Blog

Seebald & Associates friends and colleagues,

Here at Seebald & Associates, we monitor advisories from the Cybersecurity and Infrastructure Protection Agency (CISA) and other organizations to ensure that we are aware of emerging threats.

On February 7^th, CISA released an advisory related to the People’s Republic of China (PRC) state-sponsored cyber group known as Volt Typhoon. The advisory was issued in cooperation with the National Security Agency, the Federal Bureau of Investigation, and other government agencies and foreign allies. The link to that advisory is:

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a

I’ve included a few key quotes below that show the seriousness of this advisory:

• “The U.S. authoring agencies have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in Communications, Energy, Transportation Systems, and Water and Wastewater Systems Sectors”
• “Cyber actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States.”
• “Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions. “
• “The U.S. authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and/or military conflicts.”

I strongly encourage you to share this advisory with your cybersecurity teams, and with senior risk management personnel at your organization. The advisory recommends that organizations take immediate actions to hunt for and respond to this threat and provides tools and information for doing so.

Thank you for doing all you can to protect your organization, and our great nation, from all threats.

Key takeaways:

– Android OS versions up to and including version 10 are in end-of-life status, meaning they are no longer receiving security patches/updates.

– Unpatched vulnerabilities can lead to unauthorized access to sensitive security information, denial of service (DoS) attacks and ransomware.

– Security patches also improve the stability and performance of devices, which is crucial to physical access control systems (PACS) that require fast and reliable authentication to ensure security of secured areas.

In today’s world, technology is an indispensable tool that makes our personal and professional lives easier and more convenient. We rely on our smartphones, tablets, and other mobile devices to stay connected, access information, and perform a wide range of tasks. However, as technology evolves rapidly, so do the risks associated with it. While visibility of this issue has improved significantly for workstation computers in recent years, security on mobile devices remains a frequently overlooked topic. In this post, we will explain the security risks associated with unmaintained Android software when used by Maritime Transportation Security Act and Chemical Facility Anti-Terrorism Standards regulated facilities for physical access control and how to mitigate them.

Physical access control systems are used to regulate and monitor access to secured areas, assets, and buildings. PACS use technologies such as smart cards, biometric readers, and mobile devices to authenticate and grant access to authorized individuals. With the increasing use of mobile devices in PACS, it is essential to have up-to-date applications and operating systems, especially for Android devices.

Android is one of the most widely used mobile operating systems in the world, with more than 2.5 billion active users. With such a large user base, the platform provides an appealing target for those looking to infiltrate vulnerable systems through cyber-attacks. These vulnerabilities can be exploited by attackers to gain unauthorized access to a PACS, which can lead to severe security breaches. To mitigate these risks, it is essential to ensure that devices are running actively maintained operating systems, and that they are receiving patch updates on a regular basis.

The Importance of Android Security Patches

Security patches are released periodically by device vendors to address vulnerabilities and bugs that are found in the operating system. These patches are critical in ensuring the security of the Android operating system, and failure to install them can leave the device vulnerable to attack. For example, Android OS 7.1.2 and 8.0 have been in end-of-life status since 2019 and 2021 respectively. From the standpoint of cybersecurity, that is a very long time and each version has accumulated a large number of unpatched security bulletins that can provide a significant attack surface.

Unpatched vulnerabilities can create several problems for a device. First, attackers can exploit these vulnerabilities to gain unauthorized access and steal sensitive data from the device. Second, running outdated Android versions can make the device vulnerable to denial-of-service (DoS) attacks and ransomware. A DoS attack involves flooding the device with traffic to overwhelm the system and prevent legitimate users from accessing the system. Ransomware, on the other hand, selectively blocks access to critical functionality or information until the device owner has paid a ransom to the attacker. Either attack can be particularly problematic for PACS, which requires fast and reliable authentication processes.

Finally, patches can also improve the overall performance of the Android operating system. These updates often include bug fixes and stability improvements that can enhance the effectiveness of the device. This can be crucial for PACS, which requires fast and reliable authentication processes to ensure the security of the secured area.

Mechanically, attacks leveraging such vulnerabilities can take several forms. In the simplest cases, an attacker may be able to exfiltrate data from the PACS, compromising operational security and providing the attacker with valuable information on a facility. In the most complex cases, an attacker may attempt to fully take control of a device, actively making the device complicit in a broader cyber or physical attack on the organization. In the case of the Android 7.1.2 and 8.0 versions mentioned earlier, there are 8 and 38 (respectively) documented^[1] exploits that can be used for remote code execution – which is typically a precursor to the most sophisticated attacks.

