The paper is devoted to studying categorization of NPP instrumentation and control (I&C) systems from the point of view of computer security and to consideration of the computer security levels and zones used by the International Atomic Energy Agency (IAEA). The paper also describes the computer security degrees and zones regulated by the International Electrotechnical Commission (IEC) standard. The computer security categorization of the systems used by the U.S. Nuclear Regulatory Commission (NRC) is presented. The experts analyzed the main differences in I&C systems computer security categorization accepted by the IAEA, IEC and U.S. NRC. The approaches to categorization that should be advisably used in Ukraine during the development of regulation on NPP I&C systems computer security are proposed in the paper.
The main principles and methods of protection against computer threats, methodology used for computer security, policy, plan and computer security program are considered in the paper. The recommendations on the application of protective measures against computer threats in Ukraine depending on a computer security degree are made. The paper presents the analysis of different approaches to computer security assurance described in documents of the International Atomic Energy Agency, U.S. Nuclear Regulatory Commission and International Electrotechnical Commission.
Стаття присвячена питанням оцінювання ризиків, зокрема оцінюванню ризиків кіберзахисту інформаційних та керуючих систем АЕС під час застосування ризик-інформованого підходу. Автори акцентують увагу на нагальній проблемі забезпечення інформаційної безпеки та кіберзахисту ядерних установок, враховуючи відсутність повного розуміння ризиків кіберінцидентів. Автори зауважують, що важливим кроком для вирішення цієї проблеми є оцінювання ризиків кіберзахисту для визначення ймовірності кібератак та їх потенційних наслідків. Оцінювання ризиків кіберзахисту дозволить здійснювати заходи кіберзахисту на основі диференційованого підходу за результатами відповідного оцінювання, забезпечити гнучкість та адаптивність впровадження кіберзахисту, виявляти ризики кіберзахисту на загальному та системному рівні тощо. Розглянуті вимоги до оцінювання та управління ризиками без врахування специфіки об’єкта (підприємства/установи та/або системи тощо), оцінювання та управління ризиками інформаційної безпеки, а також кіберзахисту ядерних установок. У статті описано принципи використання ризик-інформованого підходу до оцінювання кіберзахисту інформаційних та керуючих систем АЕС, який завдяки систематичному оцінюванню та управлінню ризиками кіберзахисту на кожному етапі життєвого циклу цих систем дозволяє попередити використання зловмисниками вразливостей, що може призвести до зниження ядерної та радіаційної безпеки. Надана інформація щодо рекомендованих методик оцінювання ризиків кіберзахисту інформаційних та керуючих систем АЕС. Окремо зауважено, що наразі жоден нормативний документ не вимагає використання конкретної методики оцінювання ризиків кіберзахисту інформаційних та керуючих систем АЕС. Проте найактуальнішим питанням можливості використання ризик-інформованого підходу до оцінювання кіберзахисту інформаційних та керуючих систем АЕС є необхідність розробки методики, яка дозволить проводити комплексне оцінювання ризиків кіберзахисту таких систем, враховуючи їх особливості та специфіку забезпечення ядерної та радіаційної безпеки АЕС.
The chapter is devoted to the consideration of the issues concerning the cyber security assurance of NPP instrumentation and control systems. A brief overview of the international regulatory framework in the field of cyber security for nuclear facilities is given. The different approaches to the categorization of NPP instrumentation and control systems by cyber security are expressed. The basic principles of cyber security assurance of NPP instrumentation and control systems are considered. The specific measures of cyber security assurance (i.e., graded according to the cyber security levels) on the stages of development, implementation, and operation of NPP instrumentation and control systems are presented.
The chapter is devoted to the issues of cyber security assessment of instrumentation and control systems (I&C systems) of nuclear power plants (NPP). The authors examined the main types of potential cyber threats at the stages of development and operation of NPP I&C systems. Examples of real incidents at various nuclear facilities caused by intentional cyber-attacks or unintentional computer errors during the maintenance of the software of NPP I&C systems are given. The approaches to vulnerabilities assessment of NPP I&C systems are described. The scope and content of the assessment and periodic reassessment of cyber security of NPP I&C systems are considered. An approach of assessment to cyber security risks is described.
The approaches to the development and management of computer security justification documents on computer security policy, program and plan, computer incident response plan, reports related to computer security are considered in the paper. Requirements for computer security policy, program and plan are presented, and the analysis of different approaches adopted and reflected in the documents of the International Atomic Energy Agency, U.S. Nuclear Regulatory Commission and International Electrotechnical Commission is carried out. It is noted that the approaches used by these organizations to the development and management of computer security justification documents are quite similar. The paper provides suggestions for the development of requirements for computer security justification documents on the instrumentation and control systems at Ukrainian NPPs. The analysis of different international approaches to the development, implementation, and management of the computer security policy, program and plan has allowed developing requirements for the above-mentioned documents, which will be reflected in the new regulation taking into account the current situation at Ukrainian NPPs. Besides, it is planned to include separate requirements for computer security documentation of the developers of instrumentation and control systems regarding computer incident response plan and reporting documents on computer security in this regulation. The paper presents recommendations for the content, implementation and management of computer security justification documents.
The paper is devoted to the issues of computer security assessment of instrumentation and control systems (I&C systems) of nuclear power plants (NPPs). The authors specified the main areas of assessing the computer security of NPP I&C systems, especially the assessment of cyber threats, vulnerabilities of I&C computer security, sufficiency of applied measures for ensuring I&C systems computer security, risks of I&C system computer security as well as periodic reassessment of I&C computer security. The paper considers the assessment of I&C computer security vulnerabilities, sufficiency of applied measures for ensuring I&C computer security (assessment of cyber threats and the risks of I&C computer security are discussed in detail in other publications from the series “Computer Security of NPP Instrumentation and Control Systems”). Approaches to assessing the computer security vulnerabilities of I&C systems and software at each stage of I&C life cycle are considered. The recommendations for assessing vulnerabilities regarding technical and software protection against unauthorized access or connection to I&C, protection of local networks, implementation of organizational measures and procedures for computer security are provided. The paper describes the scope and procedures for the initial assessment and periodic reassessment of NPP I&C computer security. Recommendations for the formation of an appropriate evaluation team are provided. Methods of assessing I&C computer security are considered, namely: analysis of documents (computer security policy, program, plan, reports, etc.), survey of staff (administrative, operational, service and computer security experts), direct review of I&C systems, their components and local networks. The evaluation stages (collection of information, detailed analysis, reporting) and the scope of work at each stage are described. General information about the possibility and necessity of assessing the computer security risks of I&C systems in the case of using risk-informed approaches is provided. The need to document the results of the assessment is noted separately and specific proposals about the procedure for developing relevant reports are made.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.
hi@scite.ai
10624 S. Eastern Ave., Ste. A-614
Henderson, NV 89052, USA
Copyright © 2024 scite LLC. All rights reserved.
Made with 💙 for researchers
Part of the Research Solutions Family.