Skip to main content

Cyber Security and Defending What’s Important

We read all the time about various data breaches that cause – potentially, anyway – a good deal of pain. Probably the best known example recently was the theft of over 40 million credit card numbers from Target last year, which has led to a lawsuit from the companies that had to replace all those cards and a class action suit from disgruntled customers.

We’ve no brief on Target’s cyber security strategy, except that we expect it to get a full review. But it certainly suggests the value of a good cyber security program:  defending what must be defended to ensure the public good.

Cyber security at nuclear energy plants – and all essential infrastructure - is extremely important because the potential for malicious mischief is very high – not from thieves as much as terrorists and others who want to cripple the electricity grid or cause a radioactive release. Stealing credit cards can be discomforting, but attacking a nuclear facility could have grave impacts.

For these and other reasons, nuclear facilities have been working on cyber security for about as long as digital items have filtered into them – most essential parts of a plant are analog in nature – and developed approaches to handling them even before the Nuclear Regulatory Commission became involved in the issue.

The NRC’s rulemaking on the issue are, for the most part, judicious and on-point, but they are also very broad in nature. The nuclear industry wants primary attention on cyber security threats that involve public safety and plant integrity – obvious enough, but in guarding against such threats, one must identify what is and is not essential.

Consequently, NEI submitted a petition to the NRC last June to reconsider the scope of the cyber security rule. (Comments on the petition are due today.) But if public safety is the issue, shouldn’t everything be coequal?

Nobody should doubt that the health and safety of the public is a paramount motivation for the industry and the Nuclear Regulatory Commission. Unsafe nuclear plants – or any large industrial operation – carry no benefits for operators or customers.

But both the industry and the NRC recognize that rules must be properly “scoped;” that is, they have to take in those elements that the rule is meant to cover and nothing more. If the rule is too broadly scoped, then the facility runs the risk of wasting resources  while creating no true value.

That can seem a little abstract, so let’s get concrete. As written, the cyber security rule covers items such as fax machines, hand-held calibration devices, radios and pagers, and calculators used by emergency preparedness personnel. These don’t have any potential to impact human safety nor could their misuse damage essential systems. They are basic business tools that an Information Technology department knows how to protect. The same is true of the computers that have no connection to the plant’s processes but are used for things like word processing or creating dull slide shows. If the NRC has to hear about a fax machine going down, it wastes time at both the plant and the agency.

Not wasting time and effort on the inessential also facilitates defense-in-depth. This just means protecting the same item in multiple ways. For example, cars keep their passengers alive in a crash through crash-resistant bumpers, crumple zones, seat belts, air bags, anti-lock breaking systems and even proximity sensors! Ideally, these work in tandem so that one tool does not interfere with any other tool and render it ineffective.

In a cyber security program, defense-in-depth includes implementing systems to prevent attacks, to detect an attack in progress and  to respond to an attack. These methods are intended to recover a system quickly and minimize any impact from the attack. They are also integrated, as in an automobile, to allow multiple methods to prevent, detect and recover from an attack.

So what NEI is asking is that the rule covers what the rule must cover to ensure public safety and the reliability of the facility, but not everything that has the slightest digital footprint. This is how physical design basis threats are handled in rulemaking. Cyber threats are also considered design basis threats, which means their damage impacts essential plant components. Bringing the cyber security rule into line with the other design basis threat rules creates a cleaner, more effective set of regulations. It ensures that what is protected is fully protected and that time is not wasted on trying to defend a fax machine.

---

We’ve written several posts on cyber security. It’s an important but somewhat under appreciated topic. Look here for more Nuclear Notes coverage.

---

Sometimes, under covered would be preferable to bad coverage, which is what ABC News supplied in a an exceptionally alarmist story in November:

A destructive “Trojan Horse” malware program has penetrated the software that runs much of the nation’s critical infrastructure and is poised to cause an economic catastrophe, according to the Department of Homeland Security.

National Security sources told ABC News there is evidence that the malware was inserted by hackers believed to be sponsored by the Russian government, and is a very serious threat.

The hacked software is used to control complex industrial operations like oil and gas pipelines, power transmission grids, water distribution and filtration systems, wind turbines and even some nuclear plants. Shutting down or damaging any of these vital public utilities could severely impact hundreds of thousands of Americans.

But none of the components at a nuclear power plant interact with external networks and cannot be impacted by malware of this kind. Additionally, the industry was aware of this threat because the Department of Homeland Security briefed it. ABC could have found this out by calling NEI or any nuclear facility (or any energy-related industrial outlet, I expect, though I can’t speak for them), but why wreck a good story with a drive to get at the truth? NEI let ABC know the salient information on Twitter, but no change to the story.

Bill Gross, NEI’s senior project manager, engineering, nuclear generation, contributed substantially to this post.

Comments

Popular posts from this blog

Knowing What You’ve Got Before It’s Gone in Nuclear Energy

The following is a guest post from Matt Wald, senior director of policy analysis and strategic planning at NEI. Follow Matt on Twitter at @MattLWald.

Nuclear energy is by far the largest source of carbon prevention in the United States, but this is a rough time to be in the business of selling electricity due to cheap natural gas and a flood of subsidized renewable energy. Some nuclear plants have closed prematurely, and others likely will follow.
In recent weeks, Exelon and the Omaha Public Power District said that they might close the Clinton, Quad Cities and Fort Calhoun nuclear reactors. As Joni Mitchell’s famous song says, “Don’t it always seem to go that you don’t what you’ve got ‘til it’s gone.”
More than 100 energy and policy experts will gather in a U.S. Senate meeting room on May 19 to talk about how to improve the viability of existing nuclear plants. The event will be webcast, and a link will be available here.
Unlike other energy sources, nuclear power plants get no specia…

Making Clouds for a Living

Donell Banks works at Southern Nuclear’s Plant Vogtle units 3 and 4 as a shift supervisor in Operations, but is in the process of transitioning to his newly appointed role as the daily work controls manager. He has been in the nuclear energy industry for about 11 years.

I love what I do because I have the unique opportunity to help shape the direction and influence the culture for the future of nuclear power in the United States. Every single day presents a new challenge, but I wouldn't have it any other way. As a shift supervisor, I was primarily responsible for managing the development of procedures and programs to support operation of the first new nuclear units in the United States in more than 30 years. As the daily work controls manager, I will be responsible for oversight of the execution and scheduling of daily work to ensure organizational readiness to operate the new units.

I envision a nuclear energy industry that leverages the technology of today to improve efficiency…

Nuclear: Energy for All Political Seasons

The electoral college will soon confirm a surprise election result, Donald Trump. However, in the electricity world, there are fewer surprises – physics and economics will continue to apply, and Republicans and Democrats are going to find a lot to like about nuclear energy over the next four years.

In a Trump administration, the carbon conversation is going to be less prominent. But the nuclear value proposition is still there. We bring steady jobs to rural areas, including in the Rust Belt, which put Donald Trump in office. Nuclear plants keep the surrounding communities vibrant.

We hold down electricity costs for the whole economy. We provide energy diversity, reducing the risk of disruption. We are a critical part of America’s industrial infrastructure, and the importance of infrastructure is something that President-Elect Trump has stressed.

One of our infrastructure challenges is natural gas pipelines, which have gotten more congested as extremely low gas prices have pulled m…