House and Senate negotiators, principally from the two
intelligence and both homeland security committees, attached the Cybersecurity
Act of 2105 to the Consolidated
Appropriations Act, 2016 (HR 2029) that is being considered in the House
this morning. Labeled as Division N (pgs 1728 thru 1863), the Act is a
negotiated blend of S
754 (CISA), HR
1560 (Protecting Cyber Networks Act), and HR
1731 (National Cybersecurity Protection Advancement Act of 2015) that were passed earlier this
year in their respective house of congress.
The Act consists of four Titles:
• Cybersecurity Information Sharing;
• National Cybersecurity
Advancement;
• Federal Cybersecurity Workforce
Assessment; and
• Other Cyber Matters
Industrial Control
System Provisions
For the most part the three base bills that were merged
together to form this Division dealt with information technology (IT) systems;
not industrial control systems (ICS). This is even more obvious in the blended
legislation. The one clear exception to this is found in the definition of ‘information
system’ found in §102(9);
it specifically includes “industrial control systems, such as supervisory
control and data acquisition systems, distributed control systems, and programmable
logic controllers” {§102(9)(B)}.
Thus all of the information sharing provisions of Title I specifically apply to
industrial control systems.
Unfortunately, the attention to ICS quickly breaks down in
Title II of the bill where cyber incidents are discussed in relation to the
operations of the National Cybersecurity and Communications Integration Center.
The term incident is defined in the new §227(a)(3)
as “an occurrence that actually or imminently jeopardizes, without lawful
authority, the integrity, confidentiality, or availability of information on an
information system, or actually or imminently jeopardizes, without lawful
authority, an information system”.
This definition ignores the fact that a situation could
involve an ICS in critical infrastructure and result in catastrophic results to
a region or community (wide spread power outage, pipeline rupture and fire, or
a toxic chemical release) without in any way harming the ICS or the information
contained within the ICS. The basic misunderstanding of this situation can be
clearly seen in §208
where DHS is required to report to Congress on “the feasibility of producing a
risk-informed plan to address the risk of multiple simultaneous cyber incidents
affecting critical infrastructure, including cyber incidents that may have a
cascading effect on other critical infrastructure”. This was almost certainly
seen as addressing control systems (the use of the term ‘cascading effect’ is
clearly indicating power grid incidents), but the definition of ‘incidents’
almost excludes the intended situations.
This is seen again in §209 where another report to Congress by DHS is supposed
to look at “cybersecurity vulnerabilities for the 10 United States ports that the
Secretary determines are at greatest risk of a cybersecurity incident and
provide recommendations to mitigate such vulnerabilities”. Again, the failure
to include non-cyber consequences in the definition of ‘incident’ severely
restricts its application to control system situations.
There is an interesting consequence to this expanded
definition of ‘information system’ used throughout this division. In §228 the bill mandates
that DHS “develop and implement an intrusion assessment plan to proactively
detect, identify, and remove intruders in agency information systems on a
routine basis” {§228(b)(1)(A)}.
Since this Section uses the same ‘information system’ definition, this
requirement also applies to agency ICS for such systems as building
environmental controls, building access controls and security systems. In fact,
an argument could be made that it also includes automotive control systems. I
am pretty sure that this was not specifically intended by the staffs crafting
this legislation.
Interestingly the ‘information system’ definition is not
carried over to §405,
Improving Cybersecurity in the Health Care Industry. This means that vendors
of, and software developers for, medical devices are not included in the
definition of ‘health care industry stakeholder’ found at §405(a). This makes no
sense when the report required by this section from the Secretary of Health and
Human Services is specifically required to address “challenges that covered
entities and business associates face in securing networked medical devices and
other software or systems that connect to an electronic health record” {§405(c)(1)(C)}.
Missing ICS
Provisions
The three bills that were the precursor to this Division
were also generally IT security bills, but they did include two specific ICS
related provisions that did not make it into this legislation.
For example S 754 included a provision (§407)
that required the DHS Secretary to “identify critical infrastructure entities
where a cybersecurity incident could reasonably result in catastrophic regional
or national effects on public health or safety, economic security, or national
security” {§407(b)}. It would then require a report to Congress “describing the
extent to which each covered entity reports significant intrusions of
information systems essential to the operation of critical infrastructure”
{§407(c)} to either DHS or a regulating agency.
In HR 1731 we saw an amendment to 6
USC 148 that would
have modified the mandatory composition of the National Cybersecurity and
Communications Integration Center by adding the DHS ICS-CERT as a represented
organization. It would have formalized the role of the ICS-CERT with the responsibility
to {new §148(d)(1)(G)}:
∙ Coordinate with industrial
control systems owners and operators;
∙ Provide training, upon request,
to Federal entities and non-Federal entities on industrial control systems
cybersecurity;
∙ Collaboratively address
cybersecurity risks and incidents to industrial control systems;
∙ Provide technical assistance,
upon request, to Federal entities and non-Federal entities relating to
industrial control systems cybersecurity; and
∙ Shares cyber threat indicators,
defensive measures, or information related to cybersecurity risks and incidents
of industrial control systems in a timely fashion.
Moving Forward
Each of the component bills used to craft this negotiated
compromise were passed by significant bipartisan votes in their respective
house of Congress. Unfortunately, there are a number of privacy advocates that
are dissatisfied with the privacy protection feature that were not included in
this final version. For them to vote against the Cybersecurity Act of 2015,
however, they have to vote against the whole package of spending bills to which
it is appended. At this point (the House is currently debating HR 2029 as I
write this) it is not clear if there is enough combined opposition to this (and
other slightly less controversial provisions) to stop the bill from passing.
Posts
