7
7
7
7
Organisations face a range of cyber threats, including attacks to the front-end of a website aimed at damaging a company’s reputation; attacks seeking to steal or alter technical or personnel-related information; and attacks aimed at taking control of physical systems. These threats are magnified by the involvement of insiders. According to a 2018 report by IBM, insiders accounted for 60% of cyber attacks in 2017 and two-thirds of data breaches. The 2019 iteration of the report drew attention to the ‘inadvertent insider’ “who unwittingly compromise the environment”. According to IBM, the two most prolific ways inadvertent insiders leave organizations open to attack “is by falling for phishing scams or social engineering, and through the improper configuration of systems, servers, and cloud environments, and by foregoing password best practices”.
Historically, there have been relatively few serious cyber related incidents at nuclear organisations. Perhaps the most famous is the Stuxnet virus that attacked Iran’s uranium enrichment facility in Natanz. First uncovered in 2010, the virus was able to breech Iran’s ‘air-gapped’ computer systems and provide unauthorised commands to the Programmable Logic Controller (PLC), damaging centrifuge operations. Other examples include cyber attacks on India’s nuclear infrastructure. On 30 October 2019, the Nuclear Power Corporation of India Limited (NPCIL) confirmed that malware (linked to North Korean hackers) had been identified on its systems. Although NPCIL insisted that the malware was “isolated from the critical internal network”, the extend of the malware’s penetration is disputed – with the attackers gaining a privileged vantage point of the operations.
As facilities integrate more systems, the potential for the cyber domain as an attack vector increases. Moreover, as noted by the IAEA there is a “continuous trend towards growing [cyber] attack sophistication and decreasing knowledge required to launch such an attack.” The proliferation of hacking skills suggests a greater diversity of potential actors and motivations that may wish to harm nuclear organisations.
Cyber attacks should be included in the design basis threat (DBT) assessment and, because of the increased potential for cyber-attacks, the IAEA recommends that “computer security programmes should strive to maintain a level of assessment that covers a very broad range of possible attack scenarios.”
Further Reading:
