Computer Security in the Nuclear World Ι World View
How international collaboration keeps the world safe from cyberthreats
T
Tighe Smith is the Convenor of IEC SC45A WGA9. He has been appointed by a committee to lead the working group A9, which deals with cyber security, at the International Electrotechnical Commission (IEC). The IEC is a global not-for-profit organization that develops international standards for the design, construction and operation of electrical equipment, including that used in nuclear power plants. Founded in 1906, the IEC brings together more than 170 countries and publishes 10 000 IEC International Standards.
26 | IAEA Bulletin, June 2023
he nuclear industry faces a significant challenge in maintaining computer security owing to the widespread use of digital devices. This trend is evident in everyday life, where smart fridges, lighting and other devices controlled remotely via cloud computing have become commonplace. Many systems at nuclear facilities, which previously would not have had any digital components, now have digital elements. Their computational power, reprogrammable nature and ability to interconnect delivers unequalled efficiency in the support of operations, nuclear safety and nuclear security. Small modular reactors and other new reactor designs are being developed in a digital-first world with an even more widespread use of computer systems than in previous designs. They may be designed to operate remotely or even autonomously, utilizing computer network infrastructure to communicate with a central operator. This approach can enable operators and automated systems to analyse large amounts of data to increase the operational efficiency of the nuclear facility. However, this digital modernization of the nuclear industry creates more challenges as, without adequate computer security, weak points or vulnerabilities could be exploited by
malicious actors as part of an attack against one of these facilities. In order to address the challenges posed by the rapidly evolving digital technology landscape in nuclear facilities, and the need to support harmonized approaches between countries and facilities, the IEC has adopted a consequence-based and risk-informed approach aligned with the information and computer security guidance within the IAEA Nuclear Security Series (NSS). Rather than a prescriptive approach, we advise a graded approach, enabling organizations to determine the level of control required for a product or process based on the potential consequences of a cyberattack. For instance, the first step in a computer security programme is to review the functions of the nuclear facility, assess their impact on safety and security, and determine the appropriate level of security requirements.
Prevention, detection and mitigation Predicting how cyberattacks will evolve in the future is challenging, so the IEC has worked closely with the IAEA and developed standards that recommend that computer security programmes in nuclear facilities