The Colonial Pipeline cyberattack is still causing ripples. Some of these federal mandates may mark major changes for operational technology (OT) cybersecurity.

The privately held Colonial Pipeline company, which provides nearly half of the fuel used by the East Coast — gasoline, heating oil, jet fuel and fuel for the military totaling around 100 million gallons a day — was hit by a double-extortion ransomware attack by a DarkSide group in May of 2021.

In reaction, the company shut down pipeline operations and IT systems. Next, they brought in FireEye’s Mandiant to conduct cyber forensics.

The event triggered panic in national security circles. After years of talk about whether a state-sponsored cyberattack could shut down major infrastructure or utilities on a massive scale, it seemed like that fear finally came true. In fact, the company was motivated by money and chose to shut down.

Still, the Colonial Pipeline attack mobilized the federal government into action. And that action is what’s still causing lingering problems.

TSA responses to Colonial Pipeline attack

In the aftermath of the attack, the Transportation Security Administration (TSA) issued two major mandatory cybersecurity directives for all U.S. pipeline operators. TSA rules had been voluntary before this. Now, violators could be fined up to $11,904 per day.

Trouble is that the TSA developed these rules without notice-and-comment rulemaking, which would have enabled pipeline companies to contribute to the crafting of rules to make them more feasible. Even Congress wasn’t notified of the rules in advance.

Some pipeline operators are now saying that not only are some rules confusing and too complex, but they might even threaten pipeline operations and safety.

Mandatory cybersecurity rules have constrained power stations for many years. However, lawmakers saw pipeline operators as a special case requiring a lighter touch. By definition, these companies operate IT and OT systems that span vast distances. Compliance with the new directives, for example, often means sending technicians to each far-flung control box and attempting to apply patches, upgrades or changes that don’t always make sense for that kind of hardware.

Struggling to comply

Pipeline operators say they are struggling to comply. While the TSA offered to help companies, the agency also appears overwhelmed. Operators have permission to find other routes to the same objectives, but the TSA has to approve those plans first. And it has become clear that the TSA is understaffed and underfunded for this level of back-and-forth.

The core problem is that TSA is not the right agency for this kind of regulation, according to University of Tulsa professor Ido Kilovaty. Its current staffing and budget are “lacking the expertise and tools needed to effectively regulate cybersecurity in the pipeline context,” he wrote.

A better choice may be the Federal Energy Regulatory Commission (FERC). This is an independent agency within the Department of Energy responsible for cybersecurity regulation of the electric power sector. Moving from TSA to FERC, in fact, has the backing of the Biden Administration.

In general, the TSA rules are overly prescriptive, dictating not only outcomes but methods. And these prescriptions may not consider the variability and complexity of affected systems.

One common complaint is that the directives don’t give enough time. The timelines are too aggressive and overly specific.

What the industry can expect from future regulations

Changes are coming. Pipeline cybersecurity regulations may remain under the TSA, but with expanded funding. Or, the government may move them to another existing agency or to a special-purpose agency yet to be created. And new rules, made in concert with the pipeline industry, are surely coming to replace the old.

It’s ironic that the rushed, overly-prescriptive, top-down directives ended up that way in the interest of time. Now, arriving at a regulatory regime that really works to keep pipelines safe is taking far longer than it could have.

More from Risk Management

Cybersecurity Awareness Month: Cybersecurity awareness for developers

3 min read - It's the 21st annual Cybersecurity Awareness Month, and we’re covering many different angles to help organizations manage their cybersecurity challenges. In this mini-series of articles, we’re focusing on specific job roles outside of cybersecurity and how their teams approach security.For developers, cybersecurity has historically been a love-hate issue. The common school of thought is that coders are frustrated with having to tailor their work to fit within cybersecurity rules. However, many companies are embracing a security-first approach, and some developers…

Spooky action: Phantom domains create hijackable hyperlinks

4 min read - According to a recent paper published at the 2024 Web Conference, so-called "phantom domains" make it possible for malicious actors to hijack hyperlinks and exploit users' trust in familiar websites.The research defines phantom domains as active links to dot-com domains that have never been registered.Here's what enterprises need to know about how phantom domains emerge, the potential risks they represent and what they can do to disrupt phantom attacks. There are two common types of phantom domains: Errors and placeholders.Domain errorsErrors…

SANS Institute: Top 5 dangerous cyberattack techniques in 2024

4 min read - The SANS Institute — a leading authority in cybersecurity research, education and certification — released its annual Top Attacks and Threats Report. This report provides insights into the evolving threat landscape, identifying the most prevalent and dangerous cyberattack techniques that organizations need to prepare for.This year’s report also highlighted the main takeaways from the SANS keynote hosted at the annual conference. During the keynote presentation, five new cybersecurity attacks were identified and discussed by key SANS members along with suggested…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today