Feeds

US to tighten nuclear cyber security

Added computer security standards

  • alert
  • submit to reddit

3 Big data security analytics techniques

Federal regulators are proposing to add computer security standards to their criteria for installing new computerized safety systems in nuclear power plants.

The US Nuclear Regulatory Commission (NRC) quietly launched a public comment period late last month on a proposed 15-page update to its regulatory guide "Criteria for Use of Computers in Safety Systems of Nuclear Power Plants." The current version, written in 1996, is three pages long and makes no mention of security.

The replacement would expand existing safety and reliability requirements for digital safety system, and infuse security requirements into every stage of a system's lifecycle, from drawing board to retirement.

Last year the United Nations' International Atomic Energy Agency (IAEA) warned of growing international concern about the potential for cyber attacks against nuclear facilities, and said it was finalizing new security guidelines of its own. No successful targeted attacks against plants have been publicly reported, but in 2001 the Slammer worm penetrated a private computer network at Ohio's idled Davis-Besse nuclear plant and disabled a safety monitoring system for nearly five hours. The worm entered the plant network through an interconnected contractor's network, bypassing Davis-Besse's firewall.

The NRC draft advises against such interconnections. It also advises plant operators to consider the effect of each new system on the plant's cyber security, and to develop response plans to deal with computer incidents. Vendors are told how to reduce the risk of saboteurs planting backdoors and logic bombs in safety system software during the development phase.

"I really liked the notion of making people aware that they need to address security throughout the process of developing new software and systems, and not just as a test at the end," says Chris Wysopal, a Boston-based computer security researcher with the Symantec Corporation. "They talked about that going all the way back to the requirement phase, which I thought was good."

But for all its breadth, adherence to the new guidelines would be strictly voluntary for operators of the 103 nuclear reactors already running in the US - a detail that irks some security experts. In filed comments, Joe Weiss, a control systems cyber security consultant at KEMA, Inc., argued the regulatory guide shouldn't be limited to plant safety systems, and that existing plants should be required to comply.

"There have been numerous cases of control system cyber security impacts including several in commercial nuclear plants," Weiss wrote. "Many nuclear plants have connected their plant networks to corporate networks making them potentially vulnerable to cyber intrusions."

Wysopal, who reviewed the draft at SecurityFocus' request, agrees that it could use more juice. "It's kind of sad," he says. "I see that people have all these great notions of how we can build software and systems more securely, but it's always voluntary."

The NRC is accepting public comments on the new guide until 11 February.

Copyright © 2004, SecurityFocus logo

Related stories

Nuke watchdog issues cybergeddon alert
Five lose jobs over nuke lab security debacle
US nuclear lab suspends secret work
Homer Simpson let loose on US nuclear weapons facility

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.