US to Set New Pipeline Rules to Protect Against Cyberattacks

（单词翻译）

The United States plans to launch new rules designed to protect pipeline¹ companies against increasing cyberattacks.

The action follows a cyberattack earlier this month that shut down a major U.S. fuel pipeline. The outage, involving a 9,000 kilometer pipeline system, led to temporary fuel shortages in some places in the eastern United States.

U.S. officials say new cybersecurity regulations are expected to be issued this week by the Transportation Security Administration (TSA). The TSA oversees² the nation's network of pipelines³.

The Department of Homeland Security (DHS) said Tuesday that TSA officials had already begun working with private pipeline companies on ways to identify and prevent cyberattacks.

One of the new regulations will require the companies to report cyber threats to the federal government, one official told The Associated Press. Another rule is expected to require pipeline operators to complete a self-examination of their systems for possible vulnerabilities to cyberattacks.

Mark Montgomery is with the Foundation for the Defense⁴ of Democracies. He is also the former director of the congressionally supported Cyberspace⁵ Solarium Commission.

Montgomery told the AP he sees the expected requirements as "a good step" forward in the fight against cyberattacks. He added that such regulations need to be put in place for non-pipeline companies as well, "so that all our national critical infrastructure⁶ is at a higher level."

At a news conference this week, DHS Secretary Alejandro Mayorkas spoke⁷ about the ransomware attack that shut down the Colonial Pipeline. He said that kind of attack "is one of the greatest cybersecurity threats that we face in the United States."

In a ransomware attack, online attackers infect the computer systems of organizations and hijack⁹ data in a way that leaves it unreadable. The attacker then demands payment in exchange for returning the data to a usable state.

Colonial Pipeline in Georgia said it had paid a ransom⁸ of $4.4 million to regain¹⁰ control of its data from the cybercriminals. The Federal Bureau of Investigation¹¹ has linked the attack to a Russian-speaking criminal group known as DarkSide.

Suzanne Spaulding is a cybersecurity expert with the Center for Strategic and International Studies based in Washington, D.C. She said many companies are still not taking steps to protect themselves.

"There are two kinds of companies in the world, those who have been hacked¹³ and those who haven't detected it yet," she told the French press agency AFP.

Spaulding noted¹⁴ one problem is that many countries cannot produce enough computer workers who are trained to deal with serious cyber threats. This shortage drives up pay rates, making it difficult for many organizations to employ quality workers with the right skills.

Private cybersecurity companies have been helpful to organizations facing threats and can also help prevent new attacks. But a new report suggests that publicizing anti-ransomware measures can also help cybercriminals.

The report was published jointly¹⁶ by MIT Technology Review and ProPublica. It details how Romanian cybersecurity company BitDefender announced in January it had found a fix to help companies avoid ransomware attacks by the DarkSide group.

BitDefender said it had discovered a flaw in the ransomware that DarkSide had been using to freeze computer networks of American and European businesses.

But by bringing attention to its fix, BitDefender also let DarkSide know about the flaw, which it was able to quickly repair. The next day, DarkSide declared: "Special thanks to BitDefender for helping¹⁷ fix our issues. This will make us even better."

The fix was quickly confirmed when DarkSide carried out a series of new attacks, including the hijack of Colonial Pipeline's data.

The joint¹⁵ report notes that two other cybersecurity experts had also discovered BitDefender's flaw a month before BitDefender. But those researchers did not publicly announce their finding. Instead, they began secretly reaching out to possible victims to offer help.

Words in This Story

regulation – n. an official rule that controls how something is done

vulnerable – adj. able to be easily hurt, influenced or attacked

infrastructure – n. the basic equipment and structures (such as roads and bridges) that are needed for a country or region

hack¹² – n. to use a computer to illegally get into someone else's computer system to read the information that is kept there

detect – v. to discover or notice something

flaw – n. a mistake or defect