Review - CISA Publishes Chemical Security Quarterly – 1-2-24

Earlier this week I received an email from CISA sending me a copy of the latest copy of the Chemical Security Quarterly. This is not special treatment, anyone can sign up for these updates from CISA. Anyway, this somewhat periodic newsletter provides updates on chemical security programs and processes at CISA. Unfortunately, I have not been able to find a link to the newsletter.

Topics covered in this latest version include:

• A brief update from Kelly Murray, Associate Director, Chemical Security, CISA,

• A listing of ‘Chemical Security in the News’ articles,

• A brief ‘Year in Review’ look at 2023,

• A summary of the ‘2023 Global Congress on Chemical Security and Emerging Threats Plenary Meeting’,

• A 2023 Chemical Security Summit Recap,

• A brief note on ‘Celebrating Two Years of ChemLock’,

• A summary of the impacts of ‘Five Months Without the CFATS Program’, and

• A series of CFATS Lapse FAQs.

 

For more information about this newsletter, see my article at CFSN Detailed Analysis - http://tinyurl.com/59b49fd5 - subscription required.

CISA Announces Registration for 2023 Chemical Security Summit

Today, CISA update their ‘2023 Chemical Security Summit’ web page to both announce the location of the August Summit and to provide a link to the on-line registration page. The meeting will be held at the Crystal Gateway Mariott in Arlington, VA on August 29-31, 2023. Free registrations are available for both virtual and actual attendance at the Summit.

The registration process also includes an intermediate page that allows for personnel attending in person to request a consultation with a chemical security expert from CISA’s Office of Chemical Security on any of the topics listed below. Consult requests can also be completed at the Sumit registration desk.

BTW: I have completed my registration. Once again, I will be attending virtually.

Review - CISA Posts Presentations from 2022 Chemical Security Summit

This week CISA updated their Chemical Security Summit page providing a link to a new page that provides copies of many of the presentations made at this year’s Chemical Security Summit held last August. Copies of 19 presentations are provided on the page.

An interesting omission from the Summit Presentations page is any reference to the availability of a video of Jen Easterly’s Fireside Chat on day 2 of the Summit. This was not recorded by CISA, but rather by CSPAN. I suspect that it is missing because CSPAN is a non-governmental organization and the CISA lawyers did not want to be advertising their site.

For more details about what is available, and my look at two of the threat presentations, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/cisa-posts-presentations-from-2022 - subscription required.

2022 Chemical Security Summit Registration Open

This week, CISA announced the actual location of the 2022 Chemical Security Summit and that registration was now open. The Summit will be held, virtually and in person, August 23-25^th at the Crystal Gateway Marriott, 1700 Richmond Highway, Arlington, Virginia. I have registered, have you?

CISA Makes 2022 Chemical Security Summit Announcement

CISA announced today the dates and general location for the 2022 Chemical Security Summit. It looks like the first post-COVID, in-person Summit will be held on August 23-25, 2022, in the National Capital Region. This is a little later than the previous live summits were held, but I expect that the leadership wanted to avoid announcing an in-person event and then cancel it like they did in 2020 because of COVID.

CISA is taking no chance that anyone will miss today’s announcement. It was announced on:

• The CFATS Knowledge Center page,

• The Chemical Security Events page,

• The Chemical Security Summit page, and the  

• The Chemical Security Quarterly - Spring 2022 email.

They even have a QR Code for the event:

The only thing missing is a CISA blog post about the event, and that will probably be coming in the next day or so. Anyway, just the dates and general location is all that is really available so far. More to follow.

Review - 2021 Chemical Security Summit Presentations

Yesterday CISA updated the Chemical Security Summit (CSS) web page to provide links to some of the presentations that were made at last month’s virtual summit. The links go to copies of the slides used in the presentations, not videos of the actual presentations, so a lot of detail is missing. And they have not covered all of the presentations that were made. Still, there is a great deal of information here.

