DHS-CERT CSSP Calendar Page Update 05-11-10

The DHS-CERT Control System Security Program has updated their Calendar web page. They have had June training date posted for their Introduction to Industrial Control Systems Cybersecurity for Federal Employees class for almost a week now, but today they have added a class description and registration information. It’s kind of odd since a July training date has had this type information available since last month.

Of course, the July training is an advance class that lasts five days and is being held in the Idaho Falls, ID training center. The June 9th class will be held in Washington, DC and it will be an introductory course. These classes are for Federal employees and contractors and are free of charge. Only a limited number of spaces are available. As DHS and the rest of the Federal Government ramp up the number of employees available for cyber security duties, classes like these are going to be very valuable. As I noted in my blog about the July class, I certainly recommend that ISCD get as many of their chemical inspectors to these classes as possible. Last week I explained that there is a weakness in the CFATS inspection program because of the dearth of qualified ICS security experts to conduct SSP inspections. These CERT classes will be invaluable in correcting that situation. As always, I would really like to hear from any readers that attend these classes. I would like to hear the gory details of how well these classes are taught and how comprehensive the coverage is. As a professional instructor I know that student feedback is not necessarily a good gauge of instructional performance, but it is one of the few metrics to which I will have access.

CSSP Web Page Update 04-23-10

On Friday the DHS-CERT Control Systems Security Program website was updated with links to new security warning documents and information on training that will be offered by CSSP in July. Control System’s Analysis Reports Under the ‘What's New’ heading on the site there are two new documents that every security officer and cyber security officer at high-risk chemical facilities should read. They deal with two potential attack vectors that are being used to attack control systems. The first report, SSH Brute‐Force Scanning And Attacks, addresses an attack mode that has been familiar to the general IT community for years, the brute-force authentication search for authentication credentials on systems providing secure shell (SSH) command line access. Control systems or their components that are running SSH on a default TCP Port are particularly vulnerable to this type of attack. The report explains the risk for this type of attack and methods to reduce/eliminate the threat. The second report, USB Drives Commonly Used as an Attack Vector against Critical Infrastructure, describes a variety of ways that USB devices like thumb drives can be used to gain unauthorized access to control systems. From social engineering attacks, to malware infected devices, and intentional insider attacks using LaunchPad applications, a number of techniques for attacking control systems using these devices are described. Advanced Cyber Security Training The CSSP Calendar web page was updated, removing the April classes and providing information on a July training program, the Control Systems Cyber Security Training and Workshop for Federal Employees. This five day training course will be conducted on July 19th thru 23rd, 2010 and will be held at the Control Systems Analysis Center in Idaho Falls, ID. This program will address a variety of current cyber security techniques for ICS security and will include Red Team/Blue Team exercises. Hopefully, DHS ISCD will be able to get some of their chemical security inspectors to this type of training.

Reader Comment 07-02-09 ICS-NIMS Training

It took me almost two days to get a reader comment posted to the blog last week because I essentially took a day off Friday to spend with the wife, which meant no time for the internet. This is one of the short comings for having to mediate blog comments, but it can’t be helped. You wouldn’t believe some of the salacious comments that I have seen posted when I discuss ‘video escorting’.

In any case, Anonymous posted a comment Thursday to my blog on S 1385. Anonymous had two points to make; first that this looks like an unfunded mandate and second that the training requirement was a good thing. Unfunded Mandate Anonymous wrote:

“No new appropriations are included for either assistance program." And no new appropriations for those vessels and facilities impacted by this new classification of chemicals, I bet. Another unfunded mandate by someone who probably thinks if you wave a lit match near a LNG vessel you'll get a crater you can see from the surface of the moon.”

While I agree with the gist of the comments, I am forced to point out that technically these will not be ‘unfunded mandates’ under the accepted usage of that term. First, the money for the assistance programs would come from the Federal government so it would be funded. Second, ‘unfunded mandates’ usually refers to Federal laws that must be implemented by State and local governments without providing money to those agencies for their enforcement activities. The two assistance programs described in my posting refer to money and ‘in kind’ assistance going to foreign ports.

To be fair to Senator Lautenberg, it would be premature to include funding authorization in this bill for foreign port assistance. The bill mandates that DHS and State work with foreign governments to set up the ‘rules’ for handling especially hazardous cargo (EHC) destined for shipment to the United States. It allows for three years to develop these rules (probably an under generous amount of time); then DHS would have to write the regulations to provide for our government’s implementation (another year at least). Four years out is way too soon to be talking realistically about funding.

I assume that what Anonymous was really complaining about was the costs that implementing this legislation would have on the shipping companies and their customers. Those costs, which are not even tangentially discussed in this bill, will fall completely on those companies and ultimately their customers. While some of the security costs may be borne by the Coast Guard; a significant portion will fall directly on the companies involved.

It would be nice to have some discussion of what those costs might be, but it is unrealistic to expect that those will be discussed in any hearings associated with this bill. On one hand, companies will be unable to effectively estimate those costs without knowing what international rules might be developed in response to this bill. Even if the international rules were known today, the language of the supporting legislation and rules that would be required to implement such legislation would have to be known to provide a reasonable ballpark guess of the associated costs. This would mean that any discussion of costs would be branded as ‘alarmist’ or ‘premature’ by bill proponents.

The discussion comes back to whom should pay for security (safety, environmental protection, whatever) at private facilities. In our society the answer is ‘simple’; the owner of the facility must absorb those costs as part of the ‘cost of doing business’. This has always been the answer for any of these social mandates. While many liberal advocates do actually assume that the owner will really assume the costs, anyone with any experience in business knows that those costs, along with all other cost of doing business, are passed on to consumers in the form of higher prices.

This is probably appropriate since society is receiving the benefit of the higher security; they are protected against the potential terrorist attack at the facility. It also rewards the owner that can find a lower cost way of achieving the security standard in that they will have a competitive advantage in the market place. This, of course, assumes that all competitors have to abide by the same rules. If the cost of security measures is greater than the shipping costs of similar foreign produced goods, all bets are off and more jobs go overseas.

Training Requirement In regards to the training requirement Anonymous writes:

“One thing I do like is the idea that someone in Congress has awakened to the fact that there needs to be a mandate for CSO/VSO/FSO for ICS/NIMS training. Across the board, everybody, put it in 33 CFR 104 and 105 and 106 (as long as those sections are being re-written anyway.)”

Anon. makes a very good point. Any facility/vessel that handles significant quantities of extremely hazardous material has the potential to be involved in a Federal incident response situation. Having one or more people at such facilities trained in the FEMA incident command system would be a good thing. This would ensure that someone at the facility (presumably the most knowledgeable people about the local hazards) will know how that system works and will be able to easily become a part of the larger incident response.

Of course, if this is reasonable for maritime related incidents it should also be reasonable for high-risk chemical facilities, railroads, large municipal water treatment facilities or even large sports venues. Any facility where a terrorist attack or industrial accident could have a significant impact on the surrounding community or have a strategic impact on the economy should be included in this training requirement. At a minimum all MTSA covered facilities and high-risk chemical facilities should be required to have their facility/vessel security officer and deputy undergo this training.