Oil and Natural Gas Co's became Primary Attack Targets Last Year

At least according to analysis from cyber security company Alert Logic. This detail and more is captured in a report just released by the US Council on Foreign Relations (CFR).

According to authors Blake Clayton and Adam Segal:

Cyber attacks on energy companies are increasing in both frequency and sophistication, making them more difficult to detect and defend against. Cyber espionage is being carried out by foreign intelligence and defense agencies, even organized crime or freelance hackers.

Attacks affecting the sector over the past several years including Night Dragon, Stuxnet and Shamoon are all given a nod, as are all the past and present legislative efforts to improve cyber security and information sharing functions. On the international front as well (see: foreign relations).

Nothing new here I think, but this is a good Oil & Gas industry-specific rollup of challenges and potentially mitigating solutions.

Announced on a very high news day it may not get much notice, though I've seen it written up in a number of outlets including Reuters and FoxNews.  But timing may be propitious ahead of Department of Energy's efforts to start a cyber security maturity model for Oil & Gas sector shortly. Stay tuned for more on that.

-----------------

URL for CFR report summary with link to full report (8 pages)

http://www.cfr.org/energy/addressing-cyber-threats-oil-gas-suppliers/p30977

-----------------

Photo credit: Peter Carson at Flickr.com

Read More

Grid Security Keynote of Note at May 2013 ISO Conference

Since you can't be everywhere, there's the SGSB (which can).  Former Seattle City Light CISO and current Verizon control systems security ace Ernie Hayden gave a keynote presentation at the recent ISO New England and New York ISO Energy Conference held in Boston, and we've got it for you.

If you don't know ISO, it stands for Independent System Operator, a term which is often used interchangeably with another acronym: RTO, or Regional Transmission Organization. In North America, these organizations are like referees and traffic cops, trying to keep the peace among utilities and ensure the smooth and reliable flow of appropriately priced electricity across multi-state regions.

It's good to see Security get such a prominent platform at a high profile industry event like this. Certainly a sign of the times.  Ernie's slides will take you through the past, 2013/present and future of grid security, and though some of the info would clearly benefit from his accompanying narration, a lot of this works quite well as is. And if you really want the audio, then I'm sure Ernie will agree to come to you and do it again, as long as you treat him right.  URLs below.

-----------

Ernie Hayden deck

http://www.isoenergyconference.com/pdf/Ernie-Hayden-Keynote.pdf

Conference home page

http://www.isoenergyconference.com

Read More

Looking Again at the Markey-Waxman Grid Vulnerability Publication

Where would I be without feedback? Many thanks to SGSB readers who chimed in on this.

I recently published a post titled "House of Reps Report Reams Utilities on Cybersecurity." Not accurate and all you have to do is read the cover page which, just below the House seal, says "A Report written by the staff of congressmen Edward J. Markey (D-MA) and Henry A. Waxman (D-CA)". Mea Gulpa.

So on second look I looked a little closer and found some things to like and some things I had to wonder about. For example, I'm happy to see congressmen seeking more information about the current state of security in our sector. Who could argue with that?

But their methods are not fully sound.
For example, in the cover letter to the questionnaire their staffers mailed out, it asks utilities: "... to provide responses from your entity ... and request that you submit your response electronically." But unless I'm much mistaken, the types of detailed information they sought regarding breaches and ensuing damage to bulk power systems should not and can not be shared in plain text via standard email. Please tell me if I'm wrong about that.

See question 10 which asks for info for the past 5 years re: breaches and damage, as well as how many incidents listed were and were not reported to FERC, NERC and DHS. We're still in the middle of a huge information sharing debate in this country and I don't believe we've reached agreement that this type of very sensitive information is fare game for staffers or the general public.

To sum, this curious document is the product of 2 and only 2 congressman, not the entire House, not the House Energy & Commerce Committee (which is where you'd expect something like this to have its origins), nor anywhere else. There are definitely a few good things in there, though. But my bet is most of what it tells you you already know.

So if you read it please do so with a generous helping of NaCl.

