Cybersecurity: A Growing ESG Concern

Oil and gas pipeline operators must report all cyberattacks to the federal government in the wake of the shutdown of the Colonial Pipeline from a ransomware attack earlier in May, the US Department of Homeland Security said May 27 in a new security directive.

The most devastating cyberattack on a US pipeline stopped the nation's primary artery for gasoline and refined products from delivering more than 100 million gal/d of fuels for nearly a week, triggering pricing spikes, panic-buying and regional shortages. Colonial stretches more than 5,500 miles from the Houston refining hub to New York Harbor, supplying about 45% of all the gasoline and diesel fuel consumed on the East Coast.

The decision to take the entire Colonial Pipeline Co. system offline following a cyberattack raises questions about whether the pipeline industry will be able to avoid disruptive whole-system shutdowns in the future.

Cybersecurity and information technology professionals warn that following industry best practices alone may not prevent cyberattacks from infecting the systems that control the nation's vast energy infrastructure. With legacy pipeline assets becoming more connected and ransomware on the rise, attacks that shut down physical infrastructure are becoming more commonplace, they said.

"Now we're seeing five to 10 a year. While that might not seem high, this is one of them, and you have an entire coast shut down for a pipeline," said Nicholas Friedman, national managing partner and governance, risk and compliance strategist at enterprise risk management firm Templar Shield Inc.

The event is one of the highest-profile cyberattacks on U.S. energy infrastructure to date. It brought to a halt a major artery that provides the East Coast with nearly half of its fuel and prompted the federal government to convene inter-agency meetings and take emergency measures. The impact on fuel prices and supplies continues to be in flux.

The shutdown of the 5,500-mile Colonial Pipeline Co. system following a cyberattack has revived calls for federal regulation of pipeline operators and reform at federal agencies.

As of May 11, Colonial was returning portions of the critical artery for East Coast gasoline and refined fuel supply to service. While government officials and industry analysts did not anticipate widespread supply disruptions, the high-profile event caused filling station shortages in the Southeast and raised concerns about the prospect of future pipeline shutdowns at a time of rising cyberattacks.

The cyberattack on Microsoft Corp.'s email server software has mushroomed into a global crisis that cybersecurity experts say will likely claim many more victims due to the sophisticated nature of the hack.

Vulnerabilities in Microsoft Exchange, the company's widely used email and calendaring software targeted at enterprise customers, allowed hackers to access emails from its servers and install additional malware to maintain access to the victims' environments.

Cyber attacks are on the rise, as are the financial losses that can follow in their wake.

Yet the cyber insurance market is underdeveloped, and cyber cover is often tacked onto existing liability or property insurance policies that were not originally intended to cover cyber risk. In some cases, the policies do not explicitly include or exclude cyber cover, thereby exposing the insurers to the risk of "silent cyber", or losses to settle unexpected cyber-related claims.

The cybersecurity attack on Colonial Pipeline, a main artery of US fuel supply, is spawning renewed calls for legislation to bolster defenses of US pipelines and the electric power grid, and, in some corners, calls for new government authority to hold companies accountable if they fail to act.

House Energy and Commerce Committee leaders on May 11 reintroduced bipartisan legislation aimed at strengthening the Department of Energy's ability to respond to physical and cybersecurity threats to the nation's pipelines and LNG facilities.

Committee Chairman Frank Pallone, Democrat-New Jersey and Ranking Member Cathy McMorris Rodgers, Republican-Washington, said their committee was the best equipped to lead bipartisan cybersecurity solutions, particularly for energy infrastructure and pipelines.

"The Colonial Pipeline cyberattack and the ripple effects being felt now across the country are sharp reminders of just how deeply we all rely upon our energy infrastructure every day, and just how crucial it is that we invest in modernizing and protecting it," they said in a joint statement. They urged that bipartisan solutions put forward by the committee be "enacted immediately."