TSA's role in pipeline security looks like a weak link to some in government and industry

Lawmakers and government officials are re-examining the Transportation Security Administration's place in regulating the cybersecurity of the country's natural gas pipelines in the wake of the ransomware attack on Colonial Pipeline's business systems. The office responsible for those policies is historically short staffed and the agency has yet to address several issues brought up by government auditors in December 2018.

In this instance, Colonial Pipeline faced a crippling attack on its IT system, but the fallout from the event has regulators and lawmakers worried about how the U.S. is prepared to confront an assault on the industrial control systems that manage energy pipelines.

The Department of Energy has been designated the sector specific agency for cybersecurity incidents, and its Cybersecurity, Energy Security and Emergency Response (CESER) office is managing response. The Cybersecurity and Infrastructure Security Agency is tracking the attack and publishing regular bulletins to industry about guarding against ransomware. The FBI is also investigating.

TSA has the statutory authority to regulate pipeline cybersecurity but has historically relied on industry standards and non-mandatory guidelines. Pipeline owners also work with the Department of Transportation's Pipeline and Hazardous Materials Safety Administration for non-cybersecurity related issues. There have been several pushes in Congress over the years to clarify or shift responsibilities, but those bills ultimately failed.

Still, many are concerned about the current distribution of authorities.

"It is time to establish mandatory pipeline cybersecurity standards similar to those applicable to the electricity sector. Simply encouraging pipelines to voluntarily adopt best practices is an inadequate response to the ever-increasing number and sophistication of malevolent cyber actors," said Richard Glick, chairman of the Federal Energy Regulatory Commission, said in a statement on Monday.

FERC, which regulates the electric grid, has previously called for authorities over pipelines to change hands.

A senior TSA official in 2019 testified to lawmakers the office responsible for securing the nation's pipelines -- the surface division in the office of security policy and industry engagement -- has only five full-time employees, none of whom are cybersecurity experts.

Leslie Gordon, acting director of Homeland Security and Justice at GAO, told FCW on Monday that three recommendations from her office's December 2018 report to TSA about improving "significant weaknesses" in its pipeline security management remain open.

The open recommendations include the TSA administrator developing a strategic workforce plan needed to conduct critical facility security reviews. The watchdog recommended TSA identify other data sources for determining the threats and vulnerabilities of critical pipelines. Auditors also wrote that TSA should coordinate an "independent, external peer review of its Pipeline Risk Ranking Tool.

TSA officials have indicated to GAO that the three recommendations would be addressed later this year. A separate 2019 report also recommended that TSA update its 2010 Pipeline Security and Incident Recovery Protocol Plan to accommodate for modern threats and technology. Gordon said TSA indicated that would be done by June 30.

A TSA spokeswoman told FCW on Monday that it had expanded its surface operations capabilities to include transportation security inspectors and partnered with the Cybersecurity and Infrastructure Security Agency and Idaho National Labs "to provide advanced cybersecurity training."

Rep. Jim Langevin (D-R.I.) in an interview with the Washington Post called for TSA to be held accountable for security failures and suggested evaluating whether TSA is best positioned to oversee natural gas and oil pipelines.

Karen Evans, who headed CESER during the Trump administration and has served as CIO of the Department of Homeland Security said the current arrangement, "makes sense if you work it from the inside." She added: "There's a bunch of other things that come into play, not just cyber."

In a May 11 letter to CISA's chief, Rep. John Katko (R-N.Y.), the ranking member of the House Homeland Security Committee, spoke favorably of a public-private initiative involving CISA, Energy and TSA to conduct "validated architecture and design review assessments" on pipeline systems, and wanted to know if the assessment program, which focuses on natural gas transport, will be expanded to include fuel pipelines.

Chris Strand, chief compliance Officer at the threat intelligence firm IntSights, told FCW shifting regulatory authorities to FERC makes sense from a cybersecurity perspective.

"It would then position the oil and gas energy industry under the same intense and mandatory reporting structure on cybersecurity as the rest of the energy industry," he said on Wednesday. "This would include more scrutiny and mandatory regulation for reporting cybersecurity incidents," as well as compliance with a standard baseline security control set or guideline" that meets existing North American Electric Reliability Corporation Critical Infrastructure Protection standards.

Tim Conway, a technical director specializing in industrial control systems at the SANS Institute, told FCW the authorities could be made clearer, but that has not necessarily impeded the government's response to the attack on Colonial.

"The ransomware attack on the Colonial Pipeline has demonstrated that clear rules would help for this event and future events, but the confusion over authorities is not crippling our nation's ability to respond and work together across agencies regardless of declared authorities," he told FCW on Wednesday. He said the level of cooperation both between government and the private sector and between government agencies was "encouraging," and said, "it is important that we move quickly and align regulatory bodies to make our national response more streamlined to address future cyber threats."