Thursday, June 5, 2014

Bills Introduced – 6-4-14

With the House working from home this week there were twelve bills introduced and the only one of those of potential specific interest to readers of this blog was the one bill introduced in the House.

HR 4800 Latest Title: Making appropriations for Agriculture, Rural Development, Food and Drug Administration, and Related Agencies programs for the fiscal year ending September 30, 2015, and for other purposes. Sponsor: Rep Aderholt, Robert B. (R,AL)


There are two possible (maybe) areas of interest here, cybersecurity language in the FDA section, and ammonium nitrate safety/security language in the Agriculture section. We will have to wait and see what the published language actually includes.

Wednesday, June 4, 2014

ICS-CERT Publishes Alert for Automated Road Signs

Today the DHS ICS-CERT published an alert for a hard coded credential in the Daktronics Vanguard software used in automated highway message signs. The Federal Highway Administration notified ICS-CERT of the vulnerability. The ICS-CERT advisory notes that a “Proof of Concept is known to be publicly available”, though I can’t find any mention of it in a Google® search.


Okay, this is a control system within the broadest bounds of the definition, but I sure hope that ICS-CERT folks are not spending very much time on it. Sure someone could change a message one or more of these signs and cause some confusion and maybe (a stretch) an accident, but this is hardly critical infrastructure stuff here.

Control System Malware Indicator Bulletin

One of the advantages of being a member of the ICS-ISAC is that I periodically receive a copy of the Weekly Analytic Synopsis Product (WASP) from DHS National Cybersecurity and Communications Integration Center (NCCIC). I can’t talk much about what is in this report because of information sharing rules (so much of ‘information sharing’ is not sharing), but I do think that I can tell you without angering people too much that the latest issue (May 27th) included a reference to an ICS-CERT Malware Indicator Bulletin (IB-14-30005). I’m pretty sure that if you have access to HSIN that you can read this bulletin.

Tuesday, June 3, 2014

ICS-CERT Publishes New DNP3 Advisory

Today the DHS ICS-CERT published an advisory for a pair of vulnerabilities in the COPA-Data zenon SCADA software. This is the standard IP and Serial DNP3 communications vulnerabilities that I have been referring to as the Crain-Sistrunk vulnerabilities. Even though the advisory gives Crain and Sistrunk credit for the discovery of the vulnerability in this product, a TWEET® from Adam Crain informs us that COPA-Data bought his Aegis fuzzer, used it on their product and self-reported the vulnerability. You can’t ask for a better bit of advertising than that.

NOTE: According to a later TWEET, this was the free download version of the fuzzer that was used to discover these vulnerabilities. (Added 04:15, 6-4-14)

COPA-Data has developed a newer version of the affected product that mitigates the vulnerabilities.

Bills Introduced – 6-2-14

While only the Senate is really in session the House also “met” in proforma session yesterday and was responsible for over half (5 of 9) of the bills introduced yesterday. Only one of those bills may be of specific interest to readers of this blog:

S 2410 Latest Title: An original bill to authorize appropriations for fiscal year 2015 for military activities of the Department of Defense, for military construction, and for defense activities of the Department of Energy, to prescribe military personnel strengths for such fiscal year, and for other purposes. Sponsor: Sen Levin, Carl (D,MI)


It will be interesting to see if there is any significant mention of cybersecurity or cyber-warfare in this bill.

Supervisory Chemical Security Inspector Openings

Last week the DHS National Protection and Programs Directorate (hmm, I thought that there had been a recent name change here to include something about cybersecurity) published a jobs opening on USAJobs.gov for a Supervisory Chemical Security Inspector in three US cities (Lakewood, CO; Hammond, IN; and Memphis, TN). The government is accepting applications through June 11th.

