ICS-CERT Updates ABB HeartBleed and Publishes Yokogawa Overflow

Today the DHS ICS-CERT updated a two-month old HeartBleed advisory for the ABB 650 Series application and issued a new buffer overflow advisory for Yokogawa Centum products. Yokogawa also updated an earlier advisory that has not yet been noticed by ICS-CERT.

ABB HeartBleed Update

This advisory update provides notice that ABB has produced a maintenance Release (available through customer service) that mitigates the OpenSSL bug in the 650 Series application. ABB has also updated their Cyber Security Advisory for the HeartBleed bug in their equipment. Interestingly the ABB published advisory can’t make up its mind (at the top of page 2) if the CVSS Score is 5.0 or 4.8 (not that there is much difference). ICS-CERT reports a score of 5.0.

Yokogawa Advisory

This advisory reports a single buffer stack overflow vulnerability in Yokogawa Centum products that was reported by Rapid7 in a coordinated disclosure. Yokogawa has produced a patch that mitigates the vulnerability but there is no indication in the advisory that Rapid7 has been able to verify the efficacy of the patch.

ICS-CERT reports that a moderately skilled attacker could remotely exploit this vulnerability to execute arbitrary code. Yokogawa reports that the vulnerability only is accessible when the Expanded Test Functions Package is in use.

A Yokogawa Update

While following the ICS-CERT link to the Yokogawa report referenced above, I noticed that the Company had also updated an earlier report about four buffer overflow vulnerabilities reported earlier. I don’t know why ICS-CERT is reporting on the update (yet?).

The new data in this update is found in the Table 1 list of affected products and fixes. It reports a newer patch for the CENTUM 3000, CENTUM VP, and Exaopc Server products that addresses both the earlier vulnerabilities and the one reported by ICS-CERT today. It also reports that earlier versions of ProSafe-RS that were earlier reported as having no patches available may now be corrected.

House Passes HR 4007 on Voice Vote

Earlier this afternoon (5:09 pm EDT) the House HR 4007, the Chemical Facility Anti-Terrorism Standards Program Authorization and Accountability Act of 2014, by voice vote. There was about 30 minutes of debate on the bill. While it is hard to determine how much actual opposition there was to this bill, a voice vote, without a call for a recorded vote afterwards, is a pretty good sign that there was widespread bipartisan support for the bill. As I mentioned this weekend, this bodes well for the prompt consideration and passage of this bill in the Senate.

Update Added 17:30 CDT:

The American Chemistry council congratulated the House on passing this bill today; noting that:

“This bill will provide the operational stability that DHS has sorely needed to make CFATS successful, and help the agency recruit and retain top talent to effectively implement the program. The measure will also encourage industry to continue to make long-term capital commitments to enhance security and is consistent with the recommendations issued by an interagency Working Group as part of Executive Order 13650, ‘Improving Chemical Facility Safety and Security.”

SOCMA Tweeted®: Thank you @RepMeehan and @HouseHomeland for all of your hard work on H.R. 4007! #CFATS

OMB Approves 2014-2015 Methyl Bromide Exceptions

The OMB’s Office of Information and Regulatory Affairs (OIRA) announced yesterday that it had approved the EPA’s final rule for the critical use exceptions (CUE) for the continued use of methyl bromide under the Montreal Protocol. Publication of the rule could be seen by the end of the week.

There are a couple of interesting comments in the docket for this rule (here, here and here; PDF download links). What is missing from the docket this year is a copy of the EPA’s letter to users and manufacturers of methyl bromide notifying them that the EPA would take no enforcement action against users and manufacturers for the use of methyl bromide for CUE this year while the EPA got this delayed rule through the publication process.

Once again it is clear that DHS erred in 2007 when it removed methyl bromide from the final version of Appendix a to 6 CFR 27 based upon the EPA’s assurance that methyl bromide was being phased out of use/production. While the use of methyl bromide has certainly decreased it shows no sign of disappearing from the US market place.

Perhaps if manufacturers and distributors were subject to CFATS program security costs, there might have been more of an incentive to phase out this toxic inhalation hazard product.

S 2534 Introduced – FY 2015 DHS Spending

As I noted last month Sen. Landrieu (D,LA) introduced S 2534, the Department of Homeland Security Appropriations Act, 2015; the Senate version of the annual DHS spending bill. Typically the language in this bill would be substituted for the language in the House bill (HR 4903) when it is considered in the Senate.

As is typical in the DHS spending bill the only specific language of interest to the chemical security community would be the inclusion of the extension of the CFATS authorization. This bill includes that in §532. That language would extend the current authorization one year to October 4, 2015.

The Committee Report that accompanies this bill does provide a few items of potential specific interest to readers of this blog. This would include comments about the TWIC program, facility security officer training, the CFATS program and the Chemical Defense program.

TWIC

On page 79 of the report there is a brief discussion of the criminal background check portion of the Transportation Worker Identification Credential (TWIC) program. The Committee questions the lack of recurring criminal background checks after a TWIC is issued. The report requires DHS and the FBI to develop a plan to correct the situation, but stop short of requiring them to implement the plan. They do require the production of cost estimates for implementing the recurring criminal background checks, so they do realize that additional checks may raise the costs of the program significantly.

CG FSO Training

On page 86 there is a discussion about the lack of training standards for waterfront facility security officers (FSO) under the Maritime Transportation Safety Act (MTSA) and §821 of the 2010 Coast Guard Authorization Act. There is apparently a misprint in the discussion calling the FSO’s “waterfront federal [emphasis added] security officers” instead of ‘facility’ security officers.

