Skip to main content

Blackhat, Nuclear Energy and Cyber Security

While many of us were home for the holidays we couldn't escape the movie trailer for Blackhat, a cyber crime thriller directed by Michael Mann starring Chris Hemsworth. Set to premiere in the U.S. on January 16, the trailer includes a cyber attack on a nuclear power plant in China.



We've dealt with the issue of cyber security with some frequency here at NEI Nuclear Notes. I'd refer our readers back to a post written by NEI's Bill Gross almost two years ago that outlined industry actions in this area to mitigate against the possibility of a cyber attack (emphasis mine).
By December 31, 2012, each U.S. nuclear power plant has:
  • Isolated key control systems using either air-gaps or robust hardware based isolation devices. As a result, the key safety, security, and power generation equipment at the plants are protected from any network based cyber attacks originating outside the plant.
  • Enhanced and implemented robust controls over the use of portable media and equipment. Where devices like thumb drives, CD’s, and laptops are used to interface with plant equipment, measures are in place to minimize the cyber threat. These measures include such actions as: minimizing the use of devices that are not maintained at the plant; virus scanning devices both before and after being connected to plant equipment; and, implementing additional measures where the source of the data or device originates outside the plant. As a result, the plants are well protected from attacks like Stuxnet, that propagated through the use of portable media.
  • Enhanced defenses against the insider threat. Training and insider mitigation programs have been enhanced to include cyber attributes. Individuals who work with digital plant equipment are subject to increased security screening, cyber security training, and behavioral observation.
  • Implemented cyber security controls to protect equipment deemed most essential for the protection of the public health and safety. While full implementation of cyber security controls for all digital equipment requiring protection will take some time, plants have prioritized the implementation to cover the assets most essential to the public health and safety.
  • Implemented measures to maintain the effectiveness of the implemented portions of the program. These measures include maintaining the equipment described above in the plant configuration management program, ensuring changes to the equipment are performed in a controlled way. A cyber security impact analysis is performed before making changes to the equipment. The effectiveness of implemented cyber security controls is periodically assessed, and enhancements made where necessary. Vulnerability assessments are performed to ensure the cyber security posture of the equipment is maintained.
Despite these procedures, continued vigilance is key, something that's equally true for both cyber and physical security. In the meantime, we'll be keeping an eye on this film and screening it when it comes to theaters in the U.S. next week.

Comments

jimwg said…
Excellent feature to set science/tech illiterate reporters straight with. Shoot some copies out to every media outlet and news site. Stuff like this shouldn't nearly be a closed secret to blogs like this!

James Greenidge
Queens NY
Unknown said…
From what I could see in the movie trailer, the producers confused the cooling tower which cools the non-radioactive turbine cooling water from the reactor containment building which houses the reactor and where the radioactivity and contamination are located. Further, how a cyber attack could damage a cooling tower as shown in the trailer, is beyond me.

Popular posts from this blog

Fluor Invests in NuScale

You know, it’s kind of sad that no one is willing to invest in nuclear energy anymore. Wait, what? NuScale Power celebrated the news of its company-saving $30 million investment from Fluor Corp. Thursday morning with a press conference in Washington, D.C. Fluor is a design, engineering and construction company involved with some 20 plants in the 70s and 80s, but it has not held interest in a nuclear energy company until now. Fluor, which has deep roots in the nuclear industry, is betting big on small-scale nuclear energy with its NuScale investment. "It's become a serious contender in the last decade or so," John Hopkins, [Fluor’s group president in charge of new ventures], said. And that brings us to NuScale, which had run into some dark days – maybe not as dark as, say, Solyndra, but dire enough : Earlier this year, the Securities Exchange Commission filed an action against NuScale's lead investor, The Michael Kenwood Group. The firm "misap

An Ohio School Board Is Working to Save Nuclear Plants

Ohio faces a decision soon about its two nuclear reactors, Davis-Besse and Perry, and on Wednesday, neighbors of one of those plants issued a cry for help. The reactors’ problem is that the price of electricity they sell on the high-voltage grid is depressed, mostly because of a surplus of natural gas. And the reactors do not get any revenue for the other benefits they provide. Some of those benefits are regional – emissions-free electricity, reliability with months of fuel on-site, and diversity in case of problems or price spikes with gas or coal, state and federal payroll taxes, and national economic stimulus as the plants buy fuel, supplies and services. Some of the benefits are highly localized, including employment and property taxes. One locality is already feeling the pinch: Oak Harbor on Lake Erie, home to Davis-Besse. The town has a middle school in a building that is 106 years old, and an elementary school from the 1950s, and on May 2 was scheduled to have a referendu

Wednesday Update

From NEI’s Japan micro-site: NRC, Industry Concur on Many Post-Fukushima Actions Industry/Regulatory/Political Issues • There is a “great deal of alignment” between the U.S. Nuclear Regulatory Commission and the industry on initial steps to take at America’s nuclear energy facilities in response to the nuclear accident in Japan, Charles Pardee, the chief operating officer of Exelon Generation Co., said at an agency briefing today. The briefing gave stakeholders an opportunity to discuss staff recommendations for near-term actions the agency may take at U.S. facilities. PowerPoint slides from the meeting are on the NRC website. • The International Atomic Energy Agency board has approved a plan that calls for inspectors to evaluate reactor safety at nuclear energy facilities every three years. Governments may opt out of having their country’s facilities inspected. Also approved were plans to maintain a rapid response team of experts ready to assist facility operators recoverin