Feeds

Nuke watchdog issues cybergeddon alert

Plants at risk from hack attack

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

The United Nations' nuclear watchdog agency warned Friday of growing concern about cyber attacks against nuclear facilities.

The International Atomic Energy Agency (IAEA) announced in a statement that it is developing new guidelines aimed at combating the danger of computerized attacks by outside intruders or corrupt insiders: "For example, software operated control systems in a nuclear facility could be hacked or the software corrupted by staff with insider access," the group said.

The IAEA's new guidelines on "Security of Information Technology Related Equipment and Software Based Controls Against Malevolent Acts" are being finalized now, said the agency. The announcement came out of the agency's 48th annual general conference attended by 137 nations.

Last year, the Slammer worm penetrated a private computer network at Ohio's idled Davis-Besse nuclear plant and disabled a safety monitoring system for nearly five hours. The worm entered the plant network through an interconnected contractor's network, bypassing Davis-Besse's firewall.

News of the Davis-Besse incident prompted Rep. Edward Markey (D-MA) last fall to call for US regulators to establish cyber security requirements for the 103 nuclear reactors operating in the US, specifically requiring firewalls and up-to-date patching of security vulnerabilities. By that time the US Nuclear Regulatory Commission (NRC) had already begun working on an official manual to guide plant operators in evaluating their cybersecurity posture.

But that document, finalized this month, "is not directive in nature", says Jim Davis, director of operations at the Nuclear Energy Institute, an industry association. "It does not establish a minimum level of security or anything like that. That isn't the purpose of the manual."

A related industry effort will establish management-level cyber security guidelines for plant operators, says Davis, who believes industry efforts are sufficient. "I think we are taking it seriously... and I think if the industry doesn't go far enough in this area we'll see more attention from regulators."

Neither the NRC manual nor the industry guidelines will be made public.

Separately, the NRC is working on a substantial revision of its regulatory guide, "Criteria for Use of Computers in Safety Systems of Nuclear Power Plants", which sets security and reliability criteria for installing new computerized safety systems in plants. It would replace the current guide, written in 1996, which is three pages long.

A working draft of the NRC guide reviewed by SecurityFocus would encourage plant operators to consider the effect of each new safety system on the plant's cyber security, and to develop response plans to deal with computer incidents. Additionally, it would urge vendors to maintain a secure development environment, and to probe their products for backdoors and logic bombs before shipping.

Copyright © 2004, SecurityFocus logo

Related stories

UK stumps up £1.1m for cash-strapped nuke watchdog
Five lose jobs over nuke lab security debacle
US Emergency Alert System open to hack attack
US nuclear lab suspends secret work

Designing a Defense for Mobile Applications

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.