OMB Approved DOC ICTS Supply Chain Security Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule from the Department of Commerce on “Securing the Information and Communications Technology and Services Supply Chain”. The notice of proposed rulemaking was published on November 27^th, 2019. An interim final rule (IFR) was published on January 19^th, 2021.

According to the Spring 2024 Unified Agenda entry for this rulemaking:

“Pursuant to Executive Order 13873 [link added] of May 15,2019,"Securing the Information and Communications Technology and Services Supply Chain” and Executive Order 14034 [link added] of June 9, 2021, Protecting Americans' Sensitive Data From Foreign Adversaries,” the Department of Commerce is finalizing the rule that sets forth the process and procedures that the Secretary of Commerce will use to identify, assess, and address transactions that pose an undue risk to the security, integrity, and reliability of information and communications technology and services provided and used in the United States.”

With a probable effective date well after Trumps inauguration in January, the new administration will be able to effectively kill this final rule with an executive order (the underlying IFR would take a new rulemaking to undo). While the rulemaking was initiated under Trumnp 45, the Biden Administration put their stamp on the rulemaking, so it is unclear whether the new administration would let this rule stand.

I will probably not be covering the publication of this final rule in any detail. I will, however, note its publication in the appropriate Short Takes post.

Short Takes – 11-26-24

Bird flu has been detected in raw milk in California. TheHill.com article. Pull quote: “The virus was found in a batch of cream top, whole raw milk produced and packaged at Raw Farm LLC after a public health laboratory purchased it at a retail outlet [emphasis added] for testing.”

Bird flu strikes 1st child in the US. CDC says infection source unknown. LiveScience.com article. More information than earlier article. Pull quote: “In the child's case, they initially tested positive for low levels of the H5N1 virus. Several days later, their results came back negative for H5N1 but positive for other common respiratory viruses. The child's symptoms were mild, similar to those seen with the other H5N1 cases reported in the U.S. so far. The CDPH also noted that many of the child's flu-like symptoms could have resulted from their concurrent viral infections.” Ties to raw milk incident investigated.

Squirting Cucumbers Shoot Their Seeds Like Botanical Bombardiers. NYTimes.com article (free). Pull quote: “The researchers also calculated the pressure within the cucumber and found that it’s similar to that of an inflated mountain bike tire, Dr. Box said. Using that and other data they collected on the plant, the researchers worked out the math behind the dispersal of seeds. That allowed them to simulate how hypothetical mutant plants would spread differently.”  Great Video - https://vp.nyt.com/video/2024/11/25/130107_1_25tb-squirting-cucumbers-16086_wg_1080p.mp4

The engine of Japan's flagship new small rocket explodes during a test for a second time. Phys.org article. Pull quote: “"Development of flagship rockets such as Epsilon S is extremely important from the perspective of ensuring autonomy of Japan's space development," Hayashi told reporters. "JAXA will thoroughly investigate and take steps."”

The search for a commercial lunar economy. TheSpaceReview.com article. Pull quote: “Those [decadal] timelines pose challenges for companies with private investors who want returns in several years, not several decades. That means companies like Intuitive Machines will, for now, look to government customers who have requirements linked to science and national prestige to motivate spending billions on lunar missions and enabling infrastructure. Intuitive Machines won a NASA contract in September worth as much as $4.8 billion over ten years to provide lunar communications services, funding a five-satellite network that could potentially be used by other customers as well as NASA.” Hard to see standalone commercial development until some level of infrastructure is developed.

Trump team barred from agencies amid legal standoff. Politico.com article. Pull quote: “Watchdog groups, ethics experts and former government officials say the delay in coordination with federal agencies, which typically begins by mid-November, means the new administration won’t be up to speed on the state of the career workforce and budget and what headaches may await them when Trump takes the oath of office on Jan. 20. The failure thus far to sign the memorandums has also troubled Biden officials, who are particularly concerned about the potential national security implications.”

Notice of Meeting; Homeland Security Advisory Council. Federal Register DHS meeting notice. Summary: “OPE is publishing this notice of a [closed to the public] meeting of the Homeland Security Advisory Council (HSAC). This meeting will discuss security related threats and DHS operations post-election.”

Proposed Collection, and Comment Request; Terrorism Risk Insurance Program-Data Collection Forms. Federal Register Treasury information collection request 60-day renewal notice. Summary: “The Secretary of the Treasury (Secretary) administers the Terrorism Risk Insurance Program (TRIP or Program), including the issuance of regulations and procedures regarding the Program. The Federal Insurance Office (FIO) assists the Secretary in the administration of the Program. The Department of the Treasury (Treasury), as part of its continuing effort to reduce paperwork burdens, invites the general public and other Federal agencies to comment on approved information collections for annual data collection that are due for extension by the Office of Management and Budget (OMB) (currently approved under OMB 1505-0257). These forms will be utilized, beginning in calendar year 2025, in connection with both the federal and state annual data calls regarding terrorism risk insurance. State insurance regulators, through the National Association of Insurance Commissioners (NAIC), will separately address any comments sought or made in connection with the state data call.” Minor burden estimate changes based upon 2024 call data. Comments due: January 27^th, 2025.

