Cyber Security at Civil Nuclear Facilities

Cyber Security at Civil Chatham House Report Caroline Baylon with Roger Brunt and David Livingstone Nuclear Facilities: Understanding the Understanding Risks Facilities: Nuclear Cyber Security at Civil Nuclear Facilities Understanding the Risks Caroline Baylon with Roger Brunt and David Livingstone Brunt Livingstone with and David Roger Baylon Caroline Chatham House Chatham House Report Caroline Baylon with Roger Brunt and David Livingstone September 2015 Cyber Security at Civil Nuclear Facilities Understanding the Risks Chatham House, the Royal Institute of International Affairs, is an independent policy institute based in London. Our mission is to help build a sustainably secure, prosperous and just world. The Royal Institute of International Affairs ISBN 978 1 78413 079 4 Chatham House A catalogue record for this title is available from the British Library. 10 St James’s Square London SW1Y 4LE Cover image © Korea Hydro and Nuclear Power, Handout/Getty Images T: +44 (0) 20 7957 5700 Typeset by Soapbox, www.soapbox.co.uk F: + 44 (0) 20 7957 5710 www.chathamhouse.org Printed and bound in Great Britain by Latimer Trend Charity Registration No. 208223 This publication is printed on recycled paper © The Royal Institute of International Affairs, 2015 Chatham House, the Royal Institute of International Affairs, does not express Cover image: Workers of Korea Hydro and Nuclear Power Co. participate opinions of its own. The opinions expressed in this publication are the in an anti-cyber attack exercise at the Wolsong nuclear power plant on responsibility of the authors. 22 December 2014 in Gyeongju, South Korea. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical including photocopying, recording or any information storage or retrieval system, without the prior written permission of the copyright holder. Please direct all enquiries to the publishers. ii | Chatham House Contents Foreword iv About the Authors v Acknowledgments vi Acronyms and Abbreviations vii Executive Summary and Recommendations viii 1 Introduction 1 2 Background: the Nature of the Threats 3 3 A Growing Threat – and an Evolving Industry 8 4 Industry-wide Challenges 14 5 Cultural Challenges 19 6 Technical Challenges 23 7 Meeting the Challenges: the Way Forward 26 8 Developing an Organizational Response 32 9 Conclusions 37 Annex: Interview Sources 38 References and Select Bibliography 39 Chatham House | iii Foreword All technologies have their benefits and liabilities. As a result of these concerns, the International Security Digital technologies are transforming the way in which Department at Chatham House, with the support of the people interact with each other and employ machines, John D. and Catherine T. MacArthur Foundation, undertook and how machines connect to machines. Enormous to investigate the range of potential risks at the points of amounts of data are flowing and being stored; our world intersection between cyber security and nuclear security. increasingly depends on the internet and digitization to A steering group for the project composed of eminent be able to function. Vulnerability to theft of these data experts in both cyber security and nuclear security was has become one of the major drawbacks of financial and established. Caroline Baylon, Chatham House Research other commercial transactions. The protection of data Associate in Science, Technology and Cyber Security, and the secure functioning of the critical infrastructure headed the research and analysis on this project, including – such as energy, food and water resources, transport interviewing 30 industry practitioners. Roger Brunt and and communications – depend on digital technologies David Livingstone, both members of the steering group, functioning safely and securely. Individuals’ privacy in also lent their considerable industry expertise to the regard to, for example, medical records and insurance data project and provided valuable contributions to the writing is still being breached to detrimental effect. This report, and analysis. The study found that the nuclear industry while considering such situations, focuses on a far more is beginning – but struggling – to come to grips with this dangerous category of cyber attack – when a facility’s new, insidious threat. The cyber risk to nuclear facilities industrial control systems are disrupted or even captured requires constant evaluation and response, particularly as and harnessed by saboteurs acting either inside or outside the industry increases its reliance on digital systems and as the facilities where these systems are located. cyber criminal activity continues its relentless rise. Nuclear energy has been seen at different times from It is our intention that the findings of the research and the differing perspectives as both a blessing and a curse. The proposals put forward in this report for dealing with the concerns about the health risks of ionizing radiation have cyber threat to the civil nuclear energy should be considered meant that the nuclear industry has developed a vast array in the spirit of assistance and engagement. The nuclear of safety and security measures to prevent the catastrophic industry is fortunate in having established regulatory release of radiation, and to respond quickly and effectively systems and international guidance. The Nuclear Security should such an event occur. However, no technology is Summit process, with the next meeting due in 2016, and immune to accident, misjudgment or deliberate sabotage. the role of the IAEA in addressing nuclear security and The 2011 nuclear disaster at Fukushima Daiichi as a result nuclear safety in concert are mechanisms to ensure that this of the overwhelming Tōhoku earthquake and tsunami is a important issue will start to receive more attention. The recent reminder of what can happen when basic prevention nuclear industry, regulatory bodies, security establishments, protocols and upgrades are not followed through and – governments and international organizations need to engage perhaps more significantly – when the improbable is recast with cyber security experts and academics, on a sustainable as impossible and the duty to plan for the overwhelmingly basis, to formulate robust policy responses through catastrophic is neglected. Yet the role of nuclear power coordinated plans of action to deal with the technical, production in the energy portfolio of many countries managerial and cultural shortfalls identified in this report. remains significant and in some regions is growing. Finally, as the report notes in conclusion, many of The vulnerability of critical infrastructure has been the the findings of this research are applicable to other subject of some study over recent years, but since the industries and sectors. Across societies, the wider critical revelation of the digital worm Stuxnet and the impact infrastructure – including power grids, transport networks, it is understood to have had on the functioning of the maritime shipping and space-based communications assets equipment in Iran’s nuclear programme, many experts have – is similarly vulnerable to cyber attack, with different but been concerned that similar attempts to interfere with the potentially equally dire consequences. We hope that this physical workings of a nuclear power plant could prove to report will speak to those responsible for the safety and be a severe risk. Indeed, as this report notes, there have security of this critical infrastructure and help to create been a number of reported incidents of cyber interference a culture of pragmatic dialogue between industry and in nuclear power plants and – assuming that the nuclear cyber experts, for the common good. industry behaves in similar ways to other industries – we Patricia Lewis ought to assume that these examples represent the visible Research Director, International Security part of a much more serious problem. Chatham House iv | Chatham House About the Authors Caroline Baylon is research associate in science, the merger of the UK’s security and safety regulators in technology and cyber security at Chatham House, 2007 to enhance regulatory coherence in the industry. where her work has covered topics including critical Since 2012 he has been a nuclear security consultant infrastructure protection, privacy, the digital divide and specializing in advice on regulatory compliance for internet governance. She also serves as editor of the governments, regulators and nuclear operators. He is a Journal of Cyber Policy, Chatham House’s peer-reviewed member of the IAEA director-general’s Advisory Group on academic journal published by Routledge, Taylor & Nuclear Security, and he contributes to the development Francis. She speaks regularly at international conferences of a number of IAEA nuclear security programmes. He is and is a frequent media commentator and contributor, a visiting senior research fellow at King’s College London, most recently writing a series of articles on the challenges where he supports professional development courses that drones pose to nuclear facilities. She is also the author in nuclear security, and he chairs the World Nuclear of the Chatham House research paper Challenges at the Association’s Working Group on the Security of the Intersection of Cyber Security and Space Security (2014). International Nuclear Fuel Cycle. She has been working on cyber security issues since 2003 David Livingstone is an associate fellow at Chatham and most

Load more