Chemical Engineering June 2022 - 36

FIGURE 4. It is vital for companies to regularly train employees on cybersecurity and phishing issues
has served as a model for other jurisdictions
developing robust dataprotection
requirements.
The ounce of prevention
Given the heightened risk of cyber
incidents in the chemical sector,
owners and operators should undertake
specific steps to protect themselves
from cyber vulnerabilities to
help mitigate damage to systems
and data should they fall victim to
an attack.
Adopt a " zero trust " model. A
zero trust approach is based on the
premise that no source should be
trusted, and cybersecurity teams
need to assume that attackers are
always present inside and outside
of their networks. This drives
the
that no communication
or activity should be allowed until
it is first properly authenticated
and authorized.
Zero trust also includes a focus
idea
on the micro-segmentation of networks,
which unlike traditional network
segregation that controls traffic
into and out of a data center, is
concerned with segmenting traffic
moving between applications and
processes. This may include separation
of operational systems and
data
systems
(for
instance,
the
segregation of OT and critical processes
from other business systems)
and blackening certain infrastructure
with deny-all firewalls and
by providing no public IP addresses
or open ports.
Foundational controls. Companies
should have several foundational
controls, including the following:
* Patching with automatic updates
* Encryption of sensitive data
* Offsite backups
* Multi-factor authentication (MFA)
36
* Malware protection
* An up-to-date anti-virus system
* A reputable firewall configured to
block malicious IP addresses
* Application whitelisting
* Asset inventory
These types of controls allow
companies better visibility into
systems and networks, potential
threats and related risk exposure
and to identify where vulnerabilities
might exist.
Monitor and detect. In addition to
controls, companies should have
detection capability and security
operations to monitor the controls
put
into
and at the same time, the attacks
are becoming more sophisticated.
Regulators are also extremely focused
on improving security in the
CPI and updating guidelines - the
sector must dedicate resources to
track and implement these directives.
All this is happening in a time
when the CPI continues to automate
and develop technologies that
are more connected and pose more
risk. Companies must update their
strategies for preventing attacks -
that way, if they do fall victim (and
unfortunately it is often a question of
when, not if) - they are better prepared
to mitigate the damage and
resume normal operation quickly. ■
Edited by Mary Page Bailey
References
1. U.S. Government Accountability Office (GAO), Actions Needed to
Enhance DHS Oversight of Cybersecurity at High-Risk Chemical
Facilities, GAO-20-453, May 2020.
2. Norsk Hydro, Updates on cyber attack, Press releases dated
March 19-April 5, 2019 .
3. Bailey, M. P., Hexion and Momentive respond to cyberattacks,
Chem. Eng., March 25, 2019.
4. Bomgardner, M. M., Siegfried, Brenntag, and Symrise hit by
cyberattacks, Chemical & Engineering News, May 27, 2021.
place. Companies must
consistently review and appropriately
respond to events within the
network. Companies should perform
regular vulnerability scans and
should consider implementing an
endpoint detection and response
(EDR) solution.
Inform and respond. Companies
should regularly provide cybersecurity
and phishing training and
exercises for all members of their
organization (Figure 4). Companies
should also have a robust incidentresponse
and business-continuity
plan, and regularly test both. Finally,
chemical engineers and plant operators
need to work closely and
communicate regularly with the organization's
technology and security
teams, as the plant engineers may
not understand technical or security
issues and the IT or security teams
may not understand the OT in
the plant.
Key takeaways
Cybersecurity must be a key focus
and an identified enterprise risk. The
number of attacks continues to rise,
5. 117th U.S. Congress, Public Law 117-58, Infrastructure Investment
and Jobs Act, November 15, 2021.
6.117th U.S. Congress, H.R.2471, Consolidated Appropriations Act,
March 15, 2022.
7. Cybersecurity and Infrastructure Security Agency (CISA), Cybersecurity
Directives, www.cisa.gov/directives.
8. Lozowski, D., CFATS and Chemical Plant Security, Chem. Eng.,
Sept. 2009.
9. NIST Cybersecurity Framework, www.nit.gov/cyberframework.
10. Cosman, E. C., Industrial Control Systems Security: The OwnerOperator's
Challenge, Chem. Eng., June 2014.
Authors
Matthew R. Baker (Email:
matthew.baker@bakerbotts.com)
is a partner at Baker Botts in San
Francisco. His practice focuses on
white collar defense, crisis management
and internal
investigations
for a broad range of industries,
with an emphasis on the
energy and chemical sector. He is
also well-versed in complex electronic
discovery and information governance issues, as
well as domestic and international data privacy and information
security practices.
Rachel
Ehlers (Email:
rachel.
ehlers@bakerbotts.com) is a special
counsel at Baker Botts in Austin,
Tex. Her practice focuses on
technology transactions, data privacy
and cybersecurity. She has
extensive experience advising clients
on data incidents and breach
response, cross-border transfers,
and data privacy and cybersecurity
issues related to mergers and acquisitions.
CHEMICAL ENGINEERING WWW.CHEMENGONLINE.COM
JUNE 2022

http://www.cisa.gov/directives https://www.nist.gov/cyberframework http://WWW.CHEMENGONLINE.COM

Chemical Engineering June 2022

Table of Contents for the Digital Edition of Chemical Engineering June 2022