The presentation slides available include:

• CFATS Risk-Based Performance Standards (RBPS) Deep Dive and Best Practices

• CFATS Personnel Surety Program Overview and Demonstration

• Cyber-Physical Security Convergence in the Private Sector

• Cyber Threat Hunting: Industrial Control System Security

• How to Conduct a Chemical Security Exercise

• Jack Rabbit III Program Update

• P4 – A Platform for Public-Private Emergency Management Collaboration

• Voluntary Chemical Security Initiatives: CISA ChemLock

• Case Study on Recent Disruptions in the Supply of Chlorine: Impacts and Responses

Missing Presentations

The following presentations that were made in the 3-day Summit did not make it to the list of published presentations:

• State of Chemical Security,

• Industry Perspective on the Threat Landscape,

• FBI Chemical Threat Briefing,

• FBI Case Study on Economic Espionage in the Chemical Sector, and

• Probabilistic Analysis for National Threats Hazards and Risks (PANTHR) Overview.

I have no idea why the first two presentations did not make the publication cut. The two FBI were restricted (no press allowed) presentations in the first place so, there is no surprise that the slides were not shared. I was surprised that the DHS S&T PANTHR presentation did not get published. The program web site coverage is extensive, so there should not have been any concerns about sensitive information.

For more details, including brief summaries, about the presentations, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2021-chemical-security-summit-presentations - subscription required.

Review - 2021 Chemical Security Seminars – Cyber-Physical Convergence

Yesterday was the 2^nd of three weekly Chemical Security Seminars that for a second year are taking the place of the Chemical Security Summit due to Covid-19 pandemic. Again, because of other commitments, I was only able to take in one of the presentations; “Cyber-Physical Convergence in the Private Sector”. Copies of the slides for many (sadly not all) of the presentations will probably be available next month.

NOTE: See my post about last week’s presentation on ChemLock.

According to the agenda for yesterday’s seminar, the presentation was to be focused on “operating in today’s threat environment of hybrid attacks that target both physical and cyber assets and the risksassociated with siloed security functions.” The two presenters were:

• Sandra Parker, Global Improvement Director – Cybersecurity, Dow, Inc., and

• Bradford Willke, Senior Advisor for Cyber-Physical Convergence, Infrastructure Security Division, CISA

Each of the speakers provided a brief overview of the topic from their different perspectives and then the moderator, Todd Klessman, Deputy Associate Director, CISA Chemical Security, guided a discussion on the topic with help from questions from the audience.

I enjoyed both presentations and the discussion afterwards. Parker and Wilke both had valuable insights into the problems associated with providing security for a modern chemical manufacturing operation. Unfortunately, the discussion was targeted at large corporate operations where you can find security operations centers and separate silos for IT, OT, and physical security. There was little here that would be of much help to medium to small size chemical facilities. And, while safety operations were mentioned, there was little discussion about integrating safety into security planning or security into safety risk management.

For more details about the presentation, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/2021-chemical-security-seminars-460 - subscription required.

ChemLock and the Chemical Security Summit

The deadline for registering for the 2021 Chemical Security Seminars is fast approaching. In the past, the major focus of these seminars (and the pre-Covid annual Chemical Sector Security Summit) has been on the Chemical Facility Anti-Terrorism Standards (CFATS) program. Voluntary chemical security measures and resources have always been addressed, but CFATS has been the focus. That will change this year.

With this week’s announcement of the ChemLock program, the voluntary chemical facility security presentations will take on an entirely new light and importance. CISA had already proposed a one-hour presentation on “Voluntary Chemical Security Programs”, by CISA’s Annie Hunziker Boyer. I suspect that by the time her talk rolls around on December 1^st, the actual title of the presentation will reflect the new program name. Other presentations will also be of interest to facilities considering the new ChemLock program.

Management for chemical facilities that are considering participation in the ChemLock program need to sign up for the Chemical Security Seminars. These are free, virtual presentations to be held on the first three Wednesdays of December. The preliminary agenda for the Seminars is available here. Registration ends on November 30^th, just a long holiday week away.

CISA Publishes 2020 Chemical Security Presentations

This week the Cybersecurity and Infrastructure Security Agency (CISA) updated their Chemical Security Summit web site to include links to most of the presentations that were made last month in the three-day virtual summit. For the first time, I was able to watch many of these presentations live (well… online in real time).

