Feeds

Nuke watchdog issues cybergeddon alert

Plants at risk from hack attack

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

The United Nations' nuclear watchdog agency warned Friday of growing concern about cyber attacks against nuclear facilities.

The International Atomic Energy Agency (IAEA) announced in a statement that it is developing new guidelines aimed at combating the danger of computerized attacks by outside intruders or corrupt insiders: "For example, software operated control systems in a nuclear facility could be hacked or the software corrupted by staff with insider access," the group said.

The IAEA's new guidelines on "Security of Information Technology Related Equipment and Software Based Controls Against Malevolent Acts" are being finalized now, said the agency. The announcement came out of the agency's 48th annual general conference attended by 137 nations.

Last year, the Slammer worm penetrated a private computer network at Ohio's idled Davis-Besse nuclear plant and disabled a safety monitoring system for nearly five hours. The worm entered the plant network through an interconnected contractor's network, bypassing Davis-Besse's firewall.

News of the Davis-Besse incident prompted Rep. Edward Markey (D-MA) last fall to call for US regulators to establish cyber security requirements for the 103 nuclear reactors operating in the US, specifically requiring firewalls and up-to-date patching of security vulnerabilities. By that time the US Nuclear Regulatory Commission (NRC) had already begun working on an official manual to guide plant operators in evaluating their cybersecurity posture.

But that document, finalized this month, "is not directive in nature", says Jim Davis, director of operations at the Nuclear Energy Institute, an industry association. "It does not establish a minimum level of security or anything like that. That isn't the purpose of the manual."

A related industry effort will establish management-level cyber security guidelines for plant operators, says Davis, who believes industry efforts are sufficient. "I think we are taking it seriously... and I think if the industry doesn't go far enough in this area we'll see more attention from regulators."

Neither the NRC manual nor the industry guidelines will be made public.

Separately, the NRC is working on a substantial revision of its regulatory guide, "Criteria for Use of Computers in Safety Systems of Nuclear Power Plants", which sets security and reliability criteria for installing new computerized safety systems in plants. It would replace the current guide, written in 1996, which is three pages long.

A working draft of the NRC guide reviewed by SecurityFocus would encourage plant operators to consider the effect of each new safety system on the plant's cyber security, and to develop response plans to deal with computer incidents. Additionally, it would urge vendors to maintain a secure development environment, and to probe their products for backdoors and logic bombs before shipping.

Copyright © 2004, SecurityFocus logo

Related stories

UK stumps up £1.1m for cash-strapped nuke watchdog
Five lose jobs over nuke lab security debacle
US Emergency Alert System open to hack attack
US nuclear lab suspends secret work

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.