Chemical Security Seminars – 7-11-24

I got an email today from “CFATS@messages.cisa.gov”, that caught my attention, you bet. It was a reminder about the virtual 2024 Chemical Security Seminars that start this week. Session 1 is on Thursday, the 11^th; Session 2 is the following Thursday. A reminder that the two sessions are different, but there is a single signup for both. You can still register here (Note: Not a .gov website), no charge.

This week’s sessions include:

• Opening and Keynote Remarks (Secretary Alejandro Mayorkas),

• State of Chemical Security (Associate Director Kelly Murray),  

• Transnational Threats Impacting Chemical Security, (FBI and Interpol),

• Federal Partner Priorities for Addressing Emerging Chemical Threats (TSA, CIRCIA, CG, and DOE), and

• The Impacts of Artificial Intelligence on Chemical Security (Sean Ekins, CEO, Collaborations Pharmaceuticals)

I have been registered to attend since the original announcement.

Review - 2023 CSS Presentation Slides Published

This week CISA updated their Chemical Security Summit page, adding a link to select presentation slides from the recent Summit. CISA, as has been their practice over the years, only makes slides available for select presentations.

Commentary

I have been following the Chemical Sector Security Summit (shortened recently to just Chemical Security Summitt) since 2009. The data density on the published slides has generally increased over time. From a live presentation point of view that is a bad thing because the audience pays more attention to reading the slides than they do listening to the presenter. But for attendees going back to review the data presented, or for people who missed the presentation, the higher data density is a good thing.

 

For more details about the available presentations, including summaries of selected presentations, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2023-css-presentation-slides-published - subscription required.

2023 Chemical Sector Security Summit – 8-31-23 – Morning Session

The third and last day of the 2023 Chemical Sector Security Summit opened this morning in Arlington, VA. The morning keynote from CISA by Kelly Murray, Associate Director, CISA Chemical Security, gave her an additional chance to mention CFATS reauthorization along with highlighting today’s presentations.

The first presentation of the morning was a panel discussion by the Chemical Sector Coordinating Council (abbreviated as SCC, but all of the sector coordinating councils typically use the same abbreviation). While there were the now obligatory comments about the termination and hope for reauthorization of the Chemical Facility Anti-Terrorism Security (CFATS) program, the focus of this discussion was the operation of the SCC and the importance of the information coordination and sharing capabilities of the SCC.

The second presentation covered drone security at chemical facilities. Katie Ricks, from Dow Chemical, talked briefly about an incident in February, but more importantly she emphasized the importance of having close, cooperative relationships with local law enforcement. Interesting discussion about FBI investigation of drone overflights of critical infrastructure (mainly petrochemical facilities) in Louisianna, where there is a State law prohibiting flying drones over critical infrastructure.

Two more online presentations will be made today before the CSSS closes for this year:

• Cybersecurity as a Shared Responsibility, and

• UAS Threats Facing the Chemical Sector 

2023 Chemical Sector Security Summit – 8-30-23 – Morning Sessions

The second day of the 2023 Chemical Sector Security Summit opened this morning in Arlington, VA. The morning keynote continued the CFATS reauthorization mantra from CISA by Dr. David Mussington, Executive Assistant Director, Infrastructure Security, CISA. The keynote was followed by a session closed to the press (myself included) for a presentation by the FBI on Unmanned System Threat Overview.

Interesting set of presentations on “Extreme Weather Threats to Chemical Security”. Sunny Wescott, CISA’s [corrected 9-8-23 23:03 EDT] lead meteorologist, had a fact filled presentation on how recent increases in extreme weather events across the country have impacted facility safety and security. She included a little noted impact on cyber issues, particularly at data centers, heat and cooling. She blew through this presentation pretty quickly, but it was a lot of information to get through in a short period of time.

Remaining online presentations for today:

• Academic Perspective: Terrorist Organizations and Tactics,

• A Community-Oriented Approach to Security Management,

• Artificial Intelligence and Advancing Technology, and

• Mass Attacks in Public Spaces.

