Colonial Pipeline Attack: The Pearl Harbor File

Colonial Pipeline outside Birmingham Alabama. Photo by chapstickaddict via Flickr (CC BY-NC-ND 2.0)

When the Colonial Pipeline attack occurred and I wrote my first article about it, a 22 year old conversation I had about cybersecurity came to mind. “I’ll bet” I thought, “the security person they will crucify for this Colonial Pipeline attack has a Pearl Harbor File, and I am dying to see them drag it out.”

And now it has. My prescience was rewarded.

Only moments after finishing this article, the AP published a news item where a contractor who performed a 2018 audit of Colonial Pipeline pulled out his copy of the report which cited cybersecurity lapses (among others) he had identified. What I call in the cybersecurity business “the Pearl Harbor File.”

An outside audit three years ago of the major East Coast pipeline company hit by a cyberattack found “atrocious” information management practices and “a patchwork of poorly connected and secured systems,” its author told The Associated Press.

“We found glaring deficiencies and big problems,” said Robert F. Smallwood, whose consulting firm delivered an 89-page report in January 2018 after a six-month audit. “I mean an eighth-grader could have hacked into that system.”

On the heels of the ransomware attack on the Colonial Pipeline, it’s a good time to review the bidding on how this happened. Rather than jump into the technical minutiae of the Colonial Pipeline attack for our amusement, I’ll simply quote a trusted colleague and InfoSec consultant known in the Twitterverse as @th3v0t4ry. As technical details emerged, he tweeted:

“It wasn’t Ocean’s Eleven.

Someone was walking around at night in a bad neighborhood with a bag with a huge dollar symbol painted on it, got robbed by a 12 year old with a stolen .22lr pistol.”

That sums it up nicely.

When I see incidents such as the Colonial Pipeline attack and delve into the how-it-happened aspects, I am never surprised to learn the victim was bitten by a well-known vulnerability, likely one that’s been identified and published for years. I wrote up a conversation I once had with a physical security manager waaaaay back in 1999. Here is the exchange:

“Early in my career [said the physical security manager].I was responsible for the physical security for a small group of government buildings. When I took over the job from a retiring civil servant, I had to reassess the security measures currently in place and make recommendations for security enhancements and other improvements. Any time the building managers would propose changes or additions to the buildings, they had to seek my input and approval for any necessary security enhancements. I also had to justify all the current and projected costs for security including salaries for guards, fences, lights, and anything else in the security budget.

“As my job responsibilities slowly grew, the government housed more people and more expensive equipment in the buildings. Of course, newer and better security equipment was being developed and the government security requirements evolved as well. In addition, the area around the buildings became a little more threatening. When I felt it was necessary, I would approach the facility director with a proposal to purchase newer security technologies such as cipher locks, surveillance cameras, and extra lighting. Each time he would ask me to write up a lengthy report to justify the expenditure so he could disapprove it.”

“You just said, ‘…so he could disapprove it,’” I interrupted. “Surely he didn’t always disapprove your proposals?”

“Of course, he always disapproved them. In bureaucratic circles, you open yourself up to criticism from your seniors for approving new spending projects, and God forbid you ever exceed your budget. If he approved or endorsed any new spending project not specifically directed by our agency heads, he became vulnerable. However, he never heard a peep from the headquarters if he simply disapproved the proposal at his level. And when it comes to security, it can be difficult to justify the expenditures because more often than not, you are spending money to guard against something that may never happen. However, I didn’t get discouraged. I always did a thorough job writing up the proposal and kept them in a file.”

“That makes sense; but what would happen if a security breach did occur — like equipment theft or a parking lot mugging after you had proposed something which could have prevented it?” I urged.

“There you have it!” he exclaimed. “That’s his Pearl Harbor — the unexpected attack! When a security violation resulted in a loss, we would resolve the problem and then have a postmortem meeting about it. For that interview, I would dig out a couple relevant proposals I had made over the preceding years and finally win approval for some needed enhancements.”

“Did he approve all of them?” I asked.

“Of course not. But I was usually able to push through some of the more urgent upgrades. It happened enough that I just started calling this my Pearl Harbor file.” His voice softened, then he asked, “You’re a consultant in the network security business. Don’t you recommend a Pearl Harbor file for your clients?”

Remember, this was a conversation from 22 years ago. Nothing really changes in the business of risk management.