WorldWideScience

Sample records for framework cyber-security requirements

  1. A framework for cyber security test

    International Nuclear Information System (INIS)

    Han, Kyungsoo; Song, Jaegu; Jung, Sungmin; Lee, Jungwoon; Lee, Cheolkwon

    2014-01-01

    The person in charge of I and C cyber security must not only perform real-time security inspections but also have the capabilities for performing vulnerability scanning and penetration testing, in order for vulnerability assessment. Vulnerability scanning and penetration testing are intended to find vulnerabilities in a digital system in order to make it more secure, and to determine whether it is vulnerable to attacks. In the IT sector, automated vulnerability scanning and penetration testing tools are being developed and continually researched. However, for a NPP I and C systems in which the method of communication is mixed (TCP/IP and serial), it is difficult to use the existing tools. This paper describes the penetration test framework for the IT sector, which is one of the cyber security test methods available. It concludes by discussing the need to develop a new penetration method for performing cyber security testing for NPP I and C systems, as well as the need for the NPP I and C test-bed. Security vulnerabilities need to be identified and continuously managed through vulnerability scans and assessments. For known vulnerabilities, the vulnerabilities of the target system can be periodically managed via a vulnerability database. These activities such as fuzzing, penetration testing, etc. must not affect the availability or the integrity of the NPP I and C systems. It is desired that a NPP I and C cyber security test-bad environment that exactly models the actual system must be first constructed and then penetration testing done

  2. A framework for cyber security test

    Energy Technology Data Exchange (ETDEWEB)

    Han, Kyungsoo; Song, Jaegu; Jung, Sungmin; Lee, Jungwoon; Lee, Cheolkwon [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2014-05-15

    The person in charge of I and C cyber security must not only perform real-time security inspections but also have the capabilities for performing vulnerability scanning and penetration testing, in order for vulnerability assessment. Vulnerability scanning and penetration testing are intended to find vulnerabilities in a digital system in order to make it more secure, and to determine whether it is vulnerable to attacks. In the IT sector, automated vulnerability scanning and penetration testing tools are being developed and continually researched. However, for a NPP I and C systems in which the method of communication is mixed (TCP/IP and serial), it is difficult to use the existing tools. This paper describes the penetration test framework for the IT sector, which is one of the cyber security test methods available. It concludes by discussing the need to develop a new penetration method for performing cyber security testing for NPP I and C systems, as well as the need for the NPP I and C test-bed. Security vulnerabilities need to be identified and continuously managed through vulnerability scans and assessments. For known vulnerabilities, the vulnerabilities of the target system can be periodically managed via a vulnerability database. These activities such as fuzzing, penetration testing, etc. must not affect the availability or the integrity of the NPP I and C systems. It is desired that a NPP I and C cyber security test-bad environment that exactly models the actual system must be first constructed and then penetration testing done.

  3. Primer Control System Cyber Security Framework and Technical Metrics

    Energy Technology Data Exchange (ETDEWEB)

    Wayne F. Boyer; Miles A. McQueen

    2008-05-01

    The Department of Homeland Security National Cyber Security Division supported development of a control system cyber security framework and a set of technical metrics to aid owner-operators in tracking control systems security. The framework defines seven relevant cyber security dimensions and provides the foundation for thinking about control system security. Based on the developed security framework, a set of ten technical metrics are recommended that allow control systems owner-operators to track improvements or degradations in their individual control systems security posture.

  4. Control Systems Security Center Comparison Study of Industrial Control System Standards against the Control Systems Protection Framework Cyber-Security Requirements

    Energy Technology Data Exchange (ETDEWEB)

    Robert P. Evans

    2005-09-01

    Cyber security standards, guidelines, and best practices for control systems are critical requirements that have been delineated and formally recognized by industry and government entities. Cyber security standards provide a common language within the industrial control system community, both national and international, to facilitate understanding of security awareness issues but, ultimately, they are intended to strengthen cyber security for control systems. This study and the preliminary findings outlined in this report are an initial attempt by the Control Systems Security Center (CSSC) Standard Awareness Team to better understand how existing and emerging industry standards, guidelines, and best practices address cyber security for industrial control systems. The Standard Awareness Team comprised subject matter experts in control systems and cyber security technologies and standards from several Department of Energy (DOE) National Laboratories, including Argonne National Laboratory, Idaho National Laboratory, Pacific Northwest National Laboratory, and Sandia National Laboratories. This study was conducted in two parts: a standard identification effort and a comparison analysis effort. During the standard identification effort, the Standard Awareness Team conducted a comprehensive open-source survey of existing control systems security standards, regulations, and guidelines in several of the critical infrastructure (CI) sectors, including the telecommunication, water, chemical, energy (electric power, petroleum and oil, natural gas), and transportation--rail sectors and sub-sectors. During the comparison analysis effort, the team compared the requirements contained in selected, identified, industry standards with the cyber security requirements in ''Cyber Security Protection Framework'', Version 0.9 (hereafter referred to as the ''Framework''). For each of the seven sector/sub-sectors listed above, one standard was

  5. Cyber Security Research Frameworks For Coevolutionary Network Defense

    Energy Technology Data Exchange (ETDEWEB)

    Rush, George D. [Missouri Univ. of Science and Technology, Rolla, MO (United States); Tauritz, Daniel Remy [Los Alamos National Lab. (LANL), Los Alamos, NM (United States)

    2015-12-03

    Several architectures have been created for developing and testing systems used in network security, but most are meant to provide a platform for running cyber security experiments as opposed to automating experiment processes. In the first paper, we propose a framework termed Distributed Cyber Security Automation Framework for Experiments (DCAFE) that enables experiment automation and control in a distributed environment. Predictive analysis of adversaries is another thorny issue in cyber security. Game theory can be used to mathematically analyze adversary models, but its scalability limitations restrict its use. Computational game theory allows us to scale classical game theory to larger, more complex systems. In the second paper, we propose a framework termed Coevolutionary Agent-based Network Defense Lightweight Event System (CANDLES) that can coevolve attacker and defender agent strategies and capabilities and evaluate potential solutions with a custom network defense simulation. The third paper is a continuation of the CANDLES project in which we rewrote key parts of the framework. Attackers and defenders have been redesigned to evolve pure strategy, and a new network security simulation is devised which specifies network architecture and adds a temporal aspect. We also add a hill climber algorithm to evaluate the search space and justify the use of a coevolutionary algorithm.

  6. Framework for an African policy towards creating cyber security awareness

    CSIR Research Space (South Africa)

    Dlamini, IZ

    2011-05-01

    Full Text Available Cyber security is a GLOBAL issue. The rest of the world needs Africa to be aware and ready. Furthermore, Africa can only be aware and ready if it is internally organised and collaborates effectively with the rest of the world. The African continent...

  7. Framework for Grading of Cyber Security Check-List upon I and C Architecture

    International Nuclear Information System (INIS)

    Shin, Jin Soo; Heo, Gyunyong; Son, Han Seong

    2016-01-01

    Cyber-attack can threaten research reactors as well as NPPs since the goal of cyber-attack is not only to make a catastrophic accident such as radiation exposure against public health but also to make chaos or anxiety among the public. Moreover, there is more probability to occur in research reactors than NPPs since research reactors has more users than NPPs. The nuclear regulatory agencies such as U.S.NRC and KINAC (Korea Institute of Nuclear Nonproliferation and Control) have published regulatory guides for rules against cyber-attack to maintain cyber security of nuclear facilities. U.S.NRC has published a regulatory guide (U.S.NRC / RG-5.71) and KINAC has developed a regulatory standard (KINAC / RS-015) to establish a cyber security for nuclear facilities. However, these regulatory documents represent check-list for cyber security regardless of reactor type such as NPPs or research reactors. The proposed framework in this paper was grading of cyber security check-lists with BBN by I and C architecture such as NPPs and research reactors. First, the BBN model was developed to apply I and C system architecture of target nuclear facility. The architecture model calculates the cyber security risk with structural architecture, vulnerability, and mitigation measure. Second, cyber security check-lists are defined in cyber security documents. It is, then, used with the consideration of mitigation measures of BBN model in order to apply architectural characteristic. Third, after assuming cyber-attack occurs to I and C system, the model calculates the posterior information using Bayesian update. Finally, the cyber security check-lists for nuclear facilities are graded upon I and C architecture with the posterior information for mitigation measures

  8. Framework for Grading of Cyber Security Check-List upon I and C Architecture

    Energy Technology Data Exchange (ETDEWEB)

    Shin, Jin Soo; Heo, Gyunyong [Kyunghee University, Yongin (Korea, Republic of); Son, Han Seong [Joongbu University, Geumsan (Korea, Republic of)

    2016-05-15

    Cyber-attack can threaten research reactors as well as NPPs since the goal of cyber-attack is not only to make a catastrophic accident such as radiation exposure against public health but also to make chaos or anxiety among the public. Moreover, there is more probability to occur in research reactors than NPPs since research reactors has more users than NPPs. The nuclear regulatory agencies such as U.S.NRC and KINAC (Korea Institute of Nuclear Nonproliferation and Control) have published regulatory guides for rules against cyber-attack to maintain cyber security of nuclear facilities. U.S.NRC has published a regulatory guide (U.S.NRC / RG-5.71) and KINAC has developed a regulatory standard (KINAC / RS-015) to establish a cyber security for nuclear facilities. However, these regulatory documents represent check-list for cyber security regardless of reactor type such as NPPs or research reactors. The proposed framework in this paper was grading of cyber security check-lists with BBN by I and C architecture such as NPPs and research reactors. First, the BBN model was developed to apply I and C system architecture of target nuclear facility. The architecture model calculates the cyber security risk with structural architecture, vulnerability, and mitigation measure. Second, cyber security check-lists are defined in cyber security documents. It is, then, used with the consideration of mitigation measures of BBN model in order to apply architectural characteristic. Third, after assuming cyber-attack occurs to I and C system, the model calculates the posterior information using Bayesian update. Finally, the cyber security check-lists for nuclear facilities are graded upon I and C architecture with the posterior information for mitigation measures.

  9. A conceptual framework for cyber security awareness and education in SA

    Directory of Open Access Journals (Sweden)

    Noluxolo Kortjan

    2014-06-01

    Full Text Available The Internet is becoming increasingly interwoven in the daily lives of many individuals, organisations and nations. It has, to a large extent, had a positive effect on the way people communicate. It has also introduced new avenues for business; and it has offered nations an opportunity to govern online. Nevertheless, although cyberspace offers an endless list of services and opportunities, it is also accompanied by many risks, of which many Internet users are not aware. As such, various countries have developed and implemented cyber-security awareness and education measures to counter the perceived ignorance of the Internet users. However, there is currently a definite lack in South Africa (SA in this regard; as there are currently, little government-led and sponsored cyber-security awareness and education initiatives. The primary research objective of this paper, therefore, is to propose a cyber-security awareness and education framework for SA that would assist in creating a cyber-secure culture in SA among all of the users of the Internet. This framework will be developed on the basis of key factors extrapolated from a comparative analysis of relevant developed countries.

  10. National Cyber Security Policy

    Indian Academy of Sciences (India)

    National Cyber Security Policy. Salient Features: Caters to ... Creating a secure cyber ecosystem. Creating an assurance framework. Encouraging Open Standards. Strengthening the Regulatory framework. Creating mechanisms for security threat early warning, vulnerability management and response to security threats.

  11. Towards a Relation Extraction Framework for Cyber-Security Concepts

    Energy Technology Data Exchange (ETDEWEB)

    Jones, Corinne L [ORNL; Bridges, Robert A [ORNL; Huffer, Kelly M [ORNL; Goodall, John R [ORNL

    2015-01-01

    In order to assist security analysts in obtaining information pertaining to their network, such as novel vulnerabilities, exploits, or patches, information retrieval methods tailored to the security domain are needed. As labeled text data is scarce and expensive, we follow developments in semi-supervised NLP and implement a bootstrapping algorithm for extracting security entities and their relationships from text. The algorithm requires little input data, specifically, a few relations or patterns (heuristics for identifying relations), and incorporates an active learning component which queries the user on the most important decisions to prevent drifting the desired relations. Preliminary testing on a small corpus shows promising results, obtaining precision of .82.

  12. A macro-economic framework for evaluation of cyber security risks related to protection of intellectual property.

    Science.gov (United States)

    Andrijcic, Eva; Horowitz, Barry

    2006-08-01

    The article is based on the premise that, from a macro-economic viewpoint, cyber attacks with long-lasting effects are the most economically significant, and as a result require more attention than attacks with short-lasting effects that have historically been more represented in literature. In particular, the article deals with evaluation of cyber security risks related to one type of attack with long-lasting effects, namely, theft of intellectual property (IP) by foreign perpetrators. An International Consequence Analysis Framework is presented to determine (1) the potential macro-economic consequences of cyber attacks that result in stolen IP from companies in the United States, and (2) the likely sources of such attacks. The framework presented focuses on IP theft that enables foreign companies to make economic gains that would have otherwise benefited the U.S. economy. Initial results are presented.

  13. Cyber security

    CERN Document Server

    Voeller, John G

    2014-01-01

    Cyber Security features articles from the Wiley Handbook of Science and Technology for Homeland Security covering topics related to cyber security metrics and measure  and related technologies that meet security needs. Specific applications to web services, the banking and the finance sector, and industrial process control systems are discussed.

  14. Cyber security threats in the power sector: Need for a domain specific regulatory framework in India

    International Nuclear Information System (INIS)

    Ananda Kumar, V.; Pandey, Krishan K.; Punia, Devendra Kumar

    2014-01-01

    India is poised to spend over USD 5.8 billion as part of the National Smart Grid Mission aimed to alleviate India's ailing power sector as part of its 12th Five year plan (2012–2017). The federal government sponsored Restructured Accelerated Power Development and Reforms Program (R-APDRP) is also focused on building ICT capability in the state electricity boards. Presently however, there is no power sector specific cyber security mandates or policies in India. The Stuxnet, Shamoon and Anonymous incidents have shown that cyber attacks can cause significant damage and pose a risk to National Critical Infrastructure. A lack of security planning as part of designing the Smart grids can potentially leave gaping holes in the country's power sector stability. The paper highlights key cyber security threats across the entire power sector value chain—from generation, to transmission and distribution. It is aimed at building the case for power sector specific cyber security regulations based on the experience of regulators in other critical infrastructure sectors like Banking and Telecom in India and power sector regulations internationally. - Highlights: • Cyber security in power sector is key to protecting national critical infrastructure. • Poor cyber security planning would impact the power sector in India. • A laissez-faire approach to cyber security in power sector may not yield results. • There is a need for power sector specific cyber security regulations

  15. Development of Cyber Security Scheme for Nuclear Power Plant

    Energy Technology Data Exchange (ETDEWEB)

    Hong, S. B.; Choi, Y. S.; Cho, J. W. (and others)

    2009-12-15

    Nuclear I and C system is considered to be safe on the cyber threat because of the use of exclusive communication network and operating system. But the trend of open architecture and standardization on the equipment of I and C system, it is not safe on the cyber threat such as hacking and cyber terror. It is needed to protect nuclear I and C systems by the cyber attack, Countermeasures of the cyber security is required a lot of time and endeavors because there are many factors on the environment of cyber security and cyber attack. For the nuclear cyber security, we should make structural framework and eliminate cyber vulnerabilities by the analysis of cyber environment. The framework for the cyber security includes planning, embodiment of security technologies, security audit, security management and security maintenance. In this report, we examined IT security technology and the trend of standard in the industrial I and C system, and proposed a method to construct cyber security for the nuclear power plant. We analysed the threat of cyber security, vulnerability and cyber risk, then we present a method for the cyber security structure and the countermeasures.

  16. Development of Cyber Security Scheme for Nuclear Power Plant

    International Nuclear Information System (INIS)

    Hong, S. B.; Choi, Y. S.; Cho, J. W.

    2009-12-01

    Nuclear I and C system is considered to be safe on the cyber threat because of the use of exclusive communication network and operating system. But the trend of open architecture and standardization on the equipment of I and C system, it is not safe on the cyber threat such as hacking and cyber terror. It is needed to protect nuclear I and C systems by the cyber attack, Countermeasures of the cyber security is required a lot of time and endeavors because there are many factors on the environment of cyber security and cyber attack. For the nuclear cyber security, we should make structural framework and eliminate cyber vulnerabilities by the analysis of cyber environment. The framework for the cyber security includes planning, embodiment of security technologies, security audit, security management and security maintenance. In this report, we examined IT security technology and the trend of standard in the industrial I and C system, and proposed a method to construct cyber security for the nuclear power plant. We analysed the threat of cyber security, vulnerability and cyber risk, then we present a method for the cyber security structure and the countermeasures

  17. NERSC Cyber Security Challenges That Require DOE Development andSupport

    Energy Technology Data Exchange (ETDEWEB)

    Draney, Brent; Campbell, Scott; Walter, Howard

    2007-01-16

    Traditional security approaches do not adequately addressall the requirements of open, scientific computing facilities. Many ofthe methods used for more restricted environments, including almost allcorporate/commercial systems, do not meet the needs of today's science.Use of only the available "state of the practice" commercial methods willhave adverse impact on the ability of DOE to accomplish its sciencegoals, and impacts the productivity of the DOE Science community. Inparticular, NERSC and other high performance computing (HPC) centers havespecial security challenges that are unlikely to be met unless DOE fundsdevelopment and support of reliable and effective tools designed to meetthe cyber security needs of High Performance Science. The securitychallenges facing NERSC can be collected into three basic problem sets:network performance and dynamics, application complexity and diversity,and a complex user community that can have transient affiliations withactual institutions. To address these problems, NERSC proposes thefollowing four general solutions: auditing user and system activityacross sites; firewall port configuration in real time;cross-site/virtual organization identity management and access control;and detecting security issues in application middleware. Solutions arealsoproposed for three general long term issues: data volume,application complexity, and information integration.

  18. Development of a cyber security risk model using Bayesian networks

    International Nuclear Information System (INIS)

    Shin, Jinsoo; Son, Hanseong; Khalil ur, Rahman; Heo, Gyunyoung

    2015-01-01

    Cyber security is an emerging safety issue in the nuclear industry, especially in the instrumentation and control (I and C) field. To address the cyber security issue systematically, a model that can be used for cyber security evaluation is required. In this work, a cyber security risk model based on a Bayesian network is suggested for evaluating cyber security for nuclear facilities in an integrated manner. The suggested model enables the evaluation of both the procedural and technical aspects of cyber security, which are related to compliance with regulatory guides and system architectures, respectively. The activity-quality analysis model was developed to evaluate how well people and/or organizations comply with the regulatory guidance associated with cyber security. The architecture analysis model was created to evaluate vulnerabilities and mitigation measures with respect to their effect on cyber security. The two models are integrated into a single model, which is called the cyber security risk model, so that cyber security can be evaluated from procedural and technical viewpoints at the same time. The model was applied to evaluate the cyber security risk of the reactor protection system (RPS) of a research reactor and to demonstrate its usefulness and feasibility. - Highlights: • We developed the cyber security risk model can be find the weak point of cyber security integrated two cyber analysis models by using Bayesian Network. • One is the activity-quality model signifies how people and/or organization comply with the cyber security regulatory guide. • Other is the architecture model represents the probability of cyber-attack on RPS architecture. • The cyber security risk model can provide evidence that is able to determine the key element for cyber security for RPS of a research reactor

  19. Review on Cyber Security Programs for NPP Application

    Energy Technology Data Exchange (ETDEWEB)

    Oh, Eung Se [KEPRI, Daejeon (Korea, Republic of)

    2010-10-15

    Increased history records of cyber security (CS) attacks and concerns for computers and networks technical mishaps pull out cyber security to open places. In spite of secrete nature of security, transparent and shared knowledge of many security features are more required at modern plant floors. Korea Institute of Nuclear Safety (KINS), US Government and Nuclear Regulatory Commission (NRC) requested to develop cyber security plans and enforce their implementing to the NPPs. [KINS; CFR; RG 5.71] This paper reviews various cyber security guidelines and suggests an applicable cyber security program development models during the life cycle of NPP's Instrumentation and Control (I and C) systems

  20. Review on Cyber Security Programs for NPP Application

    International Nuclear Information System (INIS)

    Oh, Eung Se

    2010-01-01

    Increased history records of cyber security (CS) attacks and concerns for computers and networks technical mishaps pull out cyber security to open places. In spite of secrete nature of security, transparent and shared knowledge of many security features are more required at modern plant floors. Korea Institute of Nuclear Safety (KINS), US Government and Nuclear Regulatory Commission (NRC) requested to develop cyber security plans and enforce their implementing to the NPPs. [KINS] [CFR] [RG 5.71] This paper reviews various cyber security guidelines and suggests an applicable cyber security program development models during the life cycle of NPP's Instrumentation and Control (I and C) systems

  1. Considerations on Cyber Security Assessments of Korean Nuclear Power Plants

    International Nuclear Information System (INIS)

    Lee, Jung-Woon; Song, Jae-Gu; Han, Kyung-Soo; Lee, Cheol Kwon; Kang, Mingyun

    2015-01-01

    Korea Institute of Nuclear Nonproliferation and Control (KINAC) has prepared the regulatory standard RS-015 based on RG 5.71. RS-015 defines the elements of a cyber security program to be established in nuclear facilities and describes the security control items and relevant requirements. Cyber security assessments are important initial activities in a cyber security program for NPPs. Cyber security assessments can be performed in the following key steps: 1) Formation of a cyber security assessment team (CSAT); 2) Identification of critical systems and critical digital assets (CDAs); 3) Plant compliance checks with the security control requirements in RS-015. Through the assessments, the current status of security controls applied to NPPs can be found out. The assessments provide baseline data for remedial activities. Additional analyses with the results from the assessments should be performed before the implementation of remedial security controls. The cyber security team at the Korea Atomic Energy Research Institute (KAERI) has studied how to perform cyber security assessments for NPPs based on the regulatory requirements. Recently, KAERI's cyber security team has performed pilot cyber security assessments of a Korean NPP. Based on this assessment experience, considerations and checkpoints which would be helpful for full-scale cyber security assessments of Korean NPPs and the implementation of remedial security controls are discussed in this paper. Cyber security assessment is one of important and immediate activities for NPP cyber security. The quality of the first assessment will be a barometer for NPP cyber security. Hence cyber security assessments of Korean NPPs should be performed elaborately

  2. Considerations on Cyber Security Assessments of Korean Nuclear Power Plants

    Energy Technology Data Exchange (ETDEWEB)

    Lee, Jung-Woon; Song, Jae-Gu; Han, Kyung-Soo; Lee, Cheol Kwon [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of); Kang, Mingyun [E-Gonggam Co. Ltd., Daejeon (Korea, Republic of)

    2015-10-15

    Korea Institute of Nuclear Nonproliferation and Control (KINAC) has prepared the regulatory standard RS-015 based on RG 5.71. RS-015 defines the elements of a cyber security program to be established in nuclear facilities and describes the security control items and relevant requirements. Cyber security assessments are important initial activities in a cyber security program for NPPs. Cyber security assessments can be performed in the following key steps: 1) Formation of a cyber security assessment team (CSAT); 2) Identification of critical systems and critical digital assets (CDAs); 3) Plant compliance checks with the security control requirements in RS-015. Through the assessments, the current status of security controls applied to NPPs can be found out. The assessments provide baseline data for remedial activities. Additional analyses with the results from the assessments should be performed before the implementation of remedial security controls. The cyber security team at the Korea Atomic Energy Research Institute (KAERI) has studied how to perform cyber security assessments for NPPs based on the regulatory requirements. Recently, KAERI's cyber security team has performed pilot cyber security assessments of a Korean NPP. Based on this assessment experience, considerations and checkpoints which would be helpful for full-scale cyber security assessments of Korean NPPs and the implementation of remedial security controls are discussed in this paper. Cyber security assessment is one of important and immediate activities for NPP cyber security. The quality of the first assessment will be a barometer for NPP cyber security. Hence cyber security assessments of Korean NPPs should be performed elaborately.

  3. Cyber Security : Home User's Perspective

    OpenAIRE

    Ikonen, Mikko

    2014-01-01

    Cyber security is important to understand for home users. New technology allows for new cyber threats to emerge and new solutions must be considered to counter them. Nearly every device is connected to the Internet and this opens new possibilities and threats to cyber security. This Bachelor's thesis explores the different aspects of cyber security and suggests solutions to different cyber security issues found. The different aspects of cyber security under research here include personal ...

  4. Study on Nuclear Facility Cyber Security Awareness and Training Programs

    International Nuclear Information System (INIS)

    Lee, Jung-Woon; Song, Jae-Gu; Lee, Cheol-Kwon

    2016-01-01

    Cyber security awareness and training, which is a part of operational security controls, is defined to be implemented later in the CSP implementation schedule. However, cyber security awareness and training is a prerequisite for the appropriate implementation of a cyber security program. When considering the current situation in which it is just started to define cyber security activities and to assign personnel who has responsibilities for performing those activities, a cyber security awareness program is necessary to enhance cyber security culture for the facility personnel to participate positively in cyber security activities. Also before the implementation of stepwise CSP, suitable education and training should be provided to both cyber security teams (CST) and facility personnel who should participate in the implementation. Since such importance and urgency of cyber security awareness and training is underestimated at present, the types, trainees, contents, and development strategies of cyber security awareness and training programs are studied to help Korean nuclear facilities to perform cyber security activities more effectively. Cyber security awareness and training programs should be developed ahead of the implementation of CSP. In this study, through the analysis of requirements in the regulatory standard RS-015, the types and trainees of overall cyber security training programs in nuclear facilities are identified. Contents suitable for a cyber security awareness program and a technical training program are derived. It is suggested to develop stepwise the program contents in accordance with the development of policies, guides, and procedures as parts of the facility cyber security program. Since any training programs are not available for the specialized cyber security training in nuclear facilities, a long-term development plan is necessary. As alternatives for the time being, several cyber security training courses for industrial control systems by

  5. Study on Nuclear Facility Cyber Security Awareness and Training Programs

    Energy Technology Data Exchange (ETDEWEB)

    Lee, Jung-Woon; Song, Jae-Gu; Lee, Cheol-Kwon [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2016-10-15

    Cyber security awareness and training, which is a part of operational security controls, is defined to be implemented later in the CSP implementation schedule. However, cyber security awareness and training is a prerequisite for the appropriate implementation of a cyber security program. When considering the current situation in which it is just started to define cyber security activities and to assign personnel who has responsibilities for performing those activities, a cyber security awareness program is necessary to enhance cyber security culture for the facility personnel to participate positively in cyber security activities. Also before the implementation of stepwise CSP, suitable education and training should be provided to both cyber security teams (CST) and facility personnel who should participate in the implementation. Since such importance and urgency of cyber security awareness and training is underestimated at present, the types, trainees, contents, and development strategies of cyber security awareness and training programs are studied to help Korean nuclear facilities to perform cyber security activities more effectively. Cyber security awareness and training programs should be developed ahead of the implementation of CSP. In this study, through the analysis of requirements in the regulatory standard RS-015, the types and trainees of overall cyber security training programs in nuclear facilities are identified. Contents suitable for a cyber security awareness program and a technical training program are derived. It is suggested to develop stepwise the program contents in accordance with the development of policies, guides, and procedures as parts of the facility cyber security program. Since any training programs are not available for the specialized cyber security training in nuclear facilities, a long-term development plan is necessary. As alternatives for the time being, several cyber security training courses for industrial control systems by

  6. Development of a Quantitative Method for Evaluating the Efficacy of Cyber Security Controls in NPPs based on Intrusion Tolerant Concept

    International Nuclear Information System (INIS)

    Lee, Chanyoung; Seong, Poong Hyun

    2017-01-01

    Digital I and C systems have been developed and installed in nuclear power plants (NPPs). However, due to installation of digital I and C systems, cyber security concerns are increasing in the nuclear industry. In order to provide useful information about cyber security issues, many regulatory documents, guides and standards were already published in the nuclear industry. The documents include cyber security plans, methods for cyber security assessments and comprehensive set of security controls. In order for useful information about cyber security issues, many regulatory documents, guides and standards have been already published in the nuclear industry. However, there are still difficulties when it comes to deciding which security controls are needed and to defining appropriate security control requirements. It is because practical examples for the application of security controls have not been available to system designers and there is a lack of means for estimating the effectiveness of security controls. In this regard, this paper suggested a framework to quantitatively evaluate how much cyber security is improved when specific cyber security controls are applied in NPPs.

  7. Maritime Cyber Security University Research

    Science.gov (United States)

    2016-05-01

    i Classification | CG-926 RDC | author | audience | month year Maritime Cyber Security University Research Phase I - Final Report...Distribution Statement A: Approved for public release; distribution is unlimited. May 2016 Report No. CG-D-06-16 Maritime Cyber Security...Director United States Coast Guard Research & Development Center 1 Chelsea Street New London, CT 06320 Maritime Cyber Security University

  8. Cyber Security and Resilient Systems

    International Nuclear Information System (INIS)

    Anderson, Robert S.

    2009-01-01

    The Department of Energy (DOE) Idaho National Laboratory (INL) has become a center of excellence for critical infrastructure protection, particularly in the field of cyber security. It is one of only a few national laboratories that have enhanced the nation's cyber security posture by performing industrial control system (ICS) vendor assessments as well as user on-site assessments. Not only are vulnerabilities discovered, but described actions for enhancing security are suggested - both on a system-specific basis and from a general perspective of identifying common weaknesses and their corresponding corrective actions. These cyber security programs have performed over 40 assessments to date which have led to more robust, secure, and resilient monitoring and control systems for the US electrical grid, oil and gas, chemical, transportation, and many other sectors. In addition to cyber assessments themselves, the INL has been engaged in outreach to the ICS community through vendor forums, technical conferences, vendor user groups, and other special engagements as requested. Training programs have been created to help educate all levels of management and worker alike with an emphasis towards real everyday cyber hacking methods and techniques including typical exploits that are used. The asset owner or end user has many products available for its use created from these programs. One outstanding product is the US Department of Homeland Security (DHS) Cyber Security Procurement Language for Control Systems document that provides insight to the user when specifying a new monitoring and control system, particularly concerning security requirements. Employing some of the top cyber researchers in the nation, the INL can leverage this talent towards many applications other than critical infrastructure. Monitoring and control systems are used throughout the world to perform simple tasks such as cooking in a microwave to complex ones such as the monitoring and control of the

  9. Cyber Security and Resilient Systems

    Energy Technology Data Exchange (ETDEWEB)

    Robert S. Anderson

    2009-07-01

    The Department of Energy (DOE) Idaho National Laboratory (INL) has become a center of excellence for critical infrastructure protection, particularly in the field of cyber security. It is one of only a few national laboratories that have enhanced the nation’s cyber security posture by performing industrial control system (ICS) vendor assessments as well as user on-site assessments. Not only are vulnerabilities discovered, but described actions for enhancing security are suggested – both on a system-specific basis and from a general perspective of identifying common weaknesses and their corresponding corrective actions. These cyber security programs have performed over 40 assessments to date which have led to more robust, secure, and resilient monitoring and control systems for the US electrical grid, oil and gas, chemical, transportation, and many other sectors. In addition to cyber assessments themselves, the INL has been engaged in outreach to the ICS community through vendor forums, technical conferences, vendor user groups, and other special engagements as requested. Training programs have been created to help educate all levels of management and worker alike with an emphasis towards real everyday cyber hacking methods and techniques including typical exploits that are used. The asset owner or end user has many products available for its use created from these programs. One outstanding product is the US Department of Homeland Security (DHS) Cyber Security Procurement Language for Control Systems document that provides insight to the user when specifying a new monitoring and control system, particularly concerning security requirements. Employing some of the top cyber researchers in the nation, the INL can leverage this talent towards many applications other than critical infrastructure. Monitoring and control systems are used throughout the world to perform simple tasks such as cooking in a microwave to complex ones such as the monitoring and control of the

  10. Understanding human factors in cyber security as a dynamic system

    NARCIS (Netherlands)

    Young, H.J.; Vliet, A.J. van; Ven, J.G.S. van de; Jol, S.C.; Broekman, C.C.M.T.

    2018-01-01

    The perspective of human factors is largely missing from the wider cyber security dialogue and its scope is often limited. We propose a framework in which we consider cyber security as a state of a system. System change is brought on by an entity’s behavior. Interventions are ways of changing

  11. Application of the Concept of Intrusion Tolerant System for Evaluating Cyber Security Enhancements

    International Nuclear Information System (INIS)

    Lee, Chanyoung; Seong, Poong Hyun

    2016-01-01

    One of the major problems is that nuclear industry is in very early stage in dealing with cyber security issues. It is because that cyber security has received less attention compared to other safety problems. In addition, late adoption of digital I and C systems has resulted in lower level of cyber security advancements in nuclear industry than ones in other industries. For the cyber security of NPP I and C systems, many regulatory documents, guides and standards were already published. These documents include cyber security plans, methods for cyber security assessments and comprehensive set of security controls. However, methods which can help assess how much security is improved if a specific security control is applied are not included in these documents. Hence, NPP I and C system designers may encounter difficulties when trying to apply security controls with limited structure and cost. In order to provide useful information about cyber security issues including cyber security enhancements, this paper suggests a framework to evaluate how much cyber security is improved when a specific cyber security enhancement is applied in NPPs. In order to provide useful information about cyber security issues including cyber security enhancements, this paper suggests a framework to evaluate how much cyber security is improved when a specific cyber security enhancement is applied in NPPs. The extent of cyber security improvement caused by security enhancement was defined as reduction ratio of the failure probability to secure the system from cyber-attack as Eq.1. The concept of 'intrusion tolerant system' was applied to not only prevent cyber-attacks but also limit the extent of damage in this study. For applying the concept of intrusion tolerant system to NPP, the event tree was constructed with some assumptions. Cyber security improvement caused by cyber security enhancement can be estimated as Eq.3. By comparing current system to the enhanced system, it is possible to

  12. Application of the Concept of Intrusion Tolerant System for Evaluating Cyber Security Enhancements

    Energy Technology Data Exchange (ETDEWEB)

    Lee, Chanyoung; Seong, Poong Hyun [KAIST, Daejeon (Korea, Republic of)

    2016-10-15

    One of the major problems is that nuclear industry is in very early stage in dealing with cyber security issues. It is because that cyber security has received less attention compared to other safety problems. In addition, late adoption of digital I and C systems has resulted in lower level of cyber security advancements in nuclear industry than ones in other industries. For the cyber security of NPP I and C systems, many regulatory documents, guides and standards were already published. These documents include cyber security plans, methods for cyber security assessments and comprehensive set of security controls. However, methods which can help assess how much security is improved if a specific security control is applied are not included in these documents. Hence, NPP I and C system designers may encounter difficulties when trying to apply security controls with limited structure and cost. In order to provide useful information about cyber security issues including cyber security enhancements, this paper suggests a framework to evaluate how much cyber security is improved when a specific cyber security enhancement is applied in NPPs. In order to provide useful information about cyber security issues including cyber security enhancements, this paper suggests a framework to evaluate how much cyber security is improved when a specific cyber security enhancement is applied in NPPs. The extent of cyber security improvement caused by security enhancement was defined as reduction ratio of the failure probability to secure the system from cyber-attack as Eq.1. The concept of 'intrusion tolerant system' was applied to not only prevent cyber-attacks but also limit the extent of damage in this study. For applying the concept of intrusion tolerant system to NPP, the event tree was constructed with some assumptions. Cyber security improvement caused by cyber security enhancement can be estimated as Eq.3. By comparing current system to the enhanced system, it is

  13. Metaphors for cyber security.

    Energy Technology Data Exchange (ETDEWEB)

    Moore, Judy Hennessey; Parrott, Lori K.; Karas, Thomas H.

    2008-08-01

    This report is based upon a workshop, called 'CyberFest', held at Sandia National Laboratories on May 27-30, 2008. Participants in the workshop came from organizations both outside and inside Sandia. The premise of the workshop was that thinking about cyber security from a metaphorical perspective could lead to a deeper understanding of current approaches to cyber defense and perhaps to some creative new approaches. A wide range of metaphors was considered, including those relating to: military and other types of conflict, biological, health care, markets, three-dimensional space, and physical asset protection. These in turn led to consideration of a variety of possible approaches for improving cyber security in the future. From the proposed approaches, three were formulated for further discussion. These approaches were labeled 'Heterogeneity' (drawing primarily on the metaphor of biological diversity), 'Motivating Secure Behavior' (taking a market perspective on the adoption of cyber security measures) and 'Cyber Wellness' (exploring analogies with efforts to improve individual and public health).

  14. Economic Analysis of Cyber Security

    National Research Council Canada - National Science Library

    Gallaher, Michael P; Rowe, Brent R; Rogozhin, Alex V; Link, Albert N

    2006-01-01

    .... However, few organizations attempt such analysis for their cyber security mechanisms. Key performance and evaluation metrics are not available, so organizations rely on qualitative assessments...

  15. Cyber Security--Are You Prepared?

    Science.gov (United States)

    Newman, Scott

    2007-01-01

    During the summer 2002 term, Oklahoma State University-Okmulgee's Information Technologies Division offered a one credit-hour network security course--which barely had adequate student interest to meet the institution's enrollment requirements. Today, OSU-Okmulgee boasts one of the nation's premier cyber security programs. Many prospective…

  16. Cyber Security Applications: Freeware & Shareware

    Science.gov (United States)

    Rogers, Gary; Ashford, Tina

    2015-01-01

    This paper will discuss some assignments using freeware/shareware instructors can find on the Web to use to provide students with hands-on experience in this arena. Also, the college, Palm Beach State College, via a grant with the U.S. Department of Labor, has recently purchased a unique cyber security device that simulates cyber security attacks…

  17. Cyber Security Analysis of Turkey

    OpenAIRE

    Senturk, Hakan; Çil, Zaim; Sağıroğlu, Şeref

    2016-01-01

    Considering the criticality of the cyber security threat in the 21st century, it is presumed that the nations are busy with series of activities in order to protect their security in the cyber space domain. In this paper, in light of the recent developments in the cyber security field, Turkey’s cyber security analysis is performed using a macro analysis model. We researched for the measures taken in Turkey with respect to those in the other countries, reviewed the posture, the activities and ...

  18. Cyber Security Training and Awareness Through Game Play

    National Research Council Canada - National Science Library

    Cone, Benjamin D; Thompson, Michael F; Irvine, Cynthia E; Nguyen, Thuy D

    2006-01-01

    Although many of the concepts included in staff cyber-security awareness training are universal, such training often must be tailored to address the policies and requirements of a particular organization...

  19. A Video Game for Cyber Security Training and Awareness

    National Research Council Canada - National Science Library

    Cone, Benjamin D; Irvine, Cynthia E; Thompson, Michael F; Nguyen, Thuy D

    2006-01-01

    Although many of the concepts included in cyber security awareness training are universal, such training often must be tailored to address the policies and requirements of a particular organization...

  20. INFORMATION SYSTEM SECURITY (CYBER SECURITY

    Directory of Open Access Journals (Sweden)

    Muhammad Siddique Ansari

    2016-03-01

    system force and structure reliance – are discovered and tantamount with EU nations. Thusly I indicated reason viewpoints and figures of security of data structures it additionally relates to the reason of estimation of transient dangers of security of frameworks for that I begin my proposal with one of the fundamental class of data security which is Cyber security. Keyword : Cyber Security, IT

  1. Literature Review on Cyber Security Investment Decisions

    OpenAIRE

    ŞENTÜRK, Hakan; ÇİL, Celal Zaim; SAĞIROĞLU, Şeref

    2016-01-01

    Severe financial losses incurred by cyber security attacks with increasing complexity and frequency, as well as booming cyber security sector offering variety of products as investment options have led the focus of the research in the field to the economic dimension of cyber security. The need for determination of methods to be used when making cyber security investment decisions under budget constraints have become prominent. In five sections as the cyber security investment strategies, risk...

  2. CENTER FOR CYBER SECURITY STUDIES

    Data.gov (United States)

    Federal Laboratory Consortium — The mission of the Center for Cyber Security Studies is to enhance the education of midshipmen in all areas of cyber warfare, to facilitate the sharing of expertise...

  3. Cyber security consideration on I and C system development process

    International Nuclear Information System (INIS)

    Park, Jaek Wan; Park, Jeyun; Kim, Young Ki

    2012-01-01

    Instrumentation and control (I and C) systems in nuclear power plants collect sensor signals installed in plant fields, monitor plant performance and status, and generate signals to control instruments for plant operation and protection. Recently, digital systems of I and C are required to be protected from cyber threats. It has been reported that several plants have been attacked and malfunctioned by outside intruders. To cope with cyber attacks, various studies have been proposed in IT and plant industries. From 2006, regulatory guides and industry standards for cyber security have been published. Therefore, these guides should be strongly considered in the development process of a digital system. Our framework refers to the system development life cycle described in RG 1.152. The main activities of RG 5.71 are included in the framework appropriately. This approach supports the consistent application of system features for cyber security by incorporating the security requirements required in the operation and maintenance phases into the initial phase of development process. It is expected that the application of the framework to a new plant system design may comply with both RG 1.152 and 5.71

  4. Cyber security consideration on I and C system development process

    Energy Technology Data Exchange (ETDEWEB)

    Park, Jaek Wan; Park, Jeyun; Kim, Young Ki [KAERI, Daejeon (Korea, Republic of)

    2012-10-15

    Instrumentation and control (I and C) systems in nuclear power plants collect sensor signals installed in plant fields, monitor plant performance and status, and generate signals to control instruments for plant operation and protection. Recently, digital systems of I and C are required to be protected from cyber threats. It has been reported that several plants have been attacked and malfunctioned by outside intruders. To cope with cyber attacks, various studies have been proposed in IT and plant industries. From 2006, regulatory guides and industry standards for cyber security have been published. Therefore, these guides should be strongly considered in the development process of a digital system. Our framework refers to the system development life cycle described in RG 1.152. The main activities of RG 5.71 are included in the framework appropriately. This approach supports the consistent application of system features for cyber security by incorporating the security requirements required in the operation and maintenance phases into the initial phase of development process. It is expected that the application of the framework to a new plant system design may comply with both RG 1.152 and 5.71.

  5. Process Control System Cyber Security Standards - An Overview

    Energy Technology Data Exchange (ETDEWEB)

    Robert P. Evans

    2006-05-01

    The use of cyber security standards can greatly assist in the protection of process control systems by providing guidelines and requirements for the implementation of computer-controlled systems. These standards are most effective when the engineers and operators, using the standards, understand what each standard addresses. This paper provides an overview of several standards that deal with the cyber security of process measurements and control systems.

  6. Cyber security best practices for the nuclear industry

    International Nuclear Information System (INIS)

    Badr, I.

