Skip to main content

Nuclear Power Plant Response to the Cyber Threat

Our nation’s commercial nuclear power plants take the cyber threat seriously.  Our industry has been developing and implementing cyber security programs since shortly after the events of September 11, 2001.  The industry’s efforts culminated in a binding industry initiative to implement a cyber security program consistent with the guidance in a document endorsed by the NRC as an acceptable method for establishing a cyber security program.  All plants implemented this program by mid-2008.

The U.S. Nuclear Regulatory Commission (NRC) is a strong regulator in this area.  The NRC’s efforts to create a cyber security regulatory framework for the plants began shortly after September 11, 2001.  The NRC issued orders after September 11 that required power reactor licensees to implement interim compensatory measures to enhance cyber security at their sites. These security measures required an assessment sufficient to provide protection against the cyber threats at the time of the orders. Subsequently, the NRC amended the Design Basis Treat requirements to include cyber attacks.  In 2009 the NRC ammended their extensive physical protection program regulations to include specific requirements for a cyber security program to protect systems that, if compromised, would adversely impact safety, security or emergency preparedness.

So what does all of this mean?  What have the plants actually done to implement cyber security protective measures in response to the cyber threat?

Every plant submitted a cyber security plan to the NRC that describes how the plant will implement their cyber security program.  The NRC has reviewed and approved each of these plans.

Each plant also submitted an implementation schedule describing the interim milestone actions toward full implementation of the cyber security program.  The NRC has reviewed and approved each of these schedules.  The interim milestones of the schedule prioritize key activities designed to address the most prominent cyber threats to these facilities.

By December 31, 2012, each U.S. nuclear power plant has:
  • Isolated key control systems using either air-gaps or robust hardware based isolation devices. As a result, the key safety, security, and power generation equipment at the plants are protected from any network based cyber attacks originating outside the plant.
  • Enhanced and implemented robust controls over the use of portable media and equipment.  Where devices like thumb drives, CD’s, and laptops are used to interface with plant equipment, measures are in place to minimize the cyber threat.  These measures include such actions as: minimizing the use of devices that are not maintained at the plant; virus scanning devices both before and after being connected to plant equipment; and, implementing additional measures where the source of the data or device originates outside the plant.  As a result, the plants are well protected from attacks like Stuxnet, that propagated through the use of portable media.
  • Enhanced defenses against the insider threat.  Training and insider mitigation programs have been enhanced to include cyber attributes.  Individuals who work with digital plant equipment are subject to increased security screening, cyber security training, and behavioral observation.
  • Implemented cyber security controls to protect equipment deemed most essential for the protection of the public health and safety.  While full implementation of cyber security controls for all digital equipment requiring protection will take some time, plants have prioritized the implementation to cover the assets most essential to the public health and safety.
  • Implemented measures to maintain the effectiveness of the implemented portions of the program.  These measures include maintaining the equipment described above in the plant configuration management program, ensuring changes to the equipment are performed in a controlled way.  A cyber security impact analysis is performed before making changes to the equipment.  The effectiveness of implemented cyber security controls is periodically assessed, and enhancements made where necessary.  Vulnerability assessments are performed to ensure the cyber security posture of the equipment is maintained.
This week the NRC began inspecting plant’s implementation of these milestones.

The balance of the implementation of the cyber security program is ongoing.  And I look forward to keeping the readers of the blog up-to-speed on advancements.

No cyber security program will be 100% perfect.  These interim measures well position the plants to ensure that the public health and safety are maintained, and that the sites will reliably continue to make their significant contribution to the nation’s electrical supply.

Comments

Manolya Rowe said…
Hi Bill, nice post. One comment I like to make is that it is easy to write a cyber security concept, but it is so much more difficult to actually implement the program and make the security happen at the system level. I would like to know, what the NRC finds appropriated enough and what SSP will be approved and what the standert's will be used.
Anonymous said…
"....the NRC amended the Design Basis Treat requirements to include cyber attacks."

Cyber TREATS are much better than cyber THREATS....

Happy Valentine’s day x

Mr Pedant
Rehan Azhar said…
Hi Bill,

I am working on a research report for the nuclear cyber security industry and was hoping I could briefly get your input on a few questions I had. If so, I can call you at your NEI work number.

Best,
Rehan

Popular posts from this blog

A Design Team Pictures the Future of Nuclear Energy

For more than 100 years, the shape and location of human settlements has been defined in large part by energy and water. Cities grew up near natural resources like hydropower, and near water for agricultural, industrial and household use.

So what would the world look like with a new generation of small nuclear reactors that could provide abundant, clean energy for electricity, water pumping and desalination and industrial processes?

Hard to say with precision, but Third Way, the non-partisan think tank, asked the design team at the Washington, D.C. office of Gensler & Associates, an architecture and interior design firm that specializes in sustainable projects like a complex that houses the NFL’s Dallas Cowboys. The talented designers saw a blooming desert and a cozy arctic village, an old urban mill re-purposed as an energy producer, a data center that integrates solar panels on its sprawling flat roofs, a naval base and a humming transit hub.

In the converted mill, high temperat…

Sneak Peek

There's an invisible force powering and propelling our way of life.
It's all around us. You can't feel it. Smell it. Or taste it.
But it's there all the same. And if you look close enough, you can see all the amazing and wondrous things it does.
It not only powers our cities and towns.
And all the high-tech things we love.
It gives us the power to invent.
To explore.
To discover.
To create advanced technologies.
This invisible force creates jobs out of thin air.
It adds billions to our economy.
It's on even when we're not.
And stays on no matter what Mother Nature throws at it.
This invisible force takes us to the outer reaches of outer space.
And to the very depths of our oceans.
It brings us together. And it makes us better.
And most importantly, it has the power to do all this in our lifetime while barely leaving a trace.
Some people might say it's kind of unbelievable.
They wonder, what is this new power that does all these extraordinary things?

Seeing the Light on Nuclear Energy

If you think that there is plenty of electricity, that the air is clean enough and that nuclear power is a just one among many options for meeting human needs, then you are probably over-focused on the United States or Western Europe. Even then, you’d be wrong.

That’s the idea at the heart of a new book, “Seeing the Light: The Case for Nuclear Power in the 21st Century,” by Scott L. Montgomery, a geoscientist and energy expert, and Thomas Graham Jr., a retired ambassador and arms control expert.


Billions of people live in energy poverty, they write, and even those who don’t, those who live in places where there is always an electric outlet or a light switch handy, we need to unmake the last 200 years of energy history, and move to non-carbon sources. Energy is integral to our lives but the authors cite a World Health Organization estimate that more than 6.5 million people die each year from air pollution.  In addition, they say, the global climate is heading for ruinous instability. E…