The Colonial Pipeline cyberattack is still causing ripples. Some of these federal mandates may mark major changes for operational technology (OT) cybersecurity.

The privately held Colonial Pipeline company, which provides nearly half of the fuel used by the East Coast — gasoline, heating oil, jet fuel and fuel for the military totaling around 100 million gallons a day — was hit by a double-extortion ransomware attack by a DarkSide group in May of 2021.

In reaction, the company shut down pipeline operations and IT systems. Next, they brought in FireEye’s Mandiant to conduct cyber forensics.

The event triggered panic in national security circles. After years of talk about whether a state-sponsored cyberattack could shut down major infrastructure or utilities on a massive scale, it seemed like that fear finally came true. In fact, the company was motivated by money and chose to shut down.

Still, the Colonial Pipeline attack mobilized the federal government into action. And that action is what’s still causing lingering problems.

TSA responses to Colonial Pipeline attack

In the aftermath of the attack, the Transportation Security Administration (TSA) issued two major mandatory cybersecurity directives for all U.S. pipeline operators. TSA rules had been voluntary before this. Now, violators could be fined up to $11,904 per day.

Trouble is that the TSA developed these rules without notice-and-comment rulemaking, which would have enabled pipeline companies to contribute to the crafting of rules to make them more feasible. Even Congress wasn’t notified of the rules in advance.

Some pipeline operators are now saying that not only are some rules confusing and too complex, but they might even threaten pipeline operations and safety.

Mandatory cybersecurity rules have constrained power stations for many years. However, lawmakers saw pipeline operators as a special case requiring a lighter touch. By definition, these companies operate IT and OT systems that span vast distances. Compliance with the new directives, for example, often means sending technicians to each far-flung control box and attempting to apply patches, upgrades or changes that don’t always make sense for that kind of hardware.

Struggling to comply

Pipeline operators say they are struggling to comply. While the TSA offered to help companies, the agency also appears overwhelmed. Operators have permission to find other routes to the same objectives, but the TSA has to approve those plans first. And it has become clear that the TSA is understaffed and underfunded for this level of back-and-forth.

The core problem is that TSA is not the right agency for this kind of regulation, according to University of Tulsa professor Ido Kilovaty. Its current staffing and budget are “lacking the expertise and tools needed to effectively regulate cybersecurity in the pipeline context,” he wrote.

A better choice may be the Federal Energy Regulatory Commission (FERC). This is an independent agency within the Department of Energy responsible for cybersecurity regulation of the electric power sector. Moving from TSA to FERC, in fact, has the backing of the Biden Administration.

In general, the TSA rules are overly prescriptive, dictating not only outcomes but methods. And these prescriptions may not consider the variability and complexity of affected systems.

One common complaint is that the directives don’t give enough time. The timelines are too aggressive and overly specific.

What the industry can expect from future regulations

Changes are coming. Pipeline cybersecurity regulations may remain under the TSA, but with expanded funding. Or, the government may move them to another existing agency or to a special-purpose agency yet to be created. And new rules, made in concert with the pipeline industry, are surely coming to replace the old.

It’s ironic that the rushed, overly-prescriptive, top-down directives ended up that way in the interest of time. Now, arriving at a regulatory regime that really works to keep pipelines safe is taking far longer than it could have.

More from Risk Management

Digital solidarity vs. digital sovereignty: Which side are you on?

4 min read - The landscape of international cyber policy continues to evolve rapidly, reflecting the dynamic nature of technology and global geopolitics. Central to this evolution are two competing concepts: digital solidarity and digital sovereignty.The U.S. Department of State, through its newly released International Cyberspace and Digital Policy Strategy, has articulated a clear preference for digital solidarity, positioning it as a counterpoint to the protectionist approach of digital sovereignty.What are the main differences between these two concepts, and why does it matter? Let’s…

A decade of global cyberattacks, and where they left us

5 min read - The cyberattack landscape has seen monumental shifts and enormous growth in the past decade or so.I spoke to Michelle Alvarez, X-Force Strategic Threat Analysis Manager at IBM, who told me that the most visible change in cybersecurity can be summed up in one word: scale. A decade ago, “'mega-breaches' were relatively rare, but now feel like an everyday occurrence.”A summary of the past decade in global cyberattacksThe cybersecurity landscape has been impacted by major world events, especially in recent years.…

It all adds up: Pretexting in executive compromise

4 min read - Executives hold the keys to the corporate kingdom. If attackers can gain the trust of executives using layered social engineering techniques, they may be able to access sensitive corporate information such as intellectual property, financial data or administrative control logins and passwords.While phishing remains the primary pathway to executive compromise, increasing C-suite awareness of this risk requires a more in-depth approach from attackers: Pretexting.What is pretexting?Pretexting is the use of a fabricated story or narrative — a “pretext” — to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today