Best Practices for Android Operating System Updates

To ensure the security of a PACS, it is essential to follow best practices for Android operating system updates. Here are some tips to help ensure that the device is up-to-date and secure:

– Ensure the Android devices used in your PACS are running supported versions of the operating system. As of today, currently supported versions are Android 11 and higher. If your device cannot be updated to a supported Android Operating System, it is recommended that you upgrade your equipment as soon as possible.

– Enable automatic updates: One of the easiest ways to ensure that the device is up to date is to enable automatic updates. This will allow the device to automatically download and install the latest security patches and updates as they become available. If this is done through your service provider, you should ask them what their policy is on updating your deployed equipment.

– Check for updates regularly: If automatic updates are not enabled, it is essential to check for updates regularly. This will ensure that the device is up to date with the latest security patches and updates.

The bottom line is: if you are using a PACS at your facility, it is imperative for security that you know what operating system is running on your equipment, and what the patching/updating policy is for those devices. Collaborate with your IT staff, reach out to your contracted service providers and do not overlook the importance of keeping your security software and hardware up to date.

^[1] Based on MITRE CVE Database; https://cve.mitre.org/

Remember the old TV ads where a fast talking salesman demonstrated the amazing features of various household gadgets? While the quality of those products was always a bit doubtful, you could count on getting various bonus products if you “act now and call the number on your screen!”

Here at Seebald & Associates, we take pride in providing world class expertise in helping facilities and vessels meet their Coast Guard security requirements under the Maritime Transportation and Security Act. And while those at Seebald & Associates have been known to talk at length, this is no late-night TV scam. You can trust all of us here at Seebald & Associates to provide top service in a wide range of areas of interest to marine transportation and critical infrastructure.

Did you know that Seebald & Associates can help your organization with other Coast Guard requirements? Need to update your Operations Manual or your Facility Response Plan? We’ve got you covered. Concerned about an upcoming safety inspection for your liquified or hazardous gas facility – we have experts to help you prepare.

And yes, our expertise extends to other DHS security programs. Many U.S. Coast Guard regulated facilities also participate in Customs and Border Protection’s Customs Trade Partnership Against Terrorism (CTPAT), which is focused on supply chain security. This is a voluntary program, but meeting its standards has many benefits, and it aligns well with MTSA requirements. Let us know how we can help!

And for non-transportation related facilities that handle, use, or store certain “chemicals of interest”, we can help ensure compliance with CISA’s Chemical Facility Anti Terrorism Standards (CFATS), which helps keep our nation safe from malicious actors who might find ways to release, sabotage, or steal dangerous chemicals.

Like the old TV commercials, all can say is “but wait, there’s more!”. Call now, operators are standing by. Or to bring this into the 21^st century, go to the “Services” tab on our website and click on the link for the full list or download the Products & Services Document.

On the final day of our 2023 Security Symposium, Captain Andy Meyers, CG-FAC, served as our morning keynote speaker. Captain Meyers is the program manager at Coast Guard Headquarters for the Coast Guard’s facility inspection program, including safety, security, and environmental standards.

Captain Meyers addressed several important security topics, including cyber, TWIC, and the growing use of drones in and around waterfront facilities. Captain Meyers also discussed recovery and resilience, and the growing use of novel fuels in the maritime industry, such as hydrogen and ammonia. Facilities that may be adding these fuels to their inventory should certainly consider the safety, security, and emergency response risks they may bring.

Sergeant Jay Santalucia, of the Broward County Sherriff department was our second speaker. With 35 years of law enforcement experience, he gave us a frank and engaging presentation on active shooter incidents. A few takeaways: develop a warrior mindset, consider “stop the bleed” training, https://www.stopthebleed.org/training/, and work with your local law enforcement agencies before an incident to build relationships and understand how to report and respond to an active shooter incident, including how to behave once law enforcement arrives.

After lunch Eric Linden, Integritas Security Service Inc., showed us how they train and use canines for explosives and narcotics. It was clear that the dogs are enthusiastic and very good at their jobs and could be an effective security tool in many scenarios.

Lastly, Ian Wristbridge, MAGNAR LLC, gave us an education on the value of access control technologies, including the social and economic factors that can make it effective. We know that access control is the most common violation issued by the Coast Guard, so clearly, we have some work to do in this critical area.

After the Symposium concluded, Mark Dubina, Vice President and Security Chief for Port Tampa Bay hosted a cruise through the Port. It was a delightful end to a great week. Thank you Mark and thanks to all our FSOs, participants, and partners who made the Symposium a tremendous success!

On Wednesday morning the FSO course finished when the students made their presentations and took the final exam. The good news is that everyone passed, and the better news is that our nation and marine transportation system is now stronger by 34 fully qualified Facility Security Officers!

