Cyber Security Assurance in the Design, Implementation, and Operation of NPP I&C Systems

2020 ◽  
pp. 323-348
Author(s):  
Oleksandr Klevtsov ◽  
Artem Symonov ◽  
Serhii Trubchaninov
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Regulatory Framework ◽  
Nuclear Facilities ◽  
Stages Of Development ◽  
Basic Principles ◽  
Security Assurance ◽  
Security Levels ◽  
And Control

The chapter is devoted to the consideration of the issues concerning the cyber security assurance of NPP instrumentation and control systems. A brief overview of the international regulatory framework in the field of cyber security for nuclear facilities is given. The different approaches to the categorization of NPP instrumentation and control systems by cyber security are expressed. The basic principles of cyber security assurance of NPP instrumentation and control systems are considered. The specific measures of cyber security assurance (i.e., graded according to the cyber security levels) on the stages of development, implementation, and operation of NPP instrumentation and control systems are presented.

Cyber Security Assessment of NPP I&C Systems

2020 ◽  
pp. 221-238
Author(s):  
Oleksandr Klevtsov ◽  
Artem Symonov ◽  
Serhii Trubchaninov
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Nuclear Power ◽  
Power Plants ◽  
Cyber Attacks ◽  
Security Assessment ◽  
Nuclear Facilities ◽  
Security Risks ◽  
Cyber Threats ◽  
And Control

The chapter is devoted to the issues of cyber security assessment of instrumentation and control systems (I&C systems) of nuclear power plants (NPP). The authors examined the main types of potential cyber threats at the stages of development and operation of NPP I&C systems. Examples of real incidents at various nuclear facilities caused by intentional cyber-attacks or unintentional computer errors during the maintenance of the software of NPP I&C systems are given. The approaches to vulnerabilities assessment of NPP I&C systems are described. The scope and content of the assessment and periodic reassessment of cyber security of NPP I&C systems are considered. An approach of assessment to cyber security risks is described.

Cybersecurity From Field to Host

2016 ◽  
Author(s):  
Lee A. Cysouw ◽  
Douglas C. Osburn ◽  
Nader M. Rabadi
Keyword(s):  
Best Practices ◽  
Control Systems ◽  
Cyber Security ◽  
Measurement Data ◽  
Cyber Attacks ◽  
Operating Costs ◽  
Data Monitoring ◽  
Industry Standards ◽  
And Control ◽  
Remote Communications

Remote communications to field devices for data monitoring and controls has greatly reduced operating costs, reduced downtime, and helped to optimize our industry. With the ever growing threat of cyber-attacks, the need for securing that data is becoming a more common topic of discussion. Whether collecting SCADA or Measurement data from the field, doing remote configuration, or even sitting dormant, it is important to keep the line of communication to your devices secure. This presentation will discuss potential threats and examples of cyber-attacks. It will cover industry standards, types of cyber security, and the importance and best practices for securing data for Measurement and/or SCADA and control systems.

Automated security testing for web applications on industrial automation and control systems

2019 ◽  
Vol 67 (5) ◽  
pp. 383-401
Author(s):  
Steffen Pfrang ◽  
Anne Borcherding ◽  
David Meier ◽  
Jürgen Beyerer
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Web Application ◽  
Web Applications ◽  
Security Testing ◽  
Industrial Automation ◽  
Local Networks ◽  
Automation And Control ◽  
And Control ◽  
The Web

Abstract Industrial automation and control systems (IACS) play a key role in modern production facilities. On the one hand, they provide real-time functionality to the connected field devices. On the other hand, they get more and more connected to local networks and the internet in order to facilitate use cases promoted by “Industrie 4.0”. A lot of IACS are equipped with web servers that provide web applications for configuration and management purposes. If an attacker gains access to such a web application operated on an IACS, he can exploit vulnerabilities and possibly interrupt the critical automation process. Cyber security research for web applications is well-known in the office IT. There exist a lot of best practices and tools for testing web applications for different kinds of vulnerabilities. Security testing targets at discovering those vulnerabilities before they can get exploited. In order to enable IACS manufacturers and integrators to perform security tests for their devices, ISuTest was developed, a modular security testing framework for IACS. This paper provides a classification of known types of web application vulnerabilities. Therefore, it makes use of the worst direct impact of a vulnerability. Based on this analysis, a subset of open-source vulnerability scanners to detect such vulnerabilities is selected to be integrated into ISuTest. Subsequently, the integration is evaluated. This evaluation is twofold: At first, willful vulnerable web applications are used. In a second step, seven real IACS, like a programmable logic controller, industrial switches and cloud gateways, are used. Both evaluation steps start with the manual examination of the web applications for vulnerabilities. They conclude with an automated test of the web applications using the vulnerability scanners automated by ISuTest. The results show that the vulnerability scanners detected 53 % of the existing vulnerabilities. In a former study using commercial vulnerability scanners, 54 % of the security flaws could be found. While performing the analysis, 45 new vulnerabilities were detected. Some of them did not only break the web server but crashed the whole IACS, stopping the critical automation process. This shows that security testing is crucial in the industrial domain and needs to cover all services provided by the devices.

scholarly journals Analyzing the Impact of Cybersecurity on Monitoring and Control Systems in the Energy Sector

Energies ◽  
2021 ◽  
Vol 15 (1) ◽  
pp. 218
Author(s):  
Mohammed Alghassab
Keyword(s):  
Control System ◽  
Control Systems ◽  
Cyber Security ◽  
Energy Sector ◽  
Industrial Control System ◽  
Monitoring And Control ◽  
Industrial Control ◽  
Industrial Control Systems ◽  
Monitoring And Control Systems ◽  
And Control

