Tuesday, September 20, 2022

OSHA Postpones PSM Stakeholder Meeting

Today, DOL’s Occupational Safety and Health Administration (OSHA) published a notice in today’s Federal Register (87 FR 57520-57522) announcing that it was postponing the PSM stakeholder’s meeting that was scheduled for September 28th, 2022. The new date announced today is October 12th, 2022. The deadline for submitting written comments is also being extended until November 14th, 2022.

No comments have been posted to the www.Regulations.gov website (docket # OSHA-2013-0020) for the current request for comments.


Reader Comment – CSB Hiring Problems

Earlier today, Rosearray published a comment to yesterday’s “Short Takes” post. As is usual with Richard’s comments, he provides some interesting observations about problems at the Chemical Safety Board. This time he is providing some background information about the problems the CSB has experienced with hiring chemical accident investigators. Richards comments should be read closely by anyone that is concerned about the problems at the CSB.

In a larger sense, however, Richard is describing problems in the hiring process throughout the Federal government. Anyone who has tried to apply for a job on USAJOBS.com, should be able to recognize, from the applicant’s point of view, the problems that Richard is describing. In trying to rationalize the application process, the government (and most large companies in my experience) tries to strictly describe the duties and responsibilities of the jobs being offered and the qualifications necessary to fulfill those duties. Unfortunately, few jobs can be categorized that closely without excluding a large universe of qualified individuals.

For jobs like this, the problem is exacerbated by the fact that a chemical accident investigator, particularly a great investigator, is going to have such a wide spread knowledge base to be able to recognize and understand all of the subtle nuances of a wide range of accidents in an ever expanding universe of chemical facilities, that the job description crafters would never be able to adequately characterize the experience that would lead to that scope of knowledge.

I am not sure how the CSB is going to overcome this issue (beyond the suggestion of re-hiring investigators that quit in disgust at some of the political games that have bothered the CSB over the years), but identifying the problem is surely the first step in finding a solution.


Review – 5 Advisories and 3 Updates Published – 9-20-22

Today, CISA’s NCCIC-ICS published four control system and one medical device security advisory for products from Host Engineering, Dataprobe, Hitachi Energy (2) and Medtronic. They also published updates for three advisories for products from MiCODUS and AutomationDirect (2).

Host Engineering Advisory - This advisory describes a stack-based buffer overflow vulnerability in the Host Engineering H0-ECOM100 Communications Module.

Dataprobe Advisory - This advisory describes seven vulnerabilities in the Dataprobe Dataprobe iBoot-PDU.

Hitachi Energy Advisory #1 - This advisory discusses a stack-based buffer overflow vulnerability in the Hitachi Energy AFF660/665 Firewall.

NOTE: I briefly discussed this vulnerability on July 30th, 2022.

Hitachi Energy Advisory #2 - This advisory discusses an improper access control vulnerability, with a known exploit, in the Hitachi Energy PROMOD IV and the PROMOD-Generator energy planning systems.

I briefly discussed this vulnerability on June 18th, 2022.

Medtronic Advisory - This advisory describes a protection measure failure vulnerability in the Medtronic NGP 600 Series Insulin Pumps and accessory components.

MiCODUS Update - This update provides additional information on an advisory that was originally published on July 19th, 2022.

AutomationDirect Update #1 - This update provides additional information on an advisory that was originally published on June 16th, 2022.

AutomationDirect Update #2 - This update provides additional information on an advisory that was originally published on June 16th, 2022.

 

For more details on the NCCIC-ICS reports, including links to researcher reports, third-party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-3-updates-published - subscription required.

Bills Introduced – 9-19-22

Yesterday, with both the House and Senate in session there were 57 bills introduced. One of those bills may see additional coverage in this blog:

S 4882 A bill to amend the Federal Fire Prevention and Control Act of 1974 to authorize appropriations for the United States Fire Administration and firefighter assistance grant programs. Peters, Gary C. [Sen.-D-MI]

I will be watching this bill for language and definitions that specifically address chemical facility and chemical transportation fire safety issues.

Monday, September 19, 2022

Short Takes – 9-19-22

Deal averting railroad strike has potential to fall apart. TheHill.com article. Pre-election strike could cause problems for Democrats with swing voters. ““I would be surprised if the bargaining committee misread what the rank and file would support. That doesn’t mean that it will pass with supermajorities,” Bruno said. “That will signal a level of continuing grievance on the part of the membership. It wouldn’t surprise me if a fairly substantial number of members voted ‘no’ in part because of how genuinely abused they feel.””

China has returned helium-3 from the moon, opening door to future technology. TheHill.com opinion piece. Somewhat simplistic look at US-Chinese moon competition. Pull quote: “Many reasons exist for returning to the moon: science, commerce and the bragging rights that translate into soft political power. However, China’s return of helium-3 suggests that the moon could become the Persian Gulf of the mid to late 21st century. Clean and abundant fusion energy would change the world in ways that can barely be evaluated.”

