October 2022, Vol. 249, No. 10
Features
Revised Cybersecurity Requirements Focus on Performance Measures
(P&GJ) — The Transportation Security Administration (TSA) announced the revision and reissuance of its Security Directive regarding oil and natural gas pipeline cybersecurity. This revised directive will continue the effort to build cybersecurity resiliency for the nation’s critical pipelines.
Developed with extensive input from industry stakeholders and federal partners, including TSA’s Cybersecurity and Infrastructure Security Agency (CISA), the reissued security directive for critical pipeline companies follows the directive announced in July 2021. The directive extends cybersecurity requirements for another year and focuses on performance-based – rather than prescriptive – measures to achieve critical cybersecurity outcomes.
“TSA is committed to keeping the nation’s transportation systems safe from cyberattacks. This revised security directive follows significant collaboration between TSA and the oil and natural gas pipeline industry,” said TSA Administrator David Pekoske. “The directive establishes a new model that accommodates variance in systems and operations to meet our security requirements.”
TSA, through the revised directive, recognizes that each company is different, and it has developed an approach that accommodates that fact, which is supported by continuous monitoring and auditing to assess achievement of the needed cybersecurity outcomes, a TSA spokesperson said.
TSA said it will keep working with those in the transportation sector to increase cybersecurity resilience “throughout the system and acknowledge the significant work over the past year to protect this critical infrastructure.”
Following the May 2021 ransomware attack on a major pipeline, TSA issued several security directives mandating that critical pipeline owners and operators implement several urgently needed cybersecurity measures. In the fourteen months since this attack, the threat posed to this sector has evolved and intensified. Reducing this national security risk requires significant public and private collaboration.
Through this revised and reissued security directive, TSA continues to take steps that protect transportation infrastructure from evolving cybersecurity threats. TSA also intends to begin the formal rulemaking process, which will provide the opportunity for the submission and consideration of public comments.
The reissued security directive takes an innovative, performance-based approach to enhancing security, allowing industry to leverage new technologies and adapt to changing environments.
The security directive requires that TSA-specified owners and operators of pipeline and LNG facilities take action to prevent disruption and degradation to their infrastructure to achieve the following security outcomes:
- Develop network segmentation policies and controls to ensure that the Operational Technology system can continue to safely operate if an information technology system has been compromised and vice versa; create access control measures to secure and prevent unauthorized access to critical cyber-systems.
- Build continuous monitoring and detection policies and procedures to detect cybersecurity threats and correct anomalies that affect critical cyber-system operations.
- Reduce the risk of exploitation of unpatched systems through the application of security patches and updates for operating systems, applications, drivers and firmware on critical cyber-systems in a timely manner using a risk-based methodology.
The security directive will require pipeline owners and operators to do the following:
- Establish and execute a TSA-approved cybersecurity Implementation Plan that describes the specific cybersecurity measures the pipeline owners and operators are using to achieve the security outcomes set forth in the security directive.
- Develop and maintain a cybersecurity Incident Response Plan that includes measures the pipeline owners and operators will take in the event of operational disruption or significant business degradation caused by a cybersecurity incident.
- Establish a cybersecurity assessment program to proactively test and regularly audit the effectiveness of cybersecurity measures and identify and resolve vulnerabilities within devices, networks, and systems.
- These requirements are in addition to the previously established requirement to report significant cybersecurity incidents to CISA, establish a cybersecurity point of contact and conduct an annual cybersecurity vulnerability assessment.
Comments