I do want to mention a presentation late this afternoon that will not be presented online: Cyber Threats Facing the Chemical Sector. The presenters include Carole Kelliher the Deputy Program Manager for CISA’s CyberSentry program. CyberSentry is a CISA-managed threat detection and monitoring capability, governed by an agreement between CISA and voluntarily-participating critical infrastructure partners who operate significant systems supporting National Critical Functions.

2023 Chemical Sector Security Summit – 8-29-23 – Morning Session

The 2023 Chemical Sector Security Summit opened this morning in Arlington, VA. All of this morning’s sessions were shared online. Jen Easterly (Director CISA) and Kelly Murray (Associate Director for Chemical Security) had an interesting chat about the status of the Chemical Facility Anti-Terrorism Standards (CFATS) program (currently terminated) along with a discussion about the importance of reinstating the program. Kelly continued that discussion with her presentation on “State of Chemical Security”.

There was a great deal of information about CFATS and what the termination has meant for CISA, the regulated community, and their surrounding neighbors. Both of these presentations emphasized (repeated a number of times) a couple of statics about the effects that the termination has had in the thirty-days since the Program ceased to exist:

• 160 inspections did not take place (historically 35% of inspections discovered program shortcomings),

• 40 Top Screens were not submitted and evaluated, and

• 300 personnel surety vatting’s per day were not submitted for checks against the Terrorist Screening Database.

As I noted on LinkedIn: “I hope that CISA recorded her presentation and shared it with Congress. She laid out the case for a quick reauthorization of CFATS in great detail.” Kelly did note that the Legislative Liaison folks at CISA were actively in discussions with Congress, but refused to try to forecast what the legislators would do.

This afternoon’s sessions will include:

• Secretary of Homeland Security Remarks,

• Federal and Industry Discussion on the Future of Chemical Security,

• Federal and Industry Response to Supply Chain Disturbances,

• “Wicked Problems” in Chemical Security

Chemical Sector Security Summit Update – 8-19-23

With just over a week and a half until the 2023 Chemical Sector Security Summit (August 29^th, thru 31^st), CISA has provided a more detailed agenda for the meeting. There are no major changes to the breakout sessions, but there is more information available about presenters.

With the demise (hopefully temporary) of the CFATS program since the last update, the morning sessions on Day 1 of the Summit take on increased importance, and fortunately, they will all be live-streamed. These include:

8:35  DHS and CISA Keynote Addresses, Jen Easterly and an as of yet unnamed DHS official,

9:20  Federal and Industry Discussion on the Future of Chemical Security, Eric Byer (NACD) and Caitlin Durkovich (NSC),

10:05 State of Chemical Security, Kelly Murray (CISA), and

11:00 Chemical Threats to the Homeland, Lisa Parnpichate (FBI).

These four presentations alone will be well worth the price of admission (FREE registration).

Chemical Sector Security Summit Update – 7-27-23

Today, I received an interesting email from chemicalsummitreg@hq.dhs.gov about my recent registration for the 2023 Chemical Sector Security Summit. Apparently, some of the automated response emails for registration confirmations have not reached registrants. Lots of good information in the email. If you registered and have not received either this email or the original confirmation email, you should contact them at the above email address.

Bad News for Remote Attendees

The email (and the CSSS website) contain a link to the Preliminary Agenda for the CSSS. The following items on the agenda will not be available to remote attendees:

Day 1 – 8-29-23

Speed Meet the Experts

Day 2 – 8-30-23

Multilayered Approach to Combating the Acquisition of Bomb-Making Materials,

CFATS Tiering Methodology,

CFATS Cyber and Physical Security Best Practices,

ChemLock: On-Site Assessment Case Study,

Cyber Threats Facing the Chemical Sector, and

Federal Expo,

Day 3 – 8-31-23

Cyber Regulations at Chemical Facilities, and

CISA’s Regional Footprint

Most of these are part of ‘breakout sessions’ where two sessions are held at the same time. In person attendees get to choose which sessions they will attend. Those of us who will be attending remotely are having that choice made by the DHS organizers. I would have made different choices (may be, it would depend on who is presenting, and that info is not yet available), but someone at DHS has to make this decision, so I will not argue with them. If you really want to see one of the above presentations, attend in person.