Better Human-Machine Coordination to Thwart Growing Threats to the U.S. Power Grid. HomelandSecurityNewsWire.com article. Pull quote: “The U.S. grid is far more complicated than it was a few decades ago, something Srivastava attributes to the competitive electricity market created in the late 1990s and to the rise in small-scale power sources like home solar panels and electric vehicle charging stations, both of which have tangled the paths power takes from plant to substation to consumer.”

The Inflation Reduction Act Is the Start of Reclaiming Critical Mineral Chains. HomelandSecurityNewsWire.com article. Pull quote: “China refines 68 percent of the world’s nickel, 40 percent of its copper, 59 percent of its lithium, and 73 percent of its cobalt. More importantly, China holds 78 percent of the world’s manufacturing capacity for EV batteries, the bulk of the world’s production of solar panels, and three-quarters of the world’s lithium-ion battery factories.”

Building a Robust Drone Security Framework for Safer UAS Integration into National Airspace System. HSToday.us article. FAA puff piece. Pull quote: “The FAA continues to work extensively with our security partners to build a robust drone security framework that will enable safe and secure drone integration into the NAS, and the National Action Plan is part of that. Further, mandatory registration, remote identification, critical infrastructure protection, and drone detection and mitigation testing are vital steps forward to ensure the safe and secure integration of these systems into our nation’s airspace.”

Whisky Boom Stresses Remote Scottish Island. WSJ.com article. Pull quote: “While its thriving distilleries mean it has more jobs than many of its island neighbors, locals say young families often leave the island because they can’t afford houses. People from the British mainland can afford to pay more, while tourism—most of it whisky related—has swallowed up much of Islay’s housing stock for use as vacation rentals.” And what happens when the taste for scotch drops off for the next new fad?

Private Drillers Are Hitting Their Limits. WSJ.com article. More problems in the oil patch. Pull quote: “The constraints will likely lead many private producers to level out activity or sell themselves to larger companies that would temper their growth, executives and analysts say. A pullback could crimp overall U.S. oil production. Private producers hold around one-fifth of the Permian’s most valuable acreage, analysts say.”

EPA OIG: CSB Continues to Struggle. LinkedIn.com article. Nice, short review of CSB’s troubled past. Pull quote: “The EPA OIG’s review will serve as additional ammunition for the agency’s critics. It also will most certainly shape the early tenure of CSB Board Member Steve Owens who joined the agency earlier this year. Owens presently serves as the agency’s Interim Executive Authority. President Joseph Biden recently nominated Owens to serve as CSB Chair. If Owens is confirmed by the U.S. Senate, he will be taking the helm of an agency that profoundly struggles to carry out its important statutory mission.”


Committee Hearings – Week of 9-18-22

 

With both the House and Senate in Washington this week, we have a fairly light hearing schedule. This reflects a lot of behind-the-scenes meetings on a continuing resolution and other end-of-session priorities. There will be two hearing of peripheral interest here: federal building security and right-to-repair jurisdiction.

Building Security

On Thursday, the Subcommittee on Oversight, Management, & Accountability of the House Homeland Security Committee will hold a hearing on “Federal Building Security: Examining the Risk Assessment Process”. The witness list includes:

• Richard “Kris” Cline, Federal Protective Service,

• Scott Breor, CISA,

• Catina Latham, GAO

Should be an interesting (if probably abbreviated) look at the physical security risk assessment process.

Right-to-Repair

On Wednesday, the Subcommittee on Legislative and Budget Process of the House Rules Committee will hold an original jurisdiction hearing on “Right to Repair: Legislative and Budgetary Solutions to Unfair Restrictions on Repair”. No witness list is provided at this time.

As I mentioned last week, there are a variety of congressional jurisdictional issues that must be addressed before any legislative work can move forward. This hearing is part of that determination process.

Sunday, September 18, 2022

Short Takes – 9-18-22

Hurricane Fiona Knocks Out Power in Puerto Rico, Governor Says. NYTimes.com article. Pull quote: “In Puerto Rico, rainfall totals could reach 12 to 16 inches, with local maximum totals of 30 inches, particularly across eastern and southern Puerto Rico, forecasters said. The rain threatened to cause not only flash flooding across Puerto Rico and portions of the eastern Dominican Republic but also mudslides and landslides.” And this is only a Category 1 Hurricane at this point.

White House rolls out $1 billion in cyber funding to states. CBSNews.com article. Pull quote: “Friday's official rollout of the "State and Local Cybersecurity Grant Program" marks the biggest state and local investment in cybersecurity to date. The funds – doled out by the Department of Homeland Security (DHS) – are slated for distribution over the next four years, with $185 million up for grabs that was already allocated for 2022.”

Phony document lands on court docket in Trump search case. SeatleTimes.com article. Pull quote: “The incident also suggests that the court clerk was easily tricked into believing it was real, landing the document on the public docket in the Mar-a-Lago search warrant case. It also highlights the vulnerability of the U.S. court system and raises questions about the court’s vetting of documents that purport to be official records.” And this was not a cyberattack, it was a paper document.


 
/* Use this with templates/template-twocol.html */