Chemical Engineering June 2022 - 34

FIGURE 3. CFATS provides security guidance for high-risk facilities, which are designated based on the
presence of so-called chemicals of interest, which include toxic, flammable or explosive materials
Norsk Hydro, was forced to shut
down plants and switch to manual
production after key systems were
encrypted and inaccessible. Around
the same time, U.S.-based chemical
companies Momentive and Hexion
announced they had also become
victims of a cyberattack. The same
encryption program is believed to
be behind all three attacks, but investigators
could not determine how
the malware was introduced into the
systems. Experts believe the three
attacks were financially motivated.
Finally, in 2021, three other chemimanufacturers
- Siegfried,
cal
Brenntag and Symrise - were victims
of cyberattacks. Swiss drug ingredient
manufacturer Siegfried experienced
a malware attack that shut
down production at multiple sites
and cut off network connections [4].
Siegfried was involved in the packaging
of the Pfizer COVID-19 vaccine at
the time of the attack. Later in 2021,
chemical distributor, Brenntag, was a
victim of the same ransomware variant
used in the Colonial Pipeline attack.
Brenntag reportedly paid $4.4
million to the threat actors to recover
potentially impacted data, including
intellectual property, project data,
financial information and employee
data. Symrise was also the victim of
a ransomware attack. The company
reportedly did not pay the ransom
but, according to the company's
CEO, the resulting delays in produc34
tion
and logistics directly related to
the cyber event caused the company
to fall short of its sales targets.
Industry laws and standards
The chemicals sector is not without
its guardrails. In addition to the
CFATS, there are frameworks that
support proper risk profiling and
cyber preparation for the sector, as
well as regulate the protection of
personal information (for instance,
customer or employee personal
information).
Additionally, new directives are
expected for the chemicals sector
through the Infrastructure Investment
and Jobs Act, which was signed into
law in November 2021 [5].
On March 15, 2022, President
Biden signed into law the Cyber Incident
Reporting for Critical Infrastructure
Act of 2022 [6]. It requires entities
in critical infrastructure, which
includes the chemicals sector, that
experience a covered cyber incident
to report the incident to the Cybersecurity
and Infrastructure Security
Agency (CISA), part of the Department
of Homeland Security (DHS;
Washington, D.C.; www.dhs.gov),
within 72 h after the entity reasonably
believes the incident occurred.
Additionally, in the event a covered
entity makes any ransom payment,
the entity must report the payment
to CISA within 24 h.
The new reporting requirements
will not go into effect immediately.
Instead, a proposed rule is to be issued
by March 15, 2024, and then
the Director of CISA is required to
issue the final rule within 18 months
of the issuance of the proposed rule.
The proposed rule should include
definitions of covered entities and
covered cyber incidents. The new
law also includes the creation of a
Cyber Incident Reporting Council,
aimed to increase cooperation and
responsiveness of federal agencies
to cyber attacks impacting
critical infrastructure.
Additionally, CISA recently announced
its focus on the chemicals
sector, and that it also will continue
to release new guidance directed at
critical infrastructure that aligns with
President Biden's cybersecurity executive
order [7].
CFATS. The approximately 3,300
CPI facilities identified as high-risk
because they possess certain quantities
of designated chemicals of interest
are covered under CFATS [8].
The CFATS are regulated under CISA
and are meant to ensure that security
measures are in place to reduce the
risk of hazardous chemicals being
weaponized. The CFATS regulations
apply across the chemicals sector,
including chemical plants, chemical
storage facilities and electrical generating
facilities. Facilities are required
to report to CISA within 60 days of
when they gain possession of one of
the more than 300 identified chemicals
of interest (Figure 3). CISA then
determines whether the facility is
high risk. High-risk facilities are then
required to develop and implement
a security plan that addresses the
CFATS requirements, which include
requirements for covered facilities
to establish protocols for identifying
and reporting significant cyber incidents
to appropriate facility personnel,
local law enforcement and CISA.
National Institute of Standards and
Technology (NIST) Framework.
The National Institute of Standards
and Technology (NIST; Gaithersburg,
Md.; www.nist.gov) cybersecurity
framework [9] has been adopted
by many CPI companies to create
cyber-risk management programs.
NIST establishes specific cyber
frameworks
for industrial
CHEMICAL ENGINEERING WWW.CHEMENGONLINE.COM
control
JUNE 2022

http://www.dhs.gov http://www.nist.gov http://WWW.CHEMENGONLINE.COM

Chemical Engineering June 2022

Table of Contents for the Digital Edition of Chemical Engineering June 2022