NOTE: As I write this the Congressional Record for yesterday has not yet been printed, so I still do not know if the Senate passed HR 4470, the CFATS extension bill. If the program is not extended, much of the above agenda will obviously change.

CISA Publishes 2020 Chemical Security Webinars Agenda

Sometime this week (they still have not resumed dating web page changes) the Cybersecurity and Infrastructure Security Agency (CISA) updated their Chemical Security Summit web page to provide updated information for the 2020 Chemical Security Summit. As I had noted earlier, CISA will be holding this mostly-annual summit this year as a three-day virtual event held on consecutive Wednesday’s in December. This week’s update provides an agenda for the three-day event.

I misunderstood the previous update to mean that CISA would be holding one seminar on three-separate dates. The agenda published this week makes it clear the CISA will be holding three separate seminars, one on each day of the scheduled event. This closely parallels the organization of the Chemical Sector Security Summits that have been held over the last 10+ years.

While there are (currently?) no speaker names included in the published Agenda, there are some topics that look to be very interesting (all would appear to be worthwhile). These call-out topics include:

• Jack Rabbit III Demonstration – 12-2-20,

• Security Incidents Trends & Challenges During the COVID-19 Pandemic and Supply Chain Constraints – 12-2-20,

• Chemical Security Threat Briefing – 12-2-20,

• Hurricanes, Wildfires, Floods, and Pandemics – 12-9-20,

• TSA Surface & USCG MTSA Program Updates and Information – 12-9-20,

• Cybersecurity & Physical Security Working Together, 12-16-20, and

• Chemical Security Tools (Virtual Expo), 12-16-20

Registration information is still not available.

Update on CISA Chemical Security Seminars – 10-3-20

This week the Cybersecurity and Infrastructure Security Agency updated their Chemical Security Summit web page, providing additional information on the chemical security seminars that will be taking the place of this year’s COVID-19 canceled Chemical Security Summit. Seminars will be held on December 2^nd, 9^th, and 16^th. A brief agenda outline has been included.

The topics that will be addressed include:

• The state of chemical security—Updates for the Chemical Facility Anti-Terrorism Standards (CFATS) program and ongoing nonregulatory chemical security efforts

• A demo of the CFATS Personnel Surety Program application

• A deep dive into the 18 CFATS Risk-Based Performance Standards (RBPS) and best practices

• A chemical threat briefing

• Managing chemical security during natural disasters: hurricanes, wildfires, floods, and pandemics

• Challenges encountered with chemical security during the COVID-19 pandemic

• Growing a global culture of chemical security

• The convergence of cyber and physical security

ISCD Publishes Hydrogen Peroxide Fact Sheet

Today the CISA Infrastructure Security Compliance Division (ISCD) updated the Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center page. Old news items were dropped and one new one added and a link was provided to a new chemical flyer.

News Update

Today’s news update was old news; the announcement that the 2020 Chemical Sector Security Summit was canceled was posted with today’s date. That announcement was made early last month on the CSSS web page.

Interestingly, the COVID-19 notices that were published in late March in the news section have been removed.  The link to the .PDF document announced in that notice still works. That explained that ISCD was suspending inspections but still expected facilities to maintain their security programs during the COVID-19 pandemic. As far as I can tell, those conditions still stand.

New Chemical Flyer

In the ‘Fact Sheets and Flyers’ section of the Knowledge Center, ISCD has added a link for a ‘Hydrogen Peroxide’ flyer. This one page .PDF document is in the same general format as the other three chemical specific flyers published on the CFATS Resources web page and the ‘Hydrogen Peroxide’ flyer was also added to that page today.  The four chemicals listed to date are frequently found in facilities that are not considered to be traditional chemical facilities.