    2012-01-01

    When deploying software based systems, such as, digital instrumentation and controls for the nuclear industry, it is vital to include cyber security assessment as part of architecture and development process. When integrating and delivering software-intensive systems for the nuclear industry, engineering teams should make use of a secure, requirements driven, software development life cycle, ensuring security compliance and optimum return on investment. Reliability protections, data loss prevention, and privacy enforcement provide a strong case for installing strict cyber security policies. (authors)

  7. Cyber security best practices for the nuclear industry

    Energy Technology Data Exchange (ETDEWEB)

    Badr, I. [Rational IBM Software Group, IBM Corporation, Evanston, IL 60201 (United States)

    2012-07-01

    When deploying software based systems, such as, digital instrumentation and controls for the nuclear industry, it is vital to include cyber security assessment as part of architecture and development process. When integrating and delivering software-intensive systems for the nuclear industry, engineering teams should make use of a secure, requirements driven, software development life cycle, ensuring security compliance and optimum return on investment. Reliability protections, data loss prevention, and privacy enforcement provide a strong case for installing strict cyber security policies. (authors)

  8. Nuclear Cyber Security Issues and Policy Recommendations

    International Nuclear Information System (INIS)

    Lee, Cheol-Kwon; Lee, Dong-Young; Lee, Na-Young; Hwang, Young-Soo

    2015-01-01

    The cyber-attack against computer systems causes the loss of function which brings about the big economic loss, and it becomes a national-wide issue. In recent days the cyber threat has occurred in the national critical infrastructure around the world. In the nuclear industry, while discussing responses to various threats against nuclear facilities since 2006, cyber-terrorism was also discussed. But at that time, cyber-attacks against control networks in nuclear facilities were not seriously considered because those networks were isolated from the Internet thoroughly and it was evaluated that cyber penetration would not be possible. However Stuxnet worm virus which attacked Iran's nuclear facilities confirmed that the cyber security problem could occur even in other nuclear facilities. The facilities were isolated from the Internet. After the cyber incident, we began to discuss the topic of NPP cyber security. It is very difficult to predict whether or when or how the cyber-attack will be occurred, which is a characteristic of cyber-attack. They could be always detected only after when an incident had occurred. This paper summarizes the report, 'Nuclear Cyber Security Issues and Policy Recommendations' by issue committee in the Korea Nuclear Society, which reviewed the cyber security framework for nuclear facilities in the Republic of Korea being established to prevent nuclear facilities from cyber-attacks and to respond systematically. As a result this paper proposes several comments to improve the security and furthermore safety of nuclear facilities Digital technology will be used more widely at the national critical infrastructure including nuclear facilities in the future, and moreover wireless technologies and mobile devices will be soon introduced to nuclear industry. It is therefore anticipated that the rapid advance in digital technology will accelerate the opportunity of hacking these facilities

  9. Nuclear Cyber Security Issues and Policy Recommendations

    Energy Technology Data Exchange (ETDEWEB)

    Lee, Cheol-Kwon; Lee, Dong-Young [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of); Lee, Na-Young; Hwang, Young-Soo [Korea Institute of Nuclear Nonproliferation and Control, Daejeon (Korea, Republic of)

    2015-10-15

    The cyber-attack against computer systems causes the loss of function which brings about the big economic loss, and it becomes a national-wide issue. In recent days the cyber threat has occurred in the national critical infrastructure around the world. In the nuclear industry, while discussing responses to various threats against nuclear facilities since 2006, cyber-terrorism was also discussed. But at that time, cyber-attacks against control networks in nuclear facilities were not seriously considered because those networks were isolated from the Internet thoroughly and it was evaluated that cyber penetration would not be possible. However Stuxnet worm virus which attacked Iran's nuclear facilities confirmed that the cyber security problem could occur even in other nuclear facilities. The facilities were isolated from the Internet. After the cyber incident, we began to discuss the topic of NPP cyber security. It is very difficult to predict whether or when or how the cyber-attack will be occurred, which is a characteristic of cyber-attack. They could be always detected only after when an incident had occurred. This paper summarizes the report, 'Nuclear Cyber Security Issues and Policy Recommendations' by issue committee in the Korea Nuclear Society, which reviewed the cyber security framework for nuclear facilities in the Republic of Korea being established to prevent nuclear facilities from cyber-attacks and to respond systematically. As a result this paper proposes several comments to improve the security and furthermore safety of nuclear facilities Digital technology will be used more widely at the national critical infrastructure including nuclear facilities in the future, and moreover wireless technologies and mobile devices will be soon introduced to nuclear industry. It is therefore anticipated that the rapid advance in digital technology will accelerate the opportunity of hacking these facilities.

  10. Cyber security in digitalized nuclear power plants

    Energy Technology Data Exchange (ETDEWEB)

    Sohn, Kwang Young; Yi, Woo June [KoRTS Co., Ltd., Daejeon (Korea, Republic of)

    2008-10-15

    This paper analyzer the cyber security issues pertaining to networks and general systems, and provides cyber security activity model. For this, the importance of security, and the domestic and international trends of cyber security are surveyed in order to introduce the strategies and countermeasures of cyber security which should be interfaced with Quality Assurance (QA) plan Based on the result of cyber security model introduced in this paper, activities for cyber security, work load, necessary resources and process for activities, and duration could be estimated hopefully.

  11. Cyber security in digitalized nuclear power plants

    International Nuclear Information System (INIS)

    Sohn, Kwang Young; Yi, Woo June

    2008-01-01

    This paper analyzer the cyber security issues pertaining to networks and general systems, and provides cyber security activity model. For this, the importance of security, and the domestic and international trends of cyber security are surveyed in order to introduce the strategies and countermeasures of cyber security which should be interfaced with Quality Assurance (QA) plan Based on the result of cyber security model introduced in this paper, activities for cyber security, work load, necessary resources and process for activities, and duration could be estimated hopefully

  12. European Cyber Security Perspectives 2015

    NARCIS (Netherlands)

    Baloo, J.; Geveke, H.G.; Paulissen, W.; Vries, H. de

    2015-01-01

    Following the success of last year’s publication, we are proud to present the second edition of our European Cyber Security Perspectives report. Through this collection of articles, we aim to share our different perspectives and insights, the latest developments and achievements in the field of

  13. Help for the Developers of Control System Cyber Security Standards

    Energy Technology Data Exchange (ETDEWEB)

    Robert P. Evans

    2008-05-01

    A Catalog of Control Systems Security: Recommendations for Standards Developers (Catalog), aimed at assisting organizations to facilitate the development and implementation of control system cyber security standards, has been developed. This catalog contains requirements that can help protect control systems from cyber attacks and can be applied to the Critical Infrastructures and Key Resources of the United States and other nations. The requirements contained in the catalog are a compilation of practices or various industry bodies used to increase the security of control systems from both physical and cyber attacks. They should be viewed as a collection of recommendations to be considered and judiciously employed, as appropriate, when reviewing and developing cyber security standards for control systems. The recommendations in the Catalog are intended to be broad enough to provide any industry using control systems the flexibility needed to develop sound cyber security standards specific to their individual security requirements.

  14. Cyber Security Risk Assessment for the KNICS Safety Systems

    International Nuclear Information System (INIS)

    Lee, C. K.; Park, G. Y.; Lee, Y. J.; Choi, J. G.; Kim, D. H.; Lee, D. Y.; Kwon, K. C.

    2008-01-01

    In the Korea Nuclear I and C Systems Development (KNICS) project the platforms for plant protection systems are developed, which function as a reactor shutdown, actuation of engineered safety features and a control of the related equipment. Those are fully digitalized through the use of safety-grade programmable logic controllers (PLCs) and communication networks. In 2006 the Regulatory Guide 1.152 (Rev. 02) was published by the U.S. NRC and it describes the application of a cyber security to the safety systems in the Nuclear Power Plant (NPP). Therefore it is required that the new requirements are incorporated into the developed platforms to apply to NPP, and a cyber security risk assessment is performed. The results of the assessment were input for establishing the cyber security policies and planning the work breakdown to incorporate them

  15. Cyber Security for Smart Grid, Cryptography, and Privacy

    Directory of Open Access Journals (Sweden)

    Swapna Iyer

    2011-01-01

    Full Text Available The invention of “smart grid” promises to improve the efficiency and reliability of the power system. As smart grid is turning out to be one of the most promising technologies, its security concerns are becoming more crucial. The grid is susceptible to different types of attacks. This paper will focus on these threats and risks especially relating to cyber security. Cyber security is a vital topic, since the smart grid uses high level of computation like the IT. We will also see cryptography and key management techniques that are required to overcome these attacks. Privacy of consumers is another important security concern that this paper will deal with.

  16. Cyber security evaluation of II&C technologies

    Energy Technology Data Exchange (ETDEWEB)

    Thomas, Ken [Idaho National Laboratory (INL), Idaho Falls, ID (United States)

    2014-11-01

    The Light Water Reactor Sustainability (LWRS) Program is a research and development program sponsored by the Department of Energy, which is conducted in close collaboration with industry to provide the technical foundations for licensing and managing the long-term, safe and economical operation of current nuclear power plants The LWRS Program serves to help the US nuclear industry adopt new technologies and engineering solutions that facilitate the continued safe operation of the plants and extension of the current operating licenses. Within the LWRS Program, the Advanced Instrumentation, Information, and Control (II&C) Systems Technologies Pathway conducts targeted research and development (R&D) to address aging and reliability concerns with the legacy instrumentation and control and related information systems of the U.S. operating light water reactor (LWR) fleet. The II&C Pathway is conducted by Idaho National Laboratory (INL). Cyber security is a common concern among nuclear utilities and other nuclear industry stakeholders regarding the digital technologies that are being developed under this program. This concern extends to the point of calling into question whether these types of technologies could ever be deployed in nuclear plants given the possibility that the information in them can be compromised and the technologies themselves can potentially be exploited to serve as attack vectors for adversaries. To this end, a cyber security evaluation has been conducted of these technologies to determine whether they constitute a threat beyond what the nuclear plants already manage within their regulatory-required cyber security programs. Specifically, the evaluation is based on NEI 08-09, which is the industry’s template for cyber security programs and evaluations, accepted by the Nuclear Regulatory Commission (NRC) as responsive to the requirements of the nuclear power plant cyber security regulation found in 10 CFR 73.54. The evaluation was conducted by a

  17. Maritime Cyber Security University Research: Phase 1

    Science.gov (United States)

    2016-05-01

    i Classification | CG-926 RDC | author | audience | month year Maritime Cyber Security University Research Phase I - Final Report...Appendices Distribution Statement A: Approved for public release; distribution is unlimited. May 2016 Report No. CG-D-07-16 Maritime ...Macesker Executive Director United States Coast Guard Research & Development Center 1 Chelsea Street New London, CT 06320 Maritime Cyber Security

  18. Ten national cyber security strategies: A comparison

    NARCIS (Netherlands)

    Luiijf, H.A.M.; Besseling, K. van; Spoelstra, M.; Graaf, P. de

    2013-01-01

    A number of nations developed and published a national cyber security strategy (NCSS). Most of them were published in the period 2009 - 2011. Despite the fact that each of these NCSS intends to address the cyber security threat, large differences exist between the NCSS approaches. This paper

  19. Kanttekeningen bij de Europese cyber security strategie

    NARCIS (Netherlands)

    Luiijf, H.A.M.; Smulders, A.C.M.; Kamphuis, P.

    2013-01-01

    In februari presenteerde de Europese Unie de Europese cyber security strategie en begeleidende concept richtlijn. The Hague Security Delta (HSD) is verheugd dat de Nederlandse Nationale Cyber Security Strategie nu ook op Europees niveau navolging krijgt. Toch plaatsen we een paar kantekeningen.

  20. Mathematical and Statistical Opportunities in Cyber Security

    Energy Technology Data Exchange (ETDEWEB)

    Meza, Juan; Campbell, Scott; Bailey, David

    2009-03-23

    The role of mathematics in a complex system such as the Internet has yet to be deeply explored. In this paper, we summarize some of the important and pressing problems in cyber security from the viewpoint of open science environments. We start by posing the question 'What fundamental problems exist within cyber security research that can be helped by advanced mathematics and statistics'? Our first and most important assumption is that access to real-world data is necessary to understand large and complex systems like the Internet. Our second assumption is that many proposed cyber security solutions could critically damage both the openness and the productivity of scientific research. After examining a range of cyber security problems, we come to the conclusion that the field of cyber security poses a rich set of new and exciting research opportunities for the mathematical and statistical sciences.

  1. Cyber security issues in online games

    Science.gov (United States)

    Zhao, Chen

    2018-04-01

    With the rapid development of the Internet, online gaming has become a way of entertainment for many young people in the modern era. However, in recent years, cyber security issues in online games have emerged in an endless stream, which have also caused great attention of many game operators. Common cyber security problems in the game include information disclosure and cyber-attacks. These problems will directly or indirectly cause economic losses to gamers. Many gaming companies are enhancing the stability and security of their network or gaming systems in order to enhance the gaming user experience. This article has carried out the research of the cyber security issues in online games by introducing the background and some common cyber security threats, and by proposing the latent solution. Finally, it speculates the future research direction of the cyber security issues of online games in the hope of providing feasible solution and useful information for game operators.

  2. A Study of Cyber Security Activities for Development of Safety-related Controller

    Energy Technology Data Exchange (ETDEWEB)

    Lee, Myeongkyun; Song, Seunghwan; Yoo, Kwanwoo; Yun, Donghwa [Korea Univ., Seoul (Korea, Republic of)

    2014-05-15

    Nuclear Power Plant Regulatory guide describes the regulatory requirements to implement cyber security activities to ensure that design and operate to respond to cyber threats that exploited to vulnerability of digital-based technologies associated with safety-related digital instrumentation and control systems at nuclear power plants. Cyber security activities coverage is instrumentation and control systems to perform safety functions and digital-based equipment to use development, test, analysis and asset for instrumentation and control systems. Regulatory guidance is required to the cyber security activities that should be performed in each development phase of safety-related controller. Development organization should establish and implement to cyber security plans for responding to cyber threats throughout each lifecycle phase and the result of the cyber security activities should be generated to the documents. In addition, the independent verification and validation organization should perform simulated penetration test for enhancing response capabilities to cyber security threats and development organization should establish and implement response hardening solutions for the cyber security vulnerabilities identified in the simulated penetration test.

  3. A Study of Cyber Security Activities for Development of Safety-related Controller

    International Nuclear Information System (INIS)

    Lee, Myeongkyun; Song, Seunghwan; Yoo, Kwanwoo; Yun, Donghwa

    2014-01-01

    Nuclear Power Plant Regulatory guide describes the regulatory requirements to implement cyber security activities to ensure that design and operate to respond to cyber threats that exploited to vulnerability of digital-based technologies associated with safety-related digital instrumentation and control systems at nuclear power plants. Cyber security activities coverage is instrumentation and control systems to perform safety functions and digital-based equipment to use development, test, analysis and asset for instrumentation and control systems. Regulatory guidance is required to the cyber security activities that should be performed in each development phase of safety-related controller. Development organization should establish and implement to cyber security plans for responding to cyber threats throughout each lifecycle phase and the result of the cyber security activities should be generated to the documents. In addition, the independent verification and validation organization should perform simulated penetration test for enhancing response capabilities to cyber security threats and development organization should establish and implement response hardening solutions for the cyber security vulnerabilities identified in the simulated penetration test

  4. A Case Study on Cyber-security Program for the Programmable Logic Controller of Modern NPPs

    International Nuclear Information System (INIS)

    Song, S. H.; Lee, M. S.; Kim, T. H.; Park, C. H.; Park, S. P.; Kim, H. S.

    2014-01-01

    As instrumentation and control (I and C) systems for modern Nuclear Power Plants (NPPs) have been digitalized to cope with their growing complexity, the cyber-security has become an important issue. To protect the I and C systems adequately from cyber threats, such as Stuxnet that attacked Iran's nuclear facilities, regulations of many countries require a cyber-security program covering all the life cycle phases of the system development, from the concept to the retirement. This paper presents a case study of cyber-security program that has been performed during the development of the programmable logic controller (PLC) for modern NPPs of Korea. In the case study, a cyber-security plan, including technical, management, and operational controls, was established through a security risk assessment. Cyber-security activities, such as development of security functions and periodic inspections, were conducted according to the plan: the security functions were applied to the PLC as the technical controls, and periodic inspections and audits were held to check the security of the development environment, as the management and operational controls. A final penetration test was conducted to inspect all the security problems that had been issued during the development. The case study has shown that the systematic cyber-security program detected and removed the vulnerabilities of the target system, which could not be found otherwise, enhancing the cyber-security of the system

  5. A Case Study on Cyber-security Program for the Programmable Logic Controller of Modern NPPs

    Energy Technology Data Exchange (ETDEWEB)

    Song, S. H. [Korea University, Seoul (Korea, Republic of); Lee, M. S.; Kim, T. H. [Formal Work Inc., Seoul (Korea, Republic of); Park, C. H. [LINE Corp., Tokyo (Japan); Park, S. P. [Ahnlab Inc., Seoul (Korea, Republic of); Kim, H. S. [Sejong University, Seoul (Korea, Republic of)

    2014-08-15

    As instrumentation and control (I and C) systems for modern Nuclear Power Plants (NPPs) have been digitalized to cope with their growing complexity, the cyber-security has become an important issue. To protect the I and C systems adequately from cyber threats, such as Stuxnet that attacked Iran's nuclear facilities, regulations of many countries require a cyber-security program covering all the life cycle phases of the system development, from the concept to the retirement. This paper presents a case study of cyber-security program that has been performed during the development of the programmable logic controller (PLC) for modern NPPs of Korea. In the case study, a cyber-security plan, including technical, management, and operational controls, was established through a security risk assessment. Cyber-security activities, such as development of security functions and periodic inspections, were conducted according to the plan: the security functions were applied to the PLC as the technical controls, and periodic inspections and audits were held to check the security of the development environment, as the management and operational controls. A final penetration test was conducted to inspect all the security problems that had been issued during the development. The case study has shown that the systematic cyber-security program detected and removed the vulnerabilities of the target system, which could not be found otherwise, enhancing the cyber-security of the system.

  6. The North West cyber security industry : export potential assessment

    OpenAIRE

    Prince, Daniel David Campbell; Fitton, Oliver James

    2016-01-01

    Cyber Security businesses in the North West of England form an industry which is growing. This study has taken an in depth analysis of the industry to determine its size, make up and readiness to export and is the first of its kind classifying business within the framework identified by the UKTI cyber export strategy. This report presents the findings of the research undertaken independently by Lancaster University commissioned by the UKTI.

  7. What kind of cyber security? Theorising cyber security and mapping approaches

    OpenAIRE

    Laura Fichtner

    2018-01-01

    Building on conceptual work on security and cyber security, the paper explores how different approaches to cyber security are constructed. It outlines structural components and presents four common approaches. Each of them suggests a different role for the actors involved and is motivated and justified by different values such as privacy, economic order and national security. When a cyber security policy or initiative is chosen by policymakers, the analysis of the underlying approach enhances...

  8. Information fusion for cyber-security analytics

    CERN Document Server

    Karabatis, George; Aleroud, Ahmed

    2017-01-01

    This book highlights several gaps that have not been addressed in existing cyber security research. It first discusses the recent attack prediction techniques that utilize one or more aspects of information to create attack prediction models. The second part is dedicated to new trends on information fusion and their applicability to cyber security; in particular, graph data analytics for cyber security, unwanted traffic detection and control based on trust management software defined networks, security in wireless sensor networks & their applications, and emerging trends in security system design using the concept of social behavioral biometric. The book guides the design of new commercialized tools that can be introduced to improve the accuracy of existing attack prediction models. Furthermore, the book advances the use of Knowledge-based Intrusion Detection Systems (IDS) to complement existing IDS technologies. It is aimed towards cyber security researchers. .

  9. Realizing Scientific Methods for Cyber Security

    Energy Technology Data Exchange (ETDEWEB)

    Carroll, Thomas E.; Manz, David O.; Edgar, Thomas W.; Greitzer, Frank L.

    2012-07-18

    There is little doubt among cyber security researchers about the lack of scientic rigor that underlies much of the liter-ature. The issues are manifold and are well documented. Further complicating the problem is insufficient scientic methods to address these issues. Cyber security melds man and machine: we inherit the challenges of computer science, sociology, psychology, and many other elds and create new ones where these elds interface. In this paper we detail a partial list of challenges imposed by rigorous science and survey how other sciences have tackled them, in the hope of applying a similar approach to cyber security science. This paper is by no means comprehensive: its purpose is to foster discussion in the community on how we can improve rigor in cyber security science.

  10. Evaluating cyber security awareness in South Africa

    CSIR Research Space (South Africa)

    Grobler, M

    2011-07-01

    Full Text Available broadband capability and knowledge transfer within rural communities. To evaluate the current level of cyber security awareness, a series of exploratory surveys have been distributed to less technologically resourced entities in rural and deep rural...

  11. Automated Big Traffic Analytics for Cyber Security

    OpenAIRE

    Miao, Yuantian; Ruan, Zichan; Pan, Lei; Wang, Yu; Zhang, Jun; Xiang, Yang

    2018-01-01

    Network traffic analytics technology is a cornerstone for cyber security systems. We demonstrate its use through three popular and contemporary cyber security applications in intrusion detection, malware analysis and botnet detection. However, automated traffic analytics faces the challenges raised by big traffic data. In terms of big data's three characteristics --- volume, variety and velocity, we review three state of the art techniques to mitigate the key challenges including real-time tr...

  12. Critical infrastructure cyber-security risk management

    OpenAIRE

    Spyridopoulos, T.; Maraslis, K.; Tryfonas, T.; Oikonomou, G.

    2017-01-01

    Traditional IT cyber-security risk management methods are based on the evaluation of risks calculated as the likelihood of cyber-security incidents occurring. However, these probabilities are usually estimations or guesses based on past experience and incomplete data. Incorrect estimations can lead to errors in the evaluation of risks that can ultimately affect the protection of the system. This issue is also transferred to methods used in Industrial Control Systems (ICSs), as they are mainly...

  13. Simulations in Cyber-Security: A Review of Cognitive Modeling of Network Attackers, Defenders, and Users

    OpenAIRE

    Vladislav D. Veksler; Norbou Buchler; Blaine E. Hoffman; Daniel N. Cassenti; Char Sample; Shridat Sugrim

    2018-01-01

    Computational models of cognitive processes may be employed in cyber-security tools, experiments, and simulations to address human agency and effective decision-making in keeping computational networks secure. Cognitive modeling can addresses multi-disciplinary cyber-security challenges requiring cross-cutting approaches over the human and computational sciences such as the following: (a) adversarial reasoning and behavioral game theory to predict attacker subjective utilities and decision li...

  14. Microgrid cyber security reference architecture.

    Energy Technology Data Exchange (ETDEWEB)

    Veitch, Cynthia K.; Henry, Jordan M.; Richardson, Bryan T.; Hart, Derek H.

    2013-07-01

    This document describes a microgrid cyber security reference architecture. First, we present a high-level concept of operations for a microgrid, including operational modes, necessary power actors, and the communication protocols typically employed. We then describe our motivation for designing a secure microgrid; in particular, we provide general network and industrial control system (ICS)-speci c vulnerabilities, a threat model, information assurance compliance concerns, and design criteria for a microgrid control system network. Our design approach addresses these concerns by segmenting the microgrid control system network into enclaves, grouping enclaves into functional domains, and describing actor communication using data exchange attributes. We describe cyber actors that can help mitigate potential vulnerabilities, in addition to performance bene ts and vulnerability mitigation that may be realized using this reference architecture. To illustrate our design approach, we present a notional a microgrid control system network implementation, including types of communica- tion occurring on that network, example data exchange attributes for actors in the network, an example of how the network can be segmented to create enclaves and functional domains, and how cyber actors can be used to enforce network segmentation and provide the neces- sary level of security. Finally, we describe areas of focus for the further development of the reference architecture.

  15. Cyber security awareness toolkit for national security: an approach to South Africa's cyber security policy implementation

    CSIR Research Space (South Africa)

    Phahlamohlaka, LJ

    2011-05-01

    Full Text Available The aim of this paper is to propose an approach that South Africa could follow in implementing its proposed cyber security policy. The paper proposes a Cyber Security Awareness Toolkit that is underpinned by key National Security imperatives...

  16. Mission Assurance Modeling and Simulation: A Cyber Security Roadmap

    Science.gov (United States)

    Gendron, Gerald; Roberts, David; Poole, Donold; Aquino, Anna

    2012-01-01

    This paper proposes a cyber security modeling and simulation roadmap to enhance mission assurance governance and establish risk reduction processes within constrained budgets. The term mission assurance stems from risk management work by Carnegie Mellon's Software Engineering Institute in the late 19905. By 2010, the Defense Information Systems Agency revised its cyber strategy and established the Program Executive Officer-Mission Assurance. This highlights a shift from simply protecting data to balancing risk and begins a necessary dialogue to establish a cyber security roadmap. The Military Operations Research Society has recommended a cyber community of practice, recognizing there are too few professionals having both cyber and analytic experience. The authors characterize the limited body of knowledge in this symbiotic relationship. This paper identifies operational and research requirements for mission assurance M&S supporting defense and homeland security. M&S techniques are needed for enterprise oversight of cyber investments, test and evaluation, policy, training, and analysis.

  17. Survey of Cyber Security Methods for the Nuclear Power Plants

    Energy Technology Data Exchange (ETDEWEB)

    Choi, Yoo Rark; Lee, Jae Cheol; Choi, Young Soo; Hong, Seok Boong [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2009-10-15

    Cyber security includes the method of protecting information, computer programs, and other computer system assets. Hardware security, which is the security of computer assets and capital equipment, refers to computer location, access control, fire protection, and storage procedures. Such measures as badges, electronic identification keys, alarm systems, and physical barriers at entries are used for this purpose. Software security entails the protection of software assets such as Application Programs, the Operating System, and the Data Base Management System and stored information. Special user numbers and passwords are typically used to prevent unauthorized access to software and data. In addition to security for hardware and software, good internal control also requires that measures be taken to prevent loss or accidental destruction of data. Cyber attacks create substantial threats to large enterprises, including federal systems and digital I and C of a NPP (Nuclear Power Plant) is one of them. The cyber security policy for the digital I and C network of the NPP has been established for years by KINS, but its scope is very broad and conceptual. We will propose a cyber security method based on cryptography and authentication that is developed for the digital I and C network of the NPP.

  18. Survey of Cyber Security Methods for the Nuclear Power Plants

    International Nuclear Information System (INIS)

    Choi, Yoo Rark; Lee, Jae Cheol; Choi, Young Soo; Hong, Seok Boong

    2009-01-01

    Cyber security includes the method of protecting information, computer programs, and other computer system assets. Hardware security, which is the security of computer assets and capital equipment, refers to computer location, access control, fire protection, and storage procedures. Such measures as badges, electronic identification keys, alarm systems, and physical barriers at entries are used for this purpose. Software security entails the protection of software assets such as Application Programs, the Operating System, and the Data Base Management System and stored information. Special user numbers and passwords are typically used to prevent unauthorized access to software and data. In addition to security for hardware and software, good internal control also requires that measures be taken to prevent loss or accidental destruction of data. Cyber attacks create substantial threats to large enterprises, including federal systems and digital I and C of a NPP (Nuclear Power Plant) is one of them. The cyber security policy for the digital I and C network of the NPP has been established for years by KINS, but its scope is very broad and conceptual. We will propose a cyber security method based on cryptography and authentication that is developed for the digital I and C network of the NPP

  19. Comparative Study on Cyber Securities between Power Reactor and Research Reactor with Bayesian Update

    International Nuclear Information System (INIS)

    Shin, Jinsoo; Heo, Gyunyoung; Son, Han Seong

    2016-01-01

    The Stuxnet has shown that nuclear facilities are no more safe from cyber-attack. Due to practical experiences and concerns on increasing of digital system application, cyber security has become the important issue in nuclear industry. Korea Institute of Nuclear Nonproliferation and control (KINAC) published a regulatory standard (KINAC/RS-015) to establish cyber security framework for nuclear facilities. However, it is difficult to research about cyber security. It is hard to quantify cyber-attack which has malicious activity which is different from existing design basis accidents (DBAs). We previously proposed a methodology on development of a cyber security risk model with BBN. However, the methodology had a limitation in which the input data as prior information was solely on expert opinions. In this study, we propose a cyber security risk model for instrumentation and control (I and C) system of nuclear facilities with some equation for quantification by using Bayesian Belief Network (BBN) in order to overcome the limitation of previous research. The proposed model has been used for comparative study on cyber securities between large-sized nuclear power plants (NPPs) and small-sized Research Reactors (RR). In this study, we proposed the cyber security risk evaluation model with BBN. It includes I and C architecture, which is a target system of cyber-attack, malicious activity, which causes cyber-attack from attacker, and mitigation measure, which mitigates the cyber-attack risk. Likelihood and consequence as prior information are evaluated by considering characteristics of I and C architecture and malicious activity. The BBN model provides posterior information with Bayesian update by adding any of assumed cyber-attack scenarios as evidence. Cyber security risk for nuclear facilities is analyzed by comparing between prior information and posterior information of each node. In this study, we conducted comparative study on cyber securities between power reactor

  20. Comparative Study on Cyber Securities between Power Reactor and Research Reactor with Bayesian Update

    Energy Technology Data Exchange (ETDEWEB)

    Shin, Jinsoo; Heo, Gyunyoung [Kyung Hee University, Yongin (Korea, Republic of); Son, Han Seong [Joongbu Univiersity, Geumsan (Korea, Republic of)

    2016-10-15

    The Stuxnet has shown that nuclear facilities are no more safe from cyber-attack. Due to practical experiences and concerns on increasing of digital system application, cyber security has become the important issue in nuclear industry. Korea Institute of Nuclear Nonproliferation and control (KINAC) published a regulatory standard (KINAC/RS-015) to establish cyber security framework for nuclear facilities. However, it is difficult to research about cyber security. It is hard to quantify cyber-attack which has malicious activity which is different from existing design basis accidents (DBAs). We previously proposed a methodology on development of a cyber security risk model with BBN. However, the methodology had a limitation in which the input data as prior information was solely on expert opinions. In this study, we propose a cyber security risk model for instrumentation and control (I and C) system of nuclear facilities with some equation for quantification by using Bayesian Belief Network (BBN) in order to overcome the limitation of previous research. The proposed model has been used for comparative study on cyber securities between large-sized nuclear power plants (NPPs) and small-sized Research Reactors (RR). In this study, we proposed the cyber security risk evaluation model with BBN. It includes I and C architecture, which is a target system of cyber-attack, malicious activity, which causes cyber-attack from attacker, and mitigation measure, which mitigates the cyber-attack risk. Likelihood and consequence as prior information are evaluated by considering characteristics of I and C architecture and malicious activity. The BBN model provides posterior information with Bayesian update by adding any of assumed cyber-attack scenarios as evidence. Cyber security risk for nuclear facilities is analyzed by comparing between prior information and posterior information of each node. In this study, we conducted comparative study on cyber securities between power reactor

  1. Cyber security analytics, technology and automation

    CERN Document Server

    Neittaanmäki, Pekka

    2015-01-01

    Over the last two decades, the Internet and more broadly cyberspace has had a tremendous impact on all parts of society. Governments across the world have started to develop cyber security strategies and to consider cyberspace as an increasingly important international issue. The book, in addition to the cyber threats and technology, processes cyber security from many sides as a social phenomenon and how the implementation of the cyber security strategy is carried out. The book gives a profound idea of the most spoken phenomenon of this time. The book is suitable for a wide-ranging audience from graduate to professionals/practitioners and researchers. Relevant disciplines for the book are  Telecommunications / Network security, Applied mathematics / Data analysis, Mobile systems / Security, Engineering / Security of critical infrastructure and Military science / Security.

  2. What kind of cyber security? Theorising cyber security and mapping approaches

    Directory of Open Access Journals (Sweden)

    Laura Fichtner

    2018-05-01

    Full Text Available Building on conceptual work on security and cyber security, the paper explores how different approaches to cyber security are constructed. It outlines structural components and presents four common approaches. Each of them suggests a different role for the actors involved and is motivated and justified by different values such as privacy, economic order and national security. When a cyber security policy or initiative is chosen by policymakers, the analysis of the underlying approach enhances our understanding of how this shapes relationships between actors and of the values prioritised, promoted and inscribed into the concerned technologies.

  3. Computational Intelligence, Cyber Security and Computational Models

    CERN Document Server

    Anitha, R; Lekshmi, R; Kumar, M; Bonato, Anthony; Graña, Manuel

    2014-01-01

    This book contains cutting-edge research material presented by researchers, engineers, developers, and practitioners from academia and industry at the International Conference on Computational Intelligence, Cyber Security and Computational Models (ICC3) organized by PSG College of Technology, Coimbatore, India during December 19–21, 2013. The materials in the book include theory and applications for design, analysis, and modeling of computational intelligence and security. The book will be useful material for students, researchers, professionals, and academicians. It will help in understanding current research trends and findings and future scope of research in computational intelligence, cyber security, and computational models.

  4. Bio-Inspired Cyber Security for Smart Grid Deployments

    Energy Technology Data Exchange (ETDEWEB)

    McKinnon, Archibald D.; Thompson, Seth R.; Doroshchuk, Ruslan A.; Fink, Glenn A.; Fulp, Errin W.

    2013-05-01

    mart grid technologies are transforming the electric power grid into a grid with bi-directional flows of both power and information. Operating millions of new smart meters and smart appliances will significantly impact electric distribution systems resulting in greater efficiency. However, the scale of the grid and the new types of information transmitted will potentially introduce several security risks that cannot be addressed by traditional, centralized security techniques. We propose a new bio-inspired cyber security approach. Social insects, such as ants and bees, have developed complex-adaptive systems that emerge from the collective application of simple, light-weight behaviors. The Digital Ants framework is a bio-inspired framework that uses mobile light-weight agents. Sensors within the framework use digital pheromones to communicate with each other and to alert each other of possible cyber security issues. All communication and coordination is both localized and decentralized thereby allowing the framework to scale across the large numbers of devices that will exist in the smart grid. Furthermore, the sensors are light-weight and therefore suitable for implementation on devices with limited computational resources. This paper will provide a brief overview of the Digital Ants framework and then present results from test bed-based demonstrations that show that Digital Ants can identify a cyber attack scenario against smart meter deployments.

  5. Game based cyber security training: are serious games suitable for cyber security training?

    OpenAIRE

    Hendrix, Maurice; Al-Sherbaz, Ali; Victoria, Bloom

    2016-01-01

    Security research and training is attracting a lot of investment and interest from governments and the private sector. Most efforts have focused on physical security, while cyber security or digital security has been given less importance. With recent high-profile attacks it has become clear that training in cyber security is needed. Serious Games have the capability to be effective tools for public engagement and behavioural change and role play games, are already used by security profession...

  6. Cyber security for greater service reliability

    Energy Technology Data Exchange (ETDEWEB)

    Vickery, P. [N-Dimension Solutions Inc., Richmond Hill, ON (Canada)

    2008-05-15

    Service reliability in the electricity transmission and distribution (T and D) industry is being challenged by increased equipment failures, harsher climatic conditions, and computer hackers who aim to disrupt services by gaining access to transmission and distribution resources. This article discussed methods of ensuring the cyber-security of T and D operators. Weak points in the T and D industry include remote terminal units; intelligent electronic devices; distributed control systems; programmable logic controllers; and various intelligent field devices. An increasing number of interconnection points exist between an operator's service control system and external systems. The North American Electric Reliability Council (NERC) standards specify that cyber security strategies should ensure that all cyber assets are protected, and that access points must be monitored to detect intrusion attempts. The introduction of new advanced metering initiatives must also be considered. Comprehensive monitoring systems should be available to support compliance with cyber security standards. It was concluded that senior management should commit to a periodic cyber security re-assessment program in order to keep up-to-date.

  7. Attack tree based cyber security analysis of nuclear digital instrumentation and control systems

    International Nuclear Information System (INIS)

    Khand, P.A.

    2009-01-01

    To maintain the cyber security, nuclear digital Instrumentation and Control (I and C) systems must be analyzed for security risks because a single security breach due to a cyber attack can cause system failure, which can have catastrophic consequences on the environment and staff of a Nuclear Power Plant (NPP). Attack trees have been widely used to analyze the cyber security of digital systems due to their ability to capture system specific as well as attacker specific details. Therefore, a methodology based on attack trees has been proposed to analyze the cyber security of the systems. The methodology has been applied for the Cyber Security Analysis (CSA) of a Bistable Processor (BP) of a Reactor Protection System (RPS). Threats have been described according to their source. Attack scenarios have been generated using the attack tree and possible counter measures according to the Security Risk Level (SRL) of each scenario have been suggested. Moreover, cyber Security Requirements (SRs) have been elicited, and suitability of the requirements has been checked. (author)

  8. Cyber-Security Challenges with SMEs in Developing Economies: Issues of Confidentiality, Integrity & Availability (CIA)

    DEFF Research Database (Denmark)

    Yeboah-Boateng, Ezer Osei

    The essence of this study is first to highlight the cyber-security challenges confronting SMEs in developing economies, and to model a framework for safeguarding their assets, to ensure continuous optimal business operations, and to participate and compete securely in the ubiquitous cyber......, to develop customer-centric strategies. While connectivity is indispensable for achieving business success, being connected also implies being exposed to a myriad of cyber-security challenges, such as vulnerabilities of confidentiality, integrity and availability (CIA). As vulnerabilities are exploited...... cognitive map (FCM) approach is also used to show the implications of vulnerabilities amongst SMEs asset disposal policies....

  9. Using a Prediction Model to Manage Cyber Security Threats

    Directory of Open Access Journals (Sweden)

    Venkatesh Jaganathan

    2015-01-01

    Full Text Available Cyber-attacks are an important issue faced by all organizations. Securing information systems is critical. Organizations should be able to understand the ecosystem and predict attacks. Predicting attacks quantitatively should be part of risk management. The cost impact due to worms, viruses, or other malicious software is significant. This paper proposes a mathematical model to predict the impact of an attack based on significant factors that influence cyber security. This model also considers the environmental information required. It is generalized and can be customized to the needs of the individual organization.

  10. Using a Prediction Model to Manage Cyber Security Threats.

    Science.gov (United States)

    Jaganathan, Venkatesh; Cherurveettil, Priyesh; Muthu Sivashanmugam, Premapriya

    2015-01-01

    Cyber-attacks are an important issue faced by all organizations. Securing information systems is critical. Organizations should be able to understand the ecosystem and predict attacks. Predicting attacks quantitatively should be part of risk management. The cost impact due to worms, viruses, or other malicious software is significant. This paper proposes a mathematical model to predict the impact of an attack based on significant factors that influence cyber security. This model also considers the environmental information required. It is generalized and can be customized to the needs of the individual organization.

  11. Using a Prediction Model to Manage Cyber Security Threats

    Science.gov (United States)

    Muthu Sivashanmugam, Premapriya

    2015-01-01

    Cyber-attacks are an important issue faced by all organizations. Securing information systems is critical. Organizations should be able to understand the ecosystem and predict attacks. Predicting attacks quantitatively should be part of risk management. The cost impact due to worms, viruses, or other malicious software is significant. This paper proposes a mathematical model to predict the impact of an attack based on significant factors that influence cyber security. This model also considers the environmental information required. It is generalized and can be customized to the needs of the individual organization. PMID:26065024

  12. Asset Analysis Method for the Cyber Security of Man Machine Interface System

    Energy Technology Data Exchange (ETDEWEB)

    Kang, Sung Kon; Kim, Hun Hee; Shin, Yeong Cheol [Korea Hydro and Nuclear Power, Daejeon (Korea, Republic of)

    2010-10-15

    As digital MMIS (Man Machine Interface System) is applied in Nuclear Power Plant (NPP), cyber security is becoming more and more important. Regulatory guide (KINS/GT-N27) requires that implementation plan for cyber security be prepared in NPP. Regulatory guide recommends the following 4 processes: 1) an asset analysis of MMIS, 2) a vulnerability analysis of MMIS, 3) establishment of countermeasures, and 4) establishment of operational guideline for cyber security. Conventional method for the asset analysis is mainly performed with a table form for each asset. Conventional method requires a lot of efforts due to the duplication of information. This paper presents an asset analysis method using object oriented approach for the NPP

  13. Asset Analysis Method for the Cyber Security of Man Machine Interface System

    International Nuclear Information System (INIS)

    Kang, Sung Kon; Kim, Hun Hee; Shin, Yeong Cheol

    2010-01-01

    As digital MMIS (Man Machine Interface System) is applied in Nuclear Power Plant (NPP), cyber security is becoming more and more important. Regulatory guide (KINS/GT-N27) requires that implementation plan for cyber security be prepared in NPP. Regulatory guide recommends the following 4 processes: 1) an asset analysis of MMIS, 2) a vulnerability analysis of MMIS, 3) establishment of countermeasures, and 4) establishment of operational guideline for cyber security. Conventional method for the asset analysis is mainly performed with a table form for each asset. Conventional method requires a lot of efforts due to the duplication of information. This paper presents an asset analysis method using object oriented approach for the NPP

  14. Design concept of CSRAS (Cyber Security Risk Analysis and Assessment System) for digital I and C systems

    International Nuclear Information System (INIS)

    Song, J. G.; Lee, J. W.; Lee, D. Y.; Lee, C. K.

    2012-01-01

    The instrumentation and control (I and C) systems in nuclear power plants (NPPs) have been digitalized recently. Hence, cyber security becomes an important feature to be incorporated into the I and C systems. The Regulatory Guide 5.71 published by U.C NRC in 2010 presents a comprehensive set of security controls for the cyber security of I and C systems in NPPs. However, the application of security controls specified in the RG 5.71 in a specific I and C system still requires many analysis efforts based on the understanding of the security controls, since the guideline does not provide the details to system designers or developers regarding what, where, and how to apply the security controls. To apply security controls to I and C systems, cyber security requirements should be identified based on the cyber security policy and program, then the design and implementation of security controls should be performed along with the I and C system development life cycle. It can be assumed that cyber security requirements are identified during the system design(SD) phase and the design and implementation of security controls is performed during the component design(CD) phase. When identifying security requirements and performing the design and implementation of security controls, cyber security risk assessments should be processed with the understanding of the characteristics of target systems. In this study, the Cyber Security Risk Analysis and Assessment System (CSRAS) has been developed as a tool for analyzing security requirements and technical security controls considering based on a general cyber security risk assessment procedure with the consideration of the characteristics of I and C systems and the development phases

  15. Design concept of CSRAS (Cyber Security Risk Analysis and Assessment System) for digital I and C systems

    Energy Technology Data Exchange (ETDEWEB)

    Song, J. G.; Lee, J. W.; Lee, D. Y.; Lee, C. K. [KAERI, Daejeon (Korea, Republic of)

    2012-10-15

    The instrumentation and control (I and C) systems in nuclear power plants (NPPs) have been digitalized recently. Hence, cyber security becomes an important feature to be incorporated into the I and C systems. The Regulatory Guide 5.71 published by U.C NRC in 2010 presents a comprehensive set of security controls for the cyber security of I and C systems in NPPs. However, the application of security controls specified in the RG 5.71 in a specific I and C system still requires many analysis efforts based on the understanding of the security controls, since the guideline does not provide the details to system designers or developers regarding what, where, and how to apply the security controls. To apply security controls to I and C systems, cyber security requirements should be identified based on the cyber security policy and program, then the design and implementation of security controls should be performed along with the I and C system development life cycle. It can be assumed that cyber security requirements are identified during the system design(SD) phase and the design and implementation of security controls is performed during the component design(CD) phase. When identifying security requirements and performing the design and implementation of security controls, cyber security risk assessments should be processed with the understanding of the characteristics of target systems. In this study, the Cyber Security Risk Analysis and Assessment System (CSRAS) has been developed as a tool for analyzing security requirements and technical security controls considering based on a general cyber security risk assessment procedure with the consideration of the characteristics of I and C systems and the development phases.

