Coastal Louisiana Expects 2 Hurricanes This Week

As if 2020 were not already crazy enough mother nature looks to be adding a new first to the mix. For the first time it looks like two different hurricanes could hit the State of Louisiana in the same week; first Marco then Laura. The forecast (for both intensity and landfall location) for both storms is a tad bit more iffy than normal for a variety of reasons, but it seems that both systems will hit the Louisiana coast this week.

TS Marco

This morning’s forecast for Marco shows the track below for a potential landfall on the coast sometime Monday afternoon as a category 1 hurricane.

Marco Track from NOAA data

0800 on 8-23-20

According to NOAA one of the ‘key messages’ to take away from the current forecast for Marco is:

“Hurricane conditions, life-threatening storm surge, and heavy rainfall are expected from Marco along portions of the Gulf Coast beginning on Monday, and Hurricane and Storm Surge Warnings have been issued. Interests in these areas should follow any advice given by local government officials.”

TS Laura

This morning’s forecast for Laura shows the track below for a potential landfall on the coast sometime Thursday morning as a category 1 hurricane.

Laura Track from NOAA Data

0800 on 8-23-20

Since Laura is a further from potential landfall there is much less certainty in the time, location and intensity forecast. This morning’s NOAA ‘key messages’ includes this:

“The details of the long-range track and intensity forecasts remain uncertain since Laura is forecast to move near or over portions of the Greater Antilles through Monday. However, Laura is forecast to strengthen over the Gulf of Mexico and could bring storm surge, rainfall, and wind impacts to portions of the U.S. Gulf Coast by the middle of next week. This could result in a prolonged period of hazardous weather for areas that are likely to be affected by Tropical Storm Marco earlier in the week. Interests there should monitor the progress of Laura and Marco and updates to the forecast during the next few days.”

Emergency Planning and Response

COVID-19 has already thrown a bit of a monkey wrench into the planning and response process for this hurricane season. Planners and responders have to address the normal chaos of a tropical system landfall while still being concerned about social distancing, COVID vulnerable populations and an unusual number of very sick people in the affected area.

When you add in a potential second storm within days of the first landfall, the problems multiply. While FEMA normally expects to move supplies toward the affected area before the storm and then into the affected area once the storm passes, they are going to have to consider a two-stage movement of supplies into the affected area. This could potentially put responders for the Marco landfall into harm’s way when Laura hits. FEMA’s response will hinge on how strong Laura is expected to be at landfall when Marco actually hits. The stronger Laura is expected to be, the more complicated FEMA’s decision will be.

A further complication is the two different tracks the two storms are expected to take once they make landfall. This will make the siting of prepositioning of emergency supplies more difficult. FEMA does not want to place their supplies in the way of the storm so they would typically place these sites to either side of the proposed track. With two significantly different tracks, FEMA is going to have to rely on a limited number of prepositioning sites on the Gulf Coast to the East of the storms. This will mean placing the sites further from the projected landfall and limiting the flow of supplies to the I-10 corridor. This will cause logistic nightmares that will further complicate the problems identified above.

Facility Planners

Chemical facility and energy facility owners in the area will face many of the same problems that FEMA will face in responding to the potential twin hits of Marco and Laura. There will be a limited time for response after Marco’s landfall before Laura arrives on the scene. Owners are going to have to make hard decisions on what level of response they will make for damage from Marco before a second storm arrives on scene. Any repairs made in that short time frame will be potentially damaged in the second strike, doubling the cost of repairs. But failing to shore up damage from the first storm could make damage from the second storm that much worse.

And again, the two different storm tracks are going to play havoc with the various cooperative response agreements in place across the Gulf and the prepositioning or response crews and material. The I-10 corridor is Florida is going to be a really crowded area for the next week or so.

ICS-CERT Publishes September Monthly Monitor

On Friday the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published the September edition of their Control System Monitor. Articles in this issue included reports on the latest spear-phishing campaign, hurricane response, and an update on the cross-vendor working group.

Spear Phishing Campaign

The newsletter reports on what appeared to be a focused campaign of spear phishing attacks on the energy, nuclear and government sectors. ICS-CERT reports that their analysis showed that this campaign appeared to be targeting control systems engineers. The article notes that ICS-CERT issued two alerts on this campaign in July.

The last bit of information will be news to most readers of this blog, as I certainly didn’t report on those alerts. The reason is that they were published on the US-CERT Control Systems Center secure portal. ICS-CERT explains that limited dissemination by stating that:

“While ICS-CERT strives to make as much information publicly available as possible, the indicators in these Alerts are considered sensitive and cannot be disseminated through public or unsecure channels.”

These alerts would be essentially counter-intelligence reports and there is always a fine line that has to be drawn about releasing such information. Too wide a release will alert the adversary about the means used to detect their attack which would allow the refinement of the attack. Too little release would leave the targeted organizations unaware of the potential threat. It is easy to criticize such decisions in hind sight and without responsibility for protecting the information.

Having said that, I would think that it would have been helpful for ICS-CERT to have published a limited information alert on their open access web page with a note for the potentially affected industries to get more information from the secure portal. That is, after all, what this article in the Monthly Monitor is doing. A more timely alert on the same lines may have protected more systems from potential attack or identified successful attacks earlier. At the very least it would have ensured that bloggers, like me, would have addressed the issue, spreading the word to a wider audience.

Interestingly it appears that this campaign may have been the reason that the previous issue of the Monthly Monitor included an article on the topic of spear phishing. If so, kudos to ICS-CERT for a creative partial-solution to the timely disclosure problem.

Hurricane Response

The article on the ICS-CERT monitoring efforts during Hurricane Irene helps to remind people that a full look at security includes protecting an organization against the effects of natural hazards as well as human attacks. The article provides a brief discussion about the importance of contingency plans for response to interruptions caused by both man-made and natural disasters.

Cross-Vendor Working Group

There is an interesting but brief article on the kick-off meeting of the cross-vendor working group of ICSJWG that is trying to “develop a unified approach for addressing serious security issues that exist across many vendor platforms”. One particular sentence in report may draw some criticism from the control system security blogger community;

“An inaccurate perception exists that the vendor community does not fully understand control system security challenges.”

There will certainly be a disagreement about the extent of the ‘community’ that does or does not ‘fully understand’ the control system security challenge. I think that we all can agree however, that a wider and fuller understanding would be helpful in all parts of the community.