Pipeline Hack: Biden Issues An Executive Order

President Biden has signed a new US Executive Order following the ransomware attack closed down the main US oils and gas pipeline supplying the East Coast which will alter how companies manage and report cyber security incidents. “Recent cybersecurity incidents such as SolarWinds, Microsoft Exchange, and the Colonial Pipeline incident are a sobering reminder that US public and private sector entities increasingly face sophisticated malicious cyber activity from both nation-state actors and cyber criminals,” the White House said in a statement.

Despite some reports that the operating company has paid an undisclosed ransom to regain control, the pipeline remains closed. 

This Order aims at strengthening US cyber security defenses, a move that follows a series of sweeping cyber attacks on private companies and federal government networks over the past year. “The United States faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector, the private sector, and ultimately the American people’s security and privacy.  The Federal Government must improve its efforts to identify, deter, protect against, detect, and respond to these actions and actors”, says the Executive Order for Improving the US Cyber Security. “We routinely install software with significant vulnerabilities to some of our most critical systems and infrastructure,...systems that are used to deliver our power and our water to help manage traffic,” a senior Biden administration official told the press. 

This Executive Order will change the way businesses communicate with the US government and the public about their cybersecurity position and also compels IT providers share information about network breaches with the government, even when they usually would not do so. It adds new standards for government purchases of federal software and IT services. 

The Biden administration hopes that the new federal requirements, will influence how IT providers make products and services available to the public. If these changes had been implemented earlier it seems likely they would have helped to prevent the SolarWinds attack that has affected multiple US government agencies.   “We use federal buying power to jumpstart the market for secure software,” said the official. 

The order also establishes a new incident review board, modeled after the National Transportation Safety Board, that will have a private sector co-chair to quickly review major cyber incidents and make recommendations on what to do about them. And it puts in place a standard playbook for responding to major cyber incidents. 

 Perhaps its most important feature, it will establish a new rating system to allow the public to judge the security of products and services that they’re buying, similar to the Department of Energy’s Energy Star rating system. That could affect the way consumers buy internet-enabled products and services. For instance, a shopper arbitrating between two baby monitors would be able to immediately see which one had the higher rating. 

The Biden Administration acknowledged that actions of the federal government alone in responding to cyber incidents are not enough, and called on private sector companies “to follow the Federal government’s lead and take ambitious measures to augment and align cybersecurity investments with the goal of minimising future incidents.”

This attack did not appear to involve the kind of highly sophisticated steps that Russia and China's state sponsored hackers are best known for.  Rather than directly try to take over the pipelines, the attackers went after what officials say was poorly protected corporate data, stealing it on such a large scale that it forced the company to close  the pipeline rather than risk the attack spreading further across the USA.

The White House:      DefenseOne:      CNBC:     Spectrum News:     New York Times:    Image: The White House

You Might Also Read:

Running Out Of Cyber Gas:

 

« Careers In Cloud Security
The European Union's Digital Security Plan »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Imperva

Imperva

Imperva is a leading provider of data and application security solutions including DDoS protection, Web application security, Data security and Cloud security.

Information Security Media Group (ISMG)

Information Security Media Group (ISMG)

Information Security Media Group is the world’s largest media organization devoted solely to information security and risk management.

Allen & Overy

Allen & Overy

Allen & Overy is an international law firm. Practice areas include Cybersecurity and Data Protection.

Zertificon Solutions

Zertificon Solutions

Zertificon is a leader in professional email encryption and data security.

HYAS Infosec

HYAS Infosec

HYAS is a highly skilled information security firm developing the next generation of information security technology.

Subgraph

Subgraph

Subgraph is an open source security company, committed to making secure and usable open source computing available to everyone.

Sqreen

Sqreen

Sqreen is a web application security monitoring and protection solution helping companies protect their apps and users from attacks.

Ukrainian Academy of Cyber Security (UACS)

Ukrainian Academy of Cyber Security (UACS)

UACS is a professional non-profit public organization established to promote the development of an extensive network and ecosystem of education and training in the field of cyber security.

Keeper Security

Keeper Security

Keeper is a leading enterprise password manager and cybersecurity platform for preventing password-related data breaches and cyberthreats.

Conquest Cyber

Conquest Cyber

Conquest Cyber builds adaptive risk management programs where innovation is most needed – within defense, intelligence, federal civilian agencies and the industrial base that supports them.

TryHackMe

TryHackMe

TryHackMe is an online platform that teaches cyber security through short, gamified real-world labs. We have content for both complete beginners and seasoned hackers.

Wazuh

Wazuh

Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.

Quad9 Foundation

Quad9 Foundation

Quad9 is a free security solution that uses DNS to protect your system against the most common cyber threats. It improves your system's performance, plus, it preserves and protects your privacy.

Zilla Security

Zilla Security

Zilla combines identity governance with cloud security to deliver comprehensive access visibility, reviews, lifecycle management, and policy-based security remediation.

ASPIA InfoTech

ASPIA InfoTech

ASPIA Infotech is a leading Information and cybersecurity organization focused on innovative approaches to avert targeted attacks.

Breathe Technology

Breathe Technology

Breathe Technology has been providing Managed IT Support/ Service Desk, Cloud Services, Cyber Security & Communications to businesses and schools since 2003.