Monitoring and control systems in the energy sector are specialized information structures that are not governed by the same information technology standards as the rest of the world’s information systems. Such industrial control systems are also used to handle important infrastructures, including smart grids, oil and gas facilities, nuclear power plants, water management systems, and so on. Industry equipment is handled by systems connected to the internet, either via wireless or cable connectivity, in the present digital age. Further, the system must work without fail, with the system’s availability rate being of paramount importance. Furthermore, to certify that the system is not subject to a cyber-attack, the entire system must be safeguarded against cyber security vulnerabilities, threats, and hazards. In addition, the article looks at and evaluates cyber security evaluations for industrial control systems, as well as their possible impact on the accessibility of industrial control system operations in the energy sector. This research work discovers that the hesitant fuzzy-based method of the Analytic Hierarchy Process (AHP) and the Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) is an operational procedure for estimating industrial control system cyber security assessments by understanding the numerous characteristics and their impacts on cyber security industrial control systems. The author evaluated the outputs of six distinct projects to determine the quality of the outcomes and their sensitivity. According to the results of the robustness analysis, alternative 1 shows the utmost effective cybersecurity project for the industrial control system. This research work will be a conclusive reference for highly secure and managed monitoring and control systems.

Cyber Security in Tactical Network Infrastructure for Command and Control

2019 ◽  
pp. 1050-1079
Author(s):  
J. Sigholm
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Best Practice ◽  
Research Question ◽  
Command And Control ◽  
Interdisciplinary Approach ◽  
Information And Communications Technology ◽  
Military Operations ◽  
Recent Developments ◽  
And Control

Emerging information and communications technology has had significant importance for military operations during the last decades. Development within such technology areas as sensors, computers, and wireless communications has allowed for faster and more efficient collection, transmission, storage, processing, analysis, and distribution of data. This has led to new and improved military capabilities within command and control, intelligence, targeting, and logistics. However, the increased complexity and interdependencies of networked systems, the continuously growing amounts of data, changing non-technical requirements, and evolving adversary threats makes upholding cyber security in command and control systems a challenging task. Although some best-practice approaches have been developed, finding good solutions for protecting critical infrastructure and important information assets is still an open research question requiring an interdisciplinary approach. This chapter describes recent developments within emerging network technology for command and control, and suggests focus areas where further research is needed in order to attain sufficient operational effect from the employed systems. While a gradual and evolutionary progress of military cyber security has been seen, a long-term commitment is required within such areas as procurement, standardization, training, doctrinal, and legal development, in order to achieve military utility of command and control systems.

scholarly journals Preliminaries of Orthogonal Layered Defence Using Functional and Assurance Controls in Industrial Control Systems

2019 ◽  
Vol 8 (1) ◽  
pp. 14 ◽  
Author(s):  
Mike Mackintosh ◽  
Gregory Epiphaniou ◽  
Haider Al-Khateeb ◽  
Keith Burnham ◽  
Prashant Pillai ◽  
...  
Keyword(s):  
Control Systems ◽  
Architectural Design ◽  
Nuclear Facilities ◽  
Industrial Control ◽  
Transit Systems ◽  
Industrial Control Systems ◽  
Highly Sensitive ◽  
Functional Control ◽  
And Control ◽  
Control Traffic

Industrial Control Systems (ICSs) are responsible for the automation of different processes and the overall control of systems that include highly sensitive potential targets such as nuclear facilities, energy-distribution, water-supply, and mass-transit systems. Given the increased complexity and rapid evolvement of their threat landscape, and the fact that these systems form part of the Critical National infrastructure (CNI), makes them an emerging domain of conflict, terrorist attacks, and a playground for cyberexploitation. Existing layered-defence approaches are increasingly criticised for their inability to adequately protect against resourceful and persistent adversaries. It is therefore essential that emerging techniques, such as orthogonality, be combined with existing security strategies to leverage defence advantages against adaptive and often asymmetrical attack vectors. The concept of orthogonality is relatively new and unexplored in an ICS environment and consists of having assurance control as well as functional control at each layer. Our work seeks to partially articulate a framework where multiple functional and assurance controls are introduced at each layer of ICS architectural design to further enhance security while maintaining critical real-time transfer of command and control traffic.

scholarly journals CYBERSECURITY MANAGEMENT OF INDUSTRIAL AUTOMATION AND CONTROL SYSTEMS: PRINCIPLES OF RELIABILITY MODEL BUILDING

2020 ◽  
pp. 56-60
Author(s):  
M. V. Afanaseva ◽  
◽  
D. R., Abzalutdinov ◽  
K. Y. Barakov ◽  
◽  
...  
Keyword(s):  
Control Systems ◽  
Cyber Security ◽  
Model Building ◽  
Reliability Function ◽  
Security Level ◽  
Reliability Model ◽  
Industrial Automation ◽  
Engineering Theory ◽  
Automation And Control ◽  
And Control

The article considers the possibility of applying the reliability engineering theory for the quantification of cyber security level of industrial automation and control systems security. The reliability model was built and the reliability function for each component of the subsystem was determined. Analytical expressions for the cybersecurity management system uptime probabil-ity calculation are also given, and a system reliability model was built taking into account its subsystems.

Sign in / Sign up

Export Citation Format

Share Document