I suspect that ISCD is using this flyer as part of their outreach program to contact all facilities that may have DHS chemicals of interest (COI) in excess of the screening threshold quantity (STQ) that would require the facility to submit a Top Screen. That report would provide ISCD with the information necessary to determine if a facility were at high-risk of terrorist attack and thus be covered by the CFATS program.

CISA Postpones 2020 CSSS

The Cybersecurity and Infrastructure Security Agency (CISA) announced this week that it was postponing the 2020 Chemical Sector Security Summit (CSSS) that had been planned to be held in Atlanta, GA this July. Not surprisingly, concerns around the COVID-19 pandemic are behind this action.

An alternate (almost certainly an on-line) event is being considered.

ISCD Announces Possible 2020 CSSS

Sometime this week the CISA Infrastructure Security Compliance Division (ISCD) announced that it was planning to hold the 2020 Chemical Sector Security Summit (CSSS) in Atlanta, GA in July. They noted that:

“CISA is closely monitoring the evolving nature of COVID-19 and is developing contingency plans. Details and updates will be posted as soon as possible.”

2019 CSSS Registration Open

Yesterday DHS announced on the Chemical Facility Anti-Terrorism Standards (CFATS) program landing page that registration was now open for the 2019 Chemical Sector Security Summit (CSSS) in New Orleans on July 16^th thru 18^th, 2019. As we have seen in the last few Summits, there are provisions for registering for webcasts of selected presentations.

The CSSS web page has also been updated with additional information on this year’s program. The new information includes a list of agenda topics that looks to be very interesting.

• Best practices and lessons learned in chemical security

• Deep dive into CFATS and other federal regulations

• Convergence of cyber and physical security in the current threat environment

• Cyber Supply Chain Risk Management

• Explosive precursors

• Industrial Control Systems Vulnerabilities

• Resources from federal stakeholders

• Theft and diversion risk management

The no fee registration can be completed here.

Chemical Sector Security Summit Announcement – 04-29-19

Yesterday the DHS Infrastructure Security Compliance Division (ISCD) announced that that the Chemical Sector Security Summit would be held in New Orleans, LA this summer. No real information beyond ‘mid-July 2019’ was provided. Until 2017 the CSSS was held every year, but the schedule has since been changed to every other year.

ISCD Announces East Regional Meeting

This weekend the DHS Infrastructure Security Compliance Division (ISCD) announced on the Chemical Facility Anti-Terrorism Standards (CFATS) landing page that the East DHSChemSecurityTalk would be held in Philadelphia on August 2^nd. This will be the last of the three regional DHSChemSecurityTalks held this year. The first was held last week in Oakland, CA and the second will be held on July 19^th in Chicago, IL.

Additional information and links to the registration site can be found on the DHSChemSecurityTalks web page. The agenda for the East meeting is very nearly the same as the agendas for both the West and Mid meetings. As I mentioned for the Mid meeting, there is one presentation that has been changed; instead of the “DHS Soft Target Security” presentation that will be seen in Chicago, DHS will present “Countering Malicious Use of Drones” in Philadelphia.

Commentary

When ISCD initially announced these regional meetings, I wondered if they were going to supplant the annual Chemical Sector Security Summit. Last year that meeting was moved to Houston and that looked to be a move to re-energize the meeting which had seen a gradual decline in attendance over the last couple of years. And in February ISCD announced that planning was underway for the ‘biennial’ CSSS in 2019 a much-overlooked change in the CSSS program.

In many ways regional programs make more sense than a big CSSS. It changes to a one-day event which may be easier to squeeze into a corporate schedule and many of the presentations can be tailored to specific regional concerns. Unfortunately, it also reduces the number of scope of the presentations made and would seem to remove the vendor side show aspect of the CSSS.

The major draw back to these regional meetings for many folks, however, will be the backwards step in the removal of the web cast of the presentations. There are too many folks, particularly at smaller facilities, that will just not have the travel budget to attend even these regional meetings. This is why I lobbied so hard to have many of the presentations at the CSSS web cast.