The comment notes that the CG is internally developing the requirements for this training, but it recommends that FEMA be brought into the development process since the §821 requirements that the training should be “consistent with, and supports implementation of, the National Incident Management System”. A plan for the implementation of §821 is required to be submitted to Congress within 60 days of the passage of this bill.

Chemical Security

There is a fairly lengthy discussion (pages 102 thru 104) of the CFATS program. In addition to the obligatory requirement for multiple reports about the programs implementation there is:

• A brief discussion about the coordination between Administration agencies on chemical safety and security under EO 13650;

• A one sentence requirement to “work with industry on a viable solution to personnel surety”;

• A cryptic (and misaddressed) requirement to consider the use of “chemical neutralization technologies when creating comprehensive and integrated standard operating procedures for a unified Federal approach for identifying and responding to risks in chemical facilities” (this should be addressed at OSHA and EPA not NPPD); and

• A complaint about the abuse of Administratively Uncontrollable Overtime by chemical security inspectors.

Chemical Defense Program

On page 110 there is a very brief discussion about the Office of Health Affair’s chemical defense program; a program that I discussed last fall. Beyond recommending a continuation of current (and requested) funding levels (a comparatively miniscule $824,000) there is a requirement to submit a report on the progress being made in the four demonstration projects.

Moving Forward

This bill will move forward to the Senate floor, be amended and adopted. Then when the House bill reaches the Senate the language for this bill will be substituted for the House language (the Constitution requires that spending bills originate in the House). Then a Conference Committee will be formed to iron out the differences. September will probably be the earliest that a conference committee report will be voted upon.

CFATS Bill to House Floor Tuesday

Yesterday the House Majority Leader’s web site announced that HR 4007, the Chemical Facility Anti-Terrorism Standards Program Authorization and Accountability Act of 2014, will come to the floor of the House for consideration on Tuesday. In an unusual move for a CFATS related bill, it will be considered under suspension of the rules with limited debate and no amendments.

The reason that this is unusual for a CFATS bill is that bills considered under suspension of the rules require a 2/3 vote (not >50%) to pass the bill. Bills that are considered in this manner are generally considered to be non-controversial and are expected to have widespread bipartisan support. This would mark the first time since the 9/11 attacks started serious congressional discussion about chemical facility security legislation that a comprehensive chemical security bill had even a hope of minimal (much less ‘wide spread’) bipartisan support.

If this wide spread bipartisan support also applies to the Senate, this may mean that the bill could be quickly picked up by the Senate and perhaps be voted upon before the summer recess. It may, in fact, explain why the Senate Homeland Security and Governmental Affairs Committee stopped their announced introduction of a CFATS bill last month.

If this bill is adopted it will have one side effect that will adversely affect the chemical security program development. It will effectively kill the currently proposed Personnel Surety Program that is under review by the Office of Management and Budget. ISCD will have to start from scratch to craft a program that would meet the requirements of §2101(d)(3) of this bill. This means that it will be at least another year (probably 2) before there is a chance that there will be a method for screening employees at a high-risk chemical facility for known potential connections to terrorist organizations.

S 2478 IS – Short Line Railroad Safety Act of 2014

As I noted last month Sen. Collins (R,ME) introduced S 2478, the  Short Line Railroad Safety Act of 2014. This bill is designed to enhance the ability of the nation’s short line railroads to safely handle hazardous cargoes such as crude oil. The bill would amend 49 USC 20108 ‘Research, development, testing, and training’.

The bill would add paragraph (d) to 49 USC 20108. It would establish the Short Line and Regional Railroad Safety Training Initiative. This would be a grant program for Class II and Class III railroads administered by the Department of Transportation to “be used for research, development, evaluation, and training efforts that are designed to enhance rail safety practices and safety culture” {§20108(d)(2)}.

The bill would authorize $2 million in 2016 for the grants under this program.

This bill will have little problem passing a floor vote, the difficulty will be pushing it to the floor for a vote.

Two PHMSA Pipeline Meeting Announcements

Today DOT’s Pipeline and Hazardous Material Safety Administration published two pipeline meeting notices in the Federal Register (79 FR 37390, and 79 FR 37389-37390). The first will be held in Rosemont, IL on August 5^th, 2014 and will be a forum to gather and disseminate information on the state-of-the-art of crack detection in hazardous liquid and natural gas pipelines. The second will be public forum to generate a National research agenda that fosters solutions for the many challenges with pipeline safety and with protecting the environment and will be held the day after at the same location.

Pipeline Cracking Forum

According to the meeting web page this forum will address the challenges involved with detecting and characterizing crack like defects, including environmentally assisted cracks and cracks with corrosion. It will include five panel discussions:

• Regulator perspectives on cracking challenges;

• Operator perspectives on cracking challenges;

• Cracking detection technology developments;

• Presentation of research roadmaps; and

• Presentation of comprehensive case studies.

The public is invited to attend this meeting. Registration is required and may be done on-line.

Pipeline Research Forum

According to the meeting web page this two-day forum is designed to produce a consensus vision of a research agenda for pipeline safety. The forum would specifically address:

• The identification of key pipeline technical challenges facing industry and government;

• The dissemination of information on current research efforts; and

• The identification of new research that can help to meet known challenges.

To this end five working groups are currently planned:

• Damage prevention;

• Leak detection and fugitive methane;

• Anomaly detection and characterization;

• Improving risk models; and

• Addressing legacy materials challenges

The full meeting agenda will be published on the web site at a later date.

The public is invited to attend this meeting. Registration is required and may be done on-line.