By Gregory Hale
In what was a “simple” ransomware attack seeking millions of dollars against an oil and gas pipeline provider a year ago, is now showing signs of potential nation state assaults against the sector looking to inflict harm.
Colonial Pipeline Company is going to be facing a nearly $1 million fine for multiple probable violations of Federal pipeline safety regulations (PSRs), said officials at the Pipeline and Hazardous Materials Safety Administration (PHMSA) who issued a Notice of Probable Violation and Proposed Compliance Order last week.
This notice comes on the one-year anniversary of the May 7 ransomware attack on the pipeline company that delivers 45 percent of all fuel consumes on the East Coast.
Colonial Pipeline said the ransomware attack affected of its information technology systems and the company moved proactively to take certain systems offline, halting pipeline operations. The attack group DarkSide ended up labeled as the Colonial Pipeline attacker.
“Most violations and penalties levied tend to start with a physical violation, a leak, spill, etc.,” said Padraic O’Reilly, co-founder of cyber risk management firm CyberSaint. “The laws are written around this type of event and there is not a lot of cyber in the existing regs, which are in place around the physical security of pipelines and the associated processes and documentation. My hunch is that this penalty is unique in that the event is the downtime Colonial experienced, and the regulators went after flawed process and documentation.”
Colonial Pipeline Investigation
From January through November 2020, PHMSA conducted an inspection of Colonial Pipeline Company’s procedures and records for Control Room Management (CRM) in Linden, NJ; Hebert, LA; Greensboro, NC, and Alpharetta, GA. PHMSA made preliminary determinations Colonial Pipeline Company was in probable violation of several PSRs, including a probable failure to adequately plan and prepare for manual shutdown and restart of its pipeline system.
Under the authorities granted by Congress, PHMSA may propose civil penalties. PHMSA informed Colonial Pipeline of the alleged non-compliance items shortly after the 2020 inspections concluded. The NOPV said failures to adequately plan and prepare for a manual restart and shutdown operation contributed to the national impacts when the pipeline remained out of service after the May 2021 cyber-attack.
“Well, lack of planning and lack of records on testing, ‘This included 19 records for both addition of new equipment and modification of existing equipment which failed to meet the requirement of procedure,’” O’Reilly said. “This kind of violation is central to the practice of cyber. You cannot protect what you do not know you have. So, while a lot of this sounds procedural, it also involves infrastructure and alarm accuracy. Vulnerabilities are only mitigated via policy and process. The service was disrupted to some extent because Colonial did not know the possible extent of a ransomware jump across into OT. In terms of lessons – proper contingency planning, incident response, and completely understanding the networks and making sure that inventories are updated and logged in systems of record.”
At the one-year anniversary, the industry is moving forward and attempting to stay vigilant.
“It is now clear that the Colonial Pipeline attacks were just a wakeup call,” said Eric Byres, chief technology officer at software bill of materials security firm aDolus Technology. “The attacker’s objectives were simply to extract a few million dollars from a large company. They didn’t care what the company’s business was and they certainly didn’t want to stop Americans from filling their cars with gas. It was a rehearsal if you will.
Newer Fierce Attacks
“A year later we are seeing attacks like PIPEDREAM against our energy infrastructures. We are no longer facing a few cyber criminals running a ransomware-as-a-service shake down. Now a well-resourced nation state with military objectives and a scorched earth attitude is coming after our pipelines. They don’t want money; they want to destroy our energy infrastructure. They won’t be happy with shutting down the pumps for a few days – they are hoping that Americans have to go for months without gas. They want to cause chaos on a national scale.
“Certainly, the pipeline industry has stepped up its cybersecurity game in the past year. The big question is: Will it be enough to stop well-funded nation states with destruction on their minds.
“The attack on the Colonial pipeline (and the software supply chain attack on SolarWinds before it) prompted an unprecedented level of regulatory activity from the U.S. federal government with the May 12 (2021) Biden Executive Order. Some of it has been right on the money and some has diverted resources away from the goal of securing our nation’s critical infrastructures.
“TSA’s pipeline cyber regulations were a laundry list of cybersecurity activities that the operators have to follow regardless of their efficacy in reducing serious cyber risks. On the other hand, Executive Order 14028 laid out some concrete deliverables that will make substantive improvements. In particular, the requirement that suppliers of software provide a Software Bill of Materials (SBoM) is a critical first step in transparency and better visibility into the software supply chain,” Byres said. “And it’s needed – the supply chain has proven itself to be a lucrative vector of attack that our adversaries love to exploit.”
Communications Are Key
Remaining vigilant, stepping up the cybersecurity game and following the Biden Executive Order are solid moves, but in the end, it all boils down to being able to communicate effectively.
“All Incident response and contingency planning focuses on communications,” O’Reilly said. “The best practices are well known, and overall, the delivery and software providers are simplifying the implementation. The first elements of the new directives are straightforward, but the second directive, which includes architectural review, contingency planning, and mitigation measures, is more expensive and time intensive. Operators will need to take a risk-based approach to implementation. That is, identify the key business processes, game out loss scenarios (which includes proposed penalties), and begin implementing in a prioritized manner. Governance and executives will need to be engaged and nimble with budgetary decisions. Ultimately, the companies that do this well will be in the best position both competitively and reputationally.”