S 79 Reported in Senate – Energy Sector Security

This week the Senate Energy and Natural Resources Committee published their report on S 79, the Securing Energy Infrastructure Act. It was accompanied by the revised language for the bill that was adopted by that Committee earlier this year. The next step for the bill will be for its consideration before the Senate.

I have already covered the changes in the bill so most of this report is old news. The ‘Background and Need’ section of the report (pgs 3-4) is well worth reading as a succinct statement about the state of control system security, at least as it is seen by Congress. The whole thing is worth reading, but I would like to quote the last paragraph in full:

“As it has become increasingly clear that industrial control systems are vulnerable to attack, it has also become apparent that there is insufficient information available to the Department of Energy, the National Laboratories, electric utilities, manufacturers of grid-related equipment, and other interested entities about the security vulnerabilities of these systems. Also lacking is a sufficient evaluation of technology and standards to isolate and defend industrial control systems from security vulnerabilities in the most critical systems. Finally, as identifying cyber vulnerabilities and defending against them is a responsibility shared by multiple government agencies and private sector institutions including asset owners, further opportunities for working-level collaboration by these entities are necessary.”

It will be interesting to see if/when this bill makes it to the floor of the Senate. With the strong bipartisan support that it received in Committee, I expect that it will be able to pass if it is considered. Again, probably the strongest impediment to this bill passing is the $11.5 million authorized to supports its requirements. That is federal-chump-change, but the money has to come from somewhere and that can be contentious.

S 79 Introduced – Energy Sector Security

Earlier this month Sen. King (I,ME) introduced S 79, the Securing Energy Infrastructure Act. It would require the Secretary of Energy to establish a 2-year pilot program to study control system security in the energy sector. The pilot program would be funded at $10 Million for the 2-year study. This bill is essentially the same as S 3018 introduced late in the 114^th Congress; that bill saw no action in committee. Attentive readers might recall that I suggested a letter writing campaign to support that bill.

I am not going to repeat the detailed explanation of the bill since I covered that in my post on the introduction of S 3018. I would like to address two items that I did not mention in that earlier post; the definition of ‘industrial control system’ and the use of the term ‘cyber-informed engineering'.

Industrial Control System

The bill defines ‘industrial control system’ as “an operational technology used to measure, control, or manage industrial functions” {§(2)(3)(A)}. That definition is expanded in sub-paragraph (B) to specifically include “supervisory control and data acquisition systems, distributed control systems, and programmable logic or embedded controllers”.

The initial definition could clearly be interpreted to include manual control systems with no electronic component. This is important because later in the bill ‘physical controls’ (as opposed to digital or analog) are one concept that is suggested as a way to avoid the security vulnerabilities in existing systems.

Cyber-Informed Engineering

This term was first used in S 2943, the FY 2017 National Defense Authorization Act. There it was used to describe a pilot program the DOD would run “to increase the resilience of military installations against cybersecurity threats and prevent or mitigate the potential for high-consequence cyberattacks” {§1634(a)}. The Armed Services Committee report (S Rept 114-255) provides a more detailed explanation:

“A consequence-driven, cyber-informed engineering approach is based on an evaluation of the operating environment that discriminates between targeted and indiscriminate attacks, analyzes vulnerabilities beyond traditional Information Technology security, and addresses systems created to control critical infrastructure that were designed primarily to meet engineering requirements with little or sometimes no consideration of security requirements.”

In S 79 the term shows up in the §4 description of the working group. In the second portion of the description of the working group purpose the bill it states that the working group will “develop a national cyber-informed engineering strategy to isolate and defend covered entities from security vulnerabilities and exploits in the most critical systems [emphasis added] of the covered entities” {§4(a)(2)}.

This sounds very much like how safety systems are configured in chemical operations. The sensors and actuators of safety systems are isolated from the active control system so that a failure (or compromise) of components of the control system cannot affect the proper operation of the safety system. And those safety systems are only designed to protect against catastrophic failure of the chemical manufacturing system, not general failures of the control scheme to maintain product quality or process efficiency.

As I mentioned in my post about S 2943, there is an interesting paper from 2015 published by the Idaho National Laboratory (INL) about the concept of ‘cyber-informed engineering’ (Note: the link in the original post is no longer good, it has been corrected.)

Moving Forward

In the last session, this bill had bipartisan support in the Senate Energy and Natural Resources Committee and it does again this session. I suspect that the reason that the bill did not move forward in the last session was due to its late introduction and short amount of time available.

The biggest thing stopping this bill from moving forward is the spending authorization for the pilot program ($10 million) and the inclusion of spending authorization for the working group activities ($1.5 million). While that is not a great deal of money (at Federal spending levels), it is money that will have to come from somewhere. Figuring out the spending offsets for that §11.5 million will take some doing. Once that is accomplished, this bill should be able to move forward pretty easily if it makes it to the floor.

