Hacker News Reader

Comment by Animats | Hacker News Reader

It's disappointing, and too broad. A more useful plan might have things like this:

* Identify risks that can kill people. Strongly isolate systems where risk exists. Assume a hostile capability at the StuxNet level.

* Beef up black start capability for energy grids, so that in the event of a major failure, power is 90% back up in an hour. Test this annually.

* Stock up on long lead time items, especially HV grid transformers.

* Systems which handle other people's money must have continuous backups to write-once media and be able to 99% recover from a total loss of online data within 24 hours.

* Telecommunications systems must be capable of a cold restart from a known good state for 90% of users within one hour, 99% within 24 hours.

View on HN

I don't think CISA has anything close to the powers required to compel that level of top down action. This strategic plan has clearly been crafted to be at least somewhat attainable given their current remit and capabilities.

Indeed. They’re a security awareness arm of DHS. Frameworks, photo ops, pdf flyers. No teeth.

I mean, if you think of the federal government as a gigantic conglomerate enterprise network, and then read the "Measures of Effectiveness" in this plan as the current action items for the security practice in that enterprise, it's a pretty sane list, more forward thinking than e.g. most bank security teams.

> gigantic conglomerate enterprise network

It's a conglomerate that operates in every field of endeavor imaginable. One 'division' may be the world's largest 'conglomerate' itself: It employs over 1M people, has endless internal divisions, has global 24/7 operations, and an ~ $800B budget. With that budget, I would guess that their assets are worth more than Apple's market cap.

There's not a single CIO who can dicate 'we're blocking Facebook - get to work people!'.

I understand where you're coming from but "more forward thinking than a bank" should not be the aspiration for the organization primarily responsible for cybersecurity of the United States gov. This is not a good look for CISA.

You're going to have to be more specific than "this is not a good look". It looks pretty reasonable to me, given CISA's remit. Which part do you have a problem with, the limited role CISA has to motivate and guide security adoption inside government agencies, or the specific recommendations and metrics they're managing?

This "strategic plan" is devoid of any meaningful, measurable metric. The language throughout this document is carefully crafted to appear measurable at the surface, but meticulously written to be able to accomplish one thing after X number of years: stand infront of a podium and declare that the metric has been achieved.

Example: "Help organizations safely use AI to advance cybersecurity."

How do you measure this? What does this even mean? What does success look like if this is achieved?

I extracted all the metrics from the document and put them in a comment downthread. They look pretty reasonable to me. I'm sure every security team in America has some dumb metric about AI somewhere, but AI stuff is like 5% of the whole plan.

I think you're missing the point of my comment - the point is not that there is a meaningless metric about AI, the point is that it is -not a measurable metric- by any stretch of the imagination.

You'd be surprised. Any organization regulated by federal government entities, such as banks via the OCC, FDIC, etc are being required to "meet" CISA guidelines. ESPECIALLY those with federal/military contracts.

CISA has a lot more sway than you'd think in how businesses operate from a security point of view.

Being this broad allows for some more latitude by the businesses / sectors following these guidelines. But they certainly could've been more thorough in their approach without much push back.

As someone who is involved in compliance in these industries, I would be surprised to see CISA having anything close to the impact you described.

All I see are watered down checklists that can be verified by any human being who is semi-literate and may or may not have any relevance to security best practices. They probably were influenced on some level by CISA guidance if you're talking about .gov or commercial entities, but is nowhere near the level of impact you mentioned.

Do you have any examples of CISA guidelines having a meaningful impact on business operations?

> Stock up on long lead time items, especially HV grid transformers.

Even better would be to onshore production of such items with bonuses for demonstrating ability to rapidly scale manufacturing.

>Beef up black start capability for energy grids, so that in the event of a major failure, power is 90% back up in an hour. Test this annually.

From the hypothetical scenarios detailed after the Texas winter shutdown a few years ago, this rule sounds unhinged from reality without mucho mucho dollars. Up to an including spare power plant(s) "just in case" a black start would be required.

I could believe it takes multiple hours just to fully start a single coal plant. Let alone align the frequencies across multiple stations in the grid.

I imagine in most black start scenarios the coal plant would already be warm. If black start takes a day and the coal plant cannot operate without external power then maybe not so much. I don't think you need spare power plants so much as backup generators that can provide internal power to start a black start capable power plant up. If you do not have enough black start capable power plants that is not a good thing of course.

But it's not just that: to black start the grid you have to shed load - that is, you need to trip all the breakers along the grid, and then very carefully restore loads to avoid knocking yourself offline again.

You just plain aren't going to do that in an hour when you're offline because someone trashed your automated systems - resetting and restoring the grid would require people on site, in communication. That's not happening in an hour without staggering expense.

I think all recent wars have demonstrated including the Ukraine war, that there are enough guided missiles to take out all power generating facilities, if you wanted to reap havoc on a country.

So at the top, all the leaders are just trolling the populace.

There's an industry group working on this.[1] They're worried.

One big concern that hasn't been well addressed is the interaction between natural gas infrastructure and electrical power generation. The 2021 Texas outage made this clear. "Five times more natural gas than wind power had been lost. When power was cut, it disabled some compressors that push gas through pipelines, knocking out further gas plants due to lack of supply."[2] If more of the Texas grid had gone down (it was close), it would have taken far longer to restart. Especially with frozen water in the pipelines. Nuclear, coal, hydro, solar, and wind plants have their own local fuel supply, but natural gas plants usually do not. The pipeline system and compressors need to be brought up first. This is especially a concern after the 2021 pipeline ransomware attack.[3]

PJM's internal 2019 study has concerns about this.[4]

[1] https://protectourpower.org

[2] https://en.wikipedia.org/wiki/2021_Texas_power_crisis

[3] https://en.wikipedia.org/wiki/Colonial_Pipeline_ransomware_a...

[4] https://www.pjm.com/-/media/committees-groups/committees/oc/...

> When power was cut, it disabled some compressors that push gas through pipelines

Every Factorio player knows you never power your generator pumps with the primary power source

I agree. Most of the 30ish page document is completely open for interpretation, or misinterpretation. It would be much better to focus on the capabilities and outcomes.

> * Systems which handle other people's money must have continuous backups to write-once media and be able to 99% recover from a total loss of online data within 24 hours.

This is mostly in place, and has been for a while. Not so much “people’s” money, more for the banks money, which is where the systemic risk resides.

Can I vote for you? I would feel so much better if I heard anyone in government talk like this.

Oh, the fun idle musing of a non-security person. Its fun reading this list like watching Hollywood haxors attempt to hack something with some bizarre elaborate graphic user interface nobody would ever write.

> Identify risks that can kill people.

While we are imagining things people are more likely to die from excess sugar intake, alcohol, or driving on a freeway than in military combat or from some "hacker". Those are huge risks costing more lives than a holocaust and at much greater expense. We need to isolate these systems.

Talking about security with software developers who have never worked in security reminds of talking about performance. These things are like opinions. Everybody has opinions and most people become emotionally invested in their opinions as though their Monopoly money were something other than artificial. Usually though there is no actual investment of time, money, or professional experience in any of this. An outside observer might refer to this by colorful language.

If you want your opinions on security (or performance) to be more than bullshit... write some software to solve for some part of this.

nice list!!

Small addition:

Systems which handle other people's money... ==> Systems which track other people's money or possessions exceeding $x in value individually or $y in total...

(e.g. real estate, insurance policies, ...)

And then your State-like adversary also gets hold of that information and you're now less secure before you had had access to it.

On a more general note, the same thing goes for a lot of centralisation efforts backed by technology ("Digitalisation", as it is called here in the EU), it's akin to building highways pointing straight from the border to your country's capital city and to your vital industries, all this while your very dangerous neighbour has a big tank army. Of course, tech-focused agencies like the CISA will never go against the process of digitalisation per se.

there’s very few industries in the world, if any, regulated this closely

Reply on news.ycombinator.com