CISA still waiting for Colonial Pipeline to share key data about hack

Colonial Pipeline still has not shared important technical information with DHS' cyber agency about the ransomware attack that has crippled its fuel supply operations since last weekend, the agency's acting director told lawmakers Tuesday.

“Right now, we are waiting for additional technical information on exactly what happened at Colonial so that we can use that information to … protect other potential victims down the road,” acting Cybersecurity and Infrastructure Security Agency Director Brandon Wales told the Senate Homeland Security Committee.

Still early: It’s not surprising that Colonial has yet to provide CISA with detailed technical data, said Wales, whose agency typically must rely on voluntary cooperation from victims of cyberattacks, most of which do not face regulatory requirements to share breach information with the government.

“They've only been working on the incident response since over the weekend, and it's fairly early,” he told senators during a hearing focused on federal cybersecurity.

“We have had, historically, a good relationship with both Colonial as well as the cybersecurity firms that are working on their behalf,” Wales said. “We do expect information to come from [the ongoing incident response], and when we have it, we will use it to help improve cybersecurity more broadly.”

Not ideal: Colonial didn’t even contact CISA after discovering the hack, Wales said. Instead, the company contacted the FBI, which then brought in CISA.

Asked if he thought Colonial would ever have contacted CISA if the FBI hadn’t facilitated the connection, Wales said no.

CISA officials have repeatedly said that one of their top priorities is raising awareness of their agency’s work among critical infrastructure operators, many of which still do not know why it is important to contact the agency or how it can help them after a breach.