S 2943 Introduced – FY 2016 NDAA

Last week Sen. McCain (R,AZ) introduced S 2943, the National Defense Authorization Act (NDAA) for Fiscal Year 2017. The House version of this bill (HR 4909) passed last week. It provides authorization for military activities for the next fiscal year.

Like the House bill, there is an entire subtitle of this bill (Subtitle C of Title XVI) related to cyber issues. The following sections are listed in that subtitle:

Sec. 1631. Cyber protection support for Department of Defense personnel in positions highly vulnerable to cyber attack.

Sec. 1632. Cyber Mission Forces matters.

Sec. 1633. Limitation on ending of arrangement in which the Commander of the United States Cyber Command is also Director of the National Security Agency.

Sec. 1634. Pilot program on application of consequence-driven, cyber-informed engineering to mitigate against cybersecurity threats to operating technologies of military installations.

Sec. 1635. Evaluation of cyber vulnerabilities of F–35 aircraft and support systems.

Sec. 1636. Review and assessment of technology strategy and development at Defense Information Systems Agency.

Sec. 1637. Evaluation of cyber vulnerabilities of Department of Defense critical infrastructure.

Sec. 1638. Plan for information security continuous monitoring capability and comply-to-connect policy.

Sec. 1639. Report on authority delegated to Secretary of Defense to conduct cyber operations.

Sec. 1640. Deterrence of adversaries in cyberspace.

There are no overlaps between the items found in this subtitle of the bill and the corresponding subtitle of the House version. Two of the sections in this version of the bill may be of specific interest to readers of this blog: §1634 and §1640

Cyber-Informed Engineering

Section 1634 requires the DOD to establish “a pilot program to assess the feasibility and advisability of applying consequence-driven, cyber-informed engineering methodologies to the operating technologies of military installations, including industrial control systems, in order to increase the resilience of military installations against cybersecurity threats and prevent or mitigate the potential for high-consequence cyberattacks.”

While I am waiting for the Armed Forces Committee report on S 2943 to see if there are any additional insights into what the Committee expects to see included in the ‘cyber-informed engineering’ pilot, I did find an interestingpaper [updated link, 23:21 1-28-17]on the topic from a couple of engineers at the Idaho National Laboratory. They note that modern industrial processes are constructed with the assumption that the control system is trusted, an assumption that is increasingly proving to be incorrect. They call for a new engineering design process that takes the potential insecurity of the control system into account as part of the design basis for the entire industrial process.

Deterrence of Adversaries in Cyberspace

In many ways §1640 is similar to HR 5220 and S 2905 in that it requires the President to report to Congress on “determining when an action carried out in cyberspace constitutes an act of war against the United States” {§1640(b)(1)}. The important difference here is that that report only comes after the Joint Chiefs of Staff provide a detailed report to Congress “on the military and nonmilitary options available to the United States to deter Russia, China, Iran, North Korea, and terrorist organizations in cyberspace” {§1640(a)(1)}. This makes the report more of a policy development requirement rather than just a political gotcha game.

Moving Forward

The Senate Armed Services Committee has already completed their action on this bill (and I am expecting their report to be published today or tomorrow) so this bill is cleared to move to the Floor of the Senate. It is being reported on TheHill.com that this bill will come to the floor of the Senate this week, though it is not the first bill slated for floor action today.

There are a number of controversies that could arise in connection with this bill (unrelated to cybersecurity issues) that could slow consideration especially considering that the Senate is heading home for a week of campaigning at the close of the week. It would not be surprising to see some vocal posturing before the Memorial Day Recess and then more reasonable actions following the return to Washington.

When this bill is eventually passed, it will have to go to a conference committee to work out the significant differences with that House over a number of matters. It is not entirely clear at this point that a House-Senate compromise bill would be acceptable to the President as both sides try to make points going into the election. I suspect that a final version of this bill will only be achieved in the lame duck session.

Commentary

It is interesting to see a piece of legislation addressing a new and innovative engineering concept like cyber-informed engineering. It is less surprising that it was found in a defense authorization bill, particularly in the Senate. McCain did after all receive a pretty good technical education at the US Naval Academy. And as a military pilot he did come to have a pretty good personal understanding of the importance of good engineering. I am not saying that he came up with the concept, but he was better able to comprehend its importance when briefed on it by DOD than a less technologically trained congress critter would have.

In many ways the chemical engineering profession has embraced the basic idea behind this new engineering concept in the way they that have developed their stand-alone safety systems. Those systems were not developed with cybersecurity in mind, but rather to deal with problems with another less-than-trusted part of the chemical manufacturing process, the human operator. The lessons that chemical engineers have learned over the last couple of decades in dealing with human-engineering issues should be directly applicable to cyber-informed engineering.