Featured Colonial Pipeline II

Geez what is happening to the world.

 

THAT is why air-gaps in "secure networks" are a 'thing.'

Buuuuuut some people have to learn the hard way......

 

I live in central NC and those lines to get into the gas stations you see on TV are all too real. They put the TP hording to shame. Fortunately with two trips planned for this weekend, my two hybrids had full gas tanks as of yesterday.

Will give the post office an excuse to be even more late with the mail. Just got a magazine 10 days late.

Some of the pipeline is now up.

 

I read an article recently by the IT manager of a data storage firm that was attacked by ransomware. It was instant all hands on deck unplugging cables. They got it air gapped in time to stop a total loss. They then responded to the hackers by telling them to go pound sand and went to work restoring files from backups. They did lose some stuff permanently but not as much as you might think. Once they got it all cleaned up they were able to go back on line but with several staffers monitoring 24/7 for weeks or months. I don't remember how long. The hackers didn't come back. He said it was exhausting, but worth it to not have to reward criminals and while they were at it, they found and plugged some security holes.

 

UNfortunately....criminal behavior is extraordinarily Darwinian.

Nowadays, the ransomware terrorists hoover up all of your data before they spring the trap.
If you tell them to engage in self procreation and their dirty bomb is ineffective, they threaten to publish all of your sensitive data.
It may not seem like much, but I'm sure that their CIO would probably quail at having all of their personnel file information published in....saaaay....North Carolina right about now.

I got all of my Standard Form 86 information released into the dark web in the 2010s - so I know how they feel......


This is why shorting an air-gap SHOULD result in immediate termination and possible jail time for the private sector, and no-kidding....turning big rocks into little rocks jail time for persons with dot.gov or dot.mil in their email addresses......SECSTATEs included.

I have an immediate family member who is currently working in a SCIF for uncle (she's giving it up for a teaching gig later this year) and another family member that does IT work in oil and gas (production - NOT pipeline) and it's hard to say which one has the more robust "anti own-goal" program.
In my own beloved company probably 99.99999 percent of our efforts in this area involve the humorless nebbishes down in the IT dungeon struggling to keep OUR OWN EMPLOYEES from leaving doors and windows open - pun almost unintended.....but hey......
We're a freekin COMMUNICATIONS company.

Oil and gas has no excuse.
There IS no credible reason for this to have happened other than them not spending time and money to harden their junk.

Interestingly enough.....at least to me......one of the home IOT protocols that I like to tinker with is MQTT - which was originally developed as a bandwidth efficient means of........monitoring pipelines!
It was developed waaaaaaay back in the long-ago (1999) when such things were connected by satellite - something that they gave up on because it was..........(wait for it!).............."too expensive!"

....oops!

 

We can’t even get power companies to prepare their power generators for freezing weather.
We even know that is coming.

Our infrastructure is maintained in such a way as to minimize costs, and deal with emergencies when they arise.
Then our companies categorize those costs as ‘unforeseeable’.

 

Yep.
It's a pretty sorry system alright.
Almost as bad as all of the alternatives.

NASA (versus Space-X)
USPS (versus almost anything else including pack mules)
AMTRACK

etc....


REMEMBER....some of the most egregious data hacks have been against dot.gov.
They just don't 'get noticed' as much.

 

I don't think that saying works in the case of infrastructure.
Here is a great example of being prepared vs dealing with emergencies when you aren't:
Stormwater management: How Dutch solutions could have mitigated Hurricane Florence damage - 60 Minutes - CBS News

As far as hacks not being noticed as much, I agree.
Also important to remember that only publicly held companies are required to disclose hacks. Privately held companies are also a big unknown.

 

Publicly traded companies can be held criminally responsible for infrastructure neglect.
They just aren't, really.
Example: PG&E
Until and unless they start frog-marching company ossifers into court to face the music, then fines and fees will amount to a parking ticket violation....and quickly passed onto the consumer.
No one person IN the company faces much in the way of a lifestyle change no matter HOW many people they kill.

When private companies fail to be good cooperate citizens....they can (and SHOULD!) be held accountable by the regulatory agencies that monitor their activities.
Space-X is a good example.
If they suffer a(nother!) de-orbiting faux-pas and this time park a booster component into a daycare full of kids or (perhaps worse!) squish some protected species of salamander....then they "could" potentially face the wrath of a whole can's worth of alphabet soup agencies fighting over the carcass.

BUT....
They won't.

...let's not forget.
A non-trivial CUSTOMER of Space-X is..............Dot.gov.


HOWEVER (comma!)
The alternative in the case of Space-X seems to be thumbing a ride up to the space space station by one of the nations that sponsor the very cyber terrorism that free societies are so very vulnerable to.

 

For some of those cases, the government outsourced the handling and security of the data to a public or private company.

 

I mostly agree, but ....

Re: the article I referenced. How do you air gap online file storage? It's a cloud service. If they air gap, their clients will have to take files back & forth hundreds or thousands of miles on thumb drives. Or worse yet, entrust them to a delivery service or the USP(so-called)S.

 

Pay me now or pay me later.

As one who is paying the bills charged by a utility that correctly planned ahead and built the needed infrastructure, believe me it has been painful. Read 3x as expensive as a local city, maybe 5x compared to where I used to live.

 

If you run a pipeline, longlines, sat-uplink, nuclear power plant, or any of a number of other UTILITIES, then cloud storage is what you air-gap FROM.

Without getting too far into 'inside baseball' there are internets and intranets.
You use sneaker-net for one of these.
It doesn't matter what you use for the other.

One of the reasons that 'some' things that I've been exposed to use very VERY old-school systems is that they're protected by antiquity.

Ever try to sneak a 5.25" floppy or 9-track mag reel into or out of a SCIF?

One of the more successful exploits against DoD not so many years ago was to leave some fancy USB thumb drives, and certain other USB peripherals......JUST laying around in certain parking lots.

This is because of what the "U" in USB stands for.....


Pipelines are the most "earth friendly" way to move petrol over large distances....BUT...they're licensed and regulated for a REASON.
If it turns out that they paid the ransom (and my finely honed Spidey senses tell me that they DID) then they should forfeit those operating permits and go into receivership.

....maybe some custodial outter-wear for the folks in their head-shed if the source of the exploit is determined to be caused by gross neglect.


Sometimes?
You have to shoot a hostage.

 

I am unfamiliar with what you seem to be implying?
Are you suggesting SpaceX has already had errant components landing where they shouldn't?

I agree with you that consequences for companies has been lacking. Just not sure how SpaceX got drawn into your ire?

 

Nope.
I must be a victim of 'fake news' again......
Piece of SpaceX rocket debris lands at Washington state farm - ABC News

Space-X has not "drawn my ire."
BECAUSE OF THEM our nation now has a viable space program.

However (comma!) they are not a publicly traded company, IIRC.
This MEANS they have to be ACTIVELY regulated by dot.gov with the same intensity as that which is exhibited when they try to regulate tire ruts on private property as "inland waterways."
OR?
When somebody wins a 249 gram UAS (drone) and posts a picture from it on the interwebs......

well....
MAYBE not THAT much!

 

Humph! Gas stations here are running empty and we don't even get gas from the pipeline. It's just plain old panic buying.

 

Not a great example, because most power generators are prepared for freezing weather. I.e. almost everything north of Amarillo was good. And from El Paso to the west.