In the afternoon the symposium kicked off with opening remarks from Captain Michael P. Kahle, Commander of Sector St. Petersburg and Captain of the Port here in Tampa. He emphasized the importance of supply chains and the need for the Coast Guard, other agencies, and the many private sector companies to cooperate in preparing for contingencies and building resilience.

After Captain Kahle’s remarks, our own John Felker chaired a cybersecurity panel discussion with three experts from the Coast Guard: LCDR Matt Whitney from Coast Guard Headquarters, Mr. Nick Parham from Coast Guard Atlantic Area, and Mr. Carl Hatfield from Coast Guard District Eight. These three individuals have tremendous technical expertise, but they helped us all understand cyber risks in simple terms.

They also discussed some emerging policies and described the Coast Guard’s “Cyber Protection Teams”, which are available, free of charge, to help MTSA facilities with cybersecurity challenges. These teams are NOT part of the Coast Guard’s regulatory program, so you can take advantage of their services without the risk of a fine or requirement. Contact any S&A member for more information or contact them directly at maritimecyber@uscg.mil.

Jorge Torres, Port Tampa Bay FSO, receives S&A Maritime Excellence award

Spencer Byrum, CEO of HRS Consulting, introduced us to the concept of High Reliability Organizations, situational awareness, and not driving your ship straight into the lighthouse. Many of us have operational environments that are “volatile, uncertain, complex, and ambiguous”, but we can learn to recognize red flags and take action to address these complex risks.

Dr. Will Wilkins, Executive Director, Global Security & Construction Management for Valero made a captivating presentation on preparing and responding to protest activities. Have a clear-eyed discussion with both your security personnel, and your senior management, about how to respond to these types of events BEFORE they happen to you.

After the presentations we all attended an informal reception where we were delighted to present Jorge Torres, of the Port of Tampa Bay, with our Maritime Excellence Award.

The start of day three for the Facility Security Officer (FSO) Course and the day prior, the one day FSO Refresher Course wrapped up with 21 “old hands” sharing years of experience and wealth of knowledge. These were all seasoned FSOs, many of them senior managers at their organizations, taking the time to refresh their knowledge about Coast Guard requirements and emerging threats.

While all Seebald & Associates courses benefit from student discussions, the refresher course typically has at least as many “sea stories” and examples from the students as formal lecture from Captain Brian Kelley, the lead instructor. Discussions about everything from the use of shotguns to remove rust and slag from ships (no kidding, you had to be there), to how to best support security guards quickly dominated the course. Had we not had to break from lunch Master Instructor Captain Brian Kelley might never have had the chance to return to his course plan.

TWIC was the first topic in the afternoon, which included some interesting stories about forgeries. Many of us have seen guards fooled by fairly simple fakes, like those made on a copy machine and hotel rewards cards. Good training can catch these fakes, but professional forgeries are all too easy to find these days. Fortunately electronic TWIC readers, which a majority of our students are using, can catch these threats.

Another key topic was Facility Security Assessment (FSA) procedures. The FSA is the foundation of your Facility Security Plan, and if done correctly, will help you identify the security procedures at all MARSEC levels that will reduce your operational risk, meet the regulations, and align with your business practices. At Seebald and Associates we take pride in our FSA process, which always includes a risk-based-analysis of threats, vulnerabilities, and consequences.

Speaking of FSAs, we also discussed the latest Coast Guard policy guidance on incorporating cybersecurity into the FSA, which was released just weeks earlier. Seebald & Associates is already incorporating this policy into our procedures.

Wednesday closes out the FSO course, with 34 graduates joining the 21 Refresher FSO students as we transition to the Symposium, with special guest speakers and panel discussions on cybersecurity, high reliability and situational awareness and ending the day with Dr. Watkins, Valero Executive Director for Global Securities will discuss the response and lessons learned from the recent protests on Valero facilities in the United Kingdom and Valero’s planning against this threat against their facilities in the U.S.

On January 23, 2023, the United States Coast Guard released new guidance on cybersecurity for port facilities regulated by the Maritime Transportation Security Act and 33 CFR Part 105.

The “Maritime Cybersecurity Assessment and Annex Guide (MCAAG)” helps facility operators with the cybersecurity aspects of a Facility Security Assessment (FSA) and provides a template for incorporating the results of that process into a Cybersecurity Annex to a Facility Security Plan (FSP).

Before getting into the details of this new guidance, let’s first clarify that this does NOT impact facilities that already have approved Cybersecurity Annexes. Those facility operators are NOT required to resubmit new Annexes based on this guidance. However, this guidance will clearly be an appropriate tool for when existing FSPs come up for their normal, five-year renewal.