According to the notice major duties include:

• Review and evaluate facility data security plans, countermeasures against Risk Based
• Performance Standards (RBPS), and data from the on-site chemical storage, manufacturing, processing, shipping and receiving of ammonium nitrate, prior to inspections and prepare comprehensive field reports of inspection findings and after-action reports. These reports may serve as the basis for initiating administrative and/or regulatory enforcement actions, as required.
• Provide technical and compliance assistance to facility operators/owners with respect to compliance with regulations.
• May serve as an action officer on a variety of liaison activities with the FBI Joint Terrorism Task Forces, ATF Inspectors, State Homeland Security Advisors, State, regional, local intelligence fusion centers, local emergency planning committees, other relevant task forces, working groups, committees and private stakeholders.

The experience requirements for these positions include:

• Evaluating subordinate chemical inspector preparation, performance, and reporting on chemical facility inspections;
• Reporting on chemical facilities by utilizing the Chemical Facility Anti-Terrorism Standards (CFATS); and
• Supervising the work performance of other chemical facility inspectors.

There are a couple of entries in the position description that I don’t recall seeing before. First it notes that the position of Supervisory Chemical Security Inspector may be designated as an ‘essential personnel’ position. It goes on to explain that:

“Essential personnel must be able to serve during continuity of operation events without regard to declarations of liberal leave or government closures due to weather, protests, acts of terrorism, or lack of funding [emphasis added].”

This ‘lack of funding’ caveat is a tad bit odd given the fact that during the federal funding fiasco last year, the CFATS inspectors all stayed home. Oh well, maybe the Department is just keeping their options open.

The other interesting requirement deals with hazmat response activities. The notice includes the statement that:

“During responses to emergencies there is the potential for exposure to toxic, biological, radiological or physical hazards that require the use of specialized protective equipment.”

During the stand-up of what is now known as the Infrastructure Security Compliance Division (ISCD) there had been some discussion about inspectors responding to actual attacks on covered chemical facilities. This lead to some expenditures on chemical safety equipment that were later questioned by the GAO and Congress when that ‘emergency response’ type activity was removed from the description of ISCD responsibility. I would be surprised and severely disappointed if responding to chemical emergencies (actually in the hot zone) were ever to be made part of the Chemical Security Inspector duties.


Personnel wishing to submit applications for these positions should log onto the USAJobs.gov website.

Monday, June 2, 2014

Committee Hearings – Week of 6-1-14

The House is working back in their districts this week but the Senate is in session. Transportation will be the focus of three hearings; one authorization and two spending hearings. The other hearing of potential interest to readers of this blog will be an oversight hearing on port security.

THUD Spending

There will be two hearings this week on the Senate’s version of the FY 2015 transportation spending bill. The Homeland Security subcommittee of the Senate Appropriations Committee will meet Tuesday to mark-up the draft version of the bill which is not yet publically available. The Full Committee will meet Thursday for the final mark-up. I fully expect the bill to contain language addressing the safety of crude oil unit trains in general and the regulation of DOT 111 rail cars specifically.

Surface Transportation Authorization

The Surface Transportation and Merchant Marine Infrastructure, Safety, and Security Subcommittee of the Senate Commerce, Science and Transportation Committee will meet on Tuesday to discuss “Surface Transportation Reauthorization: Examining the Safety and Effectiveness of our Transportation Systems”. Again, I expect that the topic of the safety of the safety of crude oil unit trains and DOT 111 car regulations will come up.

Port Security

The Senate Homeland Security and Governmental Affairs Committee will be meeting on Wednesday to look at “Evaluating Port Security: Progress Made and Challenges Ahead”. The witness list currently includes:

• Ellen McClain, Office of Policy, DHS;
• Rear Admiral  Paul F. Thomas, USCG;
• Kevin K. McAleenan, Customs and Border Protrection, DHS;
• Brian E. Kamoie, FEMA, DHS;
• Stephen Sadler, TSA, DHS; and

• Stephen L. Caldwell, GAO.
 
/* Use this with templates/template-twocol.html */