Power plant cyber threat: Lock up your ICSs and SCADAs

That's not worrying at all

Building Dounreay Fast Reactor copyright Dounrea Site Restoration Ltd and Nuclear Decommissioning Authority

Nuclear power stations have been told to tighten their defences after government officials warned of a "credible" cyber threat.

Intel agencies are warning that terrorists, foreign spies and hacktivists are all looking to exploit "vulnerabilities" in the nuclear industry's internet defences, The Telegraph reports. Security bugs in SCADA systems and associated computer networks are becoming increasingly commonplace. Exploiting them successfully is certainly possible, but far from trivial.

UK energy minister Jesse Norman told the paper that civil nuclear strategy published in February already provides guidance about protecting against cyber threats.

John Bambenek, threat intelligence manager at Fidelis Cybersecurity, said that the call for increased vigilance made sense, adding that there was no need to press the panic button.

"It should be noted that the reports suggest terrorist groups want to develop capabilities to attack energy and nuclear facilities, but do not yet have that ability," Bambenek said. "However, that doesn't mean vigilance isn't due. Utility operators need to ensure that their critical systems do not have direct internet access and controls are in place so that no one system could cause a catastrophic outage.

"The power outages in Ukraine – that have been attributed to the Russian government – show us that even commodity tools can be used against critical infrastructure to great effect. Operators need to ensure their safety testing includes scenarios where there are machines controlled by adversary powers to ensure controls still protect against failures. In addition, what is almost more important than monitoring inbound network traffic is monitoring outbound traffic which often yields more valuable intelligence on potentially compromised devices inside a utility company."

Peter Carlisle, VP EMEA at Thales e-Security, added: "Cyberattacks against critical national infrastructure are set to increase dramatically as criminals develop increasingly heinous methods to jeopardise Britain's national security.

"From power stations to the transport network, the risk to the public remains severe, especially if hackers are able to gain access to electronic systems." ®


Biting the hand that feeds IT © 1998–2017