Colonial Pipeline CEO: Cybersecurity Mandates From TSA Might Help

The Transportation Security Administration is considering cybersecurity mandates for pipeline companies that would be helpful to the industry, the leader of a recent ransomware victim suggested.

“Certainly on a going forward basis, I think anything that can help industry, have better security practices, standards to follow would be extremely helpful, especially for the smaller companies that are, that are in other industries as well as my industry, less sophisticated,” Colonial Pipeline CEO Joseph Blount said.

Blount testified before the Senate Homeland Security and Governmental Affairs Committee Tuesday. His comment was in response to a question from Committee Ranking Member Rob Portman, R-Ohio, who asked whether TSA should build on requirements it issued at the end of last month following an attack that shuttered Colonial’s operations long enough to spur warnings against panic buying and price gouging and multiple state-of-emergency declarations on the east coast.

Portman noted that while the TSA rules require incident reporting to the Cybersecurity and Infrastructure Security Agency and a report from companies on their alignment with currently voluntary guidelines, it does not describe specific rules for the industry. 

Such rules could relate to basic cybersecurity practices such as using multifactor authentication, an identity validation mechanism that appears on practically every piece of mitigation advice CISA and other agencies provide in response to threats they’re seeing.

During the hearing, Blount confirmed previous reporting that the intruders were able to access the company’s network via a virtual private network where multifactor authentication was not installed. 

“Ranking member, in the case of this particular legacy VPN, it did only have single-factor authentication,” Blount said. He added, “But in our normal operation we use an RSA token allowance in order to create authentication difficulties for remote access.”

That did not satisfy Sen. Maggie Hassan, D-N.H., who questioned whether the company was sufficiently considering its responsibilities as a provider of critical infrastructure. 

“You know, as you've had conversations with other senators this morning, you've mentioned that you didn't have two-step authentication in place. You've mentioned a legacy VPN, which in my understanding means is that was a pretty old VPN, so I don't think it's acceptable to understand the critical nature of your, of your product, but then not really have the preparation and the system in place to protect it as if it's critical infrastructure,” she said. “You really do have an obligation to U.S. communities that you serve and to consumers and to our national security. So, I am concerned that it doesn't seem to have been a formal factor in your analysis of how much to strengthen your systems.”

CISA guidance is that organizations should disconnect and remove unused entry points. 

Pressed on the company’s cybersecurity investment, Blount also told Sen. Josh Hawley, R-Mo., “I think what Congress should require is that we have a focus on safety and security.”

But it’s unclear what that would mean in practical terms. While Blount dismissed the currently voluntary reviews TSA offers as an ineffectual “questionnaire-format type thing,” major business groups such as the U.S. Chamber of Commerce have resisted bipartisan congressional efforts to use tools such as sensors to help control the cybersecurity of defense contractors. 

The industry at large has also generally pushed back on the government issuing regulations that outline specific cybersecurity practices arguing they need the flexibility to decide what’s best for themselves. This approach is reflected in the status quo where the government encourages companies to use the National Institute of Standards and Technology’s cybersecurity framework, which allows them to choose which controls they want to implement based on their risk tolerance.

Portman asked Blount whether he would advise the use of multifactor authentication in this use case. Blount answered: “That’s absolutely the correct advice.”