Here at Seebald & Associates, our experts have taken a preliminary look at this guidance and we think it will be a useful tool in helping facilities identify and manage their cyber risks. Here are a few key points:

· The guidance begins with terms, definitions, examples, and a discussion of how various Information Technology (IT) and Operational Technology (OT) systems are often connected. This reflects sound cybersecurity principles and helps us all recognize that a vulnerability in one part of a network can have consequences elsewhere.

· The guidance recommends that facility operators identify a “Cybersecurity Officer (CySO) to work with the FSO on cybersecurity matters.

· The guidance includes a step-by-step process for facility operators to identify cyber vulnerabilities in an FSA, determine mitigation strategies, and document the results in a Cybersecurity Annex of an FSP.

· The guidance uses the NIST Framework functions (Identify, Protect, Detect, Respond, Recover), and select categories and subcategories as baseline or additional measures, based on the organization’s risk tolerance.

At Seebald & Associates, we are in regular contact with U.S. Coast Guard cybersecurity personnel, both at the Headquarters and local Captain of the Port level. We will keep all our clients informed as we all learn more about how to how the Coast Guard expects us to apply this guidance. In the meantime we look forward to working with all of you to improve your security programs.

It’s football season, and I hope you all will help Ed by cheering on the Buffalo Bills, who will doubtless go to the Superbowl this year. Just ask him!

In between games, give some thought to cybersecurity, where the goalposts always seem to be moving. Most of us can find the combination of ever evolving threats and countless new standards to be overwhelming.

Here at Seebald & Associates, we keep in close contact with cybersecurity experts at the U.S. Coast Guard, and at the Cybersecurity and Infrastructure Security Agency (CISA), to provide you with the best, most credible advice on how to manage your cybersecurity risks while meeting Coast Guard requirements.

CISA recently published “Cross-Sector Cybersecurity Performance Goals”. This document, which is written in plain language, is a set of voluntary core cybersecurity practices. It is intended to reduce risk for both individual organizations and our nation’s critical infrastructure. You can access the document at https://www.cisa.gov/cpg.

The U.S. Coast Guard is encouraging vessel and facility operators to consider these performance goals. You can read the Coast Guard’s information on this topic at https://mariners.coastguard.blog/2022/11/08/cisa-releases-cross-sector-cybersecurity-performance-goals/.

According to CISA, these performance goals can help address the concerns of small and medium sized businesses who struggle to know where to focus and invest their scarce cybersecurity resources. Our cybersecurity experts at S&A agree that this is a valuable addition to the best practices developed by CISA, and jointly promulgated with the Coast Guard.

Cybersecurity really does have moving goalposts. But to make that touchdown every time for our clients, Seebald & Associates constantly updates our training aids, audit checklists, and Facility Security Assessment processes to reflect current standards and best practices. The audit we provide next year will be different from this year’s, especially in cyber. This is how we ensure that your security programs provide meaningful security that reduces compliance, operational, and reputational risk.

For all the latest in cyber and other security issues, be sure to attend our upcoming Security Symposium, 30 January – 2 February 2023 in Tampa, FL. We’ll have an impressive list of senior Coast Guard and industry experts who will address cybersecurity, TWIC, preparing for protest activity, security guard management, and more. To register and for more information, go to at https://fsosymposium.com/.

Further Delay to the TWIC Reader Rule

Below is the excerpt from the Office of Information and Regulatory Affairs outlining the Coast Guard’s intentions with a further delay for the TWIC reader rule to May 8, 2026.

On August 23, 2016, the Coast Guard issued a final rule, requiring owners and operators of certain vessels and facilities regulated by the Coast Guard to conduct electronic inspections of Transportation Worker Identification Credentials (TWICs) as an access control measure (81 FR 57651). On March 9, 2020, Coast Guard published a final rule, delaying the effective date of the 2016 TWIC reader rule for three categories of facilities (85 FR 13493). This rulemaking would further delay portions of the August 2016 final rule. The Coast Guard would delay the effective date for the three categories of facilities by at least an additional 3 years (until May 8, 2026) or later depending on the outcome of the Homeland Security Operational Analysis Center (HSOAC) study and consideration of public comments. The study is estimated to be completed no earlier than June 2022.

The three facility categories that would be delayed are:

1. Facilities that handle certain dangerous cargoes in bulk, but do not transfer those cargoes to or from a vessel
2. Facilities that handle certain dangerous cargoes in bulk, and do transfer those cargoes to or from a vessel
3. Facilities that receive vessels carrying certain dangerous cargoes in bulk, but do not, during that vessel to facility interface, transfer those bulk cargoes to or from said vessels

You can read the entire rule intentions at: View Rule (reginfo.gov)