URLs for the above, below:

House Report on Electric Grid Cyber Vulnerability

http://markey.house.gov/sites/markey.house.gov/files/documents/Markey%20Grid%20Report_05.21.13.pdf

SGSB post "House of Reps Report Reams Utilities on Cybersecurity."

http://smartgridsecurity.blogspot.com/2013/05/house-of-reps-report-reams-utilities-on.html

Read More

House of Reps Report Reams Utilities on Cybersecurity

Was trying to capture spirit of Jesse Berst's headline on the same subject:

Utilities to FERC: Take your security measures and shove it

That's not very nice, is it?  I think they toned it down with a later change, but this headline was what was in my inbox in this morning's SmartGridNews.com newsletter. The subject is a recent report published by the House of Representatives that's highly critical of electric utilities behavior to date re: grid cybersecurity.

Moving on! The Wall Street Journal's Rachel King did a fine write-up of recent testimony from the CEO of the American Gas Association (AGA), Dave McCurdy. King began by noting that:

The oil and gas sector faces many of the same cyber security challenges as the electric industry. Yet, there’s one major difference between the industries, both of which need to secure software-based industrial control systems from intruders. There are no regulations governing cyber security among the oil and gas companies.

She also heard McCurdy say that no regulations were needed and that the sector’s voluntary approach is working just fine, and:

AGA remains concerned that prescriptive cyber security regulations will have little practical impact on cyber security and, in fact, will hinder implementation of robust cyber security programs.

If you know this subject pretty well, you're aware that there is some interesting psychology and rhetoric going on here. Most agree that mandatory, prescriptive cybersecurity rules are painful to implement and audit, and too slow to adapt to new types of attack. So in a major sense, the AGA CEO's quote is dead on. 

But the rub is that "robust cyber security programs," loosely defined, are not commonplace in the natgas distribution sector, and it's hard to imagine that market forces alone will drive companies to move of the schneid.  And the same dynamic largely holds true for the electric power sector.

The language is getting a little saucy. What's going to give?

URLs for the above, below:

House Report on Electric Grid Cyber Vulnerability

http://markey.house.gov/sites/markey.house.gov/files/documents/Markey%20Grid%20Report_05.21.13.pdf

SmartGridNews.com on Utilities' Unhappiness with Cybersecurity Regulation

http://www.smartgridnews.com/artman/publish/Technologies_Security/Utilities-to-FERC-Take-your-security-measures-and-shove-it-5778.html/?fpt#.UZ4dcSt4ZyE

WSJ: Oil and Gas Lobby Resists Regulation Despite Cyber Risk

http://blogs.wsj.com/cio/2013/05/22/oil-and-gas-lobby-resists-regulation-despite-cyber-risk/

Read More

CNAS Provides a Good Way to Grok the Executive Order

First of all, Happy Valentines Day, SGSB readers.  Hope you are finding as much success in your love lives as you are in your careers securing (or caring about securing) the most critical of critical infrastructures.

Yesterday found me walking down the street in Washington DC a little before noon, when suddenly I ran into some friends, old and new, who had just popped out of the US Department of Commerce. They witnessed directly, and gave me a  first-hand account, of the birth of the administration's Executive Order (EO) on better securing the nation's critical infrastructures.

We've been waiting for this, or something like this, for quite a while. The most recent legislative pushes were the GRID Act of 2010 which almost made it, and the Cybersecurity Act of 2012, which came similarly close but failed to pass both houses. The narrative goes: since Congress couldn't do it, the President did what he could.

Anyway, let's get to the EO while we're young. Of the torrent of analysis I came across yesterday, this one, by Irving Lachow and Jacob Stokes of the Center for New American Security (CNAS) stood out as the best and most comprehensible.

I'll highlight one section before giving you a link to their work. It's on the part many of us are wondering about ... that is, what is the likelihood that the EO will have a marked and observable impact on security posture. Nothing in the EO is mandatory; therefore, as some have suggested, it may turn out to be much ado about nothing.

Here's the CNASers' take:

The provisions within the EO may not, by themselves, change the fundamental incentives driving the behavior of critical infrastructure operators. As important as it is to identify possible incentives for changing the behavior of critical infrastructures, the government will need to experiment with these incentives to see which ones work. Conducting such experimentation will require the establishment of a well-structured and rigorous evaluation program. Congressional action may be needed to implement some incentives and to enable the proper evaluation of different options.

But I and many others hope it's much ado about something. Here's a LINK to the full CNAS write-up, and here's a LINK to the EO itself. We'll have to see how it plays out, and play our respective parts too. NIST is going to need your input and I'll share notices on how and when you can do that when I get the info. 