I understand that presenting web casts of the presentations for these regional events might detract from attendance at the later regional meetings. That is why I was hoping to see a notice that the East regional meeting (the last in the series) would include provisions for registration for web casts. It does not. I think that this is a major step backwards for the CFATS outreach program.

It will be interesting to see if ISCD publishes the slide presentations from these regional meetings on the DHSChemSecurityTalks. While the slides are not nearly as informative as the actual presentations, they do provide a way for expanding the audience to folks who could not attend the meetings. They also provided a way for individual who do attend to bring back the information to their co-workers who are also vital players in the CFATS process.

On a slightly different point. DHS also completed their apparently ‘monthly’ tweak to many of the pages on their CFATS web site. I did not see any major new information that was worth discussing, but there was something disturbingly missing. Last month ISCD rolled out a number of Spanish language versions of some of their outreach documents. Unfortunately, there are no links to any of those documents on the CFATS web site.

As I mentioned in my earlier post, I do not really see a wide spread need for many of those fact sheets, but the Spanish language version ‘Report a CFATS Violation Flyer’ is one that certainly needs more emphasis given the increasing numbers of Spanish speakers in the industrial workforce. The failure to include a link to that on the Report a Potential CFATS Violation page (which to be fair was not updated) or the page for the actual flyer which was updated) is a mistake that needs to be corrected. And if it was important enough for ISCD to  produce the other Spanish flyers, then they should have also have had their links included in the respective pages of the CFATS web site.

2016 Chemical Sector Security Summit Announced

This week DHS and the Chemical Sector Coordinating Council announced the dates for the 2016 Chemical Sector Security Summit (CSSS), published an agenda and opened registration. The CSSS will be held July 19^th thru the 21^st in Alexandria, VA. As promised DHS has greatly expanded the number of presentations that will be available via web cast this year.

The preferred method for attending the CSSS is (time and money permitting) is still being there in person in person. A number of the presentations are still not included in the web cast for a variety of reasons. That plus the fact that you will never be able to network successfully via a web cast, nor would you be able to attend the related SOCMA Expo that is always held in conjunction with the CSSS all add incentives to attend in person.

Unfortunately, there are a number of us in the chemical security community that will not be able to travel to the CSSS in person. Last year was the first year of web casting and the presentations were very limited. This year DHS is expanding them to include:

• Keynote Address;

• Infrastructure Security Compliance Division (ISCD) Regulatory Update;

• Responsible Agriculture - Lessons Learned;

• What to Expect During a Chemical Facility Anti-Terrorism Standards Inspection;

• Cybersecurity Tabletop Exercise (TTX) Methodology;

• Industry Keynote Address;

• Cyber Keynote Address;

• Former Chemical Sector Chair Panel;

• DHS Voluntary Programs Update;

• Implementing the NIST Cybersecurity Framework; and

• CFATS Compliance Lessons Learned

Some of the workshop sessions that will not make it into the web cast this year will include:

• CSAT Tool to include Personnel Surety;

• DHS Tools and Resources Exchange;

• Active Shooter;

• Enhanced Cybersecurity Services;

• Interdependencies - Chemical Facilities and Regional Resilience Assessment Programs Lessons Learned;

• Research and Development - Jack Rabbit II;

• Transportation Updates in the Chemical Sector;

• Insider Threat and Social Media - How people get radicalized; and

• Unmanned Aircraft Systems in the Homeland Security Environment

It certainly looks like the 10^th Annual CSSS will be worth attending, either in person or via the web cast. I particularly appreciate the fact that most of the cybersecurity related sessions appear to have made it into the webcast.

DHS Publishes 2015 CSSS Presentations

Earlier this week DHS updated the Chemical Sector Security Summit web site. A number of the presentations that were made at the 2015 CSSS in July now have their slides available on-line.

