Yesterday, CISA sent out an email to registered recipient (register here) on the latest version of the Chemical Security Quarterly. These periodic (mostly quarterly) updates look at chemical security issues including, the CFATS and ChemLock programs, as well as cybersecurity issues related to the same. The CFATS Knowledge Center used to post these CSQs, but stopped in 2021. Hopefully the new web site organization will include returning to the practice of publicly posting them.
Included in this issue are discussions about:
CISA Chemical Security Conducts 10,000th Compliance Inspection,
End of Windows 8.1 Support,
2023 Cyber Hygiene Reminders and Best Practices,
1993 Bombing of the World Trade Center Commemoration Presentation,
Updated CISA.gov Website,
ChemLock Service Spotlight: Assessments,
Upcoming ChemLock Trainings,
CFATS Program Statistics, and
Chemical Security Resources
Cyber Hygiene
While entire books are written about cyber hygiene, the CSQ addresses the issue in about a dozen paragraphs. The discussion does include links to additional resources. Four broad topics are addressed:
Use strong passwords and multi-factor authentication (MFA),
Train your employees on cybersecurity,
Ensure all software and hardware systems helping run your facility are patched and up to date, and
Review your organization’s security documentation and examine annual priorities.
One interesting link provided in this section of the CSQ is for the CISA Services Catalog. This second edition of the catalog was published in 2021. It is mostly not affected by the change in the CISA web site because it provides email addresses to request information instead of providing web site links.
CISA.Gov Website
I have been discussing the revised CISA.gov web site (here and here), but have yet to start my look at its effect on the CFATS and ChemLock programs. The discussion in the CSQ does not really do that either. What it does do, is to provide a look at the purpose and scope of the changes. It does note that:
“Importantly, the new website also reflects our One CISA philosophy. For example, CISA.gov now includes all the information from the former US-CERT website. All that operational content—the alerts and advisories—is still there, now consolidated so you can find it more quickly. Resources and tools are no longer separated by program, but are now listed in a filterable system on our Resources & Tools page, making it easier to find exactly what you need with just a few simple clicks.”
The discussion does include links to four new chemical security related landing pages: