Nuclear facilities face many of the same cyber security issues as other commercial organisations, although the presence of hazardous material and use of specialised industrial control systems (ICSs) are unique to the industry. Operators may also be required by their regulator to meet specific cyber security requirements, although this is not always the case.

Strong leadership of cyber security requires senior representation and management commitment. To drive effective cyber security practice, the UK’s National Cyber Security Centre (NCSC) recommends that organisations adopt a strategic risk management approach to cyber security. Organisations are encouraged to submit responsibilities for cyber security at the board-level, allowing them to, ‘[draw] effectively on senior management support, risk management policies and processes, a risk-aware culture and the assessment of risks against objectives.’ Such an approach is consistent with IAEA guidance that emphasises proportionate responses and that managers make effective use of authority to foster better compliance with security regulations.

The IAEA recommends that sites should have a Computer Security Plan (CSP), which complements the Site Security Plan (SSP) and implementation of physical security. Notably, ‘[i]nteraction between computer systems in nuclear facilities may affect security in non-obvious ways. It is therefore important that the security plan identifies all assets and includes a more comprehensive inventory of those assets critical to facility security and safety functions.’ [emphasis in original].

Owing to multiple lifetime phases and modes of operation, CSPs and inventories should be periodically revised. For example, maintenance periods may require equipment to be replaced, modified or tested as well as necessitating additional staff or contractor access. The varying nature of site activities should be taken into account in the CSP and in particular, ‘different lifetime phases might imply strong revisions of the CSP.’

Ideally, management commitment for computer security is supported by a computer security programme that includes designated Computer Security Officers.

As regular users, employees are often at the forefront of cyber risk – with cyber security risks being potentially either malicious or accidental through human error (such as inadvertently opening a phishing email, or using an infected USB stick). Simple steps that employees and management can take to help mitigate risks include:

• Refrain from clicking on suspicious weblinks

• Report attempted phishing

• Take part in regular training/sensitisation

• Minimise UBS sticks

• Conduct red teaming exercises in the IT department on phishing emails etc.

• Feed back regularly on incidents and praise good responses

Further Reading:

The UK National Cyber Security Centre, website

International Atomic Energy Agency (IAEA), Nuclear Security Culture, IAEA Nuclear Security Series: Implementing Guide, No. 7, Vienna, 2008

International Atomic Energy Agency (IAEA), Computer Security at Nuclear Facilities, IAEA Nuclear Security Series: Technical Guidance, No. 17, IAEA, Vienna, 2011

The International Electrotechnical Commission also hosts numerous relevant documents. For example, see ISO/IEC 27000:2009, ISO/IEC 27001:2005ISO/IEC 27002:2005, ISO/IEC 27005:2008, ISO/IEC 27006:2007