Review - CISA Provides Chemical Sector Specific Goals for Cybersecurity

Last week the Cybersecurity and Infrastructure Security Agency (CISA) announced that they had released Sector-Specific Goals (SSGs) for the Chemical Sector. The brief document provides a broad description of three voluntary cybersecurity related goals for the chemical sector. A link to a restricted page dealing with Cross-sector Cybersecurity Performance Goals is provided.

The three SSGs for the Chemical Sector are:

Chem.1 - System Lifecycle Management,

Chem.2 - Disable unnecessary systems, applications, and services, and

Chem.3 - Mobile Device Management

Commentary

What is missing from this ‘new’ cybersecurity management tool is an explanation of why these three goals are tailored specifically to the chemical sector. For example, there is no mention in any of these three goals about the relationship between cybersecurity and process safety, a key concern for the chemical sector. Any cybersecurity program for this sector that does not address that linkage is going to fail to prioritize cybersecurity processes tied to potentially catastrophic outcomes from successful attacks.

 

For a more detailed look at the three goals and the supporting information provided by CISA, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/cisa-provides-chemical-sector-specific - subscription required.

Updated DHS Chemical Sector Information

This week DHS, acting as the Chemical Sector-Specific Agency (SSA) supporting the National Infrastructure Protection Plan (NIPP), published a new website that provides information to support the security and safety of small and medium sized chemical facilities. This new page serves as a landing page for chemical facilities to find the resources and information available from the US government and its chemical sector partner agencies.

Information Links

The new page provides links to:

• Chemical Sector Regulatory Authorities (5-26-17);

• Chemical Sector (5-27-17);

• Chemical Sector Resources (04-07-17);

• Chemical Security Analysis Center (no date);

• Chemical Risk Management Self-Assessment Model (08-15);

• Chemical Sector Publications (02-06-17); and

• Chemical Sector: Partnering to Enhance Security and Resilience (04-05-17)

Cybersecurity Support

Chemical manufacturing, warehousing, and transportation companies have specific cybersecurity concerns that extend beyond the standard IT cybersecurity issues with which all public and private sector organizations have to contend. With that in mind, the above listed page have many references to cybersecurity resources. They include:

• DHS Critical Infrastructure Cyber Community (C³) Voluntary Program Small and Midsize Businesses (SMB) Toolkit;

• Stop.Think.Connect.™ Toolkit;

• Cybersecurity for Small Businesses (training exercise);

• Federal Communications Commission Small Biz Cyber Planner 2.0;

• Federal Trade Commission: Protecting Small Businesses;

• Internet Essentials for Business 2.0;

• White Paper: Every Small Business Should Use the NIST Cybersecurity Framework;

• Chemical Sector Cybersecurity Framework Implementation Guidance;

• Protecting Critical Infrastructure

None of the above titles specifically addresses industrial control system security issues. There are references to the topic on two of the pages listed above (Chemical Sector Publications and Protecting Critical Infrastructure). The last only provides a link to arguably the most important DHS ICS cybersecurity site, ICS-CERT. The former provides a section on ICS security which describes a worthwhile DVD resource available upon request from DHS. There is only a passing reference to the ICS-CERT Cybersecurity Evaluation Tool (CSET).

Emergency Response Planning

What is sadly lacking from the resources listed is any significant reference to emergency response planning. The only information provided is a link to a FEMA site that provides generic small business emergency planning guidelines. That information is very limited and provides no mention of chemical emergency response planning.

While emergency response planning is important for all businesses, it is arguably much more important for chemical facilities, especially those with hazardous chemicals on site. The failure of emergency response planning for most businesses will not have significant off-site consequences, but that is not true for many (most?) chemical facilities. While the EPA is vaguely responsible for emergency response planning requirements at the most dangerous facilities, one would think that the Federal Emergency Management Agency (FEMA) would be much more proactive in this area.

Chemical Sector CIKR Page Update 03-10-10

Yesterday DHS updated their Chemical Sector Critical Infrastructure and Key Resource web page. This page provides an brief overview of how the Chemical Sector fits in with other sectors in the National Infrastructure Protection Program (NIPP). DHS added a brief video to the page explaining the importance of the public-private partnership currently being used to protect facilities within the Chemical Sector and their local neighbors.