The on-line slides include:

• Infrastructure Security Compliance Division (ISCD) Regulatory Update

• Outcomes and Perspectives of Executive Order (EO) 13650: Improving Chemical Facility Safety and Security

• Chemical Facility Anti-Terrorism Standards (CFATS) and Maritime Transportation Security Act (MTSA) for Newcomers

• What to Expect During a CFATS Inspection

• Alternative Security Programs (ASPs) and Expedited Approval Program (EAP) Site Security Plan (SSP)

• Site Security Plans (SSPs) and Compliance Inspection Trends

• Responsible Agriculture Session

• Local Resources (Presentations from ISCD and the  State, Local, Tribal, and Territorial • • • • Government Coordinating Council)

• Incident Management: The Role of Social Media Messaging

I have done a quick look review of all of these slide sets and they all contain some valuable information about various aspects of the CFATS Program. Unfortunately, they do not contain the audio portion of the presentation so some of the detailed information provided at the CSSS has been lost. The Department did provide web casts of two presentations this year; the keynote by Amy Pope and David Wulf’s CFATS Update. Hopefully there will be more web casts next year.

DHS Updates CSSS Web Page

Earlier this week the folks at DHS Office of Infrastructure Protection updated the web page for the annual Chemical Sector Security Summit which was held last month. The update included links to the following:

∙ The web cast of the keynote address from Amy Pope, Deputy Homeland Security Advisor and Deputy Assistant to the President at the National Security Council;

∙ The web cast of the update on the Chemical Facility Anti-Terrorism Standards (CFATS) program by David Wulf, Director of the Infrastructure Security Compliance Division; and

∙ The DHS Blog post from Caitlin Durkovich, Assistant Secretary for Infrastructure Protection, about the success of the 2015 CSSS.

For those of you who have disabled your Adobe Flash Player® for security reasons, you will have to re-enable it to view the two web casts. Homeland Security likes Adobe.

The production values on the two web casts leave something to be desired, but these are talking head presentations so that does not take away from the many interesting points the two speakers had to make.

I’m hoping that we will see the slides from the other presentations at the CSSS in the next couple of weeks.

DHS Updates CFATS Knowledge Center – 06-24-15

This afternoon the folks at DHS Infrastructure Security Compliance Division (ISCD) added a news item to the CFATS Knowledge Center web site and a new link in the documents section. Both items dealt with the 2015 Chemical Sector Security Summit being held next month.

The new document is an invitation to attend either the live CSSS in Alexandria, VA on July 21^st thru 23^rd, or watch two of the presentations live on the Homeland Security Information Network (HSIN). This is all essentially the same information that I posted about earlier this month.

If you cannot attend the live event, I highly recommend that you sign up for both web casts. Both presentations should include information about the new EAP program and other upcoming changes to the CFATS processes. More importantly, this is the first year that DHS is web casting any of the presentations and we need to encourage them to do more by fully participating in this effort.

2015 CSSS Agenda and Registration Info

Yesterday DHS updated the 2015 Chemical Sector Security Summit (CSSS) web page to include a link to registration and agenda information. As I mentioned in an earlier post the CSSS will be held on July 21^st thru 23^rd in Alexandria, VA. It will be held at the Hilton Alexandria Mark Center and for the first time portions of the CSSS will be webcast for those not able to attend in person.

The preliminary agenda shows a host of potentially interesting topics. They include:

∙ Cybersecurity and Industrial Control Systems;

∙ Port Security – U.S. Coast Guard;

∙ What to Expect During a CFATS Inspection;

∙ Alternative Security Programs (ASPs) and Expedited Approval Program (EAP) Site Security Plan (SSP);

∙ Site Security Plans (SSP) and Compliance Inspections Trends; and

∙ Unmanned Aircraft Systems: Legal Background and Enforcement

Two sessions will be webcast over the Homeland Security Information Network (HSIN). Registration is required, but no special vetting or secure connections are required. The two sessions currently planned to be available will both be webcast on Wednesday:

∙ Keynote Address; and

∙ Infrastructure Security Compliance Division (ISCD) Regulatory Update

I would have like to have seen more sessions broadcast, but the second one will be one of the more important sessions of the Summit so I can’t really complain too much. Maybe if there is an extensive early sign up, NPPD will consider adding more sessions. I have already signed up for the web cast. Unless of course, someone wants to sponsor my attendance in Alexandria.