One Password, One Pipeline: MTSA’s Account Security Requirement
Summary: A Dragos blog post on the Maritime Transportation Security Act's account security rule recounts that Colonial Pipeline's May 2021 shutdown began with a single employee VPN password reused from an earlier breach, an account that was never deprovisioned, and no MFA. The post details § 101.650(a)'s seven minimum account security measures and sets a July 16, 2027 deadline for the Cybersecurity Plan, whose Section 7 documents the requirement.
What's compelling: Colonial's 5,500 miles of pipeline, carrying roughly 45% of the East Coast's fuel, went offline over one reused password and one unrevoked account - and the Coast Guard's rule now puts a written Section 7 account security record, with a named owner and audit date, in front of regulators by 2027.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026