  16. THE INFORMATION CONFIDENTIALITY AND CYBER SECURITY IN MEDICAL INSTITUTIONS

    Directory of Open Access Journals (Sweden)

    SABAU-POPA CLAUDIA DIANA

    2015-07-01

    Full Text Available The information confidentiality and cyber security risk affects the right to confidentiality and privacy of the patient, as regulated in Romania by the Law 46/2002. The manifestation of the cyber security risk event affects the reputation of the healthcare institution and is becoming more and more complex and often due to the: development of network technology, the medical equipment connected to wifi and the electronic databases. The databases containing medical records were implemented due to automation. Thus, transforming data into medical knowledge contribute to a better understanding of the disease. Due to these factors, the measures taken by the hospital management for this type of risk are adapted to the cyber changes. The hospital objectives aim: the implementation of a robust information system, the early threats identifications and the incident reporting. Neglecting this type of risk can generate financial loss, inability to continue providing health care services for a certain period of time, providing an erroneous diagnosis, medical equipment errors etc. Thus, in a digital age the appropriate risk management for the information security and cyber risk represent a necessity. The main concern of hospitals worldwide is to align with international requirements and obtain credentials in terms of data security from the International Organisation for Standardization, which regulates the management of this type of risk. Romania is at the beginning in terms of concerns regarding the management, avoidance and mitigation of information security, the health system being most highly exposed to its manifestation. The present paper examines the concerns of the health system to the confidentiality of information and cyber security risk and its management arrangements. Thus, a set of key risk indicators is implemented and monitored for 2011-2013, using a user interface, a Dashboard, which acts as an early warning system of the manifestation of the

  17. Cyber security for remote monitoring and control of small reactors

    Energy Technology Data Exchange (ETDEWEB)

    Trask, D., E-mail: dave.trask@cnl.ca [Atomic Energy of Canada Limited, Chalk River, ON (Canada); Jung, C. [Canadian Nuclear Safety Commission, Ottawa, ON (Canada); MacDonald, M., E-mail: marienna.macdonald@cnl.ca [Atomic Energy of Canada Limited, Chalk River, ON (Canada)

    2014-07-01

    There is growing international interest and activity in the development of small nuclear reactor technology with a number of vendors interested in building small reactors in Canada to serve remote locations. A common theme of small reactor designs proposed for remote Canadian locations is the concept of a centrally located main control centre operating several remotely located reactors via satellite communications. This theme was echoed at a recent IAEA conference where a recommendation was made to study I&C for remotely controlled small modular reactors, including satellite links and cyber security. This paper summarizes the results of an AECL-CNSC research project to analyze satellite communication technologies used for remote monitoring and control functions in order to provide cyber security regulatory considerations. The scope of this research included a basic survey of existing satellite communications technology and its use in industrial control applications, a brief history of satellite vulnerabilities and a broad review of over 50 standards, guidelines, and regulations from recognized institutions covering safety, cyber security, and industrial communication networks including wireless communications in general. This paper concludes that satellite communications should not be arbitrarily excluded by standards or regulation from use for the remote control and monitoring of small nuclear reactors. Instead, reliance should be placed on processes that are independent of any particular technology, such as reducing risks by applying control measures and demonstrating required reliability through good design practices and testing. Ultimately, it is compliance to well-developed standards that yields the evidence to conclude whether a particular application that uses satellite communications is safe and secure. (author)

  18. Cyber security for remote monitoring and control of small reactors

    International Nuclear Information System (INIS)

    Trask, D.; Jung, C.; MacDonald, M.

    2014-01-01

    There is growing international interest and activity in the development of small nuclear reactor technology with a number of vendors interested in building small reactors in Canada to serve remote locations. A common theme of small reactor designs proposed for remote Canadian locations is the concept of a centrally located main control centre operating several remotely located reactors via satellite communications. This theme was echoed at a recent IAEA conference where a recommendation was made to study I&C for remotely controlled small modular reactors, including satellite links and cyber security. This paper summarizes the results of an AECL-CNSC research project to analyze satellite communication technologies used for remote monitoring and control functions in order to provide cyber security regulatory considerations. The scope of this research included a basic survey of existing satellite communications technology and its use in industrial control applications, a brief history of satellite vulnerabilities and a broad review of over 50 standards, guidelines, and regulations from recognized institutions covering safety, cyber security, and industrial communication networks including wireless communications in general. This paper concludes that satellite communications should not be arbitrarily excluded by standards or regulation from use for the remote control and monitoring of small nuclear reactors. Instead, reliance should be placed on processes that are independent of any particular technology, such as reducing risks by applying control measures and demonstrating required reliability through good design practices and testing. Ultimately, it is compliance to well-developed standards that yields the evidence to conclude whether a particular application that uses satellite communications is safe and secure. (author)

  19. Control Systems Cyber Security Standards Support Activities

    Energy Technology Data Exchange (ETDEWEB)

    Robert Evans

    2009-01-01

    The Department of Homeland Security’s Control Systems Security Program (CSSP) is working with industry to secure critical infrastructure sectors from cyber intrusions that could compromise control systems. This document describes CSSP’s current activities with industry organizations in developing cyber security standards for control systems. In addition, it summarizes the standards work being conducted by organizations within the sector and provides a brief listing of sector meetings and conferences that might be of interest for each sector. Control systems cyber security standards are part of a rapidly changing environment. The participation of CSSP in the development effort for these standards has provided consistency in the technical content of the standards while ensuring that information developed by CSSP is included.

  20. Guideline of Cyber Security Policy for Digital I and C Systems in Nuclear Power Plant

    Energy Technology Data Exchange (ETDEWEB)

    Kim, Zeen; Kim, Jang Seong; Kim, Kwang Jo [Information and Communications University, Daejeon (Korea, Republic of); Kang, Young Doo; Kim, Dai Il; Jeong, Choong Heui [Korea Institute of Nuclear Safety, Daejeon (Korea, Republic of)

    2007-10-15

    Recently computers and communication systems have been developed very fast and applied to various areas in many applications. This development has raised new vulnerabilities that may endanger the critical systems for nuclear safety and physical protection at the facilities. In order to protect the critical infrastructures from these new cyber attacks, we clearly need deep considerations on the risks and threats through the cyberspace. Based on these needs, many organizations which related to nuclear power plants suggested various cyber security protection methods based on regulation or technical safeguard. Even if security countermeasures against various cyber attacks are important, it is required to establish the best practices of cyber security policy by the vendor and licensee. Based on the policy they can evaluate their activities against various cyber attacks throughout the whole life cycle. In this paper, we discuss how to establish the cyber security policy for digital instrumentation and control (I and C) systems in nuclear power plants.

  1. Guideline of Cyber Security Policy for Digital I and C Systems in Nuclear Power Plant

    International Nuclear Information System (INIS)

    Kim, Zeen; Kim, Jang Seong; Kim, Kwang Jo; Kang, Young Doo; Kim, Dai Il; Jeong, Choong Heui

    2007-01-01

    Recently computers and communication systems have been developed very fast and applied to various areas in many applications. This development has raised new vulnerabilities that may endanger the critical systems for nuclear safety and physical protection at the facilities. In order to protect the critical infrastructures from these new cyber attacks, we clearly need deep considerations on the risks and threats through the cyberspace. Based on these needs, many organizations which related to nuclear power plants suggested various cyber security protection methods based on regulation or technical safeguard. Even if security countermeasures against various cyber attacks are important, it is required to establish the best practices of cyber security policy by the vendor and licensee. Based on the policy they can evaluate their activities against various cyber attacks throughout the whole life cycle. In this paper, we discuss how to establish the cyber security policy for digital instrumentation and control (I and C) systems in nuclear power plants

  2. Cyber Security: Rule of Use Internet Safely?

    OpenAIRE

    -, Maskun

    2013-01-01

    International Journal Cyber security plays on important role to guarantee and protect people who use internet in their daily life. Some cases take place around the world that people get inconvenience condition when they access and use internet. Misuse of internet becomes a current issue which some cases take place including a university. Advantages of using internet in the university of course assist the student to get some information in internet. However, they have to be protected in ord...

  3. Cyber Security Audit and Attack Detection Toolkit

    Energy Technology Data Exchange (ETDEWEB)

    Peterson, Dale

    2012-05-31

    This goal of this project was to develop cyber security audit and attack detection tools for industrial control systems (ICS). Digital Bond developed and released a tool named Bandolier that audits ICS components commonly used in the energy sector against an optimal security configuration. The Portaledge Project developed a capability for the PI Historian, the most widely used Historian in the energy sector, to aggregate security events and detect cyber attacks.

  4. MDEP Common Position No DICWG08. Common position on the impact of cyber security features on digital I and C safety systems

    International Nuclear Information System (INIS)

    2012-01-01

    Cyber security measures are generally implemented at nuclear facilities to protect against cyber-attacks that may compromise safety. The implementation of such cyber security measures may vary based on site specific requirements and each country's regulatory frameworks. Safety measures and cyber security measures for a nuclear power plant should be designed and implemented so that they do not compromise one another. This common position is intended to only apply to systems classified to the highest level of safety. The Digital Instrumentation and Controls Working Group (DICWG) has agreed that a common position on this topic is warranted given the increase of use of Digital I and C in new reactor designs, its safety implications, and the need to develop a common understanding from the perspectives of regulatory authorities. This action follows the DICWG examination of the regulatory requirements of the participating members and of relevant industry standards and IAEA documents. The DICWG proposes a common position based on its recent experience with the new reactor application reviews and operating plant issues

  5. Cyber security in nuclear power plants and its portability to other industrial infrastructures

    International Nuclear Information System (INIS)

    Champigny, Sebastien; Gupta, Deeksha; Watson, Venesa; Waedt, Karl

    2017-01-01

    Power generation increasingly relies on decentralised and interconnected computerised systems. Concepts like ''Industrial Internet of Things'' of the Industrial Internet Consortium (IIC), and ''Industry 4.0'' find their way in this strategic industry. Risk of targeted exploits of errors and vulnerabilities increases with complexity, interconnectivity and decentralization. Inherently stringent security requirements and features make nuclear computerised applications and systems a benchmark for industrial counterparts seeking to hedge against those risks. Consequently, this contribution presents usual cyber security regulations and practices for nuclear power plants. It shows how nuclear cyber security can be ported and used in an industrial context to protect critical infrastructures against cyber-attacks and industrial espionage.

  6. Designing Fuzzy Rule Based Expert System for Cyber Security

    OpenAIRE

    Goztepe, Kerim

    2016-01-01

    The state of cyber security has begun to attract more attention and interest outside the community of computer security experts. Cyber security is not a single problem, but rather a group of highly different problems involving different sets of threats. Fuzzy Rule based system for cyber security is a system consists of a rule depository and a mechanism for accessing and running the rules. The depository is usually constructed with a collection of related rule sets. The aim of this study is to...

  7. Hyper-connectivity : intricacies of national and international cyber securities

    OpenAIRE

    Dawson, Maurice

    2017-01-01

    This thesis examined the three core themes: the role of education in cyber security, the role of technology in cyber security, and the role of policy in cyber security, the areas in which the papers are published. The associated works are published in referred journals, peer reviewed book chapters, and conference proceedings. Research can be found in the following outlets: 1. Security Solutions for Hyperconnectivity and the Internet of Things; 2. Developing Next-Generation Countermeasures for...

  8. Operating Nuclear Power Stations in a Regulated Cyber Security Environment

    Energy Technology Data Exchange (ETDEWEB)

    Dorman, E.

    2014-07-01

    The United States Nuclear Regulatory Commission (NRC) issued 10CFR73.54 to implement a regulated Cyber Security Program at each operating nuclear reactor facility. Milestones were implemented December 31, 2012 to mitigate the attack vectors for the most critical digital assets acknowledged by the industry and the NR C. The NRC inspections have begun. The nuclear Cyber Security Plan, implemented by the site Cyber Security Program (Program), is an element of the operating license at each facility. (Author)

  9. Bayesian Network Models in Cyber Security: A Systematic Review

    OpenAIRE

    Chockalingam, S.; Pieters, W.; Herdeiro Teixeira, A.M.; van Gelder, P.H.A.J.M.; Lipmaa, Helger; Mitrokotsa, Aikaterini; Matulevicius, Raimundas

    2017-01-01

    Bayesian Networks (BNs) are an increasingly popular modelling technique in cyber security especially due to their capability to overcome data limitations. This is also instantiated by the growth of BN models development in cyber security. However, a comprehensive comparison and analysis of these models is missing. In this paper, we conduct a systematic review of the scientific literature and identify 17 standard BN models in cyber security. We analyse these models based on 9 different criteri...

  10. Operating Nuclear Power Stations in a Regulated Cyber Security Environment

    International Nuclear Information System (INIS)

    Dorman, E.

    2014-01-01

    The United States Nuclear Regulatory Commission (NRC) issued 10CFR73.54 to implement a regulated Cyber Security Program at each operating nuclear reactor facility. Milestones were implemented December 31, 2012 to mitigate the attack vectors for the most critical digital assets acknowledged by the industry and the NR C. The NRC inspections have begun. The nuclear Cyber Security Plan, implemented by the site Cyber Security Program (Program), is an element of the operating license at each facility. (Author)

  11. A cyber security risk assessment for the design of I and C system in nuclear power plants

    International Nuclear Information System (INIS)

    Song, Jae Gu; Lee, Jung Woon; Lee, Cheal Kwon; Kwon, Kee Choon; Lee, Dong Young

    2012-01-01

    The applications of computers and communication system and network technologies in nuclear power plants have expanded recently. This application of digital technologies to the instrumentation and control systems of nuclear power plants brings with it the cyber security concerns similar to other critical infrastructures. Cyber security risk assessments for digital instrumentation and control systems have become more crucial in the development of new systems and in the operation of existing systems. Although the instrumentation and control systems of nuclear power plants are similar to industrial control systems, the former have specifications that differ from the latter in terms of architecture and function, in order to satisfy nuclear safety requirements, which need different methods for the application of cyber security risk assessment. In this paper, the characteristics of nuclear power plant instrumentation and control systems are described, and the considerations needed when conducting cyber security risk assessments in accordance with the life cycle process of instrumentation and control systems are discussed. For cyber security risk assessments of instrumentation and control systems, the activities and considerations necessary for assessments during the system design phase or component design and equipment supply phase are presented in the following 6 steps: 1) System Identification and Cyber Security Modeling, 2) Asset and Impact Analysis, 3) Threat Analysis, 4) Vulnerability Analysis, 5) Security Control Design, and 6) Penetration test. The results from an application of the method to a digital reactor protection system are described.

  12. A cyber security risk assessment for the design of I and C system in nuclear power plants

    Energy Technology Data Exchange (ETDEWEB)

    Song, Jae Gu; Lee, Jung Woon; Lee, Cheal Kwon; Kwon, Kee Choon; Lee, Dong Young [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2012-12-15

    The applications of computers and communication system and network technologies in nuclear power plants have expanded recently. This application of digital technologies to the instrumentation and control systems of nuclear power plants brings with it the cyber security concerns similar to other critical infrastructures. Cyber security risk assessments for digital instrumentation and control systems have become more crucial in the development of new systems and in the operation of existing systems. Although the instrumentation and control systems of nuclear power plants are similar to industrial control systems, the former have specifications that differ from the latter in terms of architecture and function, in order to satisfy nuclear safety requirements, which need different methods for the application of cyber security risk assessment. In this paper, the characteristics of nuclear power plant instrumentation and control systems are described, and the considerations needed when conducting cyber security risk assessments in accordance with the life cycle process of instrumentation and control systems are discussed. For cyber security risk assessments of instrumentation and control systems, the activities and considerations necessary for assessments during the system design phase or component design and equipment supply phase are presented in the following 6 steps: 1) System Identification and Cyber Security Modeling, 2) Asset and Impact Analysis, 3) Threat Analysis, 4) Vulnerability Analysis, 5) Security Control Design, and 6) Penetration test. The results from an application of the method to a digital reactor protection system are described.

  13. Game Based Cyber Security Training: are Serious Games suitable for cyber security training?

    Directory of Open Access Journals (Sweden)

    Maurice Hendrix

    2016-03-01

    Full Text Available Security research and training is attracting a lot of investment and interest from governments and the private sector. Most efforts have focused on physical security, while cyber security or digital security has been given less importance. With recent high-profile attacks it has become clear that training in cyber security is needed. Serious Games have the capability to be effective tools for public engagement and behavioural change and role play games, are already used by security professionals. Thus cyber security seems especially well-suited to Serious Games. This paper investigates whether games can be effective cyber security training tools. The study is conducted by means of a structured literature review supplemented with a general web search.While there are early positive indications there is not yet enough evidence to draw any definite conclusions. There is a clear gap in target audience with almost all products and studies targeting the general public and very little attention given to IT professionals and managers. The products and studies also mostly work over a short period, while it is known that short-term interventions are not particularly effective at affecting behavioural change.

  14. Cyber security of critical infrastructures

    Directory of Open Access Journals (Sweden)

    Leandros A. Maglaras

    2018-03-01

    Full Text Available Modern Supervisory Control and Data Acquisition (SCADA systems are essential for monitoring and managing electric power generation, transmission and distribution. In the age of the Internet of Things, SCADA has evolved into big, complex and distributed systems that are prone to be conventional in addition to new threats. Many security methods can be applied to such systems, having in mind that both high efficiency, real time intrusion identification and low overhead are required. Keywords: SCADA systems, Security

  15. Cyber Security Considerations for Autonomous Tactical Wheeled Vehicles

    Science.gov (United States)

    2016-04-01

    Update Will Enable Autonomous Driving. Retrieved August 6, 2015, from http://spectrum.ieee.org/: http://spectrum.ieee.org/ cars -that-think...Cyber Security Considerations for Autonomous Tactical Wheeled Vehicles 1 UNCLASSIFIED Cyber Security Considerations for... Autonomous Tactical Wheeled Vehicles Sebastian C Iovannitti 4/1/2016 Submitted to Lawrence Technological University College of Management in

  16. Bayesian Network Models in Cyber Security: A Systematic Review

    NARCIS (Netherlands)

    Chockalingam, S.; Pieters, W.; Herdeiro Teixeira, A.M.; van Gelder, P.H.A.J.M.; Lipmaa, Helger; Mitrokotsa, Aikaterini; Matulevicius, Raimundas

    2017-01-01

    Bayesian Networks (BNs) are an increasingly popular modelling technique in cyber security especially due to their capability to overcome data limitations. This is also instantiated by the growth of BN models development in cyber security. However, a comprehensive comparison and analysis of these

  17. Drie nationale cyber security strategieën vergeleken

    NARCIS (Netherlands)

    Luiijf, H.A.M.

    2011-01-01

    Onafhankelijk van elkaar brachten Frankrijk, Duitsland en Nederland hun nationale cyber security strategieën vrijwel tegelijk uit. De strategieën hebben overeenkomsten, maar tonen ook grote verschillen. De drie landen onderkennen een urgente noodzaak om cyber security aan te pakken, maar hebben

  18. Cyber Security: Critical Infrastructure Controls Assessment Framework

    Science.gov (United States)

    2011-05-01

    the threats to and 3 • Patch and configuration management • Vulnerability and incident t 2 vulnerabilities • Recommendations to reduce 4 managemen 5... Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington VA 22202-4302. Respondents should be aware that notwithstanding any other...unclassified c. THIS PAGE unclassified Standard Form 298 (Rev. 8-98) Prescribed by ANSI Std Z39-18 Purpose P id i t hrov e an overv ew on assessmen

  19. Introduction of regulatory guide on cyber security of L and C systems in nuclear facilities

    International Nuclear Information System (INIS)

    Kang, Y.; Jeong, C. H.; Kim, D. I.

    2008-01-01

    In the case of unauthorized individuals, systems and entities or process threatening the instrumentation and control systems of nuclear facilities using the intrinsic vulnerabilities of digital based technologies, those systems may lose their own required functions. The loss of required functions of the systems can seriously affect the safety of nuclear facilities. Consequently, digital instrumentation and control systems, which perform functions important to safety, should be designed and operated to respond to cyber threats capitalizing on the vulnerabilities of digital based technologies. To make it possible, the developers and licensees of nuclear facilities should perform appropriate cyber security activities throughout the whole life cycle of digital instrumentation and control systems. Under the goal of securing the safety of nuclear facilities, this paper presents the regulatory on cyber security activities to remove the cyber threats that exploit the vulnerabilities of digital instrumentation and control systems and to mitigate the effect of such threats. Presented regulatory guide includes establishing the cyber security policy and plan, analyzing and classifying the cyber threats and cyber security assessment of digital instrumentation and control systems. (authors)

  20. Simulations in Cyber-Security: A Review of Cognitive Modeling of Network Attackers, Defenders, and Users

    Directory of Open Access Journals (Sweden)

    Vladislav D. Veksler

    2018-05-01

    Full Text Available Computational models of cognitive processes may be employed in cyber-security tools, experiments, and simulations to address human agency and effective decision-making in keeping computational networks secure. Cognitive modeling can addresses multi-disciplinary cyber-security challenges requiring cross-cutting approaches over the human and computational sciences such as the following: (a adversarial reasoning and behavioral game theory to predict attacker subjective utilities and decision likelihood distributions, (b human factors of cyber tools to address human system integration challenges, estimation of defender cognitive states, and opportunities for automation, (c dynamic simulations involving attacker, defender, and user models to enhance studies of cyber epidemiology and cyber hygiene, and (d training effectiveness research and training scenarios to address human cyber-security performance, maturation of cyber-security skill sets, and effective decision-making. Models may be initially constructed at the group-level based on mean tendencies of each subject's subgroup, based on known statistics such as specific skill proficiencies, demographic characteristics, and cultural factors. For more precise and accurate predictions, cognitive models may be fine-tuned to each individual attacker, defender, or user profile, and updated over time (based on recorded behavior via techniques such as model tracing and dynamic parameter fitting.

  1. Measuring Library Vendor Cyber Security: Seven Easy Questions Every Librarian Can Ask

    Directory of Open Access Journals (Sweden)

    Alex Caro

    2016-04-01

    Full Text Available This article is based on an independent cyber security risk management audit for a public library system completed by the authors in early 2015 and based on a research paper by the same group at Clark University in 2014. We stress that while cyber security must include raising public knowledge in regard to cyber security issues and resources, and libraries are indeed the perfect place to disseminate this knowledge, librarians are also in a unique position as the gatekeepers of information services provided to the public and should conduct internal audits to ensure our content partners and IT vendors take cyber security as seriously as the library and its staff. One way to do this is through periodic reviews of existing vendor relationships. To this end, the authors created a simple grading rubric you can adopt or modify to help take this first step towards securing your library data. It is intended to be used by both technical and non-technical staff as a simple measurement of what vendor agreements currently exist and how they rank, while at the same time providing a roadmap for which security features or policy statements the library can or should require moving forward.

  2. Simulations in Cyber-Security: A Review of Cognitive Modeling of Network Attackers, Defenders, and Users

    Science.gov (United States)

    Veksler, Vladislav D.; Buchler, Norbou; Hoffman, Blaine E.; Cassenti, Daniel N.; Sample, Char; Sugrim, Shridat

    2018-01-01

    Computational models of cognitive processes may be employed in cyber-security tools, experiments, and simulations to address human agency and effective decision-making in keeping computational networks secure. Cognitive modeling can addresses multi-disciplinary cyber-security challenges requiring cross-cutting approaches over the human and computational sciences such as the following: (a) adversarial reasoning and behavioral game theory to predict attacker subjective utilities and decision likelihood distributions, (b) human factors of cyber tools to address human system integration challenges, estimation of defender cognitive states, and opportunities for automation, (c) dynamic simulations involving attacker, defender, and user models to enhance studies of cyber epidemiology and cyber hygiene, and (d) training effectiveness research and training scenarios to address human cyber-security performance, maturation of cyber-security skill sets, and effective decision-making. Models may be initially constructed at the group-level based on mean tendencies of each subject's subgroup, based on known statistics such as specific skill proficiencies, demographic characteristics, and cultural factors. For more precise and accurate predictions, cognitive models may be fine-tuned to each individual attacker, defender, or user profile, and updated over time (based on recorded behavior) via techniques such as model tracing and dynamic parameter fitting. PMID:29867661

  3. Simulations in Cyber-Security: A Review of Cognitive Modeling of Network Attackers, Defenders, and Users.

    Science.gov (United States)

    Veksler, Vladislav D; Buchler, Norbou; Hoffman, Blaine E; Cassenti, Daniel N; Sample, Char; Sugrim, Shridat

    2018-01-01

    Computational models of cognitive processes may be employed in cyber-security tools, experiments, and simulations to address human agency and effective decision-making in keeping computational networks secure. Cognitive modeling can addresses multi-disciplinary cyber-security challenges requiring cross-cutting approaches over the human and computational sciences such as the following: (a) adversarial reasoning and behavioral game theory to predict attacker subjective utilities and decision likelihood distributions, (b) human factors of cyber tools to address human system integration challenges, estimation of defender cognitive states, and opportunities for automation, (c) dynamic simulations involving attacker, defender, and user models to enhance studies of cyber epidemiology and cyber hygiene, and (d) training effectiveness research and training scenarios to address human cyber-security performance, maturation of cyber-security skill sets, and effective decision-making. Models may be initially constructed at the group-level based on mean tendencies of each subject's subgroup, based on known statistics such as specific skill proficiencies, demographic characteristics, and cultural factors. For more precise and accurate predictions, cognitive models may be fine-tuned to each individual attacker, defender, or user profile, and updated over time (based on recorded behavior) via techniques such as model tracing and dynamic parameter fitting.

  4. Evaluation Report on The Department's Unclassified Cyber Security Program - 2009

    International Nuclear Information System (INIS)

    Anon

    2009-01-01

    Industry experts report that security challenges and threats are continually evolving as malicious activity has become more web-based and attackers are able to rapidly adapt their attack methods. In addition, the number of data breaches continues to rise. In an effort to mitigate and address threats and protect valuable information, the Department of Energy anticipated spending about $275 million in Fiscal Year (FY) 2009 to implement cyber security measures necessary to protect its information technology resources. These systems and data are designed to support the Department's mission and business lines of energy security, nuclear security, scientific discovery and innovation, and environmental responsibility. The Federal Information Security Management Act of 2002 (FISMA) provides direction to agencies on the management and oversight of information security risks, including design and implementation of controls to protect Federal information and systems. As required by FISMA, the Office of Inspector General conducts an annual independent evaluation to determine whether the Department's unclassified cyber security program adequately protects its information systems and data. This memorandum and the attached report present the results of our evaluation for FY 2009. The Department continued to make incremental improvements in its unclassified cyber security program. Our evaluation disclosed that most sites had taken action to address weaknesses previously identified in our FY 2008 evaluation report. They improved certification and accreditation of systems; strengthened configuration management of networks and systems; performed independent assessments; and, developed and/or refined certain policies and procedures. In addition, the Department instituted a centralized incident response organization designed to eliminate duplicative efforts throughout the Department. As we have noted in previous reports, the Department continued to maintain strong network perimeter

  5. Cyber Security Policy. A methodology for Determining a National Cyber-Security Alert Level

    Directory of Open Access Journals (Sweden)

    Dan Constantin TOFAN

    2012-01-01

    Full Text Available Nowadays, assuring the security of the national cyber-space has become a big issue that can only be tackled through collaborative approaches. Threats cannot be confined to a single computer system just as much as computer systems are rendered useless without being con-nected to a supporting network. The authors of this article propose an innovative architecture of a system designated to help governments collect and analyze data about cyber-security in-cidents, from different organizations, dispersed nationwide, and acting within various economic sectors. The collected data will make us able to determine a national cyber-security alert score that could help policy makers in establishing the best strategies for protecting the national cyber-space.

  6. Methodology for Applying Cyber Security Risk Evaluation from BN Model to PSA Model

    Energy Technology Data Exchange (ETDEWEB)

    Shin, Jin Soo; Heo, Gyun Young [Kyung Hee University, Youngin (Korea, Republic of); Kang, Hyun Gook [KAIST, Dajeon (Korea, Republic of); Son, Han Seong [Joongbu University, Chubu (Korea, Republic of)

    2014-08-15

    There are several advantages to use digital equipment such as cost, convenience, and availability. It is inevitable to use the digital I and C equipment replaced analog. Nuclear facilities have already started applying the digital system to I and C system. However, the nuclear facilities also have to change I and C system even though it is difficult to use digital equipment due to high level of safety, irradiation embrittlement, and cyber security. A cyber security which is one of important concerns to use digital equipment can affect the whole integrity of nuclear facilities. For instance, cyber-attack occurred to nuclear facilities such as the SQL slammer worm, stuxnet, DUQU, and flame. The regulatory authorities have published many regulatory requirement documents such as U.S. NRC Regulatory Guide 5.71, 1.152, IAEA guide NSS-17, IEEE Standard, and KINS Regulatory Guide. One of the important problem of cyber security research for nuclear facilities is difficulty to obtain the data through the penetration experiments. Therefore, we make cyber security risk evaluation model with Bayesian network (BN) for nuclear reactor protection system (RPS), which is one of the safety-critical systems to trip the reactor when the accident is happened to the facilities. BN can be used for overcoming these problems. We propose a method to apply BN cyber security model to probabilistic safety assessment (PSA) model, which had been used for safety assessment of system, structure and components of facility. The proposed method will be able to provide the insight of safety as well as cyber risk to the facility.

  7. Methodology for Applying Cyber Security Risk Evaluation from BN Model to PSA Model

    International Nuclear Information System (INIS)

    Shin, Jin Soo; Heo, Gyun Young; Kang, Hyun Gook; Son, Han Seong

    2014-01-01

    There are several advantages to use digital equipment such as cost, convenience, and availability. It is inevitable to use the digital I and C equipment replaced analog. Nuclear facilities have already started applying the digital system to I and C system. However, the nuclear facilities also have to change I and C system even though it is difficult to use digital equipment due to high level of safety, irradiation embrittlement, and cyber security. A cyber security which is one of important concerns to use digital equipment can affect the whole integrity of nuclear facilities. For instance, cyber-attack occurred to nuclear facilities such as the SQL slammer worm, stuxnet, DUQU, and flame. The regulatory authorities have published many regulatory requirement documents such as U.S. NRC Regulatory Guide 5.71, 1.152, IAEA guide NSS-17, IEEE Standard, and KINS Regulatory Guide. One of the important problem of cyber security research for nuclear facilities is difficulty to obtain the data through the penetration experiments. Therefore, we make cyber security risk evaluation model with Bayesian network (BN) for nuclear reactor protection system (RPS), which is one of the safety-critical systems to trip the reactor when the accident is happened to the facilities. BN can be used for overcoming these problems. We propose a method to apply BN cyber security model to probabilistic safety assessment (PSA) model, which had been used for safety assessment of system, structure and components of facility. The proposed method will be able to provide the insight of safety as well as cyber risk to the facility

  8. Cyber Security Policy. A methodology for Determining a National Cyber-Security Alert Level

    OpenAIRE

    Dan Constantin TOFAN; Maria Lavinia ANDREI; Lavinia Mihaela DINCÄ‚

    2012-01-01

    Nowadays, assuring the security of the national cyber-space has become a big issue that can only be tackled through collaborative approaches. Threats cannot be confined to a single computer system just as much as computer systems are rendered useless without being con-nected to a supporting network. The authors of this article propose an innovative architecture of a system designated to help governments collect and analyze data about cyber-security in-cidents, from different organizations, di...

  9. Cyber security for nuclear power plants

    International Nuclear Information System (INIS)

    Verma, Ruchi; Razdan, Mayuri; Munshi, Prabhat

    2005-01-01

    Cyber Security, cyber terrorism and cyber crime are the buzzwords in security related aspects of information technology. These terms are related to computers and networks that are critical for normal functionality and operations of nuclear power plants. At one end, this inter connected era is giving us the ease to perform various critical operation with a click of command, but on the other end it is giving rise to the new world of terrorism. In today's internet connected world, terrorism has left all the boundaries back and taken the new form, term it cyber terrorism or cyber crime. This paper aims to spread the awareness about cyber terrorism and how it can affect the overall security of nuclear power plants and establishments. (author)

  10. Lecture 13: Control System Cyber Security

    CERN Multimedia

    CERN. Geneva

    2013-01-01

    Today, the industralized world lives in symbiosis with control systems: it depends on power distribution, oil production, public transport, automatic production lines. While the convenience is at hand, still too many control systems are designed without any security in mind, lack basic security protections, and are not even robust enough to withstand basic attacks. The Stuxnet worm attacking Siemens PLCs in 2010 was another close call. Attackers currently enjoy hacking control systems, and aim to switch lights off. This presentation shall recap the current situation and outline why the presenter is still waiting for a change in paradigm. Stefan Lüders, PhD, graduated from the Swiss Federal Institute of Technology in Zurich and joined CERN in 2002. Being initially developer of a common safety system used in all four experiments at the Large Hadron Collider, he gathered expertise in cyber-security issues of control systems. Consequently in 2004, he took over responsibilities in securing CERN's accelerator and...

  11. Survey of Cyber Security Intrinsic for a Nuclear Power Plant

    Energy Technology Data Exchange (ETDEWEB)

    Choi, Yoo Rark; Lee, Jae Cheol [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2009-05-15

    Federal agencies are facing a set of emerging cyber security threats that are the result of increasingly sophisticated methods of attack and the blending of once distinct types of attack into more complex and damaging forms. Spam, phishing, and spyware, while once viewed as discrete consumer challenges, are being blended to create substantial threats to large enterprises, including federal systems and digital I and C of a NPP (Nuclear Power Plant) is one of them. The cyber security policy for a NPP has been established for years by KINS, but its scope is very broad and conceptual. We will describe several important cyber security issues for a NPP in the applicative boundary.

  12. Survey of Cyber Security Intrinsic for a Nuclear Power Plant

    International Nuclear Information System (INIS)

    Choi, Yoo Rark; Lee, Jae Cheol

    2009-01-01

    Federal agencies are facing a set of emerging cyber security threats that are the result of increasingly sophisticated methods of attack and the blending of once distinct types of attack into more complex and damaging forms. Spam, phishing, and spyware, while once viewed as discrete consumer challenges, are being blended to create substantial threats to large enterprises, including federal systems and digital I and C of a NPP (Nuclear Power Plant) is one of them. The cyber security policy for a NPP has been established for years by KINS, but its scope is very broad and conceptual. We will describe several important cyber security issues for a NPP in the applicative boundary

  13. Advanced Course in Engineering (ACE) - Cyber Security Boot Camp

    National Research Council Canada - National Science Library

    Older, Susan

    2008-01-01

    .... ACE achieved its stated objectives by completely immersing students in the cyber-security discipline for ten weeks, through a combination of intense coursework, open-ended problems, and internship...

  14. Your employees: the front line in cyber security

    OpenAIRE

    Ashenden, D

    2016-01-01

    First published in The Chemical Engineer and reproduced by Crest - Centre for Research and Evidence on Security Threats, 26/01/2016 (https://crestresearch.ac.uk/comment/employees-front-line-cyber-security/)

  15. Empirical analysis of the effects of cyber security incidents.

    Science.gov (United States)

    Davis, Ginger; Garcia, Alfredo; Zhang, Weide

    2009-09-01

    We analyze the time series associated with web traffic for a representative set of online businesses that have suffered widely reported cyber security incidents. Our working hypothesis is that cyber security incidents may prompt (security conscious) online customers to opt out and conduct their business elsewhere or, at the very least, to refrain from accessing online services. For companies relying almost exclusively on online channels, this presents an important business risk. We test for structural changes in these time series that may have been caused by these cyber security incidents. Our results consistently indicate that cyber security incidents do not affect the structure of web traffic for the set of online businesses studied. We discuss various public policy considerations stemming from our analysis.

  16. Recommendations on Future Operational Environments Command Control and Cyber Security

    OpenAIRE

    Goztepe, Kerim

    2015-01-01

    It is a well-known fact that today a nation's telecommunication networks, critical infrastructure, and information systems are vulnerable to growing number of attacks in cyberspace. Cyber space contains very different problems involving various sets of threats, targets and costs. Cyber security is not only problem of banking, communication or transportation. It also threatens core systems of army as command control. Some significant recommendations on command control (C2) and cyber security h...

  17. The Soft Side of Cyber Security - Social Media

    DEFF Research Database (Denmark)

    Nissen, Thomas Elkjer

    2016-01-01

    The importance of cyber-security is growing. With the continued digitization of our everyday life we become increasingly vulnerable to cyber-attacks – also personally. Therefore, it is an issue to be taken extremely seriously.......The importance of cyber-security is growing. With the continued digitization of our everyday life we become increasingly vulnerable to cyber-attacks – also personally. Therefore, it is an issue to be taken extremely seriously....

  18. Developing cyber security architecture for military networks using cognitive networking

    OpenAIRE

    Kärkkäinen, Anssi

    2015-01-01

    In recent years, the importance of cyber security has increased. Cyber security has not become a critical issue only for governmental or business actors, but also for armed forces that nowadays rely on national or even global networks in their daily activities. The Network Centric Warfare (NCW) paradigm has increased the significance of networking during last decades as it enables information superiority in which military combat power increased by networking the battlefield actors from perspe...

  19. Europe’s fragmented approach towards cyber security

    OpenAIRE

    Karine e Silva

    2013-01-01

    The article proposes a deeper insight into the variety of concepts used to describe the term cyber security and the ways in which it has been used in recent years. It examines the role of three important actors involved in the internet governance arena, namely governments, private sector and civil society, and how they have influenced the debate. To this end, this paper analyses how different organisations, industry and societal actors see cyber security and how their interests influence the ...

  20. Crowdsourcing cyber security: a property rights view of exclusion and theft on the information commons

    Directory of Open Access Journals (Sweden)

    Gary Shiffman

    2013-02-01

    Full Text Available Individuals increasingly rely upon the internet for basic economic interaction. Current cyber security mechanisms are unable to stop adversaries and hackers from gaining access to sensitive information stored on government, business, and public computers. Experts propose implementing attribution and audit frameworks in cyberspace to deter, prevent, and prosecute cyber criminals and attackers. However, this method faces significant policy and resource constraints. Social science research, specifically in law and economics, concerning common-pool resources suggests an organic approach to cyber security may yield an appropriate solution. This cyber commons method involves treating the internet as a commons and encouraging individuals and institutions to voluntarily implement innovative and adaptive monitoring mechanisms. Such mechanisms are already in use and in many cases have proven more effective than attribution mechanisms in resisting and tracing the source of cyber attacks.

  1. Cyber Security in Digital I and C Implementation

    Energy Technology Data Exchange (ETDEWEB)

    Chow, Ivan; Hsu, Allen; Kim, Jong Min; Luo, William [Doosan HF Controls, Texas (United States)

    2011-08-15

    During the Nuclear Regulatory Commission (NRC) audit process of Doosan HF Control HFC-6000 safety system 2009, cyber security assessment was a major audit process. The result of the assessment was favorably satisfied. As preventing digital I and C systems from being hijacked by malicious software a major goal for the NRC, audit process of actual digital I and C implementations such as the HFC-6000 safety system which provides already strong cyber security measures is mutually beneficial to both the NRC and the vendor: NRC can enhance their set of cyber security assessments and vendors such as Doosan HFC can also augment their cyber security measures. The NRC Safety Evaluation Report (SER) for the HFC-6000 system was released in April 2011 qualifying the system to be used as safety systems in US nuclear power plants. This paper provides the summary of the cyber security assessment of the complete software life cycle of HFC-6000 Safety System. Lessons learned in each life cycle phase are provided. In addition, alternate measures or recommendations for enhancing the cyber security in each life cycle phase are also described.

  2. Cyber Security in Digital I and C Implementation

    International Nuclear Information System (INIS)

    Chow, Ivan; Hsu, Allen; Kim, Jong Min; Luo, William

    2011-01-01

    During the Nuclear Regulatory Commission (NRC) audit process of Doosan HF Control HFC-6000 safety system 2009, cyber security assessment was a major audit process. The result of the assessment was favorably satisfied. As preventing digital I and C systems from being hijacked by malicious software a major goal for the NRC, audit process of actual digital I and C implementations such as the HFC-6000 safety system which provides already strong cyber security measures is mutually beneficial to both the NRC and the vendor: NRC can enhance their set of cyber security assessments and vendors such as Doosan HFC can also augment their cyber security measures. The NRC Safety Evaluation Report (SER) for the HFC-6000 system was released in April 2011 qualifying the system to be used as safety systems in US nuclear power plants. This paper provides the summary of the cyber security assessment of the complete software life cycle of HFC-6000 Safety System. Lessons learned in each life cycle phase are provided. In addition, alternate measures or recommendations for enhancing the cyber security in each life cycle phase are also described

  3. Cyber security: a question of method

    International Nuclear Information System (INIS)

    Cappelle, A.

    2016-01-01

    Industrial devices are more and more connected which has generated numerous weaknesses and flaws in networks. Most attacks concern basic things. The French law about military programming defines vital infrastructures whose operators must comply with a minimal cyber security standard. These vital infrastructures include water treatment plants, nuclear power plants or hospitals. In last december the black-ware BlackEnergy enabled hackers to access the management systems of several power plants in Ukraine causing a huge power outage. Technical solutions exist but solving this issue is above all a question of method: you must study your network, identifying the fluxes of information and then to set adequate solutions at the right places. By positioning components able to analyse fluxes you can detect abnormal fluxes and bar the access. The right settings of software like firewalls are an important thing to get a high standard of security. For external communication efficient encoding solutions exist that ensure a high level of secrecy and can identify the contact person. (A.C.)

  4. Anomaly-based online intrusion detection system as a sensor for cyber security situational awareness system

    OpenAIRE

    Kokkonen, Tero

    2016-01-01

    Almost all the organisations and even individuals rely on complex structures of data networks and networked computer systems. That complex data ensemble, the cyber domain, provides great opportunities, but at the same time it offers many possible attack vectors that can be abused for cyber vandalism, cyber crime, cyber espionage or cyber terrorism. Those threats produce requirements for cyber security situational awareness and intrusion detection capability. This dissertation conc...

  5. Data fusion in cyber security: first order entity extraction from common cyber data

    Science.gov (United States)

    Giacobe, Nicklaus A.

    2012-06-01

    The Joint Directors of Labs Data Fusion Process Model (JDL Model) provides a framework for how to handle sensor data to develop higher levels of inference in a complex environment. Beginning from a call to leverage data fusion techniques in intrusion detection, there have been a number of advances in the use of data fusion algorithms in this subdomain of cyber security. While it is tempting to jump directly to situation-level or threat-level refinement (levels 2 and 3) for more exciting inferences, a proper fusion process starts with lower levels of fusion in order to provide a basis for the higher fusion levels. The process begins with first order entity extraction, or the identification of important entities represented in the sensor data stream. Current cyber security operational tools and their associated data are explored for potential exploitation, identifying the first order entities that exist in the data and the properties of these entities that are described by the data. Cyber events that are represented in the data stream are added to the first order entities as their properties. This work explores typical cyber security data and the inferences that can be made at the lower fusion levels (0 and 1) with simple metrics. Depending on the types of events that are expected by the analyst, these relatively simple metrics can provide insight on their own, or could be used in fusion algorithms as a basis for higher levels of inference.

  6. Assessment And Testing of Industrial Devices Robustness Against Cyber Security Attacks

    CERN Document Server

    Tilaro, F

    2011-01-01

    CERN (European Organization for Nuclear Research),like any organization, needs to achieve the conflicting objectives of connecting its operational network to Internet while at the same time keeping its industrial control systems secure from external and internal cyber attacks. With this in mind, the ISA-99[0F1] international cyber security standard has been adopted at CERN as a reference model to define a set of guidelines and security robustness criteria applicable to any network device. Devices robustness represents a key link in the defense-in-depth concept as some attacks will inevitably penetrate security boundaries and thus require further protection measures. When assessing the cyber security robustness of devices we have singled out control system-relevant attack patterns derived from the well-known CAPEC[1F2] classification. Once a vulnerability is identified, it needs to be documented, prioritized and reproduced at will in a dedicated test environment for debugging purposes. CERN - in collaboration ...

  7. Cyber Security Penetration Test for Digital Safety I and C Systems

    International Nuclear Information System (INIS)

    Lee, C. K.; Kim, D. H.; Kwon, K. C.; Joo, H. K.; Song, J. S.

    2010-01-01

    In the Korea Nuclear I and C Systems Development project the platforms for plant protection systems are developed, which function as a reactor shutdown, actuation of engineered safety features and a control of the related equipment. Those are fully digitalized through the use of safety-grade programmable logic controllers (PLCs) and few types of communication network. However the Regulatory Guide 1.152 (Rev. 02) was published by the U.S. NRC in 2006 and it recommended the application of a cyber security to the safety systems in the Nuclear Power Plant (NPP). Therefore to incorporate the new licensing requirement, a cyber security risk assessment is performed for the platforms. Then the vulnerabilities identified by the risk assessment are validated by penetration test. This paper summarizes test scenario, test results and their incorporation into system design

  8. Cyber security in nuclear power plants and its portability to other industrial infrastructures

    Energy Technology Data Exchange (ETDEWEB)

    Champigny, Sebastien; Gupta, Deeksha; Watson, Venesa; Waedt, Karl [AREVA GmbH, Erlangen (Germany)

    2017-06-15

    Power generation increasingly relies on decentralised and interconnected computerised systems. Concepts like ''Industrial Internet of Things'' of the Industrial Internet Consortium (IIC), and ''Industry 4.0'' find their way in this strategic industry. Risk of targeted exploits of errors and vulnerabilities increases with complexity, interconnectivity and decentralization. Inherently stringent security requirements and features make nuclear computerised applications and systems a benchmark for industrial counterparts seeking to hedge against those risks. Consequently, this contribution presents usual cyber security regulations and practices for nuclear power plants. It shows how nuclear cyber security can be ported and used in an industrial context to protect critical infrastructures against cyber-attacks and industrial espionage.

  9. Europe’s fragmented approach towards cyber security

    Directory of Open Access Journals (Sweden)

    Karine e Silva

    2013-10-01

    Full Text Available The article proposes a deeper insight into the variety of concepts used to describe the term cyber security and the ways in which it has been used in recent years. It examines the role of three important actors involved in the internet governance arena, namely governments, private sector and civil society, and how they have influenced the debate. To this end, this paper analyses how different organisations, industry and societal actors see cyber security and how their interests influence the way the debate has evolved. The difficult balance between security and fundamental rights, although not new to governments and society, is of great importance for the internet. Citizens have engaged in favour of an open internet. However, little attention has been paid to the demands of citizens and how they may contribute to a concept of cyber security that brings society to its core. The paper states that for cyberspace to be open and supportive of innovation, the practice of cyber security needs to internalise the interests and perspectives of end users. A multistakeholder approach to cyber security asks a more participative environment where the rules of the game are decided with public participation and consultation, giving citizens the means and methods to influence the way cyber security is conceived and implemented. The paper concludes that although a citizen centric approach towards cyber security should be the way forward, this seems to be yet far from being included in the governmental agenda. The methodology applied in the paper was mainly focused on desk research.

  10. Smart grid cyber security for Europe

    International Nuclear Information System (INIS)

    Pearson, Ivan L.G.

    2011-01-01

    In Europe, environmental and economic considerations are driving a revolution in power transmission and distribution. Specifically of interest to this paper, utility companies are increasingly using information and communication technology (ICT) to increase the efficiency and reliability of the grid, as well as to incorporate smaller-scale sources of intermittent wind and solar power into our electricity supply. This should have a positive effect on Europe's energy policy objectives. However, developments in the field of international security have made clear that increased reliance on ICT within the electricity sector will create new vulnerabilities that may undermine these gains. This paper argues that the European Union (EU) has the opportunity to mitigate these vulnerabilities by virtue of its strengthening regulatory position in the European market, and its record of promoting energy technology research. However, the organization will need to act now in recognizing that cyber security as an essential dimension of its energy policy. This paper recommends that the Commission acts now to appoint a coordinator to accelerate the adoption of sensitive institutional changes in this vein. It also suggests that the EU would benefit from cooperation with the United States-a country with strong cyber capabilities that would complement the European program. - Highlights: → Increased reliance on ICT has created new challenges in Europe's electricity sector.→ The European Union has the opportunity to mitigate these.→ The Union must acts now to prevent a potentially costly technological lock-in.→ It should designate a coordinator to drive through necessary legislative reforms.→ The United States would be a good international partner on the issue.

  11. Smart grid cyber security for Europe

    Energy Technology Data Exchange (ETDEWEB)

    Pearson, Ivan L.G., E-mail: ivan.pearson@ec.europa.eu [F03 - Energy Security Unit (ESU), European Commission, Joint Research Centre, Institute for Energy (Netherlands)

    2011-09-15

    In Europe, environmental and economic considerations are driving a revolution in power transmission and distribution. Specifically of interest to this paper, utility companies are increasingly using information and communication technology (ICT) to increase the efficiency and reliability of the grid, as well as to incorporate smaller-scale sources of intermittent wind and solar power into our electricity supply. This should have a positive effect on Europe's energy policy objectives. However, developments in the field of international security have made clear that increased reliance on ICT within the electricity sector will create new vulnerabilities that may undermine these gains. This paper argues that the European Union (EU) has the opportunity to mitigate these vulnerabilities by virtue of its strengthening regulatory position in the European market, and its record of promoting energy technology research. However, the organization will need to act now in recognizing that cyber security as an essential dimension of its energy policy. This paper recommends that the Commission acts now to appoint a coordinator to accelerate the adoption of sensitive institutional changes in this vein. It also suggests that the EU would benefit from cooperation with the United States-a country with strong cyber capabilities that would complement the European program. - Highlights: > Increased reliance on ICT has created new challenges in Europe's electricity sector.> The European Union has the opportunity to mitigate these.> The Union must acts now to prevent a potentially costly technological lock-in.> It should designate a coordinator to drive through necessary legislative reforms.> The United States would be a good international partner on the issue.

  12. APPROACH TO CYBER SECURITY ISSUES IN NIGERIA: CHALLENGES AND SOLUTION

    Directory of Open Access Journals (Sweden)

    Frank Ibikunle

    2013-06-01

    Full Text Available Cyber-space refers to the boundless space known as the internet. Cyber-security is the body of rules put in place for the protection of the cyber space. Cyber-crime refers to the series of organized crime attacking both cyber space and cyber security. The Internet is one of the fastest-growing areas of technical infrastructure development. Over the past decades, the growth of the internet and its use afforded everyone this opportunity. Google, Wikipedia and Bing to mention a few, give detailed answers to millions of questions every day. Cyberspace is a world that contains just about anything one is searching for. With the advent of these advancements in information accessibility and the advantages and applications of the internet comes an exponentially growing disadvantage- Cyber Crime. Cyber security has risen to become a national concern as threats concerning it now need to be taken more seriously. This paper attempts to provide an overview of Cybercrime and Cyber-security. It defines the concept of cybercrime, identify reasons for cyber-crime and its eradication. It look at those involved and the reasons for their involvement. Methods of stepping up cyber security and the recommendations that would help in checking the increasing rate of cyber-crimes were highlighted. The paper also attempts to name some challenges of cybercrime and present practical and logical solutions to these threats.

  13. Cyber security with radio frequency interferences mitigation study for satellite systems

    Science.gov (United States)

    Wang, Gang; Wei, Sixiao; Chen, Genshe; Tian, Xin; Shen, Dan; Pham, Khanh; Nguyen, Tien M.; Blasch, Erik

    2016-05-01

    Satellite systems including the Global Navigation Satellite System (GNSS) and the satellite communications (SATCOM) system provide great convenience and utility to human life including emergency response, wide area efficient communications, and effective transportation. Elements of satellite systems incorporate technologies such as navigation with the global positioning system (GPS), satellite digital video broadcasting, and information transmission with a very small aperture terminal (VSAT), etc. The satellite systems importance is growing in prominence with end users' requirement for globally high data rate transmissions; the cost reduction of launching satellites; development of smaller sized satellites including cubesat, nanosat, picosat, and femtosat; and integrating internet services with satellite networks. However, with the promising benefits, challenges remain to fully develop secure and robust satellite systems with pervasive computing and communications. In this paper, we investigate both cyber security and radio frequency (RF) interferences mitigation for satellite systems, and demonstrate that they are not isolated. The action space for both cyber security and RF interferences are firstly summarized for satellite systems, based on which the mitigation schemes for both cyber security and RF interferences are given. A multi-layered satellite systems structure is provided with cross-layer design considering multi-path routing and channel coding, to provide great security and diversity gains for secure and robust satellite systems.

  14. A review of game theory approach to cyber security risk management

    African Journals Online (AJOL)

    A review of game theory approach to cyber security risk management. ... This paper presents a review of game theoretic-based model for cyber security risk management. Specifically, issues on ... AJOL African Journals Online. HOW TO USE ...

  15. 78 FR 39712 - Critical Infrastructure Protection and Cyber Security Trade Mission to Saudi Arabia and Kuwait...

    Science.gov (United States)

    2013-07-02

    ... DEPARTMENT OF COMMERCE International Trade Administration Critical Infrastructure Protection and Cyber Security Trade Mission to Saudi Arabia and Kuwait Clarification and Amendment AGENCY... cyber-security firms and trade organizations which have not already submitted an application are...

  16. 78 FR 6807 - Critical Infrastructure Protection and Cyber Security Trade Mission to Saudi Arabia and Kuwait...

    Science.gov (United States)

    2013-01-31

    ... coordinating and sponsoring an executive-led Critical Infrastructure Protection and Cyber Security mission to... on the cyber security, critical infrastructure protection, and emergency management, ports of entry... security, including border protection, civil defense capabilities, and coast guard and maritime...

  17. Cyber security issues imposed on nuclear power plants

    International Nuclear Information System (INIS)

    Kim, Do-Yeon

    2014-01-01

    Highlights: • Provide history of cyber attacks targeting at nuclear facilities. • Provide cyber security issues imposed on nuclear power plants. • Provide possible countermeasures for protecting nuclear power plants. - Abstract: With the introduction of new technology based on the increasing digitalization of control systems, the potential of cyber attacks has escalated into a serious threat for nuclear facilities, resulting in the advent of the Stuxnet. In this regard, the nuclear industry needs to consider several cyber security issues imposed on nuclear power plants, including regulatory guidelines and standards for cyber security, the possibility of Stuxnet-inherited malware attacks in the future, and countermeasures for protecting nuclear power plants against possible cyber attacks

  18. Cyber security issues, challenges and solutions for the emerging smart grid

    Energy Technology Data Exchange (ETDEWEB)

    Westlund, D. [N-Dimension Solutions Inc., Richmond Hill, ON (Canada)

    2007-07-01

    This paper explored the technology and business issues and challenges associated the smart grid's tolerance of physical and cyber security attacks and proposed a framework that provides practical solutions for the electric operator. The 7 characteristics of a smart grid were described. Notably, a smart grid is self healing; supports client equipment and usage behaviour; tolerates physical and cyber security attacks; delivers high-quality power to customers; supports various power generation technologies; supports competitive power markets; and, delivers capital asset optimization while minimizing operational costs. According to the North American Electric Reliability Council (NERC), power capacity will increase by 6 per cent in the United States and 9 per cent in Canada, while the demand for electricity is expected to rise by 19 and 13 per cent respectively. In addition, total transmission miles are projected to increase by less than 7 per cent in the U.S. and by only 3.5 per cent in Canada. A Smart Grid, with distributed monitoring and control, is therefore needed to meet the increased demand. However, the power and energy sectors are targets for cyber attackers. Cyber security in real-time grid operations is a complex matter. Cyber risks include unauthorized access to control systems; interception of control data; attack on system components; interception of monitoring data; intentional and unintentional human intervention; and, impairment to application software. The proposed solution framework is based on a roadmap developed by the United States Homeland Security organization, the United States Department of Energy, and the Canadian Energy Infrastructure Protection Division. NERC reliability standards and framework are also integrated into this framework. The technical aspects of the framework include: ease of use; defence-in-depth characteristics; extensive monitoring within electronic security perimeters; protection of legacy systems; auditing, logging

  19. Cyber Security Risk Evaluation of a Nuclear I&C Using BN and ET

    OpenAIRE

    Jinsoo Shin; Hanseong Son; Gyunyoung Heo

    2017-01-01

    Cyber security is an important issue in the field of nuclear engineering because nuclear facilities use digital equipment and digital systems that can lead to serious hazards in the event of an accident. Regulatory agencies worldwide have announced guidelines for cyber security related to nuclear issues, including U.S. NRC Regulatory Guide 5.71. It is important to evaluate cyber security risk in accordance with these regulatory guides. In this study, we propose a cyber security risk evaluatio...

  20. APPROACH TO CYBER SECURITY ISSUES IN NIGERIA: CHALLENGES AND SOLUTION

    OpenAIRE

    Frank Ibikunle; Odunayo Eweniyi

    2013-01-01

    Cyber-space refers to the boundless space known as the internet. Cyber-security is the body of rules put in place for the protection of the cyber space. Cyber-crime refers to the series of organized crime attacking both cyber space and cyber security. The Internet is one of the fastest-growing areas of technical infrastructure development. Over the past decades, the growth of the internet and its use afforded everyone this opportunity. Google, Wikipedia and Bing to mention a few, give detaile...

  1. Process Control System Cyber Security Standards - An Overview

    Energy Technology Data Exchange (ETDEWEB)

    Robert P. Evans; V Stanley Scown; Rolf Carlson; Shabbir Shamsuddin; George Shaw; Jeff Dagle; Paul W Oman; Jeannine Schmidt

    2005-10-01

    The use of cyber security standards can greatly assist in the protection of critical infrastructure by providing guidelines and requisite imperatives in the implementation of computer-controlled systems. These standards are most effective when the engineers and operators using the standards understand what each of the standards addresses and does not address. This paper provides a review and comparison of ten documents dealing with control system cyber security. It is not meant to be a complete treatment of all applicable standards; rather, this is an exemplary analysis showing the benefits of comparing and contrasting differing documents.

  2. International Conference on Computational Intelligence, Cyber Security, and Computational Models

    CERN Document Server

    Ramasamy, Vijayalakshmi; Sheen, Shina; Veeramani, C; Bonato, Anthony; Batten, Lynn

    2016-01-01

    This book aims at promoting high-quality research by researchers and practitioners from academia and industry at the International Conference on Computational Intelligence, Cyber Security, and Computational Models ICC3 2015 organized by PSG College of Technology, Coimbatore, India during December 17 – 19, 2015. This book enriches with innovations in broad areas of research like computational modeling, computational intelligence and cyber security. These emerging inter disciplinary research areas have helped to solve multifaceted problems and gained lot of attention in recent years. This encompasses theory and applications, to provide design, analysis and modeling of the aforementioned key areas.

  3. Evaluation of a Cyber Security System for Hospital Network.

    Science.gov (United States)

    Faysel, Mohammad A

    2015-01-01

    Most of the cyber security systems use simulated data in evaluating their detection capabilities. The proposed cyber security system utilizes real hospital network connections. It uses a probabilistic data mining algorithm to detect anomalous events and takes appropriate response in real-time. On an evaluation using real-world hospital network data consisting of incoming network connections collected for a 24-hour period, the proposed system detected 15 unusual connections which were undetected by a commercial intrusion prevention system for the same network connections. Evaluation of the proposed system shows a potential to secure protected patient health information on a hospital network.

  4. Shopping For Danger: E-commerce techniques applied to collaboration in cyber security

    Energy Technology Data Exchange (ETDEWEB)

    Bruce, Joseph R.; Fink, Glenn A.

    2012-05-24

    Collaboration among cyber security analysts is essential to a successful protection strategy on the Internet today, but it is uncommonly practiced or encouraged in operating environments. Barriers to productive collaboration often include data sensitivity, time and effort to communicate, institutional policy, and protection of domain knowledge. We propose an ambient collaboration framework, Vulcan, designed to remove the barriers of time and effort and mitigate the others. Vulcan automated data collection, collaborative filtering, and asynchronous dissemination, eliminating the effort implied by explicit collaboration among peers. We instrumented two analytic applications and performed a mock analysis session to build a dataset and test the output of the system.

  5. Advances in cyber security technology, operations, and experiences

    CERN Document Server

    Hsu, D Frank

    2013-01-01

    Advances in Cyber Security provides, in a technical yet easy to understand fashion, a real life story of the evolving cyberspace ecosystem from the perspectives of structure, function, and application. It also provides ways and means to secure and sustain this ecosystem by the collective wisdom of professionals and practitioners from government, academia, and industry across national and international boundaries.

  6. Reconciling Malicious and Accidental Risk in Cyber Security

    NARCIS (Netherlands)

    Pieters, Wolter; Lukszo, Zofia; Hadziosmanovic, D.; van den Berg, Jan

    Consider the question whether a cyber security investment is cost-effective. The result will depend on the expected frequency of attacks. Contrary to what is referred to as threat event frequencies or hazard rates in safety risk management, frequencies of targeted attacks are not independent from

  7. Adversarial Reinforcement Learning in a Cyber Security Simulation}

    NARCIS (Netherlands)

    Elderman, Richard; Pater, Leon; Thie, Albert; Drugan, Madalina; Wiering, Marco

    2017-01-01

    This paper focuses on cyber-security simulations in networks modeled as a Markov game with incomplete information and stochastic elements. The resulting game is an adversarial sequential decision making problem played with two agents, the attacker and defender. The two agents pit one reinforcement

  8. Cyber Security Analysis by Attack Trees for a Reactor Protection System

    International Nuclear Information System (INIS)

    Park, Gee-Yong; Lee, Cheol Kwon; Choi, Jong Gyun; Kim, Dong Hoon; Lee, Young Jun; Kwon, Kee-Choon

    2008-01-01

    As nuclear facilities are introducing digital systems, the cyber security becomes an emerging topic to be analyzed and resolved. The domestic and other nation's regulatory bodies notice this topic and are preparing an appropriate guidance. The nuclear industry where new construction or upgrade of I and C systems is planned is analyzing and establishing a cyber security. A risk-based analysis for the cyber security has been performed in the KNICS (Korea Nuclear I and C Systems) project where the cyber security analysis has been applied to a reactor protection system (RPS). In this paper, the cyber security analysis based on the attack trees is proposed for the KNICS RPS

  9. Human-Technology Centric In Cyber Security Maintenance For Digital Transformation Era

    Science.gov (United States)

    Ali, Firkhan Ali Bin Hamid; Zalisham Jali, Mohd, Dr

    2018-05-01

    The development of the digital transformation in the organizations has become more expanding in these present and future years. This is because of the active demand to use the ICT services among all the organizations whether in the government agencies or private sectors. While digital transformation has led manufacturers to incorporate sensors and software analytics into their offerings, the same innovation has also brought pressure to offer clients more accommodating appliance deployment options. So, their needs a well plan to implement the cyber infrastructures and equipment. The cyber security play important role to ensure that the ICT components or infrastructures execute well along the organization’s business successful. This paper will present a study of security management models to guideline the security maintenance on existing cyber infrastructures. In order to perform security model for the currently existing cyber infrastructures, combination of the some security workforces and security process of extracting the security maintenance in cyber infrastructures. In the assessment, the focused on the cyber security maintenance within security models in cyber infrastructures and presented a way for the theoretical and practical analysis based on the selected security management models. Then, the proposed model does evaluation for the analysis which can be used to obtain insights into the configuration and to specify desired and undesired configurations. The implemented cyber security maintenance within security management model in a prototype and evaluated it for practical and theoretical scenarios. Furthermore, a framework model is presented which allows the evaluation of configuration changes in the agile and dynamic cyber infrastructure environments with regard to properties like vulnerabilities or expected availability. In case of a security perspective, this evaluation can be used to monitor the security levels of the configuration over its lifetime and

  10. Cyber secure systems approach for NPP digital control systems

    Energy Technology Data Exchange (ETDEWEB)

    McCreary, T. J.; Hsu, A. [HF Controls Corporation, 16650 Westgrove Drive, Addison, TX 75001 (United States)

    2006-07-01

    Whether fossil or nuclear power, the chief operations goal is to generate electricity. The heart of most plant operations is the I and C system. With the march towards open architecture, the I and C system is more vulnerable than ever to system security attacks (denial of service, virus attacks and others), thus jeopardizing plant operations. Plant staff must spend large amounts of time and money setting up and monitoring a variety of security strategies to counter the threats and actual attacks to the system. This time and money is a drain on the financial performance of a plant and distracts valuable operations resources from their real goals: product. The pendulum towards complete open architecture may have swung too far. Not all aspects of proprietary hardware and software are necessarily 'bad'. As the aging U.S. fleet of nuclear power plants starts to engage in replacing legacy control systems, and given the on-going (and legitimate) concern about the security of present digital control systems, decisions about how best to approach cyber security are vital to the specification and selection of control system vendors for these upgrades. The authors maintain that utilizing certain resources available in today's digital technology, plant control systems can be configured from the onset to be inherently safe, so that plant staff can concentrate on the operational issues of the plant. The authors postulate the concept of the plant I and C being bounded in a 'Cyber Security Zone' and present a design approach that can alleviate the concern and cost at the plant level of dealing with system security strategies. Present approaches through various IT cyber strategies, commercial software, and even postulated standards from various industry/trade organizations are almost entirely reactive and simply add to cost and complexity. This Cyber Security Zone design demonstrates protection from the four classes of cyber security attacks: 1)Threat from

  11. Cyber secure systems approach for NPP digital control systems

    International Nuclear Information System (INIS)

    McCreary, T. J.; Hsu, A.

    2006-01-01

    Whether fossil or nuclear power, the chief operations goal is to generate electricity. The heart of most plant operations is the I and C system. With the march towards open architecture, the I and C system is more vulnerable than ever to system security attacks (denial of service, virus attacks and others), thus jeopardizing plant operations. Plant staff must spend large amounts of time and money setting up and monitoring a variety of security strategies to counter the threats and actual attacks to the system. This time and money is a drain on the financial performance of a plant and distracts valuable operations resources from their real goals: product. The pendulum towards complete open architecture may have swung too far. Not all aspects of proprietary hardware and software are necessarily 'bad'. As the aging U.S. fleet of nuclear power plants starts to engage in replacing legacy control systems, and given the on-going (and legitimate) concern about the security of present digital control systems, decisions about how best to approach cyber security are vital to the specification and selection of control system vendors for these upgrades. The authors maintain that utilizing certain resources available in today's digital technology, plant control systems can be configured from the onset to be inherently safe, so that plant staff can concentrate on the operational issues of the plant. The authors postulate the concept of the plant I and C being bounded in a 'Cyber Security Zone' and present a design approach that can alleviate the concern and cost at the plant level of dealing with system security strategies. Present approaches through various IT cyber strategies, commercial software, and even postulated standards from various industry/trade organizations are almost entirely reactive and simply add to cost and complexity. This Cyber Security Zone design demonstrates protection from the four classes of cyber security attacks: 1)Threat from an intruder attempting to

  12. Cyber security and vulnerability of 'smart' power grids

    OpenAIRE

    Jovanović, Slobodan

    2012-01-01

    Smart power grids deliver electric energy from generation to consumers using two-way Smart Meter technology (smart meters), enabling remote control of consumer energy use. However, smart power grids are increasingly very attractive targets for hackers and terrorists. This paper discusses the key characteristics of cyber security/vulnerability of smart power grids, and their communication architecture, and their vulnerability points. Then, it describes guidelines which are needed to be impleme...

  13. Adversarial Reinforcement Learning in a Cyber Security Simulation}

    OpenAIRE

    Elderman, Richard; Pater, Leon; Thie, Albert; Drugan, Madalina; Wiering, Marco

    2017-01-01

    This paper focuses on cyber-security simulations in networks modeled as a Markov game with incomplete information and stochastic elements. The resulting game is an adversarial sequential decision making problem played with two agents, the attacker and defender. The two agents pit one reinforcement learning technique, like neural networks, Monte Carlo learning and Q-learning, against each other and examine their effectiveness against learning opponents. The results showed that Monte Carlo lear...

  14. A decision support system for corporations cyber security risk management

    OpenAIRE

    Molina, Gabriela del Rocio Roldan

    2017-01-01

    This thesis presents a decision aiding system named C3-SEC (Contex-aware Corporative Cyber Security), developed in the context of a master program at Polytechnic Institute of Leiria, Portugal. The research dimension and the corresponding software development process that followed are presented and validated with an application scenario and case study performed at Universidad de las Fuerzas Armadas ESPE – Ecuador. C3-SEC is a decision aiding software intended to support cyber ri...

  15. A Comparison of Cross-Sector Cyber Security Standards

    Energy Technology Data Exchange (ETDEWEB)

    Robert P. Evans

    2005-09-01

    This report presents a review and comparison (commonality and differences) of three cross-sector cyber security standards and an internationally recognized information technology standard. The comparison identifies the security areas covered by each standard and reveals where the standards differ in emphasis. By identifying differences in the standards, the user can evaluate which standard best meets their needs. For this report, only cross-sector standards were reviewed.

  16. Cyber Security Vulnerability Impact on I and C Reliability

    International Nuclear Information System (INIS)

    Hadley, Mark D.; McBride, Justin B.

    2006-01-01

    We present a discussion of the cyber security vulnerability impact on instrument and control reliability. In the discussion we demonstrate the likely vector of attack and vulnerabilities associated with commodity hardware, protocols and communication media. The current fleet of nuclear power plants in the United States utilizes aging analog instrument and control systems which are more frequently suffering from obsolescence and failure. The commodity equipment available now and in the near future incorporates features from information technology systems which compound cyber vulnerabilities

  17. Survey of cyber security issues in smart grids

    Science.gov (United States)

    Chen, Thomas M.

    2010-04-01

    The future smart grid will enable cost savings and lower energy use by means of smart appliances and smart meters which support dynamic load management and real-time monitoring of energy use and distribution. The introduction of two-way communications and control into power grid introduces security and privacy concerns. This talk will survey the security and privacy issues in smart grids using the NIST reference model, and relate these issues to cyber security in the Internet.

  18. The cyber security threat stops in the boardroom.

    Science.gov (United States)

    Scully, Tim

    The attitude that 'it won't happen to me' still prevails in the boardrooms of industry when senior executives consider the threat of targeted cyber intrusions. Not much has changed in the commercial world of cyber security over the past few years; hackers are not being challenged to find new ways to steal companies' intellectual property and confidential information. The consequences of even major security breaches seem not to be felt by the leaders of victim companies. Why is this so? Surely IT security practitioners are seeking new ways to detect and prevent targeted intrusions into companies' networks? Are the consequences of targeted intrusions so insignificant that the captains of industry tolerate them? Or do only others feel the pain of their failure? This paper initially explores the failure of cyber security in industry and contends that, while industry leaders should not be alone in accepting responsibility for this failure, they must take the initiative to make life harder for cyber threat actors. They cannot wait for government leadership on policy, strategy or coordination. The paper then suggests some measures that a CEO can adopt to build a new corporate approach to cyber security.

  19. Nuclear Power Plant Cyber Security Discrete Dynamic Event Tree Analysis (LDRD 17-0958) FY17 Report

    Energy Technology Data Exchange (ETDEWEB)

    Wheeler, Timothy A. [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Denman, Matthew R. [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Williams, R. A. [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Martin, Nevin [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Jankovsky, Zachary Kyle [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States)

    2017-09-01

    Instrumentation and control of nuclear power is transforming from analog to modern digital assets. These control systems perform key safety and security functions. This transformation is occurring in new plant designs as well as in the existing fleet of plants as the operation of those plants is extended to 60 years. This transformation introduces new and unknown issues involving both digital asset induced safety issues and security issues. Traditional nuclear power risk assessment tools and cyber security assessment methods have not been modified or developed to address the unique nature of cyber failure modes and of cyber security threat vulnerabilities. iii This Lab-Directed Research and Development project has developed a dynamic cyber-risk in- formed tool to facilitate the analysis of unique cyber failure modes and the time sequencing of cyber faults, both malicious and non-malicious, and impose those cyber exploits and cyber faults onto a nuclear power plant accident sequence simulator code to assess how cyber exploits and cyber faults could interact with a plants digital instrumentation and control (DI&C) system and defeat or circumvent a plants cyber security controls. This was achieved by coupling an existing Sandia National Laboratories nuclear accident dynamic simulator code with a cyber emulytics code to demonstrate real-time simulation of cyber exploits and their impact on automatic DI&C responses. Studying such potential time-sequenced cyber-attacks and their risks (i.e., the associated impact and the associated degree of difficulty to achieve the attack vector) on accident management establishes a technical risk informed framework for developing effective cyber security controls for nuclear power.

  20. Cyber Security Awareness and Its Impact on Employee’s Behavior

    OpenAIRE

    Li, Ling; Xu, Li; He, Wu; Chen, Yong; Chen, Hong

    2016-01-01

    Part 3: Security and Privacy Issues; International audience; This paper proposes a model that extends the Protection Motivation Theory to validate the relationships among peer behavior, cue to action, and employees’ action experience of cyber security, threat perception, response perception, and employee’s cyber security behavior. The findings of the study suggest that the influence from peer behavior and employees action experience of cyber security is an important factor for improving cyber...

  1. A Study Of Cyber Security Challenges And Its Emerging Trends On Latest Technologies

    OpenAIRE

    Reddy, G. Nikhita; Reddy, G. J. Ugander

    2014-01-01

    Cyber Security plays an important role in the field of information technology .Securing the information have become one of the biggest challenges in the present day. When ever we think about the cyber security the first thing that comes to our mind is cyber crimes which are increasing immensely day by day. Various Governments and companies are taking many measures in order to prevent these cyber crimes. Besides various measures cyber security is still a very big concern to many. This paper ma...

  2. Establishing cyber security programs for I and C systems at nuclear facilities

    International Nuclear Information System (INIS)

    Waedt, Karl

    2012-01-01

    In recent years, across the international nuclear community, cyber security issues have quickly gained significant attention from safety authorities and plant designers alike. This increased attention was accelerated by news of the Stuxnet virus, which impaired control systems at Iranian nuclear facilities in 2010, but is also fueled by regular news about cyber security breaches of data systems at large business corporations. This paper discusses key aspects of establishing a cyber security program for Instrumentation and Control (I and C) systems at a nuclear facility, and identifies inherent aspects of nuclear power plant (NPP) design, that differentiate the needs of such a cyber security program from those of typical corporate data systems. (orig.)

  3. Systematic elicitation of cyber-security controls for NPP I and C system

    Energy Technology Data Exchange (ETDEWEB)

    Lee, M. S.; Kim, T. H. [Formal Works Inc., Seoul (Korea, Republic of); Park, S. P. [AhnLab Inc., Seongnam (Korea, Republic of); Kim, Y. M. [Korea Institute of Nuclear Safety, Daejeon (Korea, Republic of)

    2015-05-15

    Cyber-security implementation starts with a development of a cyber security plan considering characteristics of I and C system. In this paper, we describe a method that develops a cyber security plan for NPP I and C system. Especially, we propose a method for systematic elicitation of technical security controls that should be applied to I and C system. We expect that this study can provide a basis to develop a cyber-security plan for I and C system. Also, the study can contribute enhancing security to NPP I and C system. The rest of the paper is organized as follows: Section 2 introduces activities to develop a cyber-security plan and presents the result of each activity of the security plan. Section 3 concludes the paper. We proposed a method for systematic elicitation of security controls and described the method through examples. Development companies that want to implement cyber-security in I and C system can develop a cyber-security plan and apply the cyber-security program to their system according to our method. We expect that this study can provide a basis to develop a cyber-security plan for I and C system. Also, the study can contribute enhancing security to NPP I and C system.

  4. Systematic elicitation of cyber-security controls for NPP I and C system

    International Nuclear Information System (INIS)

    Lee, M. S.; Kim, T. H.; Park, S. P.; Kim, Y. M.

    2015-01-01

    Cyber-security implementation starts with a development of a cyber security plan considering characteristics of I and C system. In this paper, we describe a method that develops a cyber security plan for NPP I and C system. Especially, we propose a method for systematic elicitation of technical security controls that should be applied to I and C system. We expect that this study can provide a basis to develop a cyber-security plan for I and C system. Also, the study can contribute enhancing security to NPP I and C system. The rest of the paper is organized as follows: Section 2 introduces activities to develop a cyber-security plan and presents the result of each activity of the security plan. Section 3 concludes the paper. We proposed a method for systematic elicitation of security controls and described the method through examples. Development companies that want to implement cyber-security in I and C system can develop a cyber-security plan and apply the cyber-security program to their system according to our method. We expect that this study can provide a basis to develop a cyber-security plan for I and C system. Also, the study can contribute enhancing security to NPP I and C system

  5. Establishing cyber security programs for I and C systems at nuclear facilities

    Energy Technology Data Exchange (ETDEWEB)

    Waedt, Karl [AREVA NP GmbH (Germany)

    2012-11-01

    In recent years, across the international nuclear community, cyber security issues have quickly gained significant attention from safety authorities and plant designers alike. This increased attention was accelerated by news of the Stuxnet virus, which impaired control systems at Iranian nuclear facilities in 2010, but is also fueled by regular news about cyber security breaches of data systems at large business corporations. This paper discusses key aspects of establishing a cyber security program for Instrumentation and Control (I and C) systems at a nuclear facility, and identifies inherent aspects of nuclear power plant (NPP) design, that differentiate the needs of such a cyber security program from those of typical corporate data systems. (orig.)

  6. Best Practices for Operating Government-Industry Partnerships in Cyber Security

    Directory of Open Access Journals (Sweden)

    Larry Clinton

    2015-12-01

    Full Text Available Since the publication of the first National Strategy to Secure Cyber Space in 2003 the US federal government has realized that due to the interconnected nature of the Internet, securing the system would require an industry-government partnership. However, defining exactly what that new partnership would look like and how it would operate has been unclear. The ramifications of this ambiguous strategy have been noted elsewhere including the 2011 JSS article “A Relationship on the Brink” which described the dysfunctional state of public private partnerships with respect to cyber security. Subsequently, a joint industry-government study of partnership programs has generated a consensus list of “best practices” for operating such programs successfully. Moreover, subsequent use of these principles seems to confirm their ability to enhance the partnership and hopefully helps ameliorate, to some degree, the growing cyber threat. This article provides a brief history of the evolution of public-private partnerships in cyber security, the joint study to assess them and the 12 best practices generated by that analysis.

  7. Cyber security deterrence and it protection for critical infrastructures

    CERN Document Server

    Martellini, Maurizio

    2013-01-01

    The experts of the International Working Group-Landau Network Centro Volta (IWG-LNCV) discuss aspects of cyber security and present possible methods of deterrence, defense and resilience against cyber attacks. This SpringerBrief covers state-of-the-art documentation on the deterrence power of cyber attacks and argues that nations are entering a new cyber arms race. The brief also provides a technical analysis of possible cyber attacks towards critical infrastructures in the chemical industry and chemical safety industry. The authors also propose modern analyses and a holistic approach to resil

  8. Probabilistic Characterization of Adversary Behavior in Cyber Security

    Energy Technology Data Exchange (ETDEWEB)

    Meyers, C A; Powers, S S; Faissol, D M

    2009-10-08

    The objective of this SMS effort is to provide a probabilistic characterization of adversary behavior in cyber security. This includes both quantitative (data analysis) and qualitative (literature review) components. A set of real LLNL email data was obtained for this study, consisting of several years worth of unfiltered traffic sent to a selection of addresses at ciac.org. The email data was subjected to three interrelated analyses: a textual study of the header data and subject matter, an examination of threats present in message attachments, and a characterization of the maliciousness of embedded URLs.

  9. Model Based Cyber Security Analysis for Research Reactor Protection System

    International Nuclear Information System (INIS)

    Sho, Jinsoo; Rahman, Khalil Ur; Heo, Gyunyoung; Son, Hanseong

    2013-01-01

    The study on the qualitative risk due to cyber-attacks into research reactors was performed using bayesian Network (BN). This was motivated to solve the issues of cyber security raised due to digitalization of instrumentation and control (I and C) system. As a demonstrative example, we chose the reactor protection system (RPS) of research reactors. Two scenarios of cyber-attacks on RPS were analyzed to develop mitigation measures against vulnerabilities. The one is the 'insertion of reactor trip' and the other is the 'scram halt'. The six mitigation measures are developed for five vulnerability for these scenarios by getting the risk information from BN

  10. Cyber Security: Assessing Our Vulnerabilities and Developing an Effective Defense

    Science.gov (United States)

    Spafford, Eugene H.

    The number and sophistication of cyberattacks continues to increase, but no national policy is in place to confront them. Critical systems need to be built on secure foundations, rather than the cheapest general-purpose platform. A program that combines education in cyber security, increasing resources for law enforcement, development of reliable systems for critical applications, and expanding research support in multiple areas of security and reliability is essential to combat risks that are far beyond the nuisances of spam email and viruses, and involve widespread espionage, theft, and attacks on essential services.

  11. Selection of the Best Security Controls for Rapid Development of Enterprise-Level Cyber Security

    Science.gov (United States)

    2017-03-01

    investment (ROI) assessment. This ROI assessment entailed consideration of both the likely/expected security benefits of each candidate security control...the top 10–20 cyber security controls, where ranking was based upon a return on investment (ROI) assessment. This ROI assessment entailed...11  II.  CYBER SECURITY: UNDERLYING PRINCIPLES, FUNDAMENTALS AND BEST PRACTICES .................................................13  A

  12. 75 FR 18819 - Second DRAFT NIST Interagency Report (NISTIR) 7628, Smart Grid Cyber Security Strategy and...

    Science.gov (United States)

    2010-04-13

    ... a cyber attack. 2. It is essential that those parts or equipment of the Smart Grid that optimize the...-0143-01] Second DRAFT NIST Interagency Report (NISTIR) 7628, Smart Grid Cyber Security Strategy and... (NIST) seeks comments on the second draft of NISTIR 7628, Smart Grid Cyber Security Strategy and...

  13. Cyber Security Analysis by Attack Trees for a Reactor Protection System

    Energy Technology Data Exchange (ETDEWEB)

    Park, Gee-Yong; Lee, Cheol Kwon; Choi, Jong Gyun; Kim, Dong Hoon; Lee, Young Jun; Kwon, Kee-Choon [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2008-10-15

    As nuclear facilities are introducing digital systems, the cyber security becomes an emerging topic to be analyzed and resolved. The domestic and other nation's regulatory bodies notice this topic and are preparing an appropriate guidance. The nuclear industry where new construction or upgrade of I and C systems is planned is analyzing and establishing a cyber security. A risk-based analysis for the cyber security has been performed in the KNICS (Korea Nuclear I and C Systems) project where the cyber security analysis has been applied to a reactor protection system (RPS). In this paper, the cyber security analysis based on the attack trees is proposed for the KNICS RPS.

  14. Nuclear Cyber Security Case Study and Analysis

    Energy Technology Data Exchange (ETDEWEB)

    Park, Sunae [ChungNam National Univ., Daejeon (Korea, Republic of); Kim, Kyung doo [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2016-10-15

    Due to the new trend in cyber attacks, there is an increased security threat towards every country's infrastructure. So, security measures are required now than ever before. Previous cyber attacks normal process consists of paralyzing a server function, data extraction, or data control into the IT system for trespassing. However, nowadays control systems and infrastructures are also targeted and attacking methods have changed a lot. These days, the virus is becoming increasingly serious and hacker attacks are also becoming more frequent. This virus is a computer virus produced for the purpose of destroying the infrastructure, such as power plants, airports, railways June 2010, and it was first discovered in Belarus. Israel, the US, and other countries are believed culprits behind Stuxnet attacks on other nations such as Iran. Recent malware distribution, such as website hacking threat is growing. In surveys today one of the most long-term posing security threats is from North Korea. In particular, North Korea has been caught launching ongoing cyber-attacks after their latest nuclear test. South Korea has identified national trends regarding North Korean nuclear tests and analyzed them in order to catch disclosed confidential information. Especially, many nuclear power plants in the world are found to be vulnerable to cyber-attacks. Industrial facilities should be more wary of the risk of a serious cyber attack in the middle is going to increase the reliance on universal and commercial digital systems (off the shelf) software, civilian nuclear infrastructure. Senior executives’ current risk rate levels are increasing. Digitalization of the perception of risk is lacking in nuclear power plants and workers are creating prevention methods to make them fully aware of the risks of cyber-attacks. It is suggested that it may be inappropriate to assume we are prepared for potential attacks. Due to advances in technology, a warning that the growing sense of crisis

  15. Nuclear Cyber Security Case Study and Analysis

    International Nuclear Information System (INIS)

    Park, Sunae; Kim, Kyung doo

    2016-01-01

    Due to the new trend in cyber attacks, there is an increased security threat towards every country's infrastructure. So, security measures are required now than ever before. Previous cyber attacks normal process consists of paralyzing a server function, data extraction, or data control into the IT system for trespassing. However, nowadays control systems and infrastructures are also targeted and attacking methods have changed a lot. These days, the virus is becoming increasingly serious and hacker attacks are also becoming more frequent. This virus is a computer virus produced for the purpose of destroying the infrastructure, such as power plants, airports, railways June 2010, and it was first discovered in Belarus. Israel, the US, and other countries are believed culprits behind Stuxnet attacks on other nations such as Iran. Recent malware distribution, such as website hacking threat is growing. In surveys today one of the most long-term posing security threats is from North Korea. In particular, North Korea has been caught launching ongoing cyber-attacks after their latest nuclear test. South Korea has identified national trends regarding North Korean nuclear tests and analyzed them in order to catch disclosed confidential information. Especially, many nuclear power plants in the world are found to be vulnerable to cyber-attacks. Industrial facilities should be more wary of the risk of a serious cyber attack in the middle is going to increase the reliance on universal and commercial digital systems (off the shelf) software, civilian nuclear infrastructure. Senior executives’ current risk rate levels are increasing. Digitalization of the perception of risk is lacking in nuclear power plants and workers are creating prevention methods to make them fully aware of the risks of cyber-attacks. It is suggested that it may be inappropriate to assume we are prepared for potential attacks. Due to advances in technology, a warning that the growing sense of crisis about

  16. Cyber Security Testing and Training Programs for Industrial Control Systems

    International Nuclear Information System (INIS)

    Noyes, Daniel

    2012-01-01

    Service providers rely on industrial control systems (ICS) to manage the flow of water at dams, open breakers on power grids, control ventilation and cooling in nuclear power plants, and more. In today's interconnected environment, this can present a serious cyber security challenge. To combat this growing challenge, government, private industry, and academia are working together to reduce cyber risks. The Idaho National Laboratory (INL) is a key contributor to the Department of Energy National SCADA Test Bed (NSTB) and the Department of Homeland Security (DHS) Control Systems Security Program (CSSP), both of which focus on improving the overall security posture of ICS in the national critical infrastructure. In support of the NSTB, INL hosts a dedicated SCADA testing facility which consists of multiple control systems supplied by leading national and international manufacturers. Within the test bed, INL researchers systematically examine control system components and work to identify vulnerabilities. In support of the CSSP, INL develops and conducts training courses which are designed to increase awareness and defensive capabilities for IT/Control System professionals. These trainings vary from web-based cyber security trainings for control systems engineers to more advanced hands-on training that culminates with a Red Team/ Blue Team exercise that is conducted within an actual control systems environment. INL also provides staffing and operational support to the DHS Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) Security Operations Center which responds to and analyzes control systems cyber incidents across the 18 US critical infrastructure sectors.

  17. Cyber Security Testing and Training Programs for Industrial Control Systems

    Energy Technology Data Exchange (ETDEWEB)

    Daniel Noyes

    2012-03-01

    Service providers rely on industrial control systems (ICS) to manage the flow of water at dams, open breakers on power grids, control ventilation and cooling in nuclear power plants, and more. In today's interconnected environment, this can present a serious cyber security challenge. To combat this growing challenge, government, private industry, and academia are working together to reduce cyber risks. The Idaho National Laboratory (INL) is a key contributor to the Department of Energy National SCADA Test Bed (NSTB) and the Department of Homeland Security (DHS) Control Systems Security Program (CSSP), both of which focus on improving the overall security posture of ICS in the national critical infrastructure. In support of the NSTB, INL hosts a dedicated SCADA testing facility which consists of multiple control systems supplied by leading national and international manufacturers. Within the test bed, INL researchers systematically examine control system components and work to identify vulnerabilities. In support of the CSSP, INL develops and conducts training courses which are designed to increase awareness and defensive capabilities for IT/Control System professionals. These trainings vary from web-based cyber security trainings for control systems engineers to more advanced hands-on training that culminates with a Red Team/ Blue Team exercise that is conducted within an actual control systems environment. INL also provides staffing and operational support to the DHS Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) Security Operations Center which responds to and analyzes control systems cyber incidents across the 18 US critical infrastructure sectors.

  18. Cyber security risk assessment for SCADA and DCS networks.

    Science.gov (United States)

    Ralston, P A S; Graham, J H; Hieb, J L

    2007-10-01

    The growing dependence of critical infrastructures and industrial automation on interconnected physical and cyber-based control systems has resulted in a growing and previously unforeseen cyber security threat to supervisory control and data acquisition (SCADA) and distributed control systems (DCSs). It is critical that engineers and managers understand these issues and know how to locate the information they need. This paper provides a broad overview of cyber security and risk assessment for SCADA and DCS, introduces the main industry organizations and government groups working in this area, and gives a comprehensive review of the literature to date. Major concepts related to the risk assessment methods are introduced with references cited for more detail. Included are risk assessment methods such as HHM, IIM, and RFRM which have been applied successfully to SCADA systems with many interdependencies and have highlighted the need for quantifiable metrics. Presented in broad terms is probability risk analysis (PRA) which includes methods such as FTA, ETA, and FEMA. The paper concludes with a general discussion of two recent methods (one based on compromise graphs and one on augmented vulnerability trees) that quantitatively determine the probability of an attack, the impact of the attack, and the reduction in risk associated with a particular countermeasure.

  19. Study of Security Attributes of Smart Grid Systems- Current Cyber Security Issues

    Energy Technology Data Exchange (ETDEWEB)

    Wayne F. Boyer; Scott A. McBride

    2009-04-01

    This document provides information for a report to congress on Smart Grid security as required by Section 1309 of Title XIII of the Energy Independence and Security Act of 2007. The security of any future Smart Grid is dependent on successfully addressing the cyber security issues associated with the nation’s current power grid. Smart Grid will utilize numerous legacy systems and technologies that are currently installed. Therefore, known vulnerabilities in these legacy systems must be remediated and associated risks mitigated in order to increase the security and success of the Smart Grid. The implementation of Smart Grid will include the deployment of many new technologies and multiple communication infrastructures. This report describes the main technologies that support Smart Grid and summarizes the status of implementation into the existing U.S. electrical infrastructure.

  20. Cyber-security of nuclear facilities: stakes and challenges

    International Nuclear Information System (INIS)

    Marquez, T.

    2016-01-01

    Major players in the French nuclear industry have implemented the concept of cyber-resilience that aims at anticipating and identifying real threats and detecting the weaknesses of the critical installations in order to protect them more efficiently. French law imposes for some categories of installations including nuclear power plants the implementation of advanced protection solutions to reach a high standard of cyber security. Sentryo, a start-up has developed a system that allows the detection of intruders in a digital network by analysing the interactions between the nodes of the network. The intruder is detected when the interaction mapping appears to be different from a configuration considered as normal. The feedback experience shows that any function in an enterprise must be made aware of the cyber risk. (A.C.)

  1. Ideal Based Cyber Security Technical Metrics for Control Systems

    Energy Technology Data Exchange (ETDEWEB)

    W. F. Boyer; M. A. McQueen

    2007-10-01

    Much of the world's critical infrastructure is at risk from attack through electronic networks connected to control systems. Security metrics are important because they provide the basis for management decisions that affect the protection of the infrastructure. A cyber security technical metric is the security relevant output from an explicit mathematical model that makes use of objective measurements of a technical object. A specific set of technical security metrics are proposed for use by the operators of control systems. Our proposed metrics are based on seven security ideals associated with seven corresponding abstract dimensions of security. We have defined at least one metric for each of the seven ideals. Each metric is a measure of how nearly the associated ideal has been achieved. These seven ideals provide a useful structure for further metrics development. A case study shows how the proposed metrics can be applied to an operational control system.

  2. Quantitative Vulnerability Assessment of Cyber Security for Distribution Automation Systems

    Directory of Open Access Journals (Sweden)

    Xiaming Ye

    2015-06-01

    Full Text Available The distribution automation system (DAS is vulnerable to cyber-attacks due to the widespread use of terminal devices and standard communication protocols. On account of the cost of defense, it is impossible to ensure the security of every device in the DAS. Given this background, a novel quantitative vulnerability assessment model of cyber security for DAS is developed in this paper. In the assessment model, the potential physical consequences of cyber-attacks are analyzed from two levels: terminal device level and control center server level. Then, the attack process is modeled based on game theory and the relationships among different vulnerabilities are analyzed by introducing a vulnerability adjacency matrix. Finally, the application process of the proposed methodology is illustrated through a case study based on bus 2 of the Roy Billinton Test System (RBTS. The results demonstrate the reasonability and effectiveness of the proposed methodology.

  3. Model Based Cyber Security Analysis for Research Reactor Protection System

    Energy Technology Data Exchange (ETDEWEB)

    Sho, Jinsoo; Rahman, Khalil Ur; Heo, Gyunyoung [Kyung Hee Univ., Yongin (Korea, Republic of); Son, Hanseong [Joongbu Univ., Geumsan (Korea, Republic of)

    2013-07-01

    The study on the qualitative risk due to cyber-attacks into research reactors was performed using bayesian Network (BN). This was motivated to solve the issues of cyber security raised due to digitalization of instrumentation and control (I and C) system. As a demonstrative example, we chose the reactor protection system (RPS) of research reactors. Two scenarios of cyber-attacks on RPS were analyzed to develop mitigation measures against vulnerabilities. The one is the 'insertion of reactor trip' and the other is the 'scram halt'. The six mitigation measures are developed for five vulnerability for these scenarios by getting the risk information from BN.

  4. The cyber security of French nuclear installations: stakes and opportunities

    International Nuclear Information System (INIS)

    Marquez, Thierry

    2016-01-01

    Notably due to the development of the number of connected objects, nuclear installations, their supply chain and all the actors of the chain value are exposed to cyber risks, even if a recent study noticed that successful cyber attacks involving nuclear plants are rare, but real. Thus, the threat is actual and growing, and the IAEA is already working with Interpol on this issue. The author then describes how French actors (EDF, Areva, CEA) have introduced cyber-resilience to better anticipate and identify actual threats and critical vulnerabilities in order to protect infrastructures. He comments some strengthened regulatory measures introduced for the French nuclear sector, and continuous improvements brought in the field of cyber security. He shows that handling these risks is also an opportunity to develop crisis management tools through the development of a specific know-how which also has an industrial value

  5. A genetic epidemiology approach to cyber-security.

    Science.gov (United States)

    Gil, Santiago; Kott, Alexander; Barabási, Albert-László

    2014-07-16

    While much attention has been paid to the vulnerability of computer networks to node and link failure, there is limited systematic understanding of the factors that determine the likelihood that a node (computer) is compromised. We therefore collect threat log data in a university network to study the patterns of threat activity for individual hosts. We relate this information to the properties of each host as observed through network-wide scans, establishing associations between the network services a host is running and the kinds of threats to which it is susceptible. We propose a methodology to associate services to threats inspired by the tools used in genetics to identify statistical associations between mutations and diseases. The proposed approach allows us to determine probabilities of infection directly from observation, offering an automated high-throughput strategy to develop comprehensive metrics for cyber-security.

  6. Bio-inspiring cyber security and cloud services trends and innovations

    CERN Document Server

    Kim, Tai-Hoon; Kacprzyk, Janusz; Awad, Ali

    2014-01-01

    This volume presents recent research in cyber security, and reports how organizations can gain competitive advantages by applying the different security techniques in real-world scenarios. The volume provides reviews of cutting–edge technologies, algorithms, applications and insights for bio-inspiring cyber security-based systems. The book will be a valuable companion and comprehensive reference for both postgraduate and senior undergraduate students who are taking a course in cyber security. The volume is organized in self-contained chapters to provide greatest reading flexibility.  

  7. Application of the JDL data fusion process model for cyber security

    Science.gov (United States)

    Giacobe, Nicklaus A.

    2010-04-01

    A number of cyber security technologies have proposed the use of data fusion to enhance the defensive capabilities of the network and aid in the development of situational awareness for the security analyst. While there have been advances in fusion technologies and the application of fusion in intrusion detection systems (IDSs), in particular, additional progress can be made by gaining a better understanding of a variety of data fusion processes and applying them to the cyber security application domain. This research explores the underlying processes identified in the Joint Directors of Laboratories (JDL) data fusion process model and further describes them in a cyber security context.

  8. Analysis of Dynamic Complexity of the Cyber Security Ecosystem of Colombia

    Directory of Open Access Journals (Sweden)

    Angélica Flórez

    2016-07-01

    Full Text Available This paper presents two proposals for the analysis of the complexity of the Cyber security Ecosystem of Colombia (CEC. This analysis shows the available knowledge about entities engaged in cyber security in Colombia and the relationships between them, which allow an understanding of the synergy between the different existing components. The complexity of the CEC is detailed from the view of the Influence Diagram of System Dynamics and the Domain Diagram of Software Engineering. The resulting model makes cyber security evident as a strategic component of national security.

  9. Public–private partnerships on cyber security: a practice of loyalty

    DEFF Research Database (Denmark)

    Christensen, Kristoffer Kjærgaard; Petersen, Karen Lund

    2017-01-01

    The governance of cyber-security risks is seen as increasingly important to the security of the nation. However, cyber-security risks are characterized by a fundamental uncertainty, which poses a great challenge to their governance and calls for new modes of organizing security politics. Public......–private partnerships (PPPs) are often seen as the answer to this challenge by enhancing flexibility and robustness through knowledge-sharing. Engaging with the literature on PPPs and the Danish practice on cyber security, we show how PPPs involve controversies over different threat realities of cyber security....... This plays out as controversies over what is considered threatened, the scope of the issue and the kind of expertise to be mobilized. Arguing that PPPs on security are not defined narrowly by short-sighted strategic self-interest but also loyalty and commitment, we suggest that the innovative potential...

  10. a review of game theory approach to cyber security risk management

    African Journals Online (AJOL)

    HOD

    Keywords: Cyber Security, Risk Management, Game Theory, Model. 1. INTRODUCTION. Risk is ... behaviors. This implies they are triggered by self- motivated goal .... embrace diligence verification of the recipient of the email as well as lack of ...

  11. Cyber security. Compliance to the new CSA 290.7 standard

    Energy Technology Data Exchange (ETDEWEB)

    Daley, M.; Doucet, R.; Echlin, M.; MacDonald, M.; Mihaylov, V.; Sijs, J.; Trask, D. [Canadian Nuclear Laboratories, Chalk River, Ontario (Canada)

    2015-12-15

    Since 2008, the Canadian Nuclear Safety Commission (CNSC), similar to regulators of other critical industries, has requested their licensees to implement cyber security programs and conduct self- assessments without the benefit of an industry specific cyber security standard that provides common metrics for coverage and effectiveness of their programs. However, for the nuclear industry, a new CSA standard 290.7 entitled 'Cyber security for nuclear power plants and small reactor facilities', released in December 2014, will have the CNSC looking to facility operators to be compliant to the new standard. This paper will discuss initiatives at Canadian Nuclear Laboratories to develop of a suite of tools, techniques, and best practices that can be used by the regulator and industry for assessing compliance and effectiveness of cyber security technology and implementations. (author)

  12. Cyber security - compliance to the new CSA 290.7 standard

    Energy Technology Data Exchange (ETDEWEB)

    Daley, M.; Doucet, R.; Echlin, M.; MacDonald, M.; Mihaylov, V.; Sijs, J.; Trask, D., E-mail: Matthew.Daley@cnl.ca [Canadian Nuclear Laboratories, Chalk River, ON, (Canada)

    2015-07-01

    Since 2008, the Canadian Nuclear Safety Commission (CNSC), similar to regulators of other critical industries, has requested their licensees to implement cyber security programs and conduct self-assessments without the benefit of an industry specific cyber security standard that provides common metrics for coverage and effectiveness of their programs. However, for the nuclear industry, a new CSA standard 290.7 entitled 'Cyber security for nuclear power plants and small reactor facilities' [1], released in December 2014, will have the CNSC looking to facility operators to be compliant to the new standard. This paper will discuss initiatives at Canadian Nuclear Laboratories to develop of a suite of tools, techniques, and best practices that can be used by the regulator and industry for assessing compliance and effectiveness of cyber security technology and implementations. (author)

  13. Cyber security. Compliance to the new CSA 290.7 standard

    International Nuclear Information System (INIS)

    Daley, M.; Doucet, R.; Echlin, M.; MacDonald, M.; Mihaylov, V.; Sijs, J.; Trask, D.

    2015-01-01

    Since 2008, the Canadian Nuclear Safety Commission (CNSC), similar to regulators of other critical industries, has requested their licensees to implement cyber security programs and conduct self- assessments without the benefit of an industry specific cyber security standard that provides common metrics for coverage and effectiveness of their programs. However, for the nuclear industry, a new CSA standard 290.7 entitled 'Cyber security for nuclear power plants and small reactor facilities', released in December 2014, will have the CNSC looking to facility operators to be compliant to the new standard. This paper will discuss initiatives at Canadian Nuclear Laboratories to develop of a suite of tools, techniques, and best practices that can be used by the regulator and industry for assessing compliance and effectiveness of cyber security technology and implementations. (author)

  14. Cyber security - compliance to the new CSA 290.7 standard

    International Nuclear Information System (INIS)

    Daley, M.; Doucet, R.; Echlin, M.; MacDonald, M.; Mihaylov, V.; Sijs, J.; Trask, D.

    2015-01-01

    Since 2008, the Canadian Nuclear Safety Commission (CNSC), similar to regulators of other critical industries, has requested their licensees to implement cyber security programs and conduct self-assessments without the benefit of an industry specific cyber security standard that provides common metrics for coverage and effectiveness of their programs. However, for the nuclear industry, a new CSA standard 290.7 entitled 'Cyber security for nuclear power plants and small reactor facilities' [1], released in December 2014, will have the CNSC looking to facility operators to be compliant to the new standard. This paper will discuss initiatives at Canadian Nuclear Laboratories to develop of a suite of tools, techniques, and best practices that can be used by the regulator and industry for assessing compliance and effectiveness of cyber security technology and implementations. (author)

  15. A Cyber Security Risk Assessment of Hospital Infrastructure including TLS/SSL and other Threats

    OpenAIRE

    Millar, Stuart

    2016-01-01

    Cyber threats traditionally target governments, financial institutions and businesses. However, of growing concern is the threat to healthcare organizations. This study conducts a cyber security risk assessment of a theoretical hospital environment, to include TLS/SSL, which is an encryption protocol for network communications, plus other physical, logical and human threats. Despite significant budgets in the UK for the NHS, the spend on cyber security appears worryingly low and many hospital...

  16. Enhancing Cyber Security for SME organizations through self-assessments : How self-assessment raises awareness

    OpenAIRE

    Hassinen, Tarmo

    2017-01-01

    This thesis primarily studied the importance of self-assessment in increasing business organizations’ cyber security awareness of their ICT environment. The secondary studied item was the relevance of self-assessment in detecting new business potential while understanding ICT environment changes. The self-assessment is based on FINCS, the Finnish basic level cyber security certificate launched in December 2016. FINCSC consists of physical and management security, ICT service and system securi...

  17. Science of Cyber Security as a System of Models and Problems

    OpenAIRE

    Kott, Alexander

    2015-01-01

    Terms like "Science of Cyber" or "Cyber Science" have been appearing in literature with growing frequency, and influential organizations initiated research initiatives toward developing such a science even though it is not clearly defined. We propose to define the domain of the science of cyber security by noting the most salient artifact within cyber security -- malicious software -- and defining the domain as comprised of phenomena that involve malicious software (as well as legitimate soft...

  18. Cyber security risk evaluation of a nuclear I and C using BN and ET

    Energy Technology Data Exchange (ETDEWEB)

    Shin, Jin Soo; Heo, Gyun Young [Dept. of Nuclear Engineering, Kyung Hee University, Yongin (Korea, Republic of); Son, Han Seong [Computer and Game Science, Joongbu University, Geumsan (Korea, Republic of)

    2017-04-15

    Cyber security is an important issue in the field of nuclear engineering because nuclear facilities use digital equipment and digital systems that can lead to serious hazards in the event of an accident. Regulatory agencies worldwide have announced guidelines for cyber security related to nuclear issues, including U.S. NRC Regulatory Guide 5.71. It is important to evaluate cyber security risk in accordance with these regulatory guides. In this study, we propose a cyber security risk evaluation model for nuclear instrumentation and control systems using a Bayesian network and event trees. As it is difficult to perform penetration tests on the systems, the evaluation model can inform research on cyber threats to cyber security systems for nuclear facilities through the use of prior and posterior information and backpropagation calculations. Furthermore, we suggest a methodology for the application of analytical results from the Bayesian network model to an event tree model, which is a probabilistic safety assessment method. The proposed method will provide insight into safety and cyber security risks.

  19. Cyber security risk evaluation of a nuclear I and C using BN and ET

    International Nuclear Information System (INIS)

    Shin, Jin Soo; Heo, Gyun Young; Son, Han Seong

    2017-01-01

    Cyber security is an important issue in the field of nuclear engineering because nuclear facilities use digital equipment and digital systems that can lead to serious hazards in the event of an accident. Regulatory agencies worldwide have announced guidelines for cyber security related to nuclear issues, including U.S. NRC Regulatory Guide 5.71. It is important to evaluate cyber security risk in accordance with these regulatory guides. In this study, we propose a cyber security risk evaluation model for nuclear instrumentation and control systems using a Bayesian network and event trees. As it is difficult to perform penetration tests on the systems, the evaluation model can inform research on cyber threats to cyber security systems for nuclear facilities through the use of prior and posterior information and backpropagation calculations. Furthermore, we suggest a methodology for the application of analytical results from the Bayesian network model to an event tree model, which is a probabilistic safety assessment method. The proposed method will provide insight into safety and cyber security risks

  20. Cyber Security Risk Evaluation of a Nuclear I&C Using BN and ET

    Directory of Open Access Journals (Sweden)

    Jinsoo Shin

    2017-04-01

    Full Text Available Cyber security is an important issue in the field of nuclear engineering because nuclear facilities use digital equipment and digital systems that can lead to serious hazards in the event of an accident. Regulatory agencies worldwide have announced guidelines for cyber security related to nuclear issues, including U.S. NRC Regulatory Guide 5.71. It is important to evaluate cyber security risk in accordance with these regulatory guides. In this study, we propose a cyber security risk evaluation model for nuclear instrumentation and control systems using a Bayesian network and event trees. As it is difficult to perform penetration tests on the systems, the evaluation model can inform research on cyber threats to cyber security systems for nuclear facilities through the use of prior and posterior information and backpropagation calculations. Furthermore, we suggest a methodology for the application of analytical results from the Bayesian network model to an event tree model, which is a probabilistic safety assessment method. The proposed method will provide insight into safety and cyber security risks.

  1. Implementing Cyber Security Requirements and Mechanisms in Microgrids

    OpenAIRE

    Mohan , Apurva; Khurana , Himanshu

    2015-01-01

    Part 4: INFRASTRUCTURE SECURITY; International audience; A microgrid is a collection of distributed energy resources, storage and loads under common coordination and control that provides a single functional interface to enable its management as a single unit. Microgrids provide several advantages such as power quality control, uninterrupted power supply and integration of renewable resources. However, microgrids are increasingly connected to the Internet for remote control and management, wh...

  2. Cyber Security Scenarios and Control for Small and Medium Enterprises

    Directory of Open Access Journals (Sweden)

    Nilaykumar Kiran SANGANI

    2012-01-01

    Full Text Available As the world advances towards the computing era, security threats keeps on increasing in the form of malware, viruses, internet attack, theft of IS assets / technology and a lot more. This is a major concern for any form of business. Loss in company’s status / liability / reputation is a huge downfall for a running business. We have witnessed the attacks getting carried out; large firm’s data getting breached / government bodies’ sites getting phished / attacked. These huge entities have technology expertise to safeguard their company’s interest against such attacks through investing huge amounts of capital in manpower and secure tools. But what about SMEs? SMEs enrich a huge part of the country’s economy. Big organizations have their own security measures policy which ideally is not applied when it comes to a SME. The aim of this paper is to come out with an Information Security Assurance Cyber Control for SMEs (ISACC against common cyber security threats implemented at a cost effective measure.

  3. Development of IT-based Cyber Security Technology for Nuclear Power Plant

    International Nuclear Information System (INIS)

    Hong, S. B.; Lee, J. C.; Choi, Y. S.; Choi, Y. R.; Cho, J. W.; Jung, C. E.; Jeong, K. I.; Park, B.; Koo, I. S.

    2009-11-01

    Development and enlargement of the high speed communication network make it possible the user to access online information easily. It generates changing offline activities to online in the economics, expansion of cultural interchanges and convenient life. But it also causes misuse, wiretapping, forgery and alteration of the information via illegal invasion(virus, hacking), and these are derived from the open network characteristic, weakness of the securities of the TCP/IP protocol and information systems. The security of individual and the national foundation facility(industry and government) can be threatened because of these problems, and theses can be used as a instrument of cyber-war. Many cyber security technologies have been developed to corp with the cyber threat. One of the most important national facility is the nuclear power plant and the necessity of the cyber security for the digital I and C of it have been proposed since middle of the 2000. KINS announced the regulation of the cyber security for the digital I and C of the nuclear power plant in 2007. The main concept of the cyber security for it is similar to the IT field that is treated as a leader of the cyber security. Because of the difference of the characteristics between the IT field and the nuclear industry, applying the cyber security technologies developed and used in the IT field to the nuclear industry has some critical constraints. We will analyze these problems and propose a cyber security method based on cryptograph and authentication for the I and C communication network in this report

  4. Development of IT-based Cyber Security Technology for Nuclear Power Plant

    Energy Technology Data Exchange (ETDEWEB)

    Hong, S. B.; Lee, J. C.; Choi, Y. S.; Choi, Y. R.; Cho, J. W.; Jung, C. E.; Jeong, K. I.; Park, B.; Koo, I. S

    2009-11-15

    Development and enlargement of the high speed communication network make it possible the user to access online information easily. It generates changing offline activities to online in the economics, expansion of cultural interchanges and convenient life. But it also causes misuse, wiretapping, forgery and alteration of the information via illegal invasion(virus, hacking), and these are derived from the open network characteristic, weakness of the securities of the TCP/IP protocol and information systems. The security of individual and the national foundation facility(industry and government) can be threatened because of these problems, and theses can be used as a instrument of cyber-war. Many cyber security technologies have been developed to corp with the cyber threat. One of the most important national facility is the nuclear power plant and the necessity of the cyber security for the digital I and C of it have been proposed since middle of the 2000. KINS announced the regulation of the cyber security for the digital I and C of the nuclear power plant in 2007. The main concept of the cyber security for it is similar to the IT field that is treated as a leader of the cyber security. Because of the difference of the characteristics between the IT field and the nuclear industry, applying the cyber security technologies developed and used in the IT field to the nuclear industry has some critical constraints. We will analyze these problems and propose a cyber security method based on cryptograph and authentication for the I and C communication network in this report.

  5. Operating nuclear power stations in a regulated cyber security environment: a roadmap for success

    Energy Technology Data Exchange (ETDEWEB)

    Dorman, E., E-mail: Erik.Dorman@areva.com [AREVA Inc., Cyber Security Solutions, Charlotte, NC (United States)

    2015-07-01

    The United States Nuclear Regulatory Commission (NRC) issued 10CFR73.54 to implement a regulated Cyber Security Program at each operating nuclear reactor facility. Milestones were implemented December 31, 2012 to mitigate the attack vectors for the most critical digital assets acknowledged by the industry and the NRC. The NRC inspections have begun. The nuclear Cyber Security Plan, implemented by the site Cyber Security Program (Program), is an element of the operating license at each facility. The Program is designed to protect critical digital assets (CDAs) by applying and maintaining defense-in depth protective strategies to ensure the capability to detect, respond to, and recover from cyber-attacks. The Program references NEI 08-09 R. 6, the Nuclear Energy Institute Template that provides guidance for applying Cyber Security controls derived from NIST 800-53/82 and slightly modified to fit the nuclear environment. Many mature processes are in place at nuclear facilities in response to numerous regulations implemented over the past 30 years. Many of these processes such as the Physical Security Program offer protections that are leveraged to protect the functions of critical digital assets from unauthorized physical access. Other processes and technology such as engineering design control, work management and pre-job briefs, control of portable media and mobile devices, and deterministically segregated networks protect critical digital assets. By leveraging the regulated nuclear environment, integrating NIST type Cyber Security controls, and prudently deploying technology the Cyber Security posture of operating nuclear facilities supports on-demand base load electricity 24/7 with capacity factors exceeding 85%. This paper is designed to provide a glimpse into Cyber Security Programs that support safe operation and reliability in the regulated nuclear environment while supporting the on-demand base load electricity production 24/7. (author)

  6. Operating nuclear power stations in a regulated cyber security environment: a roadmap for success

    International Nuclear Information System (INIS)

    Dorman, E.

    2015-01-01

    The United States Nuclear Regulatory Commission (NRC) issued 10CFR73.54 to implement a regulated Cyber Security Program at each operating nuclear reactor facility. Milestones were implemented December 31, 2012 to mitigate the attack vectors for the most critical digital assets acknowledged by the industry and the NRC. The NRC inspections have begun. The nuclear Cyber Security Plan, implemented by the site Cyber Security Program (Program), is an element of the operating license at each facility. The Program is designed to protect critical digital assets (CDAs) by applying and maintaining defense-in depth protective strategies to ensure the capability to detect, respond to, and recover from cyber-attacks. The Program references NEI 08-09 R. 6, the Nuclear Energy Institute Template that provides guidance for applying Cyber Security controls derived from NIST 800-53/82 and slightly modified to fit the nuclear environment. Many mature processes are in place at nuclear facilities in response to numerous regulations implemented over the past 30 years. Many of these processes such as the Physical Security Program offer protections that are leveraged to protect the functions of critical digital assets from unauthorized physical access. Other processes and technology such as engineering design control, work management and pre-job briefs, control of portable media and mobile devices, and deterministically segregated networks protect critical digital assets. By leveraging the regulated nuclear environment, integrating NIST type Cyber Security controls, and prudently deploying technology the Cyber Security posture of operating nuclear facilities supports on-demand base load electricity 24/7 with capacity factors exceeding 85%. This paper is designed to provide a glimpse into Cyber Security Programs that support safe operation and reliability in the regulated nuclear environment while supporting the on-demand base load electricity production 24/7. (author)

  7. Cyber Security Test Strategy for Non-safety Display System

    International Nuclear Information System (INIS)

    Son, Han Seong; Kim, Hee Eun

    2016-01-01

    Cyber security has been a big issue since the instrumentation and control (I and C) system of nuclear power plant (NPP) is digitalized. A cyber-attack on NPP should be dealt with seriously because it might cause not only economic loss but also the radioactive material release. Researches on the consequences of cyber-attack onto NPP from a safety point of view have been conducted. A previous study shows the risk effect brought by initiation of event and deterioration of mitigation function by cyber terror. Although this study made conservative assumptions and simplifications, it gives an insight on the effect of cyber-attack. Another study shows that the error on a non-safety display system could cause wrong actions of operators. According to this previous study, the failure of the operator action caused by a cyber-attack on a display system might threaten the safety of the NPP by limiting appropriate mitigation actions. This study suggests a test strategy focusing on the cyber-attack on the information and display system, which might cause the failure of operator. The test strategy can be suggested to evaluate and complement security measures. Identifying whether a cyber-attack on the information and display system can affect the mitigation actions of operator, the strategy to obtain test scenarios is suggested. The failure of mitigation scenario is identified first. Then, for the test target in the scenario, software failure modes are applied to identify realistic failure scenarios. Testing should be performed for those scenarios to confirm the integrity of data and to assure effectiveness of security measures

  8. Cyber Security Test Strategy for Non-safety Display System

    Energy Technology Data Exchange (ETDEWEB)

    Son, Han Seong [Joongbu University, Geumsan (Korea, Republic of); Kim, Hee Eun [KAIST, Daejeon (Korea, Republic of)

    2016-10-15

    Cyber security has been a big issue since the instrumentation and control (I and C) system of nuclear power plant (NPP) is digitalized. A cyber-attack on NPP should be dealt with seriously because it might cause not only economic loss but also the radioactive material release. Researches on the consequences of cyber-attack onto NPP from a safety point of view have been conducted. A previous study shows the risk effect brought by initiation of event and deterioration of mitigation function by cyber terror. Although this study made conservative assumptions and simplifications, it gives an insight on the effect of cyber-attack. Another study shows that the error on a non-safety display system could cause wrong actions of operators. According to this previous study, the failure of the operator action caused by a cyber-attack on a display system might threaten the safety of the NPP by limiting appropriate mitigation actions. This study suggests a test strategy focusing on the cyber-attack on the information and display system, which might cause the failure of operator. The test strategy can be suggested to evaluate and complement security measures. Identifying whether a cyber-attack on the information and display system can affect the mitigation actions of operator, the strategy to obtain test scenarios is suggested. The failure of mitigation scenario is identified first. Then, for the test target in the scenario, software failure modes are applied to identify realistic failure scenarios. Testing should be performed for those scenarios to confirm the integrity of data and to assure effectiveness of security measures.

  9. A developmental approach to learning causal models for cyber security

    Science.gov (United States)

    Mugan, Jonathan

    2013-05-01

    To keep pace with our adversaries, we must expand the scope of machine learning and reasoning to address the breadth of possible attacks. One approach is to employ an algorithm to learn a set of causal models that describes the entire cyber network and each host end node. Such a learning algorithm would run continuously on the system and monitor activity in real time. With a set of causal models, the algorithm could anticipate novel attacks, take actions to thwart them, and predict the second-order effects flood of information, and the algorithm would have to determine which streams of that flood were relevant in which situations. This paper will present the results of efforts toward the application of a developmental learning algorithm to the problem of cyber security. The algorithm is modeled on the principles of human developmental learning and is designed to allow an agent to learn about the computer system in which it resides through active exploration. Children are flexible learners who acquire knowledge by actively exploring their environment and making predictions about what they will find,1, 2 and our algorithm is inspired by the work of the developmental psychologist Jean Piaget.3 Piaget described how children construct knowledge in stages and learn new concepts on top of those they already know. Developmental learning allows our algorithm to focus on subsets of the environment that are most helpful for learning given its current knowledge. In experiments, the algorithm was able to learn the conditions for file exfiltration and use that knowledge to protect sensitive files.

  10. DETERMINATION OF CYBER SECURITY AWARENESS OF PUBLIC EMPLOYEES AND CONSCIOUSNESS-RISING SUGGESTIONS

    Directory of Open Access Journals (Sweden)

    Huseyin Kuru

    2016-07-01

    Full Text Available The aim of this study is to measure Turkish government employees’ awareness of cyber security and cyber space elements. Participants were 71 Turkish public employees working for various ministries. Both qualitative and quantitative research methods were used to get the most detailed information from the participants. A survey was administered to cyber security officers in chosen state institutions. For qualitative research, open-ended questions were administered to the participants. Reliability and validity issues were established for both surveys. Results show that employees have enough information about cyber security and cyber warfare. Findings clearly suggests that cyber defense policy should be planned in coordination with other state institutions and experiences should be shared. In order to create feasible and realistic cyber security policy at institutional level, experts at cyber security must be trained, hired and help must be requested from specialized individuals and institutions. This study recommends that rapid reaction teams (RRT should be established to take care of cyber systems, to react against cyber breaches in time, to alert staff for cyber-attacks in order to establish effective recovery.

  11. Development on Guidance of Cyber Security Exercise for the Nuclear Facilities

    Energy Technology Data Exchange (ETDEWEB)

    Kim, Hyundoo [Korea Institute of Nuclear Nonproliferation and Control, Daejeon (Korea, Republic of)

    2016-10-15

    Cyber threats and attacks are increasing rapidly against infrastructure including energy and utilities industry over the world. Because of lack of human resource and incident response system to prevent or defend increased cyber threats, many governments and major national infrastructures perform cyber security exercises to improve capabilities of cyber security incident response. Accordingly there are exponential growth in the number of cyber security exercises over the past decade with the trend expecting to accelerate in the coming years. Even though there were many cyber security exercises in the Nuclear Facilities, this exercise was first which focused on mitigation and recovery of the system of the Nuclear Facility against cyber incident. So many insufficient items were deduced such as absence of a procedure for mitigation and recovery of cyber incident. These procedures should be developed and established through 3rd phase of Cyber Security Plan (CSP) and other technical complement actions under regulatory body’s guidance. Also developed and existed procedures should be regularly performed to make cyber incident response team and related people rapidly response against cyber incident through exercises or other training. The insufficient items come from the exercise should be reflected to developed and existed procedures by periods.

  12. Development on Guidance of Cyber Security Exercise for the Nuclear Facilities

    International Nuclear Information System (INIS)

    Kim, Hyundoo

    2016-01-01

    Cyber threats and attacks are increasing rapidly against infrastructure including energy and utilities industry over the world. Because of lack of human resource and incident response system to prevent or defend increased cyber threats, many governments and major national infrastructures perform cyber security exercises to improve capabilities of cyber security incident response. Accordingly there are exponential growth in the number of cyber security exercises over the past decade with the trend expecting to accelerate in the coming years. Even though there were many cyber security exercises in the Nuclear Facilities, this exercise was first which focused on mitigation and recovery of the system of the Nuclear Facility against cyber incident. So many insufficient items were deduced such as absence of a procedure for mitigation and recovery of cyber incident. These procedures should be developed and established through 3rd phase of Cyber Security Plan (CSP) and other technical complement actions under regulatory body’s guidance. Also developed and existed procedures should be regularly performed to make cyber incident response team and related people rapidly response against cyber incident through exercises or other training. The insufficient items come from the exercise should be reflected to developed and existed procedures by periods

  13. Cyber security awareness toolkit for national security: An approach to South Africa’s cybersecurity policy implementation

    CSIR Research Space (South Africa)

    Phahlamohlaka, LJ

    2011-05-01

    Full Text Available The aim of this paper is to propose an approach that South Africa could follow in implementing its proposed Cyber security policy. The paper proposes a Cyber Security Awareness Toolkit that is underpinned by key National Security imperatives as well...

  14. Measuring the Effectiveness of Visual Analytics and Data Fusion Techniques on Situation Awareness in Cyber-Security

    Science.gov (United States)

    Giacobe, Nicklaus A.

    2013-01-01

    Cyber-security involves the monitoring a complex network of inter-related computers to prevent, identify and remediate from undesired actions. This work is performed in organizations by human analysts. These analysts monitor cyber-security sensors to develop and maintain situation awareness (SA) of both normal and abnormal activities that occur on…

  15. Comparative Analysis of Curricula for Bachelor's Degree in Cyber Security in the USA and Ukraine

    Science.gov (United States)

    Bystrova, Bogdana

    2017-01-01

    At the present stage of science and technology development the need to strengthen cyber security in every developed country and transform it into one of the most important sectors of society is growing. The peculiarities of the professional training of cyber security bachelors in the U.S. higher education system have been defined. The relevance of…

  16. ASPECTS OF POLICIES AND STRATEGIES FOR CYBER SECURITY IN THE EUROPEAN UNION

    Directory of Open Access Journals (Sweden)

    Ilina ARMENCHEVA

    2015-10-01

    Full Text Available Freedom and prosperity of mankind greatly depend on an innovative, safe and reliable Internet that, of course, will keep evolving. Cyber space must be protected from incidents, misuse and abuse. Handling the increasing number of threats to cyber security is a challenge that national security and the trend in the international environment face. This makes taking fast and adequate measures at national, European and international level a must. Changing national security strategies and adopting new cyber security strategies are a part of these measures.

  17. Individual differences in cyber security behaviors: an examination of who is sharing passwords.

    Science.gov (United States)

    Whitty, Monica; Doodson, James; Creese, Sadie; Hodges, Duncan

    2015-01-01

    In spite of the number of public advice campaigns, researchers have found that individuals still engage in risky password practices. There is a dearth of research available on individual differences in cyber security behaviors. This study focused on the risky practice of sharing passwords. As predicted, we found that individuals who scored high on a lack of perseverance were more likely to share passwords. Contrary to our hypotheses, we found younger [corrected] people and individuals who score high on self-monitoring were more likely to share passwords. We speculate on the reasons behind these findings, and examine how they might be considered in future cyber security educational campaigns.

  18. Cyber-Security aus ordnungspolitischer Sicht: Verfügungsrechte, Wettbewerb und Nudges

    OpenAIRE

    Dold, Malte; Krieger, Tim

    2017-01-01

    Cyber-Security ist aus ökonomischer Sicht vor allem eine Frage fehlgeleiteter Anreize. Wenn Marktakteure nicht die vollen Kosten ihres informationstechnologischen Handelns tragen, führt dies zu ineffizienten Märkten. Ein Grund für die geringen Investitionen in Cyber-Security dürfte in fehlenden Verfügungsrechten an den eigenen Daten im Internet liegen. Darüber hinaus müsste das Wettbewerbsrecht ausgeweitet werden, um eine Machtkonzentration auf Anbieterseite zu verhindern und ein Mindestmaß a...

  19. A Cyber Security Self-Assessment Method for Nuclear Power Plants

    International Nuclear Information System (INIS)

    Glantz, Clifford S.; Coles, Garill A.; Bass, Robert B.

    2004-01-01

    A cyber security self-assessment method (the Method) has been developed by Pacific Northwest National Laboratory. The development of the Method was sponsored and directed by the U.S. Nuclear Regulatory Commission. Members of the Nuclear Energy Institute Cyber Security Task Force also played a substantial role in developing the Method. The Method's structured approach guides nuclear power plants in scrutinizing their digital systems, assessing the potential consequences to the plant of a cyber exploitation, identifying vulnerabilities, estimating cyber security risks, and adopting cost-effective protective measures. The focus of the Method is on critical digital assets. A critical digital asset is a digital device or system that plays a role in the operation, maintenance, or proper functioning of a critical system (i.e., a plant system that can impact safety, security, or emergency preparedness). A critical digital asset may have a direct or indirect connection to a critical system. Direct connections include both wired and wireless communication pathways. Indirect connections include sneaker-net pathways by which software or data are manually transferred from one digital device to another. An indirect connection also may involve the use of instructions or data stored on a critical digital asset to make adjustments to a critical system. The cyber security self-assessment begins with the formation of an assessment team, and is followed by a six-stage process

  20. A Cyber Security Self-Assessment Method for Nuclear Power Plants

    Energy Technology Data Exchange (ETDEWEB)

    Glantz, Clifford S.; Coles, Garill A.; Bass, Robert B.

    2004-11-01

    A cyber security self-assessment method (the Method) has been developed by Pacific Northwest National Laboratory. The development of the Method was sponsored and directed by the U.S. Nuclear Regulatory Commission. Members of the Nuclear Energy Institute Cyber Security Task Force also played a substantial role in developing the Method. The Method's structured approach guides nuclear power plants in scrutinizing their digital systems, assessing the potential consequences to the plant of a cyber exploitation, identifying vulnerabilities, estimating cyber security risks, and adopting cost-effective protective measures. The focus of the Method is on critical digital assets. A critical digital asset is a digital device or system that plays a role in the operation, maintenance, or proper functioning of a critical system (i.e., a plant system that can impact safety, security, or emergency preparedness). A critical digital asset may have a direct or indirect connection to a critical system. Direct connections include both wired and wireless communication pathways. Indirect connections include sneaker-net pathways by which software or data are manually transferred from one digital device to another. An indirect connection also may involve the use of instructions or data stored on a critical digital asset to make adjustments to a critical system. The cyber security self-assessment begins with the formation of an assessment team, and is followed by a six-stage process.

  1. Challenges and Aspects of Cyber Security of the Republic of Croatia

    Directory of Open Access Journals (Sweden)

    Protrka Nikola

    2017-06-01

    Full Text Available The development of the information and communication technology (ICT, regardless of its many advantages, unfortunately has its disadvantage - the abuse of the cyberworld. The global character of cyberspace is specific in terms of national legislation and its view of specificities. Some countries adopted the recommendation of the Convention on Cybercrime of the Council of Europe (Official Gazette NN-MU 9/02, 4/04 and amended their national legislation, whereas others kept implementing their criminal law solutions, which are outdated and cannot reach the level of this type of criminal offences. Consequently, governments are inclined to cooperate and exchange information about this type of crime due to the fact that the criminal offender may be anywhere, and the offence itself can take place at a great distance from the offender. In September 2015, the government of the Republic of Croatia adopted the National Cyber Security Strategy and the Action Plan for the Implementation of the National Cyber Security Strategy, the first allencompassing strategy of the Republic of Croatia on cyber security. The paper also focuses on the role of the Police College in the Action Plan for the Implementation of the National Cyber Security Strategy.

  2. Canvassing the Cyber Security Landscape: Why Energy Companies Need to Pay Attention

    NARCIS (Netherlands)

    Averill, B.; Luiijf, H.A.M.

    2010-01-01

    Recent news of a “highly sophisticated and targeted” cyber attack on Google, Yahoo, and perhaps on as many as a dozen other companies has once again brought the issue of cyber security to the top of the news. Internet companies, however, are not the only ones vulnerable to such attacks. Over the

  3. Cyber security information exchange to gain insight into the effects of cyber threats and incidents

    NARCIS (Netherlands)

    Fransen, F.; Smulders, A.C.M.; Kerkdijk, H.

    2015-01-01

    The last couple of years we have seen an increase in interests and initiatives in establishing threat intelligence sharing communities, and on the development of standards and platforms for automated cyber security information sharing. These initiatives are focused on helping organisations to

  4. Breaking the cyber-security dilemma: aligning security needs and removing vulnerabilities.

    Science.gov (United States)

    Dunn Cavelty, Myriam

    2014-09-01

    Current approaches to cyber-security are not working. Rather than producing more security, we seem to be facing less and less. The reason for this is a multi-dimensional and multi-faceted security dilemma that extends beyond the state and its interaction with other states. It will be shown how the focus on the state and "its" security crowds out consideration for the security of the individual citizen, with detrimental effects on the security of the whole system. The threat arising from cyberspace to (national) security is presented as possible disruption to a specific way of life, one building on information technologies and critical functions of infrastructures, with relatively little consideration for humans directly. This non-focus on people makes it easier for state actors to militarize cyber-security and (re-)assert their power in cyberspace, thereby overriding the different security needs of human beings in that space. Paradoxically, the use of cyberspace as a tool for national security, both in the dimension of war fighting and the dimension of mass-surveillance, has detrimental effects on the level of cyber-security globally. A solution out of this dilemma is a cyber-security policy that is decidedly anti-vulnerability and at the same time based on strong considerations for privacy and data protection. Such a security would have to be informed by an ethics of the infosphere that is based on the dignity of information related to human beings.

  5. Implementation of a RPS Cyber Security Test-bed with Two PLCs

    International Nuclear Information System (INIS)

    Shin, Jinsoo; Heo, Gyunyoung; Son, Hanseong; An, Yongkyu; Rizwan, Uddin

    2015-01-01

    Our research team proposed the methodology to evaluate cyber security with Bayesian network (BN) as a cyber security evaluation model and help operator, licensee, licensor or regulator in granting evaluation priorities. The methodology allowed for overall evaluation of cyber security by considering architectural aspect of facility and management aspect of cyber security at the same time. In order to emphasize reality of this model by inserting true data, it is necessary to conduct a penetration test that pretends an actual cyber-attack. Through the collaboration with University of Illinois at Urbana-Champaign, which possesses the Tricon a safety programmable logic controller (PLC) used at nuclear power plants and develops a test-bed for nuclear power plant, a test-bed for reactor protection system (RPS) is being developed with the PLCs. Two PLCs are used to construct a simple test-bed for RPS, bi-stable processor (BP) and coincidence processor (CP). By using two PLCs, it is possible to examine cyber-attack against devices such as PLC, cyber-attack against communication between devices, and the effects of a PLC on the other PLC. Two PLCs were used to construct a test-bed for penetration test in this study. Advantages of using two or more PLCs instead of single PLC are as follows. 1) Results of cyber-attack reflecting characteristics among PLCs can be obtained. 2) Cyber-attack can be attempted using a method of attacking communication between PLCs. True data obtained can be applied to existing cyber security evaluation model to emphasize reality of the model

  6. Implementation of a RPS Cyber Security Test-bed with Two PLCs

    Energy Technology Data Exchange (ETDEWEB)

    Shin, Jinsoo; Heo, Gyunyoung [Kyung Hee Univ., Yongin (Korea, Republic of); Son, Hanseong [Joongbu Univ., Geumsan (Korea, Republic of); An, Yongkyu; Rizwan, Uddin [University of Illinois at Urbana-Champaign, Urbana (United States)

    2015-10-15

    Our research team proposed the methodology to evaluate cyber security with Bayesian network (BN) as a cyber security evaluation model and help operator, licensee, licensor or regulator in granting evaluation priorities. The methodology allowed for overall evaluation of cyber security by considering architectural aspect of facility and management aspect of cyber security at the same time. In order to emphasize reality of this model by inserting true data, it is necessary to conduct a penetration test that pretends an actual cyber-attack. Through the collaboration with University of Illinois at Urbana-Champaign, which possesses the Tricon a safety programmable logic controller (PLC) used at nuclear power plants and develops a test-bed for nuclear power plant, a test-bed for reactor protection system (RPS) is being developed with the PLCs. Two PLCs are used to construct a simple test-bed for RPS, bi-stable processor (BP) and coincidence processor (CP). By using two PLCs, it is possible to examine cyber-attack against devices such as PLC, cyber-attack against communication between devices, and the effects of a PLC on the other PLC. Two PLCs were used to construct a test-bed for penetration test in this study. Advantages of using two or more PLCs instead of single PLC are as follows. 1) Results of cyber-attack reflecting characteristics among PLCs can be obtained. 2) Cyber-attack can be attempted using a method of attacking communication between PLCs. True data obtained can be applied to existing cyber security evaluation model to emphasize reality of the model.

  7. Cyber Security in Nuclear Power Plants - U.S. NRC Regulatory Guide 5.71

    International Nuclear Information System (INIS)

    Pogacic, Goran

    2014-01-01

    We have already made a big step into new millennia and with it there is no more dilemma about presence of computers and internet in our lives. Almost all modern facilities struggle with this new dimension of information flow and how to use it to their best interest. But there is also the other side of the coin- the security threat. For nuclear power plants this threat poses even greater risk. In addition to protecting their trade secrets, personal data or other common targets of cyber attacks, nuclear power plants need to protect their digital computers, communication systems and networks up to and including the design basis threat (DBT). As stated in U.S. Nuclear Regulatory Commission (NRC) Regulatory Commission Regulations, Title 10, Code of Federal Regulations (CFR), section 73.1, 'Purpose and Scope' this includes protection against acts of radiological sabotage and prevention of the theft or diversion of special nuclear material. The main purpose of this paper is to explore the NRC Regulatory Guide (RG) 5.71 and its guidance in implementing cyber security requirements stated in NRC 10 CFR, section 73.54, 'Protection of Digital Computer and Communication Systems and Networks'. In particular, this section requires protection of digital computers, communication systems and networks associated with the following categories of functions: · safety-related and important-to-safety functions, · security functions, · emergency preparedness functions, including offsite communication, and · support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions. This section requires protection of such systems and networks from those cyber attacks that would act to modify, destroy, or compromise the integrity or confidentiality of data or software; deny access to systems, services or data; and impact the operation of systems, networks, and equipment. This paper will also present some of

  8. CS651 Computer Systems Security Foundations 3d Imagination Cyber Security Management Plan

    Energy Technology Data Exchange (ETDEWEB)

    Nielsen, Roy S. [Los Alamos National Lab. (LANL), Los Alamos, NM (United States)

    2015-03-02

    3d Imagination is a new company that bases its business on selling and improving 3d open source related hardware. The devices that they sell include 3d imagers, 3d printers, pick and place machines and laser etchers. They have a fast company intranet for ease in sharing, storing and printing large, complex 3d designs. They have an employee set that requires a variety of operating systems including Windows, Mac and a variety of Linux both for running business services as well as design and test machines. There are a wide variety of private networks for testing transfer rates to and from the 3d devices, without interference with other network tra c. They do video conferencing conferencing with customers and other designers. One of their machines is based on the project found at delta.firepick.org(Krassenstein, 2014; Biggs, 2014), which in future, will perform most of those functions. Their devices all include embedded systems, that may have full blown operating systems. Most of their systems are designed to have swappable parts, so when a new technology is born, it can be quickly adopted by people with 3d Imagination hardware. This company is producing a fair number of systems and components, however to get the funding they need to mass produce quality parts, so they are preparing for an IPO to raise the funds they need. They would like to have a cyber-security audit performed so they can give their investors con dence that they are protecting their data, customers information and printers in a proactive manner.

  9. Scenario-based approach to risk analysis in support of cyber security

    Energy Technology Data Exchange (ETDEWEB)

    Gertman, D. I.; Folkers, R.; Roberts, J. [Idaho National Laboratory, Roberts and Folkers Associates, LLC, Idaho Falls, ID 83404 (United States)

    2006-07-01

    control systems, perpetrators will attempt to control and defeat automation systems, engineering access, control systems and protective systems implemented in today's critical infrastructures. Major systems such as supervisory control and data acquisition (SCADA) systems are likely targets for attack. Not all attack scenarios have the same expected frequency or consequence. The attacks will be directed and structured and thus, are not be characterized as random events when one considers failure probabilities. Attack types differ in their consequence as a function of the probability associated with various sub events in the presence of specific system configurations. Ideally, a series of generic scenarios can be identified for each of the major critical infrastructure (CI) sectors. A scenario-based approach to risk assessment allows decision makers to place financial and personnel resources in-place for attacks that truly matter: e.g. attacks that generate physical and economic damage. The use of scenario-based analysis allows risk reduction goals to be informed by more than consequence analysis alone. The key CI targets used in the present study were identified previously as part of a mid-level consequence analysis performed at INL by the Control System Security Program (CSSP) for the National Cyber Security Div. (NCSD) of the Dept. of Homeland Security (DHS). This paper discusses the process for and results associated with the development of scenario-based cyber attacks upon control systems including the information and personnel requirements for scenario development. Challenges to scenario development including completeness and uncertainty characterization are discussed as well. Further, the scenario discussed herein, is one of a number of scenarios for infrastructures currently under review. (authors)

  10. Scenario-based approach to risk analysis in support of cyber security

    International Nuclear Information System (INIS)

    Gertman, D. I.; Folkers, R.; Roberts, J.

    2006-01-01

    control systems, perpetrators will attempt to control and defeat automation systems, engineering access, control systems and protective systems implemented in today's critical infrastructures. Major systems such as supervisory control and data acquisition (SCADA) systems are likely targets for attack. Not all attack scenarios have the same expected frequency or consequence. The attacks will be directed and structured and thus, are not be characterized as random events when one considers failure probabilities. Attack types differ in their consequence as a function of the probability associated with various sub events in the presence of specific system configurations. Ideally, a series of generic scenarios can be identified for each of the major critical infrastructure (CI) sectors. A scenario-based approach to risk assessment allows decision makers to place financial and personnel resources in-place for attacks that truly matter: e.g. attacks that generate physical and economic damage. The use of scenario-based analysis allows risk reduction goals to be informed by more than consequence analysis alone. The key CI targets used in the present study were identified previously as part of a mid-level consequence analysis performed at INL by the Control System Security Program (CSSP) for the National Cyber Security Div. (NCSD) of the Dept. of Homeland Security (DHS). This paper discusses the process for and results associated with the development of scenario-based cyber attacks upon control systems including the information and personnel requirements for scenario development. Challenges to scenario development including completeness and uncertainty characterization are discussed as well. Further, the scenario discussed herein, is one of a number of scenarios for infrastructures currently under review. (authors)

  11. Towards the cyber security paradigm of ehealth: Resilience and design aspects

    Science.gov (United States)

    Rajamäki, Jyri; Pirinen, Rauno

    2017-06-01

    Digital technologies have significantly changed the role of healthcare clients in seeking and receiving medical help, as well as brought up more cooperative policy issues in healthcare cross-border services. Citizens continue to take a more co-creative role in decisions about their own healthcare, and new technologies can enable and facilitate this emergent trend. In this study, healthcare services have been intended as a critical societal sector and therefore healthcare systems are focused on as critical infrastructures that ought to be protected from all types of fears, including cyber security threats and attacks. Despite continual progress in the systemic risk management of cyber domain, it is clear that anticipation and prevention of all possible types of attack and malfunction are not achievable for current or future cyber infrastructures. This study focuses on the investigation of a cyber security paradigm, adaptive systems and sense of resilience in a healthcare critical information infrastructure.

  12. A Survey on Cyber Security awareness among college students in Tamil Nadu

    Science.gov (United States)

    Senthilkumar, K.; Easwaramoorthy, Sathishkumar

    2017-11-01

    The aim of the study is to analyse the awareness of cyber security on college students in Tamil Nadu by focusing various security threats in the internet. In recent years cybercrime is an enormous challenge in all areas including national security, public safety and personal privacy. To prevent from a victim of cybercrime everyone must know about their own security and safety measures to protect by themselves. A well-structured questionnaire survey method will be applied to analyse the college student’s awareness in the area of cyber security. This survey will be going to conducted in major cities of Tamil Nadu by focusing various security threats like email, virus, phishing, fake advertisement, popup windows and other attacks in the internet. This survey examines the college students’ awareness and the level of awareness about the security issues and some suggestions are set forth to overcome these issues.

  13. Building organisational cyber resilience: A strategic knowledge-based view of cyber security management.

    Science.gov (United States)

    Ferdinand, Jason

    The concept of cyber resilience has emerged in recent years in response to the recognition that cyber security is more than just risk management. Cyber resilience is the goal of organisations, institutions and governments across the world and yet the emerging literature is somewhat fragmented due to the lack of a common approach to the subject. This limits the possibility of effective collaboration across public, private and governmental actors in their efforts to build and maintain cyber resilience. In response to this limitation, and to calls for a more strategically focused approach, this paper offers a knowledge-based view of cyber security management that explains how an organisation can build, assess, and maintain cyber resilience.

  14. A Method to Analyze Threats and Vulnerabilities by Using a Cyber Security Test-bed of an Operating NPP

    Energy Technology Data Exchange (ETDEWEB)

    Kim, Yong Sik; Son, Choul Woong; Lee, Soo Ill [KHNP CRI, Daejeon (Korea, Republic of)

    2016-10-15

    In order to implement cyber security controls for an Operating NPP, a security assessment should conduct in advance, and it is essential to analyze threats and vulnerabilities for a cyber security risk assessment phase. It might be impossible to perform a penetration test or scanning for a vulnerability analysis because the test may cause adverse effects on the inherent functions of ones. This is the reason why we develop and construct a cyber security test-bed instead of using real I and C systems in the operating NPP. In this paper, we propose a method to analyze threats and vulnerabilities of a specific target system by using a cyber security test-bed. The test-bed is being developed considering essential functions of the selected safety and non-safety system. This paper shows the method to analyze threats and vulnerabilities of a specific target system by using a cyber security test-bed. In order to develop the cyber security test-bed with both safety and non-safety functions, test-bed functions analysis and preliminary threats and vulnerabilities identification have been conducted. We will determine the attack scenarios and conduct the test-bed based vulnerability analysis.

  15. A Method to Analyze Threats and Vulnerabilities by Using a Cyber Security Test-bed of an Operating NPP

    International Nuclear Information System (INIS)

    Kim, Yong Sik; Son, Choul Woong; Lee, Soo Ill

    2016-01-01

    In order to implement cyber security controls for an Operating NPP, a security assessment should conduct in advance, and it is essential to analyze threats and vulnerabilities for a cyber security risk assessment phase. It might be impossible to perform a penetration test or scanning for a vulnerability analysis because the test may cause adverse effects on the inherent functions of ones. This is the reason why we develop and construct a cyber security test-bed instead of using real I and C systems in the operating NPP. In this paper, we propose a method to analyze threats and vulnerabilities of a specific target system by using a cyber security test-bed. The test-bed is being developed considering essential functions of the selected safety and non-safety system. This paper shows the method to analyze threats and vulnerabilities of a specific target system by using a cyber security test-bed. In order to develop the cyber security test-bed with both safety and non-safety functions, test-bed functions analysis and preliminary threats and vulnerabilities identification have been conducted. We will determine the attack scenarios and conduct the test-bed based vulnerability analysis

  16. Cyber terrorism and cyber-crime – threats for cyber security

    OpenAIRE

    Ackoski, Jugoslav; Dojcinovski, Metodija

    2012-01-01

    This paper has aim to give contribution in supporting efforts against cyber threats recognized as a cyber terrorism and cyber crime. Also, it has aim to show future challenges related to cyber security and their emerging threats – cyber war, cyber terrorism and cyber crime. Accelerate weapon development called ICT (Information Communication Technology) which is developed every day faster and faster, and development of human conscious on higher level about consequences of ICT enormous pene...

  17. Cyber security in the workplace: Understanding and \\ud promoting behaviour change

    OpenAIRE

    Blythe, John

    2013-01-01

    Cyber security and the role employees play in securing information are major concerns for businesses. The aim of this research is to explore employee security behaviours and design interventions that can motivate behaviour change. Previous research has focused on exploring factors that influence information security policy compliance; however there are several limitations with this approach. Our work-to-date has explored the behaviours that constitute ‘information security’ and potential infl...

  18. An Analysis Of Cyber Security And How It Is Affecting A Contract Writing System, Seaport

    Science.gov (United States)

    2016-06-01

    features to protect U.S. interests. Secure Socket Layers or SSL works by allowing a user to encrypt information sent or received across a network ...and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington, DC 20503. 1. AGENCY USE ONLY (Leave blank) 2...however, theoretically, cyber security can be attributed. Recommendations include adding more servers to existing SeaPort network infrastructure and

  19. In-Depth Modeling of the UNIX Operating System for Architectural Cyber Security Analysis

    OpenAIRE

    Vernotte, Alexandre; Johnson, Pontus; Ekstedt, Mathias; Lagerström, Robert

    2017-01-01

    ICT systems have become an integral part of business and life. At the same time, these systems have become extremely complex. In such systems exist numerous vulnerabilities waiting to be exploited by potential threat actors. pwnPr3d is a novel modelling approach that performs automated architectural analysis with the objective of measuring the cyber security of the modeled architecture. Its integrated modelling language allows users to model software and hardware components with great level o...

  20. Cyber Security & Social Media: How Big is Your Digital Footprint and Why Should You Care

    OpenAIRE

    Rogers, Marcus

    2016-01-01

    With the popularity of social media sites such as Facebook, Twitter, Instagram etc. we find our selves more connected to cyberspace than at any previous time in history. This constant connectiveness and sharing of daily lives in almost realtime, has some serious implications for cyber security and privacy. The talk will discuss the very real threat of our ever growing digital footprint, and what if anything we can do to mitigate the risks.

  1. A review of cyber security risk assessment methods for SCADA systems

    OpenAIRE

    Cherdantseva, Yulia; Burnap, Peter; Blyth, Andrew; Eden, Peter; Jones, Kevin; Soulsby, Hugh; Stoddart, Kristan

    2016-01-01

    This paper reviews the state of the art in cyber security risk assessment of Supervisory Control and Data Acquisition (SCADA) systems. We select and in-detail examine twenty-four risk assessment methods developed for or applied in the context of a SCADA system. We describe the essence of the methods and then analyse them in terms of aim; application domain; the stages of risk management addressed; key risk management concepts covered; impact measurement; sources of probabilistic data; evaluat...

  2. Cyber Security Insider Threats :: Government’s Role in Protecting India’s Critical Infrastructure Sectors

    OpenAIRE

    Vohra, Pulkit

    2014-01-01

    This research identifies the problem of insider threats in the critical infrastructure sectors of India. It is structured to answer the research question: "Why insider threats should be the primary concern for Indian government to protect its critical infrastructure sectors.” It defines the critical infrastructure sectors and portrays the cyber security scenario of India. Also, through the research study, it identifies the lack of awareness and non-seriousness of employees in the critical sec...

  3. A study of cyber security in hospitality industry- threats and countermeasures: case study in Reno, Nevada

    OpenAIRE

    Shabani, Neda

    2017-01-01

    The purpose of this study is to analyze cyber security and security practices of electronic information and network system, network threats, and techniques to prevent the cyber attacks in hotels. Helping the information technology directors and chief information officers (CIO) is the aim of this study to advance policy for security of electronic information in hotels and suggesting some techniques and tools to secure the computer networks. This research is completely qualitative while the cas...

  4. An analysis of cyber security and how it is affecting a contract writing system, Seaport

    OpenAIRE

    Turner, Bill; Belcher, Daniel; Allen, Danielle

    2016-01-01

    Approved for public release; distribution is unlimited The purpose of this paper is to research cyber security and whether it creates inefficiencies and ineffective business support for the DOD--specifically, the contract writing system SeaPort. Is cybersecurity becoming too restrictive, making the ability to support the programs and warfighters inefficient and ineffective? What business practices could be put in place to protect the DOD without hindering contract and business support to t...

  5. Cyber Crime & Cyber War – "Part of the Game": Cyber Security, Quo Vadis?

    Directory of Open Access Journals (Sweden)

    Karl H. Stingeder

    2015-09-01

    Full Text Available Welche Rolle spielt Cyber Crime gegenwärtig? Was unterscheidet Cyber Crime von Cyber War? Wie muss Cyber Security gestaltet sein, um effektiven Schutz nachhaltig zu gewährleisten? Cyber Crime-Aktivitäten kennzeichnen sich häufig durch eine einfache Zugänglichkeit von betrügerischem Know-How und technischen Hilfsmitteln. Bedingt durch eine schleppende und mangelhafte Umsetzung von koordinierten Gegenmaßnahmen, resultieren Cyber-Delikte in einem Low-Risk und High-Reward Szenario für Cyber-Kriminelle. Je organisierter und spezialisierter ein Cyber-Crime-Netzwerk gestaltet ist, desto größer wird das Schadenspotenzial. Cyber Crime ist der Überbegriff für betrügerische Aktivitäten über das Internet. Diese stützen sich auf das Vorbild von "traditionellen" Offline-Kriminalitätsverhaltensmustern, welche durch das technologische Spektrum des Internets einfach zugänglich sind. Nichtsdestoweniger ist es die technische Ausführung der Delikte, die ein wesentliches Unterscheidungsmerkmal zwischen Online- und Offline-Betrug bildet. Auch steht die für organisierte, kriminelle Verbindungen, so auch für Regierungen oder Terrororganisationen geringere Hemmschwelle für eine militärische Instrumentalisierung des Internets im Brennpunkt von Cyber Security. Erfolgen Cyber Crime Aktivitäten unter dem Anspruch der Verfolgung politischer Ziele, sprechen wir von Cyber War. Nachhaltige, gegen Cyber Crime und Cyber War gerichtete Cyber Security-Maßnahmen finden in einem hochdynamischen Umfeld statt. Cyber-Kriminelle sind im Regelfall logistisch und finanziell gut ausgestattet. Viele werden von Regierungen unterstützt. Cyber Crime-Player verfügen über weitreichende technische Fähigkeiten, sodass sie maßgeschneiderte Schadprogramme (Malware für ihre Ziele entwickeln können. Aktuell fehlt vielen Unternehmen und öffentlichen Institutionen das Bewusstsein für die Notwendigkeit von Abwehrsystemen. Ein Cyber Security-Fokus auf Pr

  6. 网络空间安全人才培养探讨%Discussions on the talent cultivation of cyber security

    Institute of Scientific and Technical Information of China (English)

    翁健; 马昌社; 古亮

    2016-01-01

    Cyber security has been formally approved to be the first level discipline in June 2015. How to train the cyber security talents that meet the needs of our country has become an urgent problem to be solved in the discipline construction. Synthetical analysis of the current situation of training related talents at domestic and foreign, as well as the actual demand for the cyber security talents was presented. According to the characteristics of the talent culti-vation in cyber security, some suggestions on training the cyber security talents were given.%自从2015年6月网络空间安全正式被批准为国家一级学科,如何培养符合国家需要的网络空间安全人才成为了学科建设中一个亟待解决的问题。综合分析了国内外培养相关方面人才的现状与网络空间安全的实际人才需求;结合我国网络空间安全人才培养的特点,给出了我国网络空间安全人才培养的部分建议。

  7. An assessment of the cyber security legislation and its impact on the United States electrical sector

    Science.gov (United States)

    Born, Joshua

    The purpose of this research was to examine the cyber-security posture for the United States' electrical grid, which comprises a major component of critical infrastructure for the country. The United States electrical sector is so vast, that the Department of Homeland Security (DHS) estimates, it contains more than 6,413 power plants (this includes 3,273 traditional electric utilities and 1,738 nonutility power producers) with approximately 1,075 gigawatts of energy produced on a daily basis. A targeted cyber-security attack against the electric grid would likely have catastrophic results and could even serve as a precursor to a physical attack against the United States. A recent report by the consulting firm Black and Veatch found that one of the top five greatest concerns for United States electric utilities is the risk that cybersecurity poses to their industry and yet, only one-third state they are currently prepared to meet the increasingly likely threat. The report goes on to state, "only 32% of electric utilities surveyed had integrated security systems with the proper segmentation, monitoring and redundancies needed for cyber threat protection. Another 48 % said they did not" Recent estimates indicate that a large-scale cyber-attack against this sector could cost the United States economy as much as a trillion dollars within a weeks' time. Legislative efforts in the past have primarily been focused on creating mandates that encourage public and private partnership, which have been not been adopted as quickly as desired. With 85 % of all electric utilities being privately owned, it is key that the public and private sector partner in order to mitigate risks and respond as a cohesive unit in the event of a major attack. Keywords: Cybersecurity, Professor Riddell, cyber security, energy, intelligence, outlook, electrical, compliance, legislation, partnerships, critical infrastructure.

  8. LESSONS LEARNED FROM CYBER SECURITY ASSESSMENTS OF SCADA AND ENERGY MANAGEMENT SYSTEMS

    Energy Technology Data Exchange (ETDEWEB)

    Ray Fink

    2006-10-01

    The results from ten cyber security vulnerability assessments of process control, SCADA and energy management systems, or components of those systems were reviewed to identify common problem areas. The common vulnerabilities ranged from conventional IT security issues to specific weaknesses in control system protocols. In each vulnerability category, relative measures were assigned to the severity of the vulnerability and ease with which an attacker could exploit the vulnerability. Suggested mitigations are identified in each category. Recommended mitigations having the highest impact on reducing vulnerability are listed for asset owners and system vendors.

  9. Quantum-Enhanced Cyber Security: Experimental Computation on Quantum-Encrypted Data

    Science.gov (United States)

    2017-03-02

    AFRL-AFOSR-UK-TR-2017-0020 Quantum-Enhanced Cyber Security: Experimental Computation on Quantum- Encrypted Data Philip Walther UNIVERSITT WIEN Final...on Quantum- Encrypted Data 5a.  CONTRACT NUMBER 5b.  GRANT NUMBER FA9550-16-1-0004 5c.  PROGRAM ELEMENT NUMBER 61102F 6. AUTHOR(S) Philip Walther 5d...1010 AT 8. PERFORMING ORGANIZATION REPORT NUMBER 9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) EOARD Unit 4515 APO AE 09421-4515 10

  10. Cyber Crime & Cyber War – "Part of the Game": Cyber Security, Quo Vadis?

    OpenAIRE

    Karl H. Stingeder

    2015-01-01

    Welche Rolle spielt Cyber Crime gegenwärtig? Was unterscheidet Cyber Crime von Cyber War? Wie muss Cyber Security gestaltet sein, um effektiven Schutz nachhaltig zu gewährleisten? Cyber Crime-Aktivitäten kennzeichnen sich häufig durch eine einfache Zugänglichkeit von betrügerischem Know-How und technischen Hilfsmitteln. Bedingt durch eine schleppende und mangelhafte Umsetzung von koordinierten Gegenmaßnahmen, resultieren Cyber-Delikte in einem Low-Risk und High-Reward Szenario für Cyber-Krimi...

  11. Canvassing the Cyber Security Landscape: Why Energy Companies Need to Pay Attention

    OpenAIRE

    Averill, B.; Luiijf, H.A.M.

    2010-01-01

    Recent news of a “highly sophisticated and targeted” cyber attack on Google, Yahoo, and perhaps on as many as a dozen other companies has once again brought the issue of cyber security to the top of the news. Internet companies, however, are not the only ones vulnerable to such attacks. Over the past decade, a series of events has highlighted the vulnerability of the electric grid and other energy infrastructures to both cyber disruptions (due, e.g., to malware) and from outside attacks using...

  12. Control Systems Cyber Security:Defense in Depth Strategies

    Energy Technology Data Exchange (ETDEWEB)

    David Kuipers; Mark Fabro

    2006-05-01

    Information infrastructures across many public and private domains share several common attributes regarding IT deployments and data communications. This is particularly true in the control systems domain. A majority of the systems use robust architectures to enhance business and reduce costs by increasing the integration of external, business, and control system networks. However, multi-network integration strategies often lead to vulnerabilities that greatly reduce the security of an organization, and can expose mission-critical control systems to cyber threats. This document provides guidance and direction for developing ‘defense-in-depth’ strategies for organizations that use control system networks while maintaining a multi-tier information architecture that requires: Maintenance of various field devices, telemetry collection, and/or industrial-level process systems Access to facilities via remote data link or modem Public facing services for customer or corporate operations A robust business environment that requires connections among the control system domain, the external Internet, and other peer organizations.

  13. A Method to Derive Monitoring Variables for a Cyber Security Test-bed of I and C System

    International Nuclear Information System (INIS)

    Han, Kyung Soo; Song, Jae Gu; Lee, Joung Woon; Lee, Cheol Kwon

    2013-01-01

    In the IT field, monitoring techniques have been developed to protect the systems connected by networks from cyber attacks and incidents. For the development of monitoring systems for I and C cyber security, it is necessary to review the monitoring systems in the IT field and derive cyber security-related monitoring variables among the proprietary operating information about the I and C systems. Tests for the development and application of these monitoring systems may cause adverse effects on the I and C systems. To analyze influences on the system and safely intended variables, the construction of an I and C system Test-bed should be preceded. This article proposes a method of deriving variables that should be monitored through a monitoring system for cyber security as a part of I and C Test-bed. The surveillance features and the monitored variables of NMS(Network Management System), a monitoring technique in the IT field, were reviewed in section 2. In Section 3, the monitoring variables for an I and C cyber security were derived by the of NMS and the investigation for information used for hacking techniques that can be practiced against I and C systems. The monitoring variables of NMS in the IT field and the information about the malicious behaviors used for hacking were derived as expected variables to be monitored for an I and C cyber security research. The derived monitoring variables were classified into the five functions of NMS for efficient management. For the cyber security of I and C systems, the vulnerabilities should be understood through a penetration test etc. and an assessment of influences on the actual system should be carried out. Thus, constructing a test-bed of I and C systems is necessary for the safety system in operation. In the future, it will be necessary to develop a logging and monitoring system for studies on the vulnerabilities of I and C systems with test-beds

  14. A Method to Derive Monitoring Variables for a Cyber Security Test-bed of I and C System

    Energy Technology Data Exchange (ETDEWEB)

    Han, Kyung Soo; Song, Jae Gu; Lee, Joung Woon; Lee, Cheol Kwon [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2013-10-15

    In the IT field, monitoring techniques have been developed to protect the systems connected by networks from cyber attacks and incidents. For the development of monitoring systems for I and C cyber security, it is necessary to review the monitoring systems in the IT field and derive cyber security-related monitoring variables among the proprietary operating information about the I and C systems. Tests for the development and application of these monitoring systems may cause adverse effects on the I and C systems. To analyze influences on the system and safely intended variables, the construction of an I and C system Test-bed should be preceded. This article proposes a method of deriving variables that should be monitored through a monitoring system for cyber security as a part of I and C Test-bed. The surveillance features and the monitored variables of NMS(Network Management System), a monitoring technique in the IT field, were reviewed in section 2. In Section 3, the monitoring variables for an I and C cyber security were derived by the of NMS and the investigation for information used for hacking techniques that can be practiced against I and C systems. The monitoring variables of NMS in the IT field and the information about the malicious behaviors used for hacking were derived as expected variables to be monitored for an I and C cyber security research. The derived monitoring variables were classified into the five functions of NMS for efficient management. For the cyber security of I and C systems, the vulnerabilities should be understood through a penetration test etc. and an assessment of influences on the actual system should be carried out. Thus, constructing a test-bed of I and C systems is necessary for the safety system in operation. In the future, it will be necessary to develop a logging and monitoring system for studies on the vulnerabilities of I and C systems with test-beds.

  15. On detection and visualization techniques for cyber security situation awareness

    Science.gov (United States)

    Yu, Wei; Wei, Shixiao; Shen, Dan; Blowers, Misty; Blasch, Erik P.; Pham, Khanh D.; Chen, Genshe; Zhang, Hanlin; Lu, Chao

    2013-05-01

    Networking technologies are exponentially increasing to meet worldwide communication requirements. The rapid growth of network technologies and perversity of communications pose serious security issues. In this paper, we aim to developing an integrated network defense system with situation awareness capabilities to present the useful information for human analysts. In particular, we implement a prototypical system that includes both the distributed passive and active network sensors and traffic visualization features, such as 1D, 2D and 3D based network traffic displays. To effectively detect attacks, we also implement algorithms to transform real-world data of IP addresses into images and study the pattern of attacks and use both the discrete wavelet transform (DWT) based scheme and the statistical based scheme to detect attacks. Through an extensive simulation study, our data validate the effectiveness of our implemented defense system.

  16. Cyber-Security Issues in Healthcare Information Technology.

    Science.gov (United States)

    Langer, Steve G

    2017-02-01

    In 1999-2003, SIIM (then SCAR) sponsored the creation of several special topic Primers, one of which was concerned with computer security. About the same time, a multi-society collaboration authored an ACR Guideline with a similar plot; the latter has recently been updated. The motivation for these efforts was the launch of Health Information Portability and Accountability Act (HIPAA). That legislation directed care providers to enable the portability of patient medical records across authorized medical centers, while simultaneously protecting patient confidentiality among unauthorized agents. These policy requirements resulted in the creation of numerous technical solutions which the above documents described. While the mathematical concepts and algorithms in those papers are as valid today as they were then, recent increases in the complexity of computer criminal applications (and defensive countermeasures) and the pervasiveness of Internet connected devices have raised the bar. This work examines how a medical center can adapt to these evolving threats.

  17. Towards the Development of a Methodology for the Cyber Security Analysis of Safety Related Nuclear Digital I and C Systems

    International Nuclear Information System (INIS)

    Khand, Parvaiz Ahmed; Seong, Poong Hyun

    2007-01-01

    In nuclear power plants the redundant safety related systems are designed to take automatic action to prevent and mitigate accident conditions if the operators and the non-safety systems fail to maintain the plant within normal operating conditions. In case of an event, the failure of these systems has catastrophic consequences. The tendency in the industry over the past 10 years has been to use of commercial of the shelf (COTS) technologies in these systems. COTS software was written with attention to function and performance rather than security. COTS hardware usually designed to fail safe, but security vulnerabilities could be exploited by an attacker to disable the fail safe mechanisms. Moreover, the use of open protocols and operating systems in these technologies make the plants to become vulnerable to a host of cyber attacks. An effective security analysis process is required during all life cycle phases of these systems in order to ensure the security from cyber attacks. We are developing a methodology for the cyber security analysis of safety related nuclear digital I and C Systems. This methodology will cover all phases of development, operation and maintenance processes of software life cycle. In this paper, we will present a security analysis process for the concept stage of software development life cycle

  18. Cyber Security Evaluation of the Wireless Communication for the Mobile Safeguard Systems in Nuclear Power Plants

    International Nuclear Information System (INIS)

    Lee, S.; Kim, Y.S.; Ye, S.H.

    2015-01-01

    This paper introduces cyber security evaluation results and a design of the wireless communication technology to apply to safeguard systems in nuclear power plants. While wireless communication technologies can generally make mobility and efficiency on plant operation, those have seldom been installed on the nuclear I&C systems due to the negative concern of unexpected outcomes that stem from electromagnetic interference and cyber attack. New design of advanced digital safeguard and I&C systems uses computer-based systems for the safeguard and safety functions. On the other hand, those are being exposed to various types of new and existing cyber threats, vulnerabilities and risks which significantly increase the likelihood that those could be compromised. In order to employ the wireless communication technology in safeguard function, licencees assess and manage the potential for adverse effects on safeguard and safety functions so as to provide high assurance that critical functions are properly protected cyber attack. It is expected that the safeguard function, specifically on the area of real-time monitoring, logging, can be enhanced by employing the mobile safeguard devices (: smart phone, laptop, smart pad, etc). In this paper, we deal with the cyber security evaluation, which consists of threat analysis, vulnerability test, establishment of security plan, and design solutions for the wireless communication on the basis of IEEE 802.11(Wi-Fi) protocol. Proposed evaluation and design solution could be a basis for the design of wireless communication and mobile safeguard systems in nuclear power plants. (author)

  19. British And American Cyber Security Review Mechanism And Its Enlightenment%英美网络安全审查机制及其启示

    Institute of Scientific and Technical Information of China (English)

    顾伟; 刘振宇

    2017-01-01

    It is the duty of every government to take necessary measures to continuously improve the safety performance of information technology products and services, and maintain the security and order of cyberspace. With the implementing of China's cyber security review, how to establish the effective framework and mechanism, control the corresponding security risk, and avoid the potential risk of trade friction are urgent problems to be solved. In view of the United States and Britain has implement cyber security review to maintain national security for many years, it's no doubt that the research of mechanism behind the selection of top-level design, rules system and the reform trend have reference significance to the establishment of China's cyber security review mechanism.%采取必要措施不断提升信息技术产品与服务的安全性能,维护网络空间安全与秩序,是各国政府的应尽责任.中国已经明确提出建立实施网络安全审查制度,如何确立有效的安全审查体制机制,管控相应的安全风险,同时规避可能的贸易摩擦风险,是当前亟待解决的问题.鉴于美国与英国等国家已经在国家安全相关的领域,实行了类似安全审查的机制,考察这些机制背后的路径选择、顶层设计和规章体系,分析其变革趋势,在网络全球化日益深入的当下,无疑对中国网络安全审查机制的建立健全有参考意义.

  20. 76 FR 2151 - Assumption Buster Workshop: Defense-in-Depth is a Smart Investment for Cyber Security

    Science.gov (United States)

    2011-01-12

    ... day-long workshop on the pros and cons of the defense-in-depth strategy for cyber security. The... Technology Research and Development (NITRD) Program. ACTION: Call for participation. FOR FURTHER INFORMATION... Information Technology Research and Development (NITRD) Program on behalf of the SCORE Committee. Background...

  1. 76 FR 6637 - Assumption Buster Workshop: Defense-in-Depth Is a Smart Investment for Cyber Security

    Science.gov (United States)

    2011-02-07

    ... the pros and cons of the Defense-in-Depth strategy for cyber security. The workshop will be held March... Technology Research and Development (NITRD) Program. ACTION: Call for participation. FOR FURTHER INFORMATION... notice is issued by the National Coordination Office for the Networking and Information Technology...

  2. Cyber security level assignment for research reactor digital instrumentation and control system architecture using concept of defense in depth

    International Nuclear Information System (INIS)

    Shin, Jin Soo; Heo, Gyun Young; Son, Han Seong; Kim, Young Ki; Park, Jaek Wan

    2012-01-01

    Due to recent aging of the analog instrumentation of many nuclear power plants (NPPs) and research reactors, the system reliability decreases while maintenance and testing costs increase. In addition, it is difficult to find the substitutable analog equipment s due to obsolescence. Therefore, the instrumentation and control (I and C) systems have changed from analog system to digital system due to these facts. With the introduction of digital systems, research reactors are forced to care for the problem of cyber attacks because I and C systems have been digitalized using networks or communication systems. Especially, it is more issued at research reactors due to the accessibility of human resources. In the real world, an IBM researcher has been successful in controlling the software by penetrating a NPPs network in U.S. on July 2008 and acquiring the control right of nuclear facilities after one week. Moreover, the malignant code called 'stuxnet' impaired the nearly 1,000 centrifugal separators in Iran according to an IAEA report. The problem of cyber attacks highlights the important of cyber security, which should be emphasized. Defense.in.depth (DID) is a significant concept for the cyber security to work properly. DID institutes and maintains a hardy program for critical digital asset (CDA) by implementing multiple security boundaries. In this work, we assign cyber security levels to a typical digital I and C system using DID concept. This work is very useful in applying the concept of DID to nuclear industry with respect to cyber security

  3. Secure it now or secure it later: the benefits of addressing cyber-security from the outset

    Science.gov (United States)

    Olama, Mohammed M.; Nutaro, James

    2013-05-01

    The majority of funding for research and development (R&D) in cyber-security is focused on the end of the software lifecycle where systems have been deployed or are nearing deployment. Recruiting of cyber-security personnel is similarly focused on end-of-life expertise. By emphasizing cyber-security at these late stages, security problems are found and corrected when it is most expensive to do so, thus increasing the cost of owning and operating complex software systems. Worse, expenditures on expensive security measures often mean less money for innovative developments. These unwanted increases in cost and potential slowing of innovation are unavoidable consequences of an approach to security that finds and remediate faults after software has been implemented. We argue that software security can be improved and the total cost of a software system can be substantially reduced by an appropriate allocation of resources to the early stages of a software project. By adopting a similar allocation of R&D funds to the early stages of the software lifecycle, we propose that the costs of cyber-security can be better controlled and, consequently, the positive effects of this R&D on industry will be much more pronounced.

  4. Cyber security level assignment for research reactor digital instrumentation and control system architecture using concept of defense in depth

    Energy Technology Data Exchange (ETDEWEB)

    Shin, Jin Soo; Heo, Gyun Young [Kyung Hee University, Seoul (Korea, Republic of); Son, Han Seong [Joongbu Univ., Chungnam (Korea, Republic of); Kim, Young Ki; Park, Jaek Wan [KAERI, Daejeon (Korea, Republic of)

    2012-10-15

    Due to recent aging of the analog instrumentation of many nuclear power plants (NPPs) and research reactors, the system reliability decreases while maintenance and testing costs increase. In addition, it is difficult to find the substitutable analog equipment s due to obsolescence. Therefore, the instrumentation and control (I and C) systems have changed from analog system to digital system due to these facts. With the introduction of digital systems, research reactors are forced to care for the problem of cyber attacks because I and C systems have been digitalized using networks or communication systems. Especially, it is more issued at research reactors due to the accessibility of human resources. In the real world, an IBM researcher has been successful in controlling the software by penetrating a NPPs network in U.S. on July 2008 and acquiring the control right of nuclear facilities after one week. Moreover, the malignant code called 'stuxnet' impaired the nearly 1,000 centrifugal separators in Iran according to an IAEA report. The problem of cyber attacks highlights the important of cyber security, which should be emphasized. Defense.in.depth (DID) is a significant concept for the cyber security to work properly. DID institutes and maintains a hardy program for critical digital asset (CDA) by implementing multiple security boundaries. In this work, we assign cyber security levels to a typical digital I and C system using DID concept. This work is very useful in applying the concept of DID to nuclear industry with respect to cyber security.

  5. Development Methodology of a Cyber Security Risk Analysis and Assessment Tool for Digital I and C Systems in Nuclear Power Plant

    International Nuclear Information System (INIS)

    Cha, K. H.; Lee, C. K.; Song, J. G.; Lee, Y. J.; Kim, J. Y.; Lee, J. W.; Lee, D. Y.

    2011-01-01

    With the use of digital computers and communication networks the hot issues on cyber security were raised about 10 years ago. The scope of cyber security application has now been extended from the safety Instrumentation and Control (I and C) system to safety important systems, plant security system, and emergency preparedness system. Therefore, cyber security should be assessed and managed systematically throughout the development life cycle of I and C systems in order for their digital assets to be protected from cyber attacks. Fig. 1 shows the concept of a cyber security risk management of digital I and C systems in nuclear power plants (NPPs). A lot of cyber security risk assessment methods, techniques, and supported tools have been developed for Information Technology (IT) systems, but they have not been utilized widely for cyber security risk assessments of the digital I and C systems in NPPs. The main reason is a difference in goals between IT systems and nuclear I and C systems. Confidentiality is important in IT systems, but availability and integrity are important in nuclear I and C systems. Last year, it was started to develop a software tool to be specialized for the development process of nuclear I and C systems. This paper presents a development methodology of the Cyber Security Risk analysis and Assessment Tool (CSRAT) for the digital I and C systems in NPP

  6. Development Methodology of a Cyber Security Risk Analysis and Assessment Tool for Digital I and C Systems in Nuclear Power Plant

    Energy Technology Data Exchange (ETDEWEB)

    Cha, K. H.; Lee, C. K.; Song, J. G.; Lee, Y. J.; Kim, J. Y.; Lee, J. W.; Lee, D. Y. [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2011-05-15

    With the use of digital computers and communication networks the hot issues on cyber security were raised about 10 years ago. The scope of cyber security application has now been extended from the safety Instrumentation and Control (I and C) system to safety important systems, plant security system, and emergency preparedness system. Therefore, cyber security should be assessed and managed systematically throughout the development life cycle of I and C systems in order for their digital assets to be protected from cyber attacks. Fig. 1 shows the concept of a cyber security risk management of digital I and C systems in nuclear power plants (NPPs). A lot of cyber security risk assessment methods, techniques, and supported tools have been developed for Information Technology (IT) systems, but they have not been utilized widely for cyber security risk assessments of the digital I and C systems in NPPs. The main reason is a difference in goals between IT systems and nuclear I and C systems. Confidentiality is important in IT systems, but availability and integrity are important in nuclear I and C systems. Last year, it was started to develop a software tool to be specialized for the development process of nuclear I and C systems. This paper presents a development methodology of the Cyber Security Risk analysis and Assessment Tool (CSRAT) for the digital I and C systems in NPP

  7. Operations research, engineering, and cyber security trends in applied mathematics and technology

    CERN Document Server

    Rassias, Themistocles

    2017-01-01

    Mathematical methods and theories with interdisciplinary applications are presented in this book. The eighteen contributions presented in this Work have been written by eminent scientists; a few papers are based on talks which took place at the International Conference at the Hellenic Artillery School in May 2015. Each paper evaluates possible solutions to long-standing problems such as the solvability of the direct electromagnetic scattering problem, geometric approaches to cyber security, ellipsoid targeting with overlap, non-equilibrium solutions of dynamic networks, measuring ballistic dispersion, elliptic regularity theory for the numerical solution of variational problems, approximation theory for polynomials on the real line and the unit circle, complementarity and variational inequalities in electronics, new two-slope parameterized achievement scalarizing functions for nonlinear multiobjective optimization, and strong and weak convexity of closed sets in a Hilbert space. Graduate students, scientists,...

