How pipeline owners & operators can fulfill the TSA’s 2nd security directive
Back in June, I wrote about the Transportation Security Agency’s (TSA) new security directive concerning pipeline owners and operators. The order mandated those entities to disclose security incidents such as the ransomware attack that affected the Colonial Pipeline Company back in May to the TSA and the Cybersecurity & Infrastructure Security Agency (CISA). It also required pipeline owners and operators to review their current practices, designate someone like a Chief Information Security Officer (CISO) as a Cybersecurity Coordinator, as well as work to identify gaps associated with their cybersecurity risks and report the results to the TSA and CISA.
The TSA’s Second Security Directive
Senior officials at the Department of Homeland Security (DHS), of which the TSA is a part, announced at the time of their security directive that they would soon require pipeline organizations to implement a new set of mandatory security controls or face financial penalties.
In mid-July, CISA announced the rollout of at least some of those controls in the form of a second security directive from the TSA. The mandate requires critical pipeline owners and operators to implement specific measures that can help them to defend against digital threats such as ransomware. It also necessitates entities to develop and enact a digital security contingency and recovery plan as well as review the design of their cybersecurity architecture.
Alejandro N. Mayorkas, U.S. Secretary of the DHS, framed this security directive in terms of upholding the United States’ national security. As quoted in a DHS press release:
The lives and livelihoods of the American people depend on our collective ability to protect our Nation’s critical infrastructure from evolving threats. Through this Security Directive, DHS can better ensure the pipeline sector takes the steps necessary to safeguard their operations from rising cyber threats, and better protect our national and economic security. Public-private partnerships are critical to the security of every community across our country and DHS will continue working closely with our private sector partners to support their operations and increase their cybersecurity resilience.
This second security directive actionizes advice that CISA gave to the TSA on digital threats confronting pipeline operators and owners. It also considers technical countermeasures that organizations can use to protect their systems against those threats.
Abiding by the Conditions of the TSA Security Directive
Tripwire can help in-scope organizations to uphold the requirements identified in the TSA’s latest security directive. For instance, pipeline owners and operators can use Tripwire’s file integrity monitoring (FIM) capabilities to detect changes involving their files such as when a malicious actor uses ransomware to encrypt their files and render them inaccessible. To help organizations remedy those types of security incidents, Tripwire’s FIM tools use actionable intelligence to help IT and security teams remove the guesswork associated with detection and response, focus in on what matters, and quickly address relevant trouble spots. They can use those same capabilities to also validate that planned changes have taken place.
When it comes to implementing a cybersecurity contingency plan, pipeline owners and operators need to make sure they’ve achieved comprehensive visibility over their Industrial Control Systems (ICS) along with an accurate inventory of assets. Otherwise, they won’t know what they have and, by extension, what they need to restore in the event of a disruptive digital attack. Tripwire can help organizations in that regard by discovering and profiling all assets in their network. Such visibility puts organizations in a position to set up immediate security alerts for quick resolution of potential issues, monitor those assets and the industrial network in general for potential problems, as well as avoid plant disruptions by hardening systems and detecting misconfigured systems.
