Thread by @JoeUchill

Any minute now, the House Homeland Security Committee will host a critical infrastructure cybersecurity hearing with Joseph Blount, president and CEO of Colonial Pipeline.

THREAD

Chair Bennie Thompson calls the system of (largely) voluntary cybersecurity guidelines in critical infrastructure into question.

Thompson: I hope colonial will use the recouped money to make necessary improvements in its cybersecurity.

Katko: "There's a valid question to why it took so long for TSA to finally leverage this authority."

TSA used emergency authority to issue its recent pipeline order. I'm not certain they can do that without an emergency.

Katko mentions the difficulty the international community has with Russia, believed to forgo investigating or extraditing cybercrime targeting foreign nations.

Katko:

Blount: "This attack forces us to make difficult decisions, choices in real-time that no company ever wants to face."

He thanks law enforcement, Justice, and his employees, and apologizes for the impact.

Blount: Paying ransom as quietly as possible was his call, which he says was for the good of the country.

Charles Carmakal from Mandiant is now issuing his opening statement.

Carmakal: "The majority of today's intrusions by financially motivated threat actors involve multifaceted extortion. Threat actors will apply immense pressure to coerce victims to pay substantial extortion demands often in the seven to eight-figure range."

Thompson asks Blount to clarify timeline.

Ransomware note showed up May 7. By 6 am, shutdown decision was made.

"Short time after" (still that morning) contacted mandiant. Contacted FBI same morning.

CISA contacted by noon.

Made decision to negotiate (and pay) the ransom that afternoon. Payment sometime on Saturday. Did not talk to FBI about paying the ransom.

Blount: "Your request today, putting an additional $2.2 million into hardening our systems further is not a difficult one to address and agree to."

$2.2 million is the amount recovered from the FBI. It represents 63.7 out of 75 bitcoin paid in ransom.

Carmakal: "There was a legacy VPN profile that was in place, that wasn't believed to be active. And that enabled an attacker to leverage both the user and the password to log in."

The password was not common, but was reused on other sites.

Worth noting on above $2.2 million.

https://twitter.com/JoeUchill/status/1402447137858899968

Katko: What are you doing now that you weren't before?

Blount's answer below, also says he can be more specific one on one.

Blount wants more information sharing from CISA.

Carmakal wants more information sharing in general.

Rep Jackson-Lee: "I would make the point, at this time in 2021, that because of this major crux of calamity that we face, that the private sector can no longer go it alone. It's a bluff. Do you agree with that, that the private sector can no longer go alone?"

Blount agrees as far as helping handle Russian harboring.

Blount says White House wasn't notified about ransom because they didn't ask.

Estimates Colonial notified FBI 48 hours after paying the ransom.

Carmakal can't identify which breach lead to password leak, but the password was in circulated password lists.

McCaul: "This is a fourth recent attack by either Russia - Russia as a nation-state or the Russian mafia."

It's not just four. Most ransomware isn't national news.

Given the affiliate model of Russian ransomware gangs, we don't know what country the hacker behind the actual breach is from.

McCaul touts his bill for mandatory incident reporting to CISA.

McCaul: We don't allow private companies to hack back, right? That's illegal. It would create a wild west scenario. But what is your opinion of the federal government, protecting itself and responding in kind to nation-state actors?

Carmakal: There are opportunities to be more aggressive

Blount: Did not consider insurance when deciding to pay ransom.

Blount won't commit to allowing CISA into systems because Mandiant, Dragos and Black Hills are already engaged.

"We have three sets of eyes already engaged."

Langevin asks why Mandiant was retained through outside counsel.

Blount doesn't know.

My understanding is actually pretty common. It protects the output as a legal product.

Blount says they are part of the Oil and Gas ISAC, which he didn't know off hand yesterday.

"We belong to a lot of organizations with a lot of different acronyms."

Blount says he meets with CIO daily for morning meetings.

Blount says concerns he "denied" TSA inspection are overblown - says it was more a matter of scheduling because they were moving to a new facility.

A TSA cyber audit is scheduled for July.

Blount corrects an earlier answer:
"We shared information with the FBI about the digital wallet on Sunday and discussed this ransom payment. On Wednesday, the Justice Department in its announcement a few days ago commended us for the quick communication with authorities."

Three Reps in a row have focused their questions on the TSA scheduling. Same answers each time.

As always, I'm using a hasty autotranscription program throughout my tweeting.

Typos will abound.

We have a mention of "Cyber 9/11" and a bonus "Cyber U.S.S. Cole."

Blount says Colonial uses outside auditors, and that that's a good practice.

He's right!

Carmakal, CTO of Mandiant, opts not to comment on sanctioning the Nord Stream Pipeline.

Blount says CEOs should be transparent on cyber incidents.

Blount notes that he was able to restore quickly because Colonial had working, quality backups.

It wasn't asked, but you may be wondering why someone would pay ransom if they had backups.

In fact, the law firm BakerHostetler says 20% of their clients who restore from backups also pay ransom.

Ransomware now involves several extortion vectors - it isn't just the encryption. Restoring from backup can be complicated if you don't already know when the initial attack took place. You could be restoring to a point hackers had access.

And, having said all that, Blount just explained that and more.

Blount on why Colonial paid the ransom, why that needs to be an option and why you'd do that even having backups.

Blount: Reaching out early, rather than keeping quiet, allowed Biden to relax trucking regulations faster.

Carmakal: What's happened the last few months, it's been happening the last several years.

The tone of this hearing has been fairly non-confrontational so far.

Several of the avenues that looked like they would veer into being contentious - particularly the TSA scheduling - were cut short with Blount's answers.

Rep. Clyde: "I've always believed the best defense is a good offense."

Asks if there's any evidence of state sponsorship.

(Carmakal says no)

fixing a gap in the tweets:

https://twitter.com/JoeUchill/status/1402687601153355776