  8. Combining Traditional Cyber Security Audit Data with Psychosocial Data: Towards Predictive Modeling for Insider Threat Mitigation

    Science.gov (United States)

    Greitzer, Frank L.; Frincke, Deborah A.

    The purpose of this chapter is to motivate the combination of traditional cyber security audit data with psychosocial data, to support a move from an insider threat detection stance to one that enables prediction of potential insider presence. Twodistinctiveaspects of the approach are the objectiveof predicting or anticipating potential risksandthe useoforganizational datain additiontocyber datato support the analysis. The chapter describes the challenges of this endeavor and reports on progressin definingausablesetof predictiveindicators,developingaframeworkfor integratingthe analysisoforganizationalandcyber securitydatatoyield predictions about possible insider exploits, and developing the knowledge base and reasoning capabilityof the system.We also outline the typesof errors that oneexpectsina predictive system versus a detection system and discuss how those errors can affect the usefulness of the results.

  9. A Cyber Security Risk Assessment Procedure for Digital I and C Systems in NPPs

    International Nuclear Information System (INIS)

    Song, J. G.; Lee, J. W.; Lee, C. K.; Kwon, K. C.; Lee, D. Y.

    2011-01-01

    Digital Instrumentation and Control (I and C) systems in nuclear power plants (NPPs) use general digital technologies similar to those used in IT systems. However, one of significant differences between the two systems resides in the duration of their service life. The I and C systems in NPPs operate for more than 20 years. IT systems, on the other hand, are in service for about 3 to 5 years. Hence, a one-time risk assessment for IT systems is normally acceptable. In contrast, the risk assessment for the I and C systems in NPPs should be recursively performed during their longer operation life. A recursive procedure for cyber security risk assessment of the I and C systems in NPPs is studied and proposed in this paper

  10. Computer Security: Protect your plant: a "serious game" about control system cyber-security

    CERN Multimedia

    Stefan Lueders, Computer Security Team

    2015-01-01

    Control system cyber-security is attracting increasing attention: from cybercriminals, from the media and from security researchers.   After the legendary “Stuxnet” attacks of 2010 against an Iranian uranium enrichment plant, the infiltration of Saudi Aramco in 2012, and most recently the hacking of German blast furnaces, we should be prepared. Just imagine what would happen if hackers turned off the lights in Geneva and the Pays-de-Gex for a month? (“Hacking control systems, switching lights off!"). Or if attackers infiltrated CERN’s accelerator or experiment control systems and stopped us from pursuing our core business: delivering beams and recording particle collisions (“Hacking control systems, switching... accelerators off?"). Now you can test your ability to protect an industrial plant against cyber-threats! The Computer Security Team, in collaboration with Kaspersky Lab, is organising a so-...

  11. Cyber Security for the Spaceport Command and Control System: Vulnerability Management and Compliance Analysis

    Science.gov (United States)

    Gunawan, Ryan A.

    2016-01-01

    With the rapid development of the Internet, the number of malicious threats to organizations is continually increasing. In June of 2015, the United States Office of Personnel Management (OPM) had a data breach resulting in the compromise of millions of government employee records. The National Aeronautics and Space Administration (NASA) is not exempt from these attacks. Cyber security is becoming a critical facet to the discussion of moving forward with projects. The Spaceport Command and Control System (SCCS) project at the Kennedy Space Center (KSC) aims to develop the launch control system for the next generation launch vehicle in the coming decades. There are many ways to increase the security of the network it uses, from vulnerability management to ensuring operating system images are compliant with securely configured baselines recommended by the United States Government.

  12. Real time test bed development for power system operation, control and cyber security

    Science.gov (United States)

    Reddi, Ram Mohan

    The operation and control of the power system in an efficient way is important in order to keep the system secure, reliable and economical. With advancements in smart grid, several new algorithms have been developed for improved operation and control. These algorithms need to be extensively tested and validated in real time before applying to the real electric power grid. This work focuses on the development of a real time test bed for testing and validating power system control algorithms, hardware devices and cyber security vulnerability. The test bed developed utilizes several hardware components including relays, phasor measurement units, phasor data concentrator, programmable logic controllers and several software tools. Current work also integrates historian for power system monitoring and data archiving. Finally, two different power system test cases are simulated to demonstrate the applications of developed test bed. The developed test bed can also be used for power system education.

  13. A Cyber Security Risk Assessment Procedure for Digital I and C Systems in NPPs

    Energy Technology Data Exchange (ETDEWEB)

    Song, J. G.; Lee, J. W.; Lee, C. K.; Kwon, K. C.; Lee, D. Y. [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2011-10-15

    Digital Instrumentation and Control (I and C) systems in nuclear power plants (NPPs) use general digital technologies similar to those used in IT systems. However, one of significant differences between the two systems resides in the duration of their service life. The I and C systems in NPPs operate for more than 20 years. IT systems, on the other hand, are in service for about 3 to 5 years. Hence, a one-time risk assessment for IT systems is normally acceptable. In contrast, the risk assessment for the I and C systems in NPPs should be recursively performed during their longer operation life. A recursive procedure for cyber security risk assessment of the I and C systems in NPPs is studied and proposed in this paper

  14. Towards an integrated defense system for cyber security situation awareness experiment

    Science.gov (United States)

    Zhang, Hanlin; Wei, Sixiao; Ge, Linqiang; Shen, Dan; Yu, Wei; Blasch, Erik P.; Pham, Khanh D.; Chen, Genshe

    2015-05-01

    In this paper, an implemented defense system is demonstrated to carry out cyber security situation awareness. The developed system consists of distributed passive and active network sensors designed to effectively capture suspicious information associated with cyber threats, effective detection schemes to accurately distinguish attacks, and network actors to rapidly mitigate attacks. Based on the collected data from network sensors, image-based and signals-based detection schemes are implemented to detect attacks. To further mitigate attacks, deployed dynamic firewalls on hosts dynamically update detection information reported from the detection schemes and block attacks. The experimental results show the effectiveness of the proposed system. A future plan to design an effective defense system is also discussed based on system theory.

  15. Anticipatory Cyber Security Research: An Ultimate Technique for the First-Move Advantage

    Directory of Open Access Journals (Sweden)

    Bharat S.Rawal

    2016-02-01

    Full Text Available Across all industry segments, 96 percent of systems could be breached on average. In the game of cyber security, every moment a new player (attacker is entering the game with new skill sets. An attacker only needs to be effective once while defenders of cyberspace have to be successful all of the time. There will be a first-mover advantage in such a chasing game, which means that the first move often wins. In this paper, in order to face the security challenges brought in by attacker’s first move advantage, we analyzed the past ten years of cyber-attacks, studied the immediate attack’s pattern and offer the tools to predict the next move of the cyber attacker.

  16. INDUSTRIAL CONTROL SYSTEM CYBER SECURITY: QUESTIONS AND ANSWERS RELEVANT TO NUCLEAR FACILITIES, SAFEGUARDS AND SECURITY

    Energy Technology Data Exchange (ETDEWEB)

    Robert S. Anderson; Mark Schanfein; Trond Bjornard; Paul Moskowitz

    2011-07-01

    Typical questions surrounding industrial control system (ICS) cyber security always lead back to: What could a cyber attack do to my system(s) and; how much should I worry about it? These two leading questions represent only a fraction of questions asked when discussing cyber security as it applies to any program, company, business, or organization. The intent of this paper is to open a dialog of important pertinent questions and answers that managers of nuclear facilities engaged in nuclear facility security and safeguards should examine, i.e., what questions should be asked; and how do the answers affect an organization's ability to effectively safeguard and secure nuclear material. When a cyber intrusion is reported, what does that mean? Can an intrusion be detected or go un-noticed? Are nuclear security or safeguards systems potentially vulnerable? What about the digital systems employed in process monitoring, and international safeguards? Organizations expend considerable efforts to ensure that their facilities can maintain continuity of operations against physical threats. However, cyber threats particularly on ICSs may not be well known or understood, and often do not receive adequate attention. With the disclosure of the Stuxnet virus that has recently attacked nuclear infrastructure, many organizations have recognized the need for an urgent interest in cyber attacks and defenses against them. Several questions arise including discussions about the insider threat, adequate cyber protections, program readiness, encryption, and many more. These questions, among others, are discussed so as to raise the awareness and shed light on ways to protect nuclear facilities and materials against such attacks.

  17. Industrial Control System Cyber Security: Questions And Answers Relevant To Nuclear Facilities, Safeguards And Security

    International Nuclear Information System (INIS)

    Anderson, Robert S.; Schanfein, Mark; Bjornard, Trond; Moskowitz, Paul

    2011-01-01

    Typical questions surrounding industrial control system (ICS) cyber security always lead back to: What could a cyber attack do to my system(s) and; how much should I worry about it? These two leading questions represent only a fraction of questions asked when discussing cyber security as it applies to any program, company, business, or organization. The intent of this paper is to open a dialog of important pertinent questions and answers that managers of nuclear facilities engaged in nuclear facility security and safeguards should examine, i.e., what questions should be asked; and how do the answers affect an organization's ability to effectively safeguard and secure nuclear material. When a cyber intrusion is reported, what does that mean? Can an intrusion be detected or go un-noticed? Are nuclear security or safeguards systems potentially vulnerable? What about the digital systems employed in process monitoring, and international safeguards? Organizations expend considerable efforts to ensure that their facilities can maintain continuity of operations against physical threats. However, cyber threats particularly on ICSs may not be well known or understood, and often do not receive adequate attention. With the disclosure of the Stuxnet virus that has recently attacked nuclear infrastructure, many organizations have recognized the need for an urgent interest in cyber attacks and defenses against them. Several questions arise including discussions about the insider threat, adequate cyber protections, program readiness, encryption, and many more. These questions, among others, are discussed so as to raise the awareness and shed light on ways to protect nuclear facilities and materials against such attacks.

  18. An Attack Model Development Process for the Cyber Security of Safety Related Nuclear Digital I and C Systems

    Energy Technology Data Exchange (ETDEWEB)

    Khand, Parvaiz Ahmed; Seong, Poong Hyun [Korea Advanced Institute of Science and Technology, Daejeon (Korea, Republic of)

    2007-10-15

    as a root node and different ways to achieve that attack as leaf nodes. The structure, syntax and semantics of attack trees can be seen in. In attack trees, the leaf nodes can take many kinds of values to evaluate different aspects of system security. For example, the possible/impossible value can be assigned to enumerate all sets of possible attacks that achieve the attack goal, probability values to evaluate the probability that the attack goal can be achieved, cost value to evaluate the minimum cost needed to reach attack goal, and the special equipment value to obtain the most probable attack sets with no special equipment required. Although it is possible to implement security controls almost any type of attack, it is not practical to protect everything. Attack trees also provide a systematic way to model security controls and plant specific procedures as a safeguard against attacks, and check their effectiveness. In this paper, we will present a process for developing an attack model for the cyber security of safety related nuclear digital I and C systems using attack trees.

  19. An Attack Model Development Process for the Cyber Security of Safety Related Nuclear Digital I and C Systems

    International Nuclear Information System (INIS)

    Khand, Parvaiz Ahmed; Seong, Poong Hyun

    2007-01-01

    root node and different ways to achieve that attack as leaf nodes. The structure, syntax and semantics of attack trees can be seen in. In attack trees, the leaf nodes can take many kinds of values to evaluate different aspects of system security. For example, the possible/impossible value can be assigned to enumerate all sets of possible attacks that achieve the attack goal, probability values to evaluate the probability that the attack goal can be achieved, cost value to evaluate the minimum cost needed to reach attack goal, and the special equipment value to obtain the most probable attack sets with no special equipment required. Although it is possible to implement security controls almost any type of attack, it is not practical to protect everything. Attack trees also provide a systematic way to model security controls and plant specific procedures as a safeguard against attacks, and check their effectiveness. In this paper, we will present a process for developing an attack model for the cyber security of safety related nuclear digital I and C systems using attack trees

  20. You Outsource the Service but Not the Risk: Supply Chain Risk Management for the Cyber Security of Safety Critical Systems

    OpenAIRE

    Johnson, Chris W.

    2016-01-01

    Companies increasingly form interdependent relationships between contractors and sub-contractors that extend\\ud across national borders and legal jurisdictions. In consequence, supply chain risk management (SCRM) is an\\ud increasing concern for the cyber security of safety-critical systems. The following pages argue that outsourcing\\ud undermines SCRM by eroding technical expertise, which companies need to select and audit their suppliers. They\\ud are still held accountable when the failure o...

  1. Closing the Cyber Gap: Integrating Cross-Government Cyber Capabilities to Support the DHS Cyber Security Mission

    Science.gov (United States)

    2014-12-01

    identifies and eliminates the actors who seek to target our cyber 152 “2013 Data Breach Investigations Report,” Verizon Enterprise Solutions, accessed...future. 360 “2013 Data Breach Investigations Report,” Verizon Enterprise Solutions, accessed September 29, 2013, http://www.verizonenterprise.com/DBIR...critical system owners and worldwide cyber security teams.382 381 Data Breach on the Rise: Protecting Personal Information from Harm: Hearing

  2. Cyber-security: industrials must stop denying the risk of cyber-attacks

    International Nuclear Information System (INIS)

    Hausermann, L.

    2015-01-01

    The risk of cyber-attacks of industrial sites is real. Recently the Anvers port and the Bakou-Tbilissi-Ceyhan pipeline have been attacked. In both cases hackers succeeded: they were able to track sea containers in which drug was concealed and recover it in the Anvers port and in the case of the pipeline the hackers took control of the control system and were able to trigger a huge explosion by shunning security systems and allowing damaging pressure surges. The massive use of digital systems and of automated systems in various industrial sectors has led to huge network of inter-connected smart devices whose purpose is not to process data but to monitor and control. All these devices and equipment are controlled by software whose weaknesses and fault lines multiply the risk of cyber-attacks even for 'closed' networks. While the total hacking of a nuclear power plant is highly unlikely, real threats exist and must be taken into account. Innovative solutions based on the mapping of the fluxes of the system and combined with an inventory of all its weaknesses may pave the way towards cyber-security. (A.C.)

  3. Improving Student Engagement in the Study of Professional Ethics: Concepts and an Example in Cyber Security.

    Science.gov (United States)

    Bustard, John D

    2018-04-01

    In spite of the acknowledged importance of professional ethics, technical students often show little enthusiasm for studying the subject. This paper considers how such engagement might be improved. Four guiding principles for promoting engagement are identified: (1) aligning teaching content with student interests; (2) taking a pragmatic rather than a philosophical approach to issue resolution; (3) addressing the full complexity of real-world case studies; and (4) covering content in a way that students find entertaining. The use of these principles is then discussed with respect to the specific experience of developing and presenting a master's module in Ethical and Legal Issues in Cyber Security at Queens University Belfast. One significant aspect of the resulting design is that it encourages students to see ethical issues in systemic terms rather than from an individual perspective, with issues emerging from a conflict between different groups with different vested interests. Case studies are used to examine how personal and business priorities create conflicts that can lead to negative press, fines and punitive legal action. The module explores the reasons why organisations may be unaware of the risks associated with their actions and how an inappropriate response to an ethical issue can significantly aggravate a situation. The module has been delivered in three successive years since 2014 and been well received on each occasion. The paper describes the design of the module and the experience of delivering it, concluding with a discussion of the effectiveness of the approach.

  4. Cyber Security Threats to Safety-Critical, Space-Based Infrastructures

    Science.gov (United States)

    Johnson, C. W.; Atencia Yepez, A.

    2012-01-01

    Space-based systems play an important role within national critical infrastructures. They are being integrated into advanced air-traffic management applications, rail signalling systems, energy distribution software etc. Unfortunately, the end users of communications, location sensing and timing applications often fail to understand that these infrastructures are vulnerable to a wide range of security threats. The following pages focus on concerns associated with potential cyber-attacks. These are important because future attacks may invalidate many of the safety assumptions that support the provision of critical space-based services. These safety assumptions are based on standard forms of hazard analysis that ignore cyber-security considerations This is a significant limitation when, for instance, security attacks can simultaneously exploit multiple vulnerabilities in a manner that would never occur without a deliberate enemy seeking to damage space based systems and ground infrastructures. We address this concern through the development of a combined safety and security risk assessment methodology. The aim is to identify attack scenarios that justify the allocation of additional design resources so that safety barriers can be strengthened to increase our resilience against security threats.

  5. Cyber Security in Industrial Control Systems and SCADA Applications: Modbus TCP Protocol Example

    Directory of Open Access Journals (Sweden)

    Erdal IRMAK

    2017-12-01

    Full Text Available Electrical energy generation, transmission and distribution systems are evaluated in terms of national security dimension and defined as critical infrastructures. Monitoring and controlling of these systems is provided by Industrial Control Systems (ICS or Supervisory Control and Data Acquisition (SCADA systems. According to the latest advances in communication and internet technology, ICS/SCADA systems have started to become integrated with these systems. As a result of this situation, current or existing vulnerabilities in information and communication technology affect to SCADA systems directly. Therefore, this paper focuses on the cyber security of ICS/SCADA systems. It has been proved that the lack of authentication detected in Modbus TCP protocol, one of the most used in ICS/SCADA systems, can be exploited. In order to solve this security issue, a software is developed using the Python programming language for blocking or mitigating the cyber attacks. The proposed solution is subjected to several tests and results show that the attacks can be prevented successfully. Thus, it is considered that the proposed work will contribute to the security of ICS/SCADA systems and the industrial protocols using for communicating these systems.

  6. Design of cyber security awareness game utilizing a social media framework

    CSIR Research Space (South Africa)

    Labuschagne, WA

    2011-08-01

    Full Text Available Social networking sites are a popular medium of interaction and communication. Social networking sites provide the ability to run applications and games to test users’ knowledge. The popularity of social networks makes it an ideal tool through which...

  7. Evaluating U.S. and Chinese Cyber Security Strategies Within a Cultural Framework

    Science.gov (United States)

    2016-04-01

    analysis of Chinese culture in warfare studies. They find that Chinese convention “respects inaction”28 and the teachings of Sun Tzu , thus favoring the...15 Bibliography ...AY16 16 Bibliography Ehsan Ahrari. “Transformation of America’s Military and Asymmetric War.” Comparative Strategy 29, no. 3 (2010): 223-244

  8. ATLAS Future Framework Requirements Group Report

    CERN Document Server

    The ATLAS collaboration

    2016-01-01

    The Future Frameworks Requirements Group was constituted in Summer 2013 to consider and summarise the framework requirements from trigger and offline for configuring, scheduling and monitoring the data processing software needed by the ATLAS experiment. The principal motivation for such a re-examination arises from the current and anticipated evolution of CPUs, where multiple cores, hyper-threading and wide vector registers require a shift to a concurrent programming model. Such a model requires extensive changes in the current Gaudi/Athena frameworks and offers the opportunity to consider how HLT and offline processing can be better accommodated within the ATLAS framework. This note contains the report of the Future Frameworks Requirements Group.

  9. Digital I and C and Cyber Security for Nuclear Power Plants

    International Nuclear Information System (INIS)

    An, Yong Kyu; Chen, Daniel; Kalbarczyk, Zbigniew; Sollima, Calogero; Uddin, Rizwan

    2014-01-01

    studies being carried out using this test bed for digital I and C for NPPs. Potential future use of the test bed includes cyber security tests of digital I and C systems for NPPs, stability analysis of NPP test bed connected to a simulator of the electric grid, and human machine interface and human factor engineering studies of newly developed control rooms for NPPs

  10. Digital I and C and Cyber Security for Nuclear Power Plants

    Energy Technology Data Exchange (ETDEWEB)

    An, Yong Kyu; Chen, Daniel; Kalbarczyk, Zbigniew; Sollima, Calogero; Uddin, Rizwan [University of Illinois at Urbana-Champaign, Urbana (United States)

    2014-08-15

    studies being carried out using this test bed for digital I and C for NPPs. Potential future use of the test bed includes cyber security tests of digital I and C systems for NPPs, stability analysis of NPP test bed connected to a simulator of the electric grid, and human machine interface and human factor engineering studies of newly developed control rooms for NPPs.

  11. Suggestions on cyber security talents cultivation%网络空间安全人才培养的规划建议

    Institute of Scientific and Technical Information of China (English)

    张宏莉; 于海宁; 翟健宏; 余翔湛

    2016-01-01

    Talent competition is the core content ofcyber security competition. Firstly, the definitions and character-istics of cyber security were introduced. Then, the development status of international cyber security talents cultiva-tion were analyzed, and the main problems existing in cyber security talents cultivation were pointed out. Finally, based on national significant strategy, suggestions on cyber security talents cultivation to explore a sophisticated ar-chitecture were proposed, which refer to the national overall planning, academic education, vocational training and certification, genius discovery and cultivation.%网络空间安全竞争的核心是人才的竞争。首先介绍了网络空间安全的内涵和特点,分析了目前国际上网络空间安全人才的培养现状。然后,指出了我国网络空间安全人才培养中存在的主要问题。最后,面向国家在网络空间安全人才建设方面的重大战略需求,从国家统筹规划、学历教育、职业培训与认证、专才发现与培养等4个方面给出了规划建议,以探索完善我国网络空间安全人才培养体系。

  12. 1st International Workshop on Search and Mining Terrorist Online Content and Advances in Data Science for Cyber Security and Risk on the Web

    OpenAIRE

    Tsikrika, T.; Vrochidis, S.; Akhgar, B.; Burnap, P.; Katos, Vasilis; Williams, M.L.

    2017-01-01

    The deliberate misuse of technical infrastructure (including the Web and social media) for cyber deviant and cybercriminal behaviour, ranging from the spreading of extremist and terrorism-related material to online fraud and cyber security attacks, is on the rise. This workshop aims to better understand such phenomena and develop methods for tackling them in an effective and efficient manner. The workshop brings together interdisciplinary researchers and experts in Web search, security inform...

  13. Study on Cyber-security Strategy and National Cyberspace Sovereignty%论网络安全战略与国家网络主权

    Institute of Scientific and Technical Information of China (English)

    邹鹏; 朱诗兵; 邹红霞

    2017-01-01

    While national interests increasingly extending with the development of cyberspace, cyberspace sovereignty and its guarantee have drawn wide attention from international communities and major countries have developed space-security strategy to safeguard their national cyberspace sovereignty.This paper analyzes the relationship between the cyberspace sovereignty and cyber-security as well as summarizes the characteristics of existing cyber-security strategies in the world.In view of protecting our national cyberspace sovereignty, it points out the issues we should pay more attention to in the formulation and implementation of cyber-security strategy which include taking national security as the starting point, taking cyberspace sovereignty as the fundament, perfecting relevant law and regulation systems, improving relevant systems, mechanisms and the support systems, accelerating the development of core technologies in cyber-security and strengthening the cyber-security training.%随着网络空间承载的国家利益日益广泛,网络主权及其保障问题引起了国际社会的高度重视,世界主要国家纷纷通过制定网络安全战略来维护本国网络主权.分析了世界各国对网络主权保护的态度及网络主权与网络安全的关系,综述了世界各国现有网络安全战略的特点.从保护我国国家网络主权的实际需求出发,指出了我国在网络安全战略的制定和实施中应当重点关注的问题,即以总体国家安全观为根本出发点、以网络主权为基本依据、健全相关法律法规体系、健全体制机制和保障力量体系、加快推进网络安全核心技术发展以及加强网络安全人才培养.

  14. Empirical Testing of the CySeMoL Tool for Cyber Security Assessment – Case Study of Linux Server and MySQL

    OpenAIRE

    Rabbani, Talvia

    2016-01-01

    In this Master Thesis, several common applications used with MySQL and Linux server are modelled using the Enterprise Architecture Analysis Tool (EAAT) and the Cyber Security Modelling Language (CySeMoL), both developed by the Department of Industrial Information and Control System (ICS) at KTH. The objective of this study is to use the CySeMoL tool to evaluate the feasibility and correctness of the tool by simulating some particular type of attacks on a real life Linux server. A few common a...

  15. Cyber-security Considerations for Real-Time Physiological Status Monitoring: Threats, Goals, and Use Cases

    Science.gov (United States)

    2016-11-01

    Simon and Speck require a fraction of the power that optimized AES cores do for equivalent encryption strength [20]. Similarly, the SoK literature...study evaluates several BAN-specific au- 3To put this in context, according to [10], the amount of power it takes certain AES circuitry to encrypt a 29... encryption ) — Data should only be readable to properly authenticated and authorized components of our system. Parties outside our BAN should not be able to

  16. Selection of the best security controls for rapid development of enterprise-level cyber security

    OpenAIRE

    Tytarenko, Oleksandr

    2017-01-01

    Approved for public release; distribution is unlimited State-supported cyber attacks, cyber espionage campaigns, and hacktivist movements have forced many states to accelerate their cyber defense development in order to achieve at least a minimum level of protection against expanding threats of cyber space. As with any other development effort, cyber capability development requires resources of time, money, and people, which in most cases are very restricted. To rapidly build up the first ...

  17. An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System

    Directory of Open Access Journals (Sweden)

    Halima Ibrahim Kure

    2018-05-01

    Full Text Available A cyber-physical system (CPS is a combination of physical system components with cyber capabilities that have a very tight interconnectivity. CPS is a widely used technology in many applications, including electric power systems, communications, and transportation, and healthcare systems. These are critical national infrastructures. Cybersecurity attack is one of the major threats for a CPS because of many reasons, including complexity and interdependencies among various system components, integration of communication, computing, and control technology. Cybersecurity attacks may lead to various risks affecting the critical infrastructure business continuity, including degradation of production and performance, unavailability of critical services, and violation of the regulation. Managing cybersecurity risks is very important to protect CPS. However, risk management is challenging due to the inherent complex and evolving nature of the CPS system and recent attack trends. This paper presents an integrated cybersecurity risk management framework to assess and manage the risks in a proactive manner. Our work follows the existing risk management practice and standard and considers risks from the stakeholder model, cyber, and physical system components along with their dependencies. The approach enables identification of critical CPS assets and assesses the impact of vulnerabilities that affect the assets. It also presents a cybersecurity attack scenario that incorporates a cascading effect of threats and vulnerabilities to the assets. The attack model helps to determine the appropriate risk levels and their corresponding mitigation process. We present a power grid system to illustrate the applicability of our work. The result suggests that risk in a CPS of a critical infrastructure depends mainly on cyber-physical attack scenarios and the context of the organization. The involved risks in the studied context are both from the technical and

  18. Assessment and testing of industrial devices robustness against cyber security attacks

    International Nuclear Information System (INIS)

    Tilaro, F.; Copy, B.

    2012-01-01

    CERN (European Organization for Nuclear Research),like any organization, needs to achieve the conflicting objectives of connecting its operational network to Internet while at the same time keeping its industrial control systems secure from external and internal cyber attacks. Devices robustness represents a key link in the defense-in-depth concept as some attacks will inevitably penetrate security boundaries and thus require further protection measures. CERN - in collaboration with Siemens - has designed and implemented a dedicated working environment, the Test-bench for Robustness of Industrial Equipment. Such tests attempt to detect possible anomalies by exploiting corrupt communication channels and manipulating the normal behavior of the communication protocols, in the same way as a cyber attacker would proceed. Our approach consists of analyzing protocol implementations by injecting malformed PDUs (Protocol Data Unit) to corrupt the normal behaviour of the system. As a PDU typically has many fields, the number of possible syntactically faulty PDUs grows exponentially with the number of fields. In this document, we proposed a strategy to explore this huge test domain using a hybrid approach of fuzzing and syntax techniques, specifically developed to evaluate industrial device communication robustness. So far, not all the tests can be integrated into automatic tools, human analysis and management is necessary to discover and investigate specific possible failures

  19. Analyzing Cyber Security Threats on Cyber-Physical Systems Using Model-Based Systems Engineering

    Science.gov (United States)

    Kerzhner, Aleksandr; Pomerantz, Marc; Tan, Kymie; Campuzano, Brian; Dinkel, Kevin; Pecharich, Jeremy; Nguyen, Viet; Steele, Robert; Johnson, Bryan

    2015-01-01

    The spectre of cyber attacks on aerospace systems can no longer be ignored given that many of the components and vulnerabilities that have been successfully exploited by the adversary on other infrastructures are the same as those deployed and used within the aerospace environment. An important consideration with respect to the mission/safety critical infrastructure supporting space operations is that an appropriate defensive response to an attack invariably involves the need for high precision and accuracy, because an incorrect response can trigger unacceptable losses involving lives and/or significant financial damage. A highly precise defensive response, considering the typical complexity of aerospace environments, requires a detailed and well-founded understanding of the underlying system where the goal of the defensive response is to preserve critical mission objectives in the presence of adversarial activity. In this paper, a structured approach for modeling aerospace systems is described. The approach includes physical elements, network topology, software applications, system functions, and usage scenarios. We leverage Model-Based Systems Engineering methodology by utilizing the Object Management Group's Systems Modeling Language to represent the system being analyzed and also utilize model transformations to change relevant aspects of the model into specialized analyses. A novel visualization approach is utilized to visualize the entire model as a three-dimensional graph, allowing easier interaction with subject matter experts. The model provides a unifying structure for analyzing the impact of a particular attack or a particular type of attack. Two different example analysis types are demonstrated in this paper: a graph-based propagation analysis based on edge labels, and a graph-based propagation analysis based on node labels.

  20. Enhancing the cyber-security of smart grids with applications to synchrophasor data

    Science.gov (United States)

    Pal, Seemita

    packet-drops and finally detect attacks, if any. In the case of PMU data manipulation attacks, the attacker may modify the data in the PMU packets in order to bias the system states and influence the control center into taking wrong decisions. The proposed detection technique is based on evaluating the equivalent impedances of the transmission lines and classifying the observed anomalies to determine the presence of attack and its location. The scheme for detecting data integrity attacks on SCADA systems is based on utilizing synchrophasor measurements from available PMUs in the grid. The proposed method uses a difference measure, developed in this thesis, to determine the relative divergence and mis-correlation between the datasets. Based on the estimated difference measure, tampered and genuine data can be distinguished. The proposed detection mechanisms have demonstrated high accuracy in real-time detection of attacks of various magnitudes, simulated on real PMU data obtained from the NY grid. By performing alarm clustering, the occurrence of false alarms has been reduced to almost zero. The solutions are computationally inexpensive, low on cost, do not add any overhead, and do not require any feedback from the network.

  1. A closed-loop based framework for design requirement management

    DEFF Research Database (Denmark)

    Zhang, Zhinan; Li, Xuemeng; Liu, Zelin

    2014-01-01

    management from product lifecycle, and requirement and requirement management lifecycle views. This paper highlights the importance of requirement lifecycle management and aims at closing the requirement information loop in product lifecycle. Then, it addresses the requirement management in engineering...... design field with focusing on the dynamics nature and incomplete nature of requirements. Finally, a closed-loop based framework is proposed for requirement management in engineering design....

  2. CYBER SECURITY FOR AIRPORTS

    OpenAIRE

    Kasthurirangan Gopalakrishnan; Manimaran Govindarasu; Doug W. Jacobson; Brent M. Phares

    2013-01-01

    In today’s information age, government organizations and business enterprises are heavily relying on interconnected computer systems to manage a variety of public services including energy, transportation, water, etc. While this increased connectivity has many operational advantages benefitting the public, they have also become vulnerable to cyber attacks such as Corporate Security Breaches, Spear Phishing, and Social Media Fraud. The aviation sector is one the critical infrastructure systems...

  3. Cyber security policy guidebook

    CERN Document Server

    Bayuk, nifer L; Rohmeyer, l; Sachs, cus; Schmidt, frey; Weiss, eph

    2012-01-01

    This book is a taxonomy and thesaurus of current cybersecurity policy issues, including a thorough description of each issue and a corresponding list of pros and cons with respect to identified stances on each issue. It documents policy alternatives for the sake of clarity with respect to policy alone, and dives into organizational implementation issues. Without using technical jargon, the book emphasizes the importance of critical and analytical thinking when making policy decisions.  It also equips the reader with descriptions of the impact of specific policy ch

  4. Cyber security risk management: public policy implications of correlated risk, imperfect ability to prove loss, and observability of self-protection.

    Science.gov (United States)

    Oğüt, Hulisi; Raghunathan, Srinivasan; Menon, Nirup

    2011-03-01

    The correlated nature of security breach risks, the imperfect ability to prove loss from a breach to an insurer, and the inability of insurers and external agents to observe firms' self-protection efforts have posed significant challenges to cyber security risk management. Our analysis finds that a firm invests less than the social optimal levels in self-protection and in insurance when risks are correlated and the ability to prove loss is imperfect. We find that the appropriate social intervention policy to induce a firm to invest at socially optimal levels depends on whether insurers can verify a firm's self-protection levels. If self-protection of a firm is observable to an insurer so that it can design a contract that is contingent on the self-protection level, then self-protection and insurance behave as complements. In this case, a social planner can induce a firm to choose the socially optimal self-protection and insurance levels by offering a subsidy on self-protection. We also find that providing a subsidy on insurance does not provide a similar inducement to a firm. If self-protection of a firm is not observable to an insurer, then self-protection and insurance behave as substitutes. In this case, a social planner should tax the insurance premium to achieve socially optimal results. The results of our analysis hold regardless of whether the insurance market is perfectly competitive or not, implying that solely reforming the currently imperfect insurance market is insufficient to achieve the efficient outcome in cyber security risk management. © 2010 Society for Risk Analysis.

  5. A vulnerability-centric requirements engineering framework : Analyzing security attacks, countermeasures, and requirements based on vulnerabilities

    NARCIS (Netherlands)

    Elahi, G.; Yu, E.; Zannone, N.

    2010-01-01

    Many security breaches occur because of exploitation of vulnerabilities within the system. Vulnerabilities are weaknesses in the requirements, design, and implementation, which attackers exploit to compromise the system. This paper proposes a methodological framework for security requirements

  6. Framework of the NPP I and C Security for Regulatory Guidance

    International Nuclear Information System (INIS)

    Kim, Young Mi; Jeong, Choong Heui

    2013-01-01

    I and C (Instrumentation and control) systems which have computers are a critical part of the safety and security at nuclear facilities. As the use of computers in I and C continue to grow, so does the target for cyber-attack. They include desktop computers, mainframe systems, servers, network devices, embedded systems and programmable logic controllers (PLSs) and other digital computer systems. As the Stuxnet malware shows, I and C systems of the NPPs are no longer safe from the threat of cyber-attacks. These digital I and C systems must be protected from the cyber-attacks. This paper presents framework of the NPP I and C security for regulatory guidance. KINS regulatory guideline 8.22 has been applied to new and operation nuclear power plants. This guideline refers the applicable scope of the cyber security activities, cyber security policies and security plans, and assessments of cyber security and execution of the cyber security activities. Newly developed guideline will be helpful for implement security control to ensure safe operation of NPP I and C systems

  7. Framework of the NPP I and C Security for Regulatory Guidance

    Energy Technology Data Exchange (ETDEWEB)

    Kim, Young Mi; Jeong, Choong Heui [Korea Institute of Nuclear Safety, Daejeon (Korea, Republic of)

    2013-10-15

    I and C (Instrumentation and control) systems which have computers are a critical part of the safety and security at nuclear facilities. As the use of computers in I and C continue to grow, so does the target for cyber-attack. They include desktop computers, mainframe systems, servers, network devices, embedded systems and programmable logic controllers (PLSs) and other digital computer systems. As the Stuxnet malware shows, I and C systems of the NPPs are no longer safe from the threat of cyber-attacks. These digital I and C systems must be protected from the cyber-attacks. This paper presents framework of the NPP I and C security for regulatory guidance. KINS regulatory guideline 8.22 has been applied to new and operation nuclear power plants. This guideline refers the applicable scope of the cyber security activities, cyber security policies and security plans, and assessments of cyber security and execution of the cyber security activities. Newly developed guideline will be helpful for implement security control to ensure safe operation of NPP I and C systems.

  8. Requirements for a Next Generation Framework: ATLAS Experience

    CERN Document Server

    Kama, Sami; The ATLAS collaboration

    2015-01-01

    The challenge faced by HEP experiments from the current and expected architectural evolution of CPUs and co-processors is how to successfully exploit concurrency and keep memory consumption within reasonable limits. This is a major change from frameworks which were designed for serial event processing on single core processors in the 2000s. ATLAS has recently considered this problem in some detail through its Future Frameworks Requirements group. Here we report on the major considerations of the group, which was charged with considering the best strategies to exploit current and anticipated CPU technologies. The group has re-examined the basic architecture of event processing and considered how the building blocks of a framework (algorithms, services, tools and incidents) should evolve. The group has also had to take special care to ensure that the use cases of the ATLAS high level trigger are encompassed, which differ in important ways from offline event processing (for example, 99% of events are rejected, w...

  9. A Framework for Systematic Refinement of Trustworthiness Requirements

    Directory of Open Access Journals (Sweden)

    Nazila Gol Mohammadi

    2017-04-01

    Full Text Available The trustworthiness of systems that support complex collaborative business processes is an emergent property. In order to address users’ trust concerns, trustworthiness requirements of software systems must be elicited and satisfied. The aim of this paper is to address the gap that exists between end-users’ trust concerns and the lack of implementation of proper trustworthiness requirements. New technologies like cloud computing bring new capabilities for hosting and offering complex collaborative business operations. However, these advances might bring undesirable side effects, e.g., introducing new vulnerabilities and threats caused by collaboration and data exchange over the Internet. Hence, users become more concerned about trust. Trust is subjective; trustworthiness requirements for addressing trust concerns are difficult to elicit, especially if there are different parties involved in the business process. We propose a user-centered trustworthiness requirement analysis and modeling framework. We integrate the subjective trust concerns into goal models and embed them into business process models as objective trustworthiness requirements. Business process model and notation is extended to enable modeling trustworthiness requirements. This paper focuses on the challenges of elicitation, refinement and modeling trustworthiness requirements. An application example from the healthcare domain is used to demonstrate our approach.

  10. Requirements for Participatory Framework on Governmental Policy Level

    Directory of Open Access Journals (Sweden)

    Birutė PITRĖNAITĖ

    2012-06-01

    Full Text Available The article seeks to specify the requirements of the framework for public participation in policy making on the governmental level aiming to elaborate a substantial content of the participatory policy. The research methodology engages both qualitative and quantitative approaches based on document analysis and interviews. We analysed a range of documents, issued by the Ministry of Education and Science of the Republic of Lithuania, where participatory groups are nominated for the annual terms of 2007 and 2010. Results of the research testify that, notwithstanding the considerable number of participatory facts, public administrators hold more than a half of the places in the participatory groups. Stakeholders other than public administrators are considered to be rather consultants than partners in policy development. We suggest that for a substantial, effective and efficient participation framework, several requirements should be met including a correct arena for stakes’ expression; completeness of the stake representation; balanced stake representation; sensitivity to research based evidence; monitoring and evaluation of participation quality.

  11. RiSKi: A Framework for Modeling Cyber Threats to Estimate Risk for Data Breach Insurance

    OpenAIRE

    Panou, Angeliki; Ntantogian, Christoforos; Xenakis, Christos

    2017-01-01

    Historically, the financial benefits of cyber security investments have not been calculated with the same financial discipline used to evaluate other material investments. This was mainly due to a lack of readily available data on cyber incidents impacts and systematic methodology to support the efficacy of cyber investments. In this paper we propose an innovative, cyber investment management framework named RiSKi that incorporates detection and continuous monitoring of insiders societal beha...

  12. Legislative Framework Required for Africa's M-Economy

    DEFF Research Database (Denmark)

    Williams, Idongesit

    2014-01-01

    This article discusses the importance of developing legislative frameworks for the development of an m - economy in Africa......This article discusses the importance of developing legislative frameworks for the development of an m - economy in Africa...

  13. Study on CDA Identification and Lesson Learned from the Result for the Cyber Security Regulation for Nuclear Facilities

    Energy Technology Data Exchange (ETDEWEB)

    Kim, Si Won [Korea Institute of Nuclear Nonproliferation and Control, Daejeon (Korea, Republic of)

    2016-10-15

    It is the United States that shows the most enthusiastic preparation for the protection of NPPs from cyber threats. The United States has been trying to improve cybersecurity of NPPs since the 911 terror in 2001. In this process, the Nuclear Regulatory Commission (NRC) of the U.S. demanded the protection of the digital systems in NPPs to the licensee through 10 CFR 73.54. Moreover, RG 5.71 defined the assets, which should be protected from cyber threats, as Critical Digital Asset (CDA). Nuclear Energy Institute (NEI) provided the CDA identification guide through NEI 10-04. Meanwhile, International Electrotechnical Commission (IEC) presented the security program requirements of I and C computer in NPP, as well as category about systems and functions through IEC 61226 which is under revision. In Korea, Korea Institute of Nuclear Nonproliferation and Control (KINAC) established KINAC/RS-019, which is based upon NEI 10-04 and adapted to Korean circumstances. As time goes by, the digital systems in NPPs increase and the possibilities of cyber threats becomes greater. To protect these systems from cyber attacks, it is important to identify CDA, which is the target to be protect. For that, the standards to identify CDA were established, and according to the standards, the licensees could perform identification works and draw many CDAs. During the inspection processes for this, KINAC could find several problems and has been tried to look for the solutions. It is desired that such solutions will be actively used when identifying CDAs in NPPs, and also they should be applied to the systems which are added or changed during the whole facility life cycle.

  14. Study on CDA Identification and Lesson Learned from the Result for the Cyber Security Regulation for Nuclear Facilities

    International Nuclear Information System (INIS)

    Kim, Si Won

    2016-01-01

    It is the United States that shows the most enthusiastic preparation for the protection of NPPs from cyber threats. The United States has been trying to improve cybersecurity of NPPs since the 911 terror in 2001. In this process, the Nuclear Regulatory Commission (NRC) of the U.S. demanded the protection of the digital systems in NPPs to the licensee through 10 CFR 73.54. Moreover, RG 5.71 defined the assets, which should be protected from cyber threats, as Critical Digital Asset (CDA). Nuclear Energy Institute (NEI) provided the CDA identification guide through NEI 10-04. Meanwhile, International Electrotechnical Commission (IEC) presented the security program requirements of I and C computer in NPP, as well as category about systems and functions through IEC 61226 which is under revision. In Korea, Korea Institute of Nuclear Nonproliferation and Control (KINAC) established KINAC/RS-019, which is based upon NEI 10-04 and adapted to Korean circumstances. As time goes by, the digital systems in NPPs increase and the possibilities of cyber threats becomes greater. To protect these systems from cyber attacks, it is important to identify CDA, which is the target to be protect. For that, the standards to identify CDA were established, and according to the standards, the licensees could perform identification works and draw many CDAs. During the inspection processes for this, KINAC could find several problems and has been tried to look for the solutions. It is desired that such solutions will be actively used when identifying CDAs in NPPs, and also they should be applied to the systems which are added or changed during the whole facility life cycle

  15. Towards a cyber secure society

    CSIR Research Space (South Africa)

    Labuschagne, WA

    2012-10-01

    Full Text Available -Besse Nuclear Plant ?Plant safety monitoring system (Shut down) ?2005 ?Daimler Chrysler ?13 U.S manufacturing plants (Shut down) ? CSIR 2012 Slide 6 Is It Possible? ?Estonia (April 2007) ?First cyberwar ?Three-week wave of distributed denial...-of- service attacks ? Crippled country?s information technology infra-structure ? CSIR 2012 Slide 7 Is It Possible? ?Stuxnet ?Discovered in July 2010 ?Target was Iranian nuclear facility ?Cause refinery's centrifuge to malfunction ?Air-gapped from...