The available presentations include:

• CFATS Personnel Surety Program Demonstration and Lessons Learned,

• CFATS Risk-Based Performance Standards Deep Dive and Best Practices,

• Chemical Sector Security Awareness Training,

• Cyber and Physical Security in Manufacturing Environments,

• Cybersecurity Evaluation Tool (CSET),

• Federal Emergency Management Agency (FEMA) Response: Hurricanes, Wildfires, Floods, and Pandemics,

• Incentivizing Facility Security: A Nonregulatory Approach,

• Jack Rabbit III Initiatives, and

• Transportation Security Administration Surface Operations Overview

As is usual with these Summit presentations, what you get is the slides not the audio portion and the real detail of most of these presentations is in the audio. I know, those audio files would be huge, but it would be much more informative and a better representation of the work that went into these presentations.

I was really surprised that CISA included Annie Hunziker Boyer’s presentation on the ongoing development of the voluntary chemical security program in the Infrastructure Security Compliance Division. Since she emphasized multiple times that this program was still ‘under development’ and would likely change before it was finally implemented, I was sure that the government lawyers were going to insist that the publication of these slides be withheld. Now that these slides are available, I will probably do a post on this initiative.

I was disappointed that one of the other presentations from the December 16^th session was not included in this list of provided presentations, “Infrastructure Visualization Tools”. This presentation by the CISA Infrastructure Visualization Platform (IVP) Team was a good look at a new tool developed by the team to provide an interactive visual look at an infrastructure location; think Google Street View® that includes inside the gates with interior shots. This would be a great training tool for emergency personnel prepping for high-risk facility responses.

2020 Chemical Security Summit Registration Open

Sometime this week (CISA still is no dating their web page updates) CISA updated their Chemical Security Summit web page to provide a link to a registration page for the December 2020 on-line Summit. 

As I have noted in earlier posts (most recently here) CISA had to cancel the annual summit that was scheduled to be held in Atlanta, GA in July due to COVID-19. In its place, CISA will be hosting a three-day on-line even on consecutive Wednesday’s in December. The format looks to be generally following the format that has been used in previous summits with the exception that there will not be concurrent presentations being made. Oh, and of course, no meet-and-greats, hand shaking, card exchanging or general socializing.

I have submitted my registration.

CISA Announces Chemical Security Seminars

 Sometime in the last week (can’t place it closer since CISA stopped dating web site changes) CISA updated their Chemical Security Summit web page to include a brief announcement about a planned series of Chemical Security Seminars in December. These seminars would replace the annual Chemical Security Summit that had been planned for July but was canceled due to the COVID-19 Pandemic.

The announcement is very brief. It only mentions that the current planning is for three ‘virtual’ seminars. More information, including agenda and registration links, will be forth coming.

2010 Chemical Sector Security Summit

Yesterday DHS put up a new web page on their site announcing that the 2010 Chemical Security Summit will be held on July 7th and 8th in Baltimore, MD. This will be the fourth such summit held by DHS, marking the three years since the CFATS regulations went into force in 2007. The only registration information available at this time is the fact that there will be no fee required for registration. While the agenda has yet to be set, there will certainly be presentations by a variety of government agencies about the current status of their programs that affect chemical facility security issues. Of particular interest at this summit will be the upcoming changes in the CFATS regulations because of the probable enactment of HR 2868 or similar legislation that will make the CFATS permanent. Additionally, the ammonium nitrate regulations should be finalized (or nearly so) by that date, so there should be valuable insights to be gained about that program. To keep updated on further developments on the 2010 Chemical Security Summit you can sign up for email updates from GovDelivery.com or you can simply continue to watch this site. As more information becomes available I’ll certainly cover it here. Additionally, the link for the 2010 Chemical Security Summit is now included on the Chemical Security landing page. Surprisingly it did not make it to the new Critical Infrastructure Protection landing page. This surprises me because the host for the summit is the Chemical Sector-Specific Agency, a key component of the Infrastructure Protection team at DHS.