Should TSA be regulating pipeline cybersecurity?
- By Justin Katz
- May 13, 2021
Is the Transportation Security Administration the best agency to be regulating the cybersecurity of the country's natural gas pipelines?
In the wake of the ransomware attack on Colonial Pipeline's business systems, lawmakers and government officials are concerned about how prepared the nation is to confront an assault on the industrial control systems that manage energy pipelines. They are also re-examining where the responsibility for the cybersecurity of energy pipelines should be housed.
The Department of Energy has been designated the sector-specific agency for cybersecurity incidents, and its Cybersecurity, Energy Security and Emergency Response office is managing response. The Cybersecurity and Infrastructure Security Agency is tracking the attack and publishing regular bulletins to industry about guarding against ransomware. The FBI is also investigating.
TSA has the statutory authority to regulate pipeline cybersecurity but has historically relied on industry standards and non-mandatory guidelines. Pipeline owners also work with the Department of Transportation's Pipeline and Hazardous Materials Safety Administration for non-cybersecurity related issues. There have been several pushes in Congress over the years to clarify or shift responsibilities, but those bills ultimately failed.
Still, many are concerned about the current distribution of authorities.
"It is time to establish mandatory pipeline cybersecurity standards similar to those applicable to the electricity sector. Simply encouraging pipelines to voluntarily adopt best practices is an inadequate response to the ever-increasing number and sophistication of malevolent cyber actors," Federal Energy Regulatory Commission Chairman Richard Glick said in a May 10 statement.
FERC, which regulates the electric grid, has previously called for authorities over pipelines to change hands.
A senior TSA official in 2019 testified to lawmakers that the office responsible for securing the nation's pipelines -- the surface division in the office of security policy and industry engagement -- has only five full-time employees, none of whom are cybersecurity experts.
On May 10, a TSA spokeswoman said it had expanded its surface operations capabilities to include transportation security inspectors and partnered with the CISA and Idaho National Labs "to provide advanced cybersecurity training."
Rep. Jim Langevin (D-R.I.) in an interview with the Washington Post called for TSA to be held accountable for security failures and suggested evaluating whether TSA is best positioned to oversee natural gas and oil pipelines.
Chris Strand, chief compliance officer at the threat intelligence firm IntSights, said shifting regulatory authorities to FERC makes sense from a cybersecurity perspective.
"It would then position the oil and gas energy industry under the same intense and mandatory reporting structure on cybersecurity as the rest of the energy industry," he said. "This would include more scrutiny and mandatory regulation for reporting cybersecurity incidents," as well as compliance with a standard baseline security control set or guideline" that meets existing North American Electric Reliability Corporation Critical Infrastructure Protection standards.
Tim Conway, a technical director specializing in industrial control systems at the SANS Institute, suggested the authorities could be made clearer, but that has not necessarily impeded the government's response to the attack on Colonial.
"The ransomware attack on the Colonial Pipeline has demonstrated that clear rules would help for this event and future events, but the confusion over authorities is not crippling our nation's ability to respond and work together across agencies regardless of declared authorities," he said. The level of cooperation both between government and the private sector and between government agencies was "encouraging," he said. "It is important that we move quickly and align regulatory bodies to make our national response more streamlined to address future cyber threats."
A longer version of this article was first posted to FCW, a sibling site to GCN.
Justin Katz is a former staff writer at FCW.