  16. Economic Analysis of Cyber Security

    Science.gov (United States)

    2006-07-01

    calculate the estimates are proprietary; therefore, no one outside the company can evaluate the assumptions and methodologies. Furthermore, Mi2g has a...and Miller proposed using a more mathematical approach. The theories they proposed were based on the assumption that markets operate efficiently, so...Other researchers (Ross, 1978; Ryan, 1982) modified this basic idea and created the capital asset pricing model ( CAPM ), in which investments are made

  17. DOT Cyber Security Assessment Management -

    Data.gov (United States)

    Department of Transportation — This data set contains information about the security and compliance status of FISMA systems within the Department. The information contains detailed descriptions of...

  18. Cyber Security: US - Chinese Relations

    OpenAIRE

    Debnárová, Barbora

    2015-01-01

    This diploma thesis deals with cyber relation of the United States of America and the People's republic of China. The aim of this diploma thesis is to answer the following questions: What kind of cyber threat for the United States does China represent? How is China's cyber strategy characterised? How do USA react on this threat and what are the gaps in this reaction? The thesis is divided into four chapters. The first chapter deals with definition of cyberwarfare and its perception in Chinese...

  19. Cyber Security as Social Experiment

    NARCIS (Netherlands)

    Pieters, Wolter; Hadziosmanovic, D.; Dechesne, Francien

    2014-01-01

    Lessons from previous experiences are often overlooked when deploying security-sensitive technology in the real world. At the same time, security assessments often suffer from a lack of real-world data. This appears similar to general problems in technology assessment, where knowledge about

  20. 8th International Symposium on Intelligent Distributed Computing & Workshop on Cyber Security and Resilience of Large-Scale Systems & 6th International Workshop on Multi-Agent Systems Technology and Semantics

    CERN Document Server

    Braubach, Lars; Venticinque, Salvatore; Badica, Costin

    2015-01-01

    This book represents the combined peer-reviewed proceedings of the Eight International Symposium on Intelligent Distributed Computing - IDC'2014, of the Workshop on Cyber Security and Resilience of Large-Scale Systems - WSRL-2014, and of the Sixth International Workshop on Multi-Agent Systems Technology and Semantics- MASTS-2014. All the events were held in Madrid, Spain, during September 3-5, 2014. The 47 contributions published in this book address several topics related to theory and applications of the intelligent distributed computing and multi-agent systems, including: agent-based data processing, ambient intelligence, collaborative systems, cryptography and security, distributed algorithms, grid and cloud computing, information extraction, knowledge management, big data and ontologies, social networks, swarm intelligence or videogames amongst others.

  1. A Generalized Cauchy Distribution Framework for Problems Requiring Robust Behavior

    Directory of Open Access Journals (Sweden)

    Carrillo RafaelE

    2010-01-01

    Full Text Available Statistical modeling is at the heart of many engineering problems. The importance of statistical modeling emanates not only from the desire to accurately characterize stochastic events, but also from the fact that distributions are the central models utilized to derive sample processing theories and methods. The generalized Cauchy distribution (GCD family has a closed-form pdf expression across the whole family as well as algebraic tails, which makes it suitable for modeling many real-life impulsive processes. This paper develops a GCD theory-based approach that allows challenging problems to be formulated in a robust fashion. Notably, the proposed framework subsumes generalized Gaussian distribution (GGD family-based developments, thereby guaranteeing performance improvements over traditional GCD-based problem formulation techniques. This robust framework can be adapted to a variety of applications in signal processing. As examples, we formulate four practical applications under this framework: (1 filtering for power line communications, (2 estimation in sensor networks with noisy channels, (3 reconstruction methods for compressed sensing, and (4 fuzzy clustering.

  2. A Framework for RFID Survivability Requirement Analysis and Specification

    Science.gov (United States)

    Zuo, Yanjun; Pimple, Malvika; Lande, Suhas

    Many industries are becoming dependent on Radio Frequency Identification (RFID) technology for inventory management and asset tracking. The data collected about tagged objects though RFID is used in various high level business operations. The RFID system should hence be highly available, reliable, and dependable and secure. In addition, this system should be able to resist attacks and perform recovery in case of security incidents. Together these requirements give rise to the notion of a survivable RFID system. The main goal of this paper is to analyze and specify the requirements for an RFID system to become survivable. These requirements, if utilized, can assist the system in resisting against devastating attacks and recovering quickly from damages. This paper proposes the techniques and approaches for RFID survivability requirements analysis and specification. From the perspective of system acquisition and engineering, survivability requirement is the important first step in survivability specification, compliance formulation, and proof verification.

  3. TACO - a framework for traceability and communication of requirements

    International Nuclear Information System (INIS)

    Sivertsen, Terje; Fredriksen, Rune; Thunem, Atoosa P-J.; Valkonen, Janne; Holmberg, Jan-Erik; Ventae, Olli; Andersson, Jan-Ove

    2005-06-01

    Several cases from the nuclear industry indicate the importance of clear, complete, and stable requirements from the beginning of the system development project. Since the safety of digital I and C is a property of the system in which it is embedded, the requirements specification of the I and C also plays an important role in the safety assessment of the whole system. In the development of NPP digital I and C systems, it is important to be able to trace the requirements backwards to the safety analysis report and forwards to the implementation (for development and quality control). A practical problem to perform such a trace relates to large amounts of documentation that must be read to produce the requirements specification of the safety systems. An important research task is therefore to identify, develop, or improve techniques that simplify the development and use of the requirement specification. These and related concerns motivated the initiation of the TACO project, and have provided guidance to three years of Nordic collaborative research within the NKS-R programme. The present report summarises the project and its deliverables, first of all the TACO common approach to requirements handling, called the TACO Shell. The overall objective of the TACO project was to improve the knowledge on principles and best practices related to the issues concretised in the preproject. On the basis of experiences in the Nordic countries, the project aimed at identifying the best practices and most important criteria for ensuring effective communication in relation to requirements elicitation and analysis, understandability of requirements to all parties, and traceability of requirements through the different design phases. It is expected that the project will provide important input to the development of guidelines and establishment of recommended practices related to activities involving the requirement specification. (Author)

  4. Stakeholders´ Requirements and Reference Scenarios. Deliverable D2.1

    OpenAIRE

    Diamantopoulou, Vasiliki; Mouratidis, Haralambos; Pavlidis, Michalis; Rekleitis, Evangelos

    2016-01-01

    The present document covers important elements on the development of WP2, including: a literature review of the state of the art relevant to security requirements engineering, risk management and supply chain security management standards. Following, the elicitation, analysis and documentation of requirements associated risk management and cyber-security management in ports and their supply chain sectors is presented. Emphasis is given in capturing the perspectives of all stakeholders; includ...

  5. An ontological framework for requirement change management in distributed environment

    International Nuclear Information System (INIS)

    Khatoon, A.; Hafeez, Y.; Ali, T.

    2014-01-01

    Global Software Development (GSD) is getting fame in the software industry gradually. However, in GSD, multiple and diverse stakeholders are involved in the development of complex software systems. GSD introduces several challenges, i.e. physical distance, time zone, culture difference, language barriers. As requirements play a significant role in any software development. The greatest challenge in GSD environment is to maintain a consistent view of the system even if the requirements change. But at the same time single change in the requirement might affect several other modules. In GSD different people use terms and have different ways of expressing the concepts for which people at remote sites are unable to get uniformity regarding the semantics of the terms. In a global environment requires effective communication and coordination. However, to overcome inconsistencies and ambiguities among the team members and to make the team members aware of the consistent view, a shared and common understanding is required. In this paper an approach beneficial to software industry has been proposed, focusing on changing requirements in a Global Software Development environment. A case study has been used for the evaluation of the proposed approach. Therefore, Requirements change management process has been improved by applying the approach of the case study. The proposed approach is beneficial to the software development organizations where frequent changes occur. It guided the software industry to provide the common understandings to all the development teams residing in remote locations. (author)

  6. A Framework for Requirement Elicitation, Analysis, Documentation and Prioritisation under Uncertainty

    NARCIS (Netherlands)

    Rajabali Nejad, Mohammadreza; Mladenov, V.

    2015-01-01

    This paper offers a pluralistic framework for coping with requirements in the early phases of design where there is lack of knowledge about a system, its architect and functions. The framework is used to elicit, analyze, document and prioritize the requirements. It embeds probabilistic approach and

  7. A framework for regulatory requirements and industry standards for new nuclear power plants

    International Nuclear Information System (INIS)

    Duran, Felicia A.; Camp, Allen L.; Apostolakis, George E.; Golay, Michael W.

    2000-01-01

    This paper summarizes the development of a framework for risk-based regulation and design for new nuclear power plants. Probabilistic risk assessment methods and a rationalist approach to defense in depth are used to develop a framework that can be applied to identify systematically the regulations and standards required to maintain the desired level of safety and reliability. By implementing such a framework, it is expected that the resulting body of requirements will provide a regulatory environment that will ensure protection of the public, will eliminate the burden of requirements that do not contribute significantly to safety, and thereby will improve the market competitiveness of new plants. (author)

  8. Using a data fusion-based activity recognition framework to determine surveillance system requirements

    CSIR Research Space (South Africa)

    Le Roux, WH

    2007-07-01

    Full Text Available A technique is proposed to extract system requirements for a maritime area surveillance system, based on an activity recognition framework originally intended for the characterisation, prediction and recognition of intentional actions for threat...

  9. An analysis of Technical Security Control Requirements For Digital I and C Systems in Nuclear Power Plants

    International Nuclear Information System (INIS)

    Song, Jaegu; Lee, Jungwoon; Park, Geeyong; Kwon, Keechoon; Lee, Dongyoung; Lee, Cheolkwon

    2013-01-01

    Instrumentation and control systems in nuclear power plants have been digitalized for the purpose of maintenance and precise operation. This digitalization, however, brings out issues related to cyber security. In the most recent past, international standard organizations, regulatory institutes, and research institutes have performed a number of studies addressing these systems cyber security. In order to provide information helpful to the system designers in their application of cyber security for the systems, this paper presents methods and considerations to define attack vectors in a target system, to review and select the requirements in the Regulatory Guide 5.71, and to integrate the results to identify applicable technical security control requirements. In this study, attack vectors are analyzed through the vulnerability analyses and penetration tests with a simplified safety system, and the elements of critical digital assets acting as attack vectors are identified. Among the security control requirements listed in Appendices B and C to Regulatory Guide 5.71, those that should be implemented into the systems are selected and classified in groups of technical security control requirements using the results of the attack vector analysis. For the attack vector elements of critical digital assets, all the technical security control requirements are evaluated to determine whether they are applicable and effective, and considerations in this evaluation are also discussed. The technical security control requirements in three important categories of access control, monitoring and logging, and encryption are derived and grouped according to the elements of attack vectors as results for the sample safety system

  10. An analysis of Technical Security Control Requirements For Digital I and C Systems in Nuclear Power Plants

    Energy Technology Data Exchange (ETDEWEB)

    Song, Jaegu; Lee, Jungwoon; Park, Geeyong; Kwon, Keechoon; Lee, Dongyoung; Lee, Cheolkwon [Korea Atomic Energy Research Institute, Daejeon (Korea, Republic of)

    2013-10-15

    Instrumentation and control systems in nuclear power plants have been digitalized for the purpose of maintenance and precise operation. This digitalization, however, brings out issues related to cyber security. In the most recent past, international standard organizations, regulatory institutes, and research institutes have performed a number of studies addressing these systems cyber security. In order to provide information helpful to the system designers in their application of cyber security for the systems, this paper presents methods and considerations to define attack vectors in a target system, to review and select the requirements in the Regulatory Guide 5.71, and to integrate the results to identify applicable technical security control requirements. In this study, attack vectors are analyzed through the vulnerability analyses and penetration tests with a simplified safety system, and the elements of critical digital assets acting as attack vectors are identified. Among the security control requirements listed in Appendices B and C to Regulatory Guide 5.71, those that should be implemented into the systems are selected and classified in groups of technical security control requirements using the results of the attack vector analysis. For the attack vector elements of critical digital assets, all the technical security control requirements are evaluated to determine whether they are applicable and effective, and considerations in this evaluation are also discussed. The technical security control requirements in three important categories of access control, monitoring and logging, and encryption are derived and grouped according to the elements of attack vectors as results for the sample safety system.

  11. 国家网络安全审查制度的法律困惑与中国策略%Legal puzzlements and the Chinese strategies for the national cyber-security inspection system

    Institute of Scientific and Technical Information of China (English)

    马民虎; 马宁

    2015-01-01

    我国网络安全审查制度存在诸多亟待解答的法律困惑,对于网络安全审查制度本身也存在需要修正的“误读”,为了避免“贸易保护主义”对制度本身正当性造成的减损,应当有针对性地实施中国策略,实现网络安全审查的应然状态,坚持以风险控制为审查目的,以 IT 供应链为审查范围,以立法和标准为审查基础。%Currently,China’s national cyber-security inspection system still has many legal puzzle-ments waiting to be solved urgently,as well as some “misinterpretations”.To avoid the damage to its justification caused by the “trade protectionism”,we should purposely implement the Chinese strate-gies in order to achieve the ideal state for this system with the risk-control as the aim,IT supply chain as the inspection coverage and the legislation and criterion as the basis.

  12. Preparation of safety regulatory requirements for new technology like digital system

    International Nuclear Information System (INIS)

    2012-01-01

    The current regulatory requirements on digital instrumentation and control system have been reviewed by JNES, considering international trend discussed in DICWG of MDEP. MDEP DICWG held in OECD/NEA gives the opportunity to identify the convergence of applicable standards. The working group's activities include: identifying and prioritising the member countries' challenges, practices, and needs regarding standards and regulatory guidance on digital instrumentation and control; identifying areas of importance and needs for convergence of existing standards and guidance or development of new standards; sharing of information; and identifying common positions among the member countries for areas of particular importance and need. The DICWG drafted common positions on specific issues which are based on the existing standards, national regulatory guidance, best practices, and group inputs using an agreed process and framework. The following two general common positions are discussed and to be issued in this fiscal year. Verification and Validation throughout the life cycle of safety systems using digital computers. The Impact of Cyber Security Features on Digital I and C Safety Systems. (author)

  13. Framework for Assessing the ICT Competency in Teachers up to the Requirements of "Teacher" Occupational Standard

    Science.gov (United States)

    Avdeeva, Svetlana; Zaichkina, Olga; Nikulicheva, Nataliya; Khapaeva, Svetlana

    2016-01-01

    The paper deals with problems of working out a test framework for the assessment of teachers' ICT competency in line with the requirements of "Teacher" occupational standard. The authors have analyzed the known approaches to assessing teachers' ICT competency--ISTE Standards and UNESCO ICT CFT and have suggested their own approach to…

  14. Governmental, Legal and Regulatory Framework for Safety. General Safety Requirements. Part 1

    Energy Technology Data Exchange (ETDEWEB)

    NONE

    2010-09-15

    The objective of this publication is to establish requirements in respect of the governmental, legal and regulatory framework for safety. It covers the essential aspects of the framework for establishing a regulatory body and taking other actions necessary to ensure the effective regulatory control of facilities and activities utilized for peaceful purposes. Other responsibilities and functions, such as liaison within the global safety regime and on support services for safety (including radiation protection), emergency preparedness and response, nuclear security, and the State system of accounting for and control of nuclear material, are also covered.

  15. Governmental, Legal and Regulatory Framework for Safety. General Safety Requirements. Part 1 (Arabic Edition)

    Energy Technology Data Exchange (ETDEWEB)

    NONE

    2010-09-15

    The objective of this publication is to establish requirements in respect of the governmental, legal and regulatory framework for safety. It covers the essential aspects of the framework for establishing a regulatory body and taking other actions necessary to ensure the effective regulatory control of facilities and activities utilized for peaceful purposes. Other responsibilities and functions, such as liaison within the global safety regime and on support services for safety (including radiation protection), emergency preparedness and response, nuclear security, and the State system of accounting for and control of nuclear material, are also covered.

  16. Governmental, Legal and Regulatory Framework for Safety. General Safety Requirements. Part 1 (Spanish Edition)

    International Nuclear Information System (INIS)

    2010-01-01

    The objective of this publication is to establish requirements in respect of the governmental, legal and regulatory framework for safety. It covers the essential aspects of the framework for establishing a regulatory body and taking other actions necessary to ensure the effective regulatory control of facilities and activities utilized for peaceful purposes. Other responsibilities and functions, such as liaison within the global safety regime and on support services for safety (including radiation protection), emergency preparedness and response, nuclear security, and the State system of accounting for and control of nuclear material, are also covered

  17. Governmental, Legal and Regulatory Framework for Safety. General Safety Requirements. Part 1 (French Edition)

    International Nuclear Information System (INIS)

    2010-01-01

    The objective of this publication is to establish requirements in respect of the governmental, legal and regulatory framework for safety. It covers the essential aspects of the framework for establishing a regulatory body and taking other actions necessary to ensure the effective regulatory control of facilities and activities utilized for peaceful purposes. Other responsibilities and functions, such as liaison within the global safety regime and on support services for safety (including radiation protection), emergency preparedness and response, nuclear security, and the State system of accounting for and control of nuclear material, are also covered

  18. Governmental, Legal and Regulatory Framework for Safety. General Safety Requirements. Part 1 (Chinese Edition)

    International Nuclear Information System (INIS)

    2010-01-01

    The objective of this publication is to establish requirements in respect of the governmental, legal and regulatory framework for safety. It covers the essential aspects of the framework for establishing a regulatory body and taking other actions necessary to ensure the effective regulatory control of facilities and activities utilized for peaceful purposes. Other responsibilities and functions, such as liaison within the global safety regime and on support services for safety (including radiation protection), emergency preparedness and response, nuclear security, and the State system of accounting for and control of nuclear material, are also covered

  19. Governmental, Legal and Regulatory Framework for Safety. General Safety Requirements. Part 1, Revision 1 (Chinese Edition)

    International Nuclear Information System (INIS)

    2016-01-01

    This publication establishes requirements in respect of the governmental, legal and regulatory framework for safety. It covers the essential aspects of the framework for establishing a regulatory body and taking other actions necessary to ensure the effective regulatory control of facilities and activities utilized for peaceful purposes. Other responsibilities and functions, such as liaison within the global safety regime and on support services for safety (including radiation protection), emergency preparedness and response, nuclear security, and the State system of accounting for and control of nuclear material, are also covered. A review of Safety Requirements publications was commenced in 2011 following the accident in the Fukushima Daiichi nuclear power plant in Japan. The review revealed no significant areas of weakness and resulted in just a small set of amendments to strengthen the requirements and facilitate their implementation, which are contained in the present publication.

  20. Using SCOR as a Supply Chain Management Framework for Government Agency Contract Requirements

    Science.gov (United States)

    Paxton, Joseph; Tucker, Brian

    2010-01-01

    This paper will present a model that uses the Supply-Chain Operations Reference (SCOR) model as a foundation for a framework to illustrate the information needed throughout a product lifecycle to support a healthy supply chain management function and the subsequent contract requirements to enable it. It will also show where in the supply chain the information must be extracted. The ongoing case study used to exemplify the model is NASA's (National Aeronautics and Space Administration) Ares I program for human spaceflight. Effective supply chain management and contract requirements are ongoing opportunities for continuous improvement within government agencies, specifically development of systems for human spaceflight operations. Multiple reports from the Government Accountability Office (GAO) reinforce this importance. The SCOR model is a framework for describing a supply chain with process building blocks and business activities. It provides a set of metrics for measuring supply chain performance and best practices for continuously improving. This paper expands the application of the SCOR to also provide the framework for defining information needed from different levels of the supply chain and at different phases of the lifecycle. These needs can be incorporated into contracts to enable more effective supply chain management. Depending on the phase of the lifecycle, effective supply chain management will require involvement from different levels of the organization and different levels of the supply chain.

  1. Design requirements for new nuclear reactor facilities in Canada (focus on important improvements from RD-337 version 1 of 2008)

    International Nuclear Information System (INIS)

    Shim, S.; Harwood, C.; Ohn, M-Y; Liu, Y.C.; Young, T.

    2014-01-01

    The Canadian Nuclear Safety Commission (CNSC) has established the regulatory framework that includes the documentation of the requirements and guidance for each of CNSC's 14 Safety and Control Areas, one important area being the design of nuclear power plants (NPPs). For the design area, the CNSC published RD-337 version 1 Design of New Nuclear Power Plants in 2008. As such regulatory documents are reviewed on a regular basis, this document was recently updated as RD-337 version 2, and its guidance document GD-337, Guidance for the Design of New Nuclear Power Plants was developed to provide guidance on how to meet the requirements. REGDOC-2.5.2 Design of Reactor Facilities: Nuclear Power Plants that combines RD-337 version 2 and GD-337 version 1 was presented to the Commission on March 27, 2014 after two rounds of consultation with stakeholders, and was subsequently published in May 28, 2014. Although REGDOC-2.5.2 maintains the structure and the contents nearly the same as RD-337 version 1, it introduces several important improvements to: Include GD-337 guidance for further clarity to applicants, licensees and vendors on how to meet the requirements. This guidance provides the review criteria considered in CNSC staff's review in a transparent way; Ensure alignment with international standards including recent IAEA SSR 2/1, Safety of Nuclear Power Plants: Design; Implement CNSC Fukushima Task Force Report findings that pertain to the design of reactor facilities for severe accidents; and, Make necessary improvements such as addition of requirements for cyber security. This paper describes the overall regulatory framework related to CNSC's design requirements and guidance for NPPs, and focus on the important improvements included in REGDOC-2.5.2 and their reasoning. (author)

  2. Design requirements for new nuclear reactor facilities in Canada (focus on important improvements from RD-337 version 1 of 2008)

    Energy Technology Data Exchange (ETDEWEB)

    Shim, S.; Harwood, C.; Ohn, M-Y; Liu, Y.C.; Young, T. [Canadian Nuclear Safety Commission, Ottawa, ON (Canada)

    2014-07-01

    The Canadian Nuclear Safety Commission (CNSC) has established the regulatory framework that includes the documentation of the requirements and guidance for each of CNSC's 14 Safety and Control Areas, one important area being the design of nuclear power plants (NPPs). For the design area, the CNSC published RD-337 version 1 Design of New Nuclear Power Plants in 2008. As such regulatory documents are reviewed on a regular basis, this document was recently updated as RD-337 version 2, and its guidance document GD-337, Guidance for the Design of New Nuclear Power Plants was developed to provide guidance on how to meet the requirements. REGDOC-2.5.2 Design of Reactor Facilities: Nuclear Power Plants that combines RD-337 version 2 and GD-337 version 1 was presented to the Commission on March 27, 2014 after two rounds of consultation with stakeholders, and was subsequently published in May 28, 2014. Although REGDOC-2.5.2 maintains the structure and the contents nearly the same as RD-337 version 1, it introduces several important improvements to: Include GD-337 guidance for further clarity to applicants, licensees and vendors on how to meet the requirements. This guidance provides the review criteria considered in CNSC staff's review in a transparent way; Ensure alignment with international standards including recent IAEA SSR 2/1, Safety of Nuclear Power Plants: Design; Implement CNSC Fukushima Task Force Report findings that pertain to the design of reactor facilities for severe accidents; and, Make necessary improvements such as addition of requirements for cyber security. This paper describes the overall regulatory framework related to CNSC's design requirements and guidance for NPPs, and focus on the important improvements included in REGDOC-2.5.2 and their reasoning. (author)

  3. A Measurement Framework for Team Level Assessment of Innovation Capability in Early Requirements Engineering

    Science.gov (United States)

    Regnell, Björn; Höst, Martin; Nilsson, Fredrik; Bengtsson, Henrik

    When developing software-intensive products for a market-place it is important for a development organisation to create innovative features for coming releases in order to achieve advantage over competitors. This paper focuses on assessment of innovation capability at team level in relation to the requirements engineering that is taking place before the actual product development projects are decided, when new business models, technology opportunities and intellectual property rights are created and investigated through e.g. prototyping and concept development. The result is a measurement framework focusing on four areas: innovation elicitation, selection, impact and ways-of-working. For each area, candidate measurements were derived from interviews to be used as inspiration in the development of a tailored measurement program. The framework is based on interviews with participants of a software team with specific innovation responsibilities and validated through cross-case analysis and feedback from practitioners.

  4. Toward a theoretical framework for trustworthy cyber sensing

    Science.gov (United States)

    Xu, Shouhuai

    2010-04-01

    Cyberspace is an indispensable part of the economy and society, but has been "polluted" with many compromised computers that can be abused to launch further attacks against the others. Since it is likely that there always are compromised computers, it is important to be aware of the (dynamic) cyber security-related situation, which is however challenging because cyberspace is an extremely large-scale complex system. Our project aims to investigate a theoretical framework for trustworthy cyber sensing. With the perspective of treating cyberspace as a large-scale complex system, the core question we aim to address is: What would be a competent theoretical (mathematical and algorithmic) framework for designing, analyzing, deploying, managing, and adapting cyber sensor systems so as to provide trustworthy information or input to the higher layer of cyber situation-awareness management, even in the presence of sophisticated malicious attacks against the cyber sensor systems?

  5. Framework for establishing records control in hospitals as an ISO 9001 requirement.

    Science.gov (United States)

    Al-Qatawneh, Lina

    2017-02-13

    Purpose The purpose of this paper is to present the process followed to control records in a Jordanian private community hospital as an ISO 9001:2008 standard requirement. Design/methodology/approach Under the hospital quality council's supervision, the quality management and development office staff were responsible for designing, planning and implementing the quality management system (QMS) using the ISO 9001:2008 standard. A policy for records control was established. An action plan for establishing the records control was developed and implemented. On completion, a coding system for records was specified to be used by hospital staff. Finally, an internal audit was performed to verify conformity to the ISO 9001:2008 standard requirements. Findings Successful certification by a neutral body ascertained that the hospital's QMS conformed to the ISO 9001:2008 requirements. A framework was developed that describes the records controlling process, which can be used by staff in any healthcare organization wanting to achieve ISO 9001:2008 accreditation. Originality/value Given the increased interest among healthcare organizations to achieve the ISO 9001 certification, the proposed framework for establishing records control is developed and is expected to be a valuable management tool to improve and sustain healthcare quality.

  6. Cyber Security: A Crisis of Prioritization

    Science.gov (United States)

    2005-02-01

    Society (CITRIS) and Professor University of California, Berkeley J. Carter Beese , Jr. President Riggs Capital Partners Pedro Celis, Ph.D. Software...Science University of North Carolina at Chapel Hill William J. Hannigan President AT&T Jonathan C. Javitt, M.D., M.P.H. Senior Fellow Potomac Institute...CHAIR F. Thomson Leighton MEMBERS J. Carter Beese , Jr. Patricia Thomas Evans Luis E. Fiallo Harold Mortazavian David A. Patterson Alice G

  7. ATIP Report: Cyber Security Research in China

    Science.gov (United States)

    2015-06-05

    detected in 76,160 domestic websites, including 2,425 government websites. • A total of 30,199 phishing websites targeting China’s growing online...population were monitored, with 90.2% of these phishing websites being run on foreign severs. Chinese authorities state that US-based sites accounted...an evaluation of AppIntent using a set of 750 malicious apps, as well as 1,000 of the top free apps from Google Play. The results show that AppIntent

  8. Towards a cyber security aware rural community

    CSIR Research Space (South Africa)

    Grobler, M

    2011-08-01

    Full Text Available engineering, identity theft, cookies and cyberbullies [9]. 1) Social networking Users are introduced to different types of social networking, its benefits and advantages. SN sites are platforms created to allow people to communicate through the use... be potentially used for various attacks, including but not limited to identify theft, cyberbullying, social engineering, evil twin attacks and malware. SN sites are inherently designed to allow users to provide information that could be used by cyberbullies...

  9. Smart Grids Cyber Security Issues and Challenges

    OpenAIRE

    Imen Aouini; Lamia Ben Azzouz

    2015-01-01

    The energy need is growing rapidly due to the population growth and the large new usage of power. Several works put considerable efforts to make the electricity grid more intelligent to reduce essentially energy consumption and provide efficiency and reliability of power systems. The Smart Grid is a complex architecture that covers critical devices and systems vulnerable to significant attacks. Hence, security is a crucial factor for the success and the wide deployment of...

  10. Cyber security assessment of a power plant

    Energy Technology Data Exchange (ETDEWEB)

    Nai Fovino, Igor; Masera, Marcelo; Stefanini, Alberto [Joint Research Centre, Institute for the Protection and Security of the Citizen, Ispra (Italy); Guidi, Luca [Enel Ingegneria e Innovazione, Pisa (Italy)

    2011-02-15

    Critical infrastructures and systems are today exposed not only to traditional safety and availability problems, but also to new kinds of security threats. These are mainly due to the large number of new vulnerabilities and architectural weaknesses introduced by the extensive use of information and communication technologies (ICT) into such complex systems. In this paper we present the outcomes of an exhaustive ICT security assessment, targeting an operational power plant, which consisted also of the simulation of potential cyber attacks. The assessment shows that the plant is considerably vulnerable to malicious attacks. This situation cannot be ignored, because the potential outcomes of an induced plant malfunction can be severe. (author)

  11. Gamification for Measuring Cyber Security Situational Awareness

    Energy Technology Data Exchange (ETDEWEB)

    Fink, Glenn A.; Best, Daniel M.; Manz, David O.; Popovsky, V. M.; Endicott-Popovsky, Barbara E.

    2013-03-01

    Cyber defense competitions arising from U.S. service academy exercises, offer a platform for collecting data that can inform research that ranges from characterizing the ideal cyber warrior to describing behaviors during certain challenging cyber defense situations. This knowledge could lead to better preparation of cyber defenders in both military and civilian settings. This paper describes how one regional competition, the PRCCDC, a participant in the national CCDC program, conducted proof of concept experimentation to collect data during the annual competition for later analysis. The intent is to create an ongoing research agenda that expands on this current work and incorporates augmented cognition and gamification methods for measuring cybersecurity situational awareness under the stress of cyber attack.

  12. UVI Cyber-security Workshop Workshop Analysis.

    Energy Technology Data Exchange (ETDEWEB)

    Kuykendall, Tommie G. [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Allsop, Jacob Lee [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Anderson, Benjamin Robert [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Boumedine, Marc [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Carter, Cedric [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Galvin, Seanmichael Yurko [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Gonzalez, Oscar [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Lee, Wellington K. [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Lin, Han Wei [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Morris, Tyler Jake [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Nauer, Kevin S.; Potts, Beth A.; Ta, Kim Thanh; Trasti, Jennifer; White, David R.

    2015-07-08

    The cybersecurity consortium, which was established by DOE/NNSA’s Minority Serving Institutions Partnerships Program (MSIPP), allows students from any of the partner schools (13 HBCUs, two national laboratories, and a public school district) to have all consortia options available to them, to create career paths and to open doors to DOE sites and facilities to student members of the consortium. As a part of this year consortium activities, Sandia National Laboratories and the University of Virgin Islands conducted a week long cyber workshop that consisted of three courses; Digital Forensics and Malware Analysis, Python Programming, and ThunderBird Cup. These courses are designed to enhance cyber defense skills and promote learning within STEM related fields.

  13. Cyber Security: A Crisis of Prioritization

    Data.gov (United States)

    Networking and Information Technology Research and Development, Executive Office of the President — ... The Director of the Office of Science and Technology Policy then provided a formal charge, asking PITAC members to concentrate their efforts on the focus,...

  14. Cyber security in ports : Business as usual

    NARCIS (Netherlands)

    Moerel, Lokke; Dezeure, Freddy

    2017-01-01

    Our paper summarizes the risks and provides concrete and pragmatic proposals to increase substantially the cyber maturity and resilience in the ports by organizing training and awareness raising, fostering cooperation and information exchange both between the stakeholders in the ports and across the

  15. Cyber security in ports: Business as usual

    OpenAIRE

    Moerel, Lokke; Dezeure, Freddy

    2017-01-01

    Our paper summarizes the risks and provides concrete and pragmatic proposals to increase substantially the cyber maturity and resilience in the ports by organizing training and awareness raising, fostering cooperation and information exchange both between the stakeholders in the ports and across the ports and integrating the cyber risk into the physical security risk management processes and structures already in place within the ports. This also involves a higher degree of oversight by the P...

  16. Cyber Security: A Crisis of Prioritization

    National Research Council Canada - National Science Library

    Benioff, Marc R; Lazowska, Edward D

    2005-01-01

    The information technology (IT) infrastructure of the United States, which is now vital for communication, commerce, and control of our physical infrastructure, is highly vulnerable to terrorist and criminal attacks...

  17. 75 FR 26171 - Cyber Security Certification Program

    Science.gov (United States)

    2010-05-11

    ... Internet users rely are becoming increasingly susceptible to operator error and malicious cyber attack. For... susceptibility to operator error and malicious cyber attack, Federal entities, frequently in cooperation with the... transfers from cyber threats, such as espionage, disruption, and denial of service attacks. Specifically...

  18. Cyber-Security Curricula for Basic Users

    Science.gov (United States)

    2013-09-01

    everyday life. According to the CommonSenseMedia organization, ―Kids and teens today are using the immense power of digital media to explore, connect...anything too sexy to be passed aro~.r~d the dinner table should NOT make it on to the web, as it couJd encourage sexual predators to contact you. o

  19. Cyber Security of Industrial Control Systems

    NARCIS (Netherlands)

    Luiijf, H.A.M.; Paske, B.J. te

    2015-01-01

    Our society and its citizens depend on the undisturbed functioning of (critical) infrastructures and their services. Crucial processes in most critical infrastructures, and in many other organisations, rely on the correct and undisturbed functioning of Industrial Control Systems (ICS). A failure of

  20. Multi sensor national cyber security data fusion

    CSIR Research Space (South Africa)

    Swart, I

    2015-03-01

    Full Text Available in a real world system. The data examined will then be applied to a case study that will show the results of applying available open source security information against the model to relate to the current South African cyber landscape....

  1. Wat maakt cyber security anders dan informatiebeveiliging?

    NARCIS (Netherlands)

    Van den Berg, J.

    2015-01-01

    De termen “informatiebeveiliging” en “cyber security” worden vaak door elkaar gebruikt soms met dezelfde, soms met een afwijkende betekenis. Velen spreken vandaag de dag ook over cyberspace, bijvoorbeeld als een nieuw (door de mens gecreëerd) vijfde domein naast de bestaande domeinen land, water,

  2. A Theory of Information Quality and a Framework for its Implementation in the Requirements Engineering Process

    Science.gov (United States)

    Grenn, Michael W.

    This dissertation introduces a theory of information quality to explain macroscopic behavior observed in the systems engineering process. The theory extends principles of Shannon's mathematical theory of communication [1948] and statistical mechanics to information development processes concerned with the flow, transformation, and meaning of information. The meaning of requirements information in the systems engineering context is estimated or measured in terms of the cumulative requirements quality Q which corresponds to the distribution of the requirements among the available quality levels. The requirements entropy framework (REF) implements the theory to address the requirements engineering problem. The REF defines the relationship between requirements changes, requirements volatility, requirements quality, requirements entropy and uncertainty, and engineering effort. The REF is evaluated via simulation experiments to assess its practical utility as a new method for measuring, monitoring and predicting requirements trends and engineering effort at any given time in the process. The REF treats the requirements engineering process as an open system in which the requirements are discrete information entities that transition from initial states of high entropy, disorder and uncertainty toward the desired state of minimum entropy as engineering effort is input and requirements increase in quality. The distribution of the total number of requirements R among the N discrete quality levels is determined by the number of defined quality attributes accumulated by R at any given time. Quantum statistics are used to estimate the number of possibilities P for arranging R among the available quality levels. The requirements entropy H R is estimated using R, N and P by extending principles of information theory and statistical mechanics to the requirements engineering process. The information I increases as HR and uncertainty decrease, and the change in information AI needed

  3. Grid requirements applicable to future NPPs in the new European Electricity Framework

    International Nuclear Information System (INIS)

    Beato Castro, D.; Padill, C. M.

    2000-01-01

    With a view to keeping nuclear energy as an option for future power generation in a competitive market and taking advantage of the current operating experience, a group of European electric utilities have come together to define common requirements for the design and supply of future Light Water Reactor (LWR) plants connected to the electrical system. These requirements, defined with the aim of standardizing and adapting design to the conditions of the new electricity framework, are being included in the European Utility Requirements (EUR) document. Although there are different types of power plants operating appropriately in large electrical systems, the idea is to find the minimum requirements that will allow growth of this type of energy in the European electricity industry without reducing quality, safety and reliability of interconnected electrical systems. It is therefore necessary to take into account the features of the existing power systems and the operating characteristics and design of nuclear power plants so as to harmonize their respective technical peculiarities in the framework of the deregulated electricity sector. The definition of these grid requirements is based primarily on the operating conditions of the Union pour la Coordination de la Production et le Transport de L'Electricite (UCPTE) grid and takes into account the current Grid Code of the main European countries, for the forthcoming Issue C. This paper sets outs the most relevant aspects of the grid requirements, included in Chapter 2.3 of the EUR document Grid Requirements, Issue B, for the connection of future nuclear power plants in the European electricity system, and others that are being considered in the preparation of the new issue of the document that will take into account the deregulated electricity market situation and deal with the following aspects: General characteristics. Operation of a plant under normal grid conditions. Operation of a plant under disturbed grid

  4. A decision-making framework to model environmental flow requirements in oasis areas using Bayesian networks

    Science.gov (United States)

    Xue, Jie; Gui, Dongwei; Zhao, Ying; Lei, Jiaqiang; Zeng, Fanjiang; Feng, Xinlong; Mao, Donglei; Shareef, Muhammad

    2016-09-01

    The competition for water resources between agricultural and natural oasis ecosystems has become an increasingly serious problem in oasis areas worldwide. Recently, the intensive extension of oasis farmland has led to excessive exploitation of water discharge, and consequently has resulted in a lack of water supply in natural oasis. To coordinate the conflicts, this paper provides a decision-making framework for modeling environmental flows in oasis areas using Bayesian networks (BNs). Three components are included in the framework: (1) assessment of agricultural economic loss due to meeting environmental flow requirements; (2) decision-making analysis using BNs; and (3) environmental flow decision-making under different water management scenarios. The decision-making criterion is determined based on intersection point analysis between the probability of large-level total agro-economic loss and the ratio of total to maximum agro-economic output by satisfying environmental flows. An application in the Qira oasis area of the Tarim Basin, Northwest China indicates that BNs can model environmental flow decision-making associated with agricultural economic loss effectively, as a powerful tool to coordinate water-use conflicts. In the case study, the environmental flow requirement is determined as 50.24%, 49.71% and 48.73% of the natural river flow in wet, normal and dry years, respectively. Without further agricultural economic loss, 1.93%, 0.66% and 0.43% of more river discharge can be allocated to eco-environmental water demands under the combined strategy in wet, normal and dry years, respectively. This work provides a valuable reference for environmental flow decision-making in any oasis area worldwide.

  5. AN ANALYSIS OF TECHNICAL SECURITY CONTROL REQUIREMENTS FOR DIGITAL I&C SYSTEMS IN NUCLEAR POWER PLANTS

    Directory of Open Access Journals (Sweden)

    JAE-GU SONG

    2013-10-01

    Full Text Available Instrumentation and control systems in nuclear power plants have been digitalized for the purpose of maintenance and precise operation. This digitalization, however, brings out issues related to cyber security. In the most recent past, international standard organizations, regulatory institutes, and research institutes have performed a number of studies addressing these systems cyber security. In order to provide information helpful to the system designers in their application of cyber security for the systems, this paper presents methods and considerations to define attack vectors in a target system, to review and select the requirements in the Regulatory Guide 5.71, and to integrate the results to identify applicable technical security control requirements. In this study, attack vectors are analyzed through the vulnerability analyses and penetration tests with a simplified safety system, and the elements of critical digital assets acting as attack vectors are identified. Among the security control requirements listed in Appendices B and C to Regulatory Guide 5.71, those that should be implemented into the systems are selected and classified in groups of technical security control requirements using the results of the attack vector analysis. For the attack vector elements of critical digital assets, all the technical security control requirements are evaluated to determine whether they are applicable and effective, and considerations in this evaluation are also discussed. The technical security control requirements in three important categories of access control, monitoring and logging, and encryption are derived and grouped according to the elements of attack vectors as results for the sample safety system.

  6. Analysing the conflicting requirements of the framework convention on climate change

    International Nuclear Information System (INIS)

    Enting, I.G.

    1995-01-01

    The objectives of the Framework Convention on Climate Change imply the conflicting constraints of minimising concentrations and maximising emissions (e.g. minimising emission restrictions). Carbon cycle models are readily used for 'forward' calculations of future CO 2 given specific emissions and the 'inverse' problem of deducing the emissions required to achieve specific concentration profiles. However these approaches (a) are each geared to only one side of the problem; and (b) each requires the specification of a particular pathway in terms of either emissions or concentrations. These limitations can be avoided by analysing the relations between future emissions and concentrations of CO 2 using a formalism that optimises overall possible future emission profiles, subject to relevant constraints on both emissions and concentrations. The paper presents specific calculations indicating which combinations of upper bounds on concentrations and lower bounds on emissions are mutually inconsistent and which are consistent. The authors calculate the (smaller) consistency regions that apply if emission reductions are restricted to less than 0.5% p.a. or less than 1% p.a. In each case, two reference periods (1990-2100 and 1990-2200) are considered. 11 refs., 4 figs

  7. Legislative framework and regulatory requirements for the introduction of nuclear power

    International Nuclear Information System (INIS)

    Ha-Vinh, Phuong

    1975-01-01

    The adoption of appropriate legislation is to be considered as a prerequisite to the introduction of nuclear power in view of the issues that need to be regulated. Preparatory steps should be started at the earliest stage in conjunction with the planning of nuclear power projects. The primary objectives of a licensing scheme are to ensure safety, public health and environmental protection as well as financial protection for third parties in case of nuclear incident. For licensing purposes, a legislative framework and regulatory determinations are required. Within such a framework and pursuant to such regulatory determinations, the elaboration of safety standards, rules, guides and enforcement procedures is to be considered of paramount importance. To this end a number of international recommendations and advisory material prepared by the IAEA provide useful guidance. A licensing process would normally be split into several stages relating to site approval, construction permit, pre-operational tests, and operating licence, each stage being subject to safety assessments and reviews as determined by regulations. Financial protection against nuclear damage has also to be insured. A special regime of nuclear liability has been established by international conventions, based on the principle of strict liability of the operator of a nuclear installation. As a result of such channelling of liability to him, his liability is limited in amount and time. This liability system has the dual purpose of ensuring appropriate protection for potential victims and of relieving the nuclear industry from unlimited liability risks, which would impede practical applications of atomic energy. For the elaboration of nuclear legislation and specialized regulations the Agency's advisory services have proved to be of help to countries embarking on a nuclear power programme. (author)

  8. A Requirement Engineering Framework for Electronic Data Sharing of Health Care Data Between Organizations

    Science.gov (United States)

    Liu, Xia; Peyton, Liam; Kuziemsky, Craig

    Health care is