Meanwhile, have a great and potentially romantic day please.

Read More

Supply Chain Security Awareness on Upswing for Energy and Comm Sectors

10/25/12 Update: Huawei just said it is ready to have all its source code tested for security. Would other vendors be so bold?

------------------

If you don't subscribe to the online version of the Wall Street Journal, you probably don't get its daily CIO feed, which provides a nice topical tapas-sized taste of what's on folk's minds every morning.

One of those folks is me, and I've been stirred up lately by all the press (The Economist, 60 Minutes, etc.) and Capitol Hill attention Chinese communications equipment maker Huawei has been getting. Personally, I haven't have any direct contact with Huawei or its products, but I have a gut-level response when a company gets pilloried solely on where it's headquartered or the nationality of the owner(s).

This comes from my prior experience in application security and some vetting procedures that give credit to applications built by companies with US ownership. The distance between owners, whose reputation and integrity may be stellar, and the products themselves, is vast. In the the software world, rule #1 is re-use. Components written all over the world are easy to find, buy or borrow these days. And security is often not in the decision tree of the developers on either side of the equation.

Of course, owners' reputations may be less or far less than stellar, but still, the distance remains and they have  little impact on the ultimate security characteristics of their wares. All that to say, Huawai's products need to be scrutinized carefully prior to purchase and deployment. But the same level of attention needs to be paid to ALL 3rd party products, IT and OT, hardware and software, regardless of country of  origin.

Take it away Michael Hickins (from The Morning Download: Beware Your IT Supply Chain):

Good morning. A White House report leaked Thursday exonerated Huawei of spying on behalf of the Chinese government. But that doesn't mean you can rest easy. The same report found vulnerabilities in the company’s networking equipment, which put customer data at risk.
Customers are unwittingly installing computing and networking equipment and software rife with back doors created by vendors who outsource parts of their production to partners in “politically hostile” areas of the world, according to Gartner analyst Neil McDonald, who just published a study on the topic. “Attackers use weaknesses in a supply chain to get a foothold on a system rather than attack a system in production, which is hard on a well-defended system,” McDonald told CIO Journal.

CIOs can reduce the risk of introducing trap-door-riddled IT by demanding proof of an explicit chain of custody from IT suppliers covering all third-party hardware and software they use in their products. They also should require their IT system providers to periodically sample and test their products; and they should procure the same equipment used by government agencies, which in some cases employ electron microscopes and chemicals to test IT components. McDonald says the spotlight on Huawei put IT supply chain risks “on the radar screen of every CIO.” Now it’s up to every CIO to act on this information.

Nicely said Neil McDonald.

Read More

Utilities to Commerce Chairman Rockefeller: Let's Talk and Team on Cybersecurity

We've been watching the back and forth for several years now.  2010's GRID Act didn't make it across the legislative finish line, and a similar fate just befell the Cybersecurity Act of 2012.

In response to a recent letter (read THIS first if you can) from Senate Commerce Committee Chair Jay Rockefeller, the four most significant electric utility groups banded together to craft a response.  And what a great response it is!



I'll give you an excerpt or two here, but at 3 pages you really should read the letter in full.  Here's the part I'll highlight:

Your letter references the voluntary program that the Cyber Security Act of 2012 would have created to “empower the private sector to collaborate with the government and develop dynamic and adaptable voluntary cyber security practices.” We want to be clear that we do not oppose such a regime, provided it does not seek to supplant the existing regulatory structures and public-private coordination already taking place in the electric and nuclear power sectors, even in the absence of new cyber-security legislation. 

So with extremely caveats, the industry groups would have (and do) embrace the basic thrust of the recent bill. Let's do one more ... this one is from near the closing ... and corroborates what I've been hearing utility execs plea for lately:

Given the differences of opinion evident in the Senate debate, it may be difficult for Congress to agree on a government-wide framework for cyber security that accounts for all 18 critical infrastructure sectors ... In the meantime, in the absence of consensus, we would encourage Congress to act on legislation improving information-sharing capabilities among government and industry. 

Got the idea? Now get the whole thing ... HERE. I hope others find this as significant a development as I do, and let's see where this conversation takes us.

Read More