ICS-CERT Publishes Monitor

Today the DHS ICS-CERT folks published the latest version of the ICS-CERT Monitor. The latest version continues the change from a monthly publication (it used to be called the ICS-CERT Monthly [emphasis added] Monitor) to a quarterly; a move that was started last year.

Incident Response

The Monitor has three separate articles under the heading ‘incident response’. They include

• Attacker Leverages Public Information to Customize Spear-Phishing Campaign;

• Compromise via “Credential Storage” Vulnerability; and

• Watering Hole Attacks.

The ‘Watering Hole Attacks’ claims that ICS-CERT issued an alert about watering hole attacks exploiting Internet Explorer vulnerabilities. I can’t find any such alert on the ICS-CERT page (or blog about it on my page), so it probably was published on the US-CERT Secure Portal. That would be why most people did not see the report.

Situational Awareness

There are five situational awareness articles in this latest version of the Monitor, They include:

• CSET® 5.0  Released – Updated support to protect critical assets;

• Multiyear assessments reveal common vulnerabilities;

• Protecting credentials from compromised;

• Proper permission Management.

The list of common vulnerabilities provides a consolidated list of vulnerabilities in control systems. Those common vulnerabilities include:

• Permission, privileges and access controls;

• Improper authentications;

• Credentials management;

• Security configuration and maintenance;

• Planning/policy/procedures;

• Network design weaknesses; and

• Audit and accountability;

Two other routine features round out the latest edition; ‘Noteworthy news highlights’ and ‘Coordinated vulnerability disclosure’.

Sequestration

DHS sequestration woes are noted on page 11, the ‘Upcoming events 2013’ section shows that four of the five scheduled events were cancelled because of Sequestration. The cancelled training included:

• Houston Regional Training, March 26-29, 2013 [Opps this had already passed when this document was posted today];

• ICSJWG Introduction to Control Systems Cybersecurity Training;

• Industrial Control Systems Cybersecurity Spring Conference (5-9-13);

• Cybersecurity Training for Industrial Control Systems.

The remaining event, addressing ‘Industrial Control Systems; Cybersecurity, Training’; North American Partners is of limited utility since the link to the training information does not work.

Bills Introduced – 2-28-13

Yesterday there were 37 bills introduced in the Senate and 54 bills introduced in the House, a virtual flurry of bills before Congress left for the weekend. Two of the House bills may be of interest to the cybersecurity and chemical safety/security communities; HR 888 and HR 900.

HR 888 Latest Title: To amend section 112(r) of the Clean Air Act (relating to prevention of accidental releases). Sponsor: Rep Pompeo, Mike (R-KS)

HR 900 Latest Title: To eliminate the sequestration under section 251A of the Balanced Budget and Emergency Deficit Control Act of 1985, and for other purposes. Sponsor: Rep Conyers, John, Jr. (D,MI)

General Duty Clause

HR 888 is almost certainly the same as HR 6345 introduced last session. It would address the use of the General Duty Clause of the Clean Air Act {42 USC § 7412r(1)} in general and the proposed use of that clause to require high-risk chemical facilities to implement inherently safer technology as a security measure to protect against terrorist attack.

This will be a fairly high-profile piece of legislation in the House. A letter of support from 26 organizations representing a wide variety of chemical manufacturers has already been sent to the authors of this bill and the Chairman of the House Energy and Commerce Committee that will take the lead in moving this bill forward.

Sequestration

HR 900 introduced by Conyers will join the list of pro forma bills introduced on the sequestration issues that will never see action in the House. If passed it would undoubtedly (even though I haven’t seen the actual language) affect spending on cybersecurity and chemical safety/security activities in the federal government, so it deserves mention here, but this will be the last we hear of this bill.

Bills Introduced – 2-26-13

Yesterday Sen. Mikulski (D,MD), the Chair of the Senate Appropriations Committee, introduced S 388, a “bill to appropriately limit sequestration, to eliminate tax loopholes, and for other purposes”. This bill and Sen. McConnell’s (R,KY) counter bill (that is to be introduced today) will be considered on Thursday. No details are available yet on either bill so it is too early to tell what effect, if any, these bills will have on cybersecurity, chemical security or safety spending.

Given the fact that the sequester is due to go into effect on Friday, this is kind of last minute; but we are getting used to that. If consideration of this bill (one of the two) carries over until Friday, Saturday or even Monday, I’m pretty sure that there will be no practical effects felt by the technical sequestration of funds. It seems that these budget ‘deadlines’ are more political theater than reality.

Congressional Hearings – Week of 2-10-11

While the focus this week will be on the President’s State of the Union speech, Congressional hearings will be taking place this week. There will be three organizational hearings for committees of interest in the Senate. There will also be three hearings addressing background issues that might impact future hearings and legislation; two in the House and one in the Senate.

Organizational Meetings

Three Senate committees will be holding short (scheduled for 30 minutes in two cases) organizational meetings this week. The committees are:

• Energy and Natural Resources Committee, 2-12-13;

• Homeland Security and Governmental Affairs Committee, 2-13-13; and

• Commerce, Science and Transportation Committee, 2-13-13

The most important thing that will come out of these meetings will be the listing of subcommittee chairs and members. This is all decided in advance, but the democratic trappings must be observed.

Sequestration Hearing

The Senate Appropriations Committee will be holding a hearing on Valentine’s Day looking at sequestration issues. There will be much wailing and gnashing of teeth about the devastating effects of sequestration on the Federal government. Among the dire prognosticators will be Secretary Napolitano. I doubt if CFATS or computer security will receive special mention, but you can never tell.

Threats to the Homeland

The House Homeland Security Committee will be holding a hearing on Wednesday that will look at a “New Perspective on Threats to the Homeland”. I expect that we will be hearing more about al Qaeda in Africa and homegrown threats and perhaps cyber-threats. The witnesses will all be from the civilian sector, so the testimony will all be unclassified and more openly opinionated. The witnesses include:

• Admiral Thad Allen, Senior Vice President, Booz Allen Hamilton

• Mr. Shawn Henry, President, CrowdStrike Services

• Mr. Michael Leiter, Senior Counselor, Palantir Technologies

• Hon. David M. Walker, Founder and CEO, The Comeback America Initiative

• Mr. Clark Kent Ervin, Partner, Patton Boggs, LLP

Infrastructure

The House Transportation Committee will also meet on Wednesday. They will be looking at the “Federal Role in America’s Infrastructure”. Topics of interest are sure to include maintaining, replacing and securing that infrastructure. Again, they will all be private sector witnesses, but it looks like they will have a slightly more diverse background. They will include:

• Thomas J. Donohue, President and CEO, U.S. Chamber of Commerce

• Edward G. Rendell, Co-Chair, Building America’s Future, and former Pennsylvania Governor

• Terry O’Sullivan, General President, Laborers’ International Union of North America

On the Floor

There is nothing currently on the agenda for the coming week on the floor of either the House or Senate that looks to be of particular interest to the chemical security or cybersecurity communities. The Collinsville Renewable Energy Promotion Act (HR 316) will be coming up in the House under suspension of the rules so there will be no amendments, little debate, and it will probably pass. This bill restores and extends federal permits to construct two hydropower facilities in Connecticut. Nothing of interest here, you can move along.