Review – Siemens Publishes Out-of-Zone Update – 11-26-24

Today, Siemens announced that it had published an update for their Mendix Runtime advisory. For the last few years Siemens has routinely published their advisories and updates on Cyber Tuesday (2^nd Tuesday of the month).

Updates

Siemens Update - This update provides additional information on the Mendix Runtime advisory that was originally published on September 10^th, 2024, and most recently updated on November 12^th, 2024.

 

For more information on this advisory, including a down-the-rabbit-hole look at the reported fix, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/siemens-publishes-out-of-zone-update - subscription required.

Review – 5 Advisories and 1 Update Published – 11-26-24

Today, CISA’s NCCIC-ICS published five control system security advisories for products from Hitachi Energy and Schneider Electric. They also published an update for a medical device security advisory for products from Philips.

Advisories

Hitachi Energy Advisory #1 - This advisory describes an improper input validation vulnerability in the Hitachi Energy RTU500 series products.

Hitachi Energy Advisory #2 - This advisory describes five vulnerabilities in the Hitachi Energy MicroSCADA Pro.

Schneider Advisory #1 - This advisory describes three vulnerabilities in multiple Schneider products.

Schneider Advisory #2 - This advisory describes the use of a broken or risky cryptographic algorithm in the Schneider owerLogic P5 product.

Schneider Advisory #3 - This advisory describes two vulnerabilities in the Schneider PowerLogic PM5500 and PowerLogic PM8ECC products.

Updates

Philips Update - This update provides additional information on the Vue PACS advisory that was originally published on July 18^th, 2024.

 

For more information on these advisories, including when vendors released and updated their versions of these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-1-update-published-abe - subscription required.

Short Takes – 11-25-24

Blue Origin's New Glenn rocket goes vertical on the launch pad. Phys.org article. Pull quote: “Jeff Bezos' rocket company is using the first flight of New Glenn to fly up and test the company's Blue Ring hardware, which is used to deliver payloads to their proper place in orbit once deployed. It will also be the first of two required flights to get certification by the Space Force to fly national security missions.”

Notice of the Renewal of the Critical Infrastructure Partnership Advisory Council Charter. Federal Register CISA advisory committee renewal notice. Summary: “On September 9, 2024, the Secretary of the Department of Homeland Security approved the renewal of the Critical Infrastructure Partnership Advisory Council (CIPAC) Charter. Through this notice, the Department is making the renewed CIPAC Charter publicly available and highlighting updated information and guidelines that have been included in the renewed charter.”

Sunshine Act Meeting (NTSB). Federal Register NTSB meeting notice. Agenda: “Pipeline Investigation Report—UGI Utilities Inc. Natural Gas Pipeline Explosion and Fire, West Reading, Pennsylvania, March 24, 2023”

BIS Sends Australia Group Final Rule to OMB

On Friday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a final rule from the DOC’s Bureau of Industry and Security (BIS) on “Implementation of Certain Australia Group Decisions”. This rulemaking was not included in the Spring 2024 Unified Agenda.

The Australia Group is an ‘informal’ group of 42 countries that “coordinate their national export controls to limit the supply of chemicals and biological agents-as well as related equipment, technologies, and knowledge-to countries and nonstate entities suspected of pursuing chemical or biological weapons (CBW) capabilities.” 

Short Takes – 11-23-24

Underwater volcano-like structure is spewing gas off Alaska's coast, US Coast Guard says. LiveScience.com article. Pull quote: “The structure may be spewing gas, based on data collected from the water above it, but the scientists still aren't certain. Whether the structure turns out to be a volcano or not, it is 5,250 feet (1,600 m) deep at its shallowest point, meaning it poses no risk to navigation, according to a statement.”

Eggs are getting scarcer and pricier ahead of the holidays. Here's why. CSBNews.com article. Pull quote: “After a brief respite from bird flu among commercial-egg producers, HPAI struck again starting in mid-October, resulting in the loss of 2.8 million birds. The nation's egg production fell 2.6% last month from a year ago and is projected to be down 1% this year versus 2023, the U.S. Department of Agriculture's Economic Research Service recently said in a monthly report.”

California Case Is the First Confirmed Bird Flu Infection in a U.S. Child. MedPageToday.com article. Pull quote: “Officials said they were investigating how the child was infected. California health officials previously said in a statement that they were looking into a "possible exposure to wild birds."”

The ISS has been leaking air for 5 years, and engineers still don’t know why. Arstechnica.com article. Pull quote: “"The Russians believe that continued operations are safe, but they can't prove to our satisfaction that they are," said Cabana, who was the senior civil servant at NASA until his retirement in 2023. "And the US believes that it's not safe, but we can't prove that to the Russian satisfaction that that's the case.”