| Stringent new cybersecurity requirements for pipeline companies being released today by the Department of Homeland Security are just the "first step" in a "multi-pronged" effort to prevent a repeat of the devastating Colonial Pipeline ransomware attack, officials say. The "Round 1" rules require pipeline companies to notify the Cybersecurity and Infrastructure Security Agency within 12 hours if a cyberattack disrupts their operations or even if it just threatens to disrupt them, according to a draft of those rules shared with The Washington Post. The companies also must designate a cybersecurity coordinator who can be on call around the clock to talk to DHS officials. And they must report to CISA and the Transportation Security Administration within 30 days if they're out of compliance with any of TSA's existing cybersecurity rules. Here's a preview of the order from my colleagues Ellen Nakashima and Lori Aratani. In the coming months, DHS plans to go further, releasing "an additional set of rules that require a range of actions to be taken by the [pipeline] sector," a senior department official said during a call outlining the new directive.  Attendants direct cars as they line up to fill their gas tanks in Charlotte. (Logan Cyrus/AFP/Getty Images) | "These are important steps forward and they should be understood as part of a broader strategic plan to ensure that the pipeline sector does what's needed to protect against the kind of cyber incident that we saw with respect to Colonial," the senior official said. The move marks a dramatic shift from DHS's previous approach to pipeline security, which was largely voluntary. But the government's responses may not be able to keep pace with the threat. The new rules are coming only after the Colonial Pipeline hack strangled for several days gas supplies in the southeastern United States — and after the company paid a $4.4 million ransom, which it judged was the only way to unlock its systems. The company also didn't undergo a requested security review of its systems, the Wall Street Journal's David Uberti reports. That's a blow to the voluntary review system TSA previously used. And while the government is getting ready to mandate cybersecurity protections for pipelines, officials haven't publicly contemplated such mandates for any other critical sectors. That includes schools, finance and agriculture, where a major ransomware attack could be similarly costly or disruptive. Officials declined to discuss possible mandates for other industries during the call. They stressed, however, they want to move carefully and ensure the new rules make pipelines as secure as possible. "We are currently very focused on making sure we are getting this one right and incorporating the lessons learned and working with industry," a senior official said, "because we do want to avoid creating something that's just a check-the-box kind of compliance regime." Officials also hope the new rules and widespread concern about Colonial will spur other companies to get their cybersecurity protections in order. "We're hopeful the attention [to] the Colonial Pipeline incident and the broader range of ransomware attacks in the past several months has created a public consciousness of cybersecurity threats that arguably we haven't seen in the past decade," a senior official said. | Share The Cybersecurity 202 |  |  |  | | | 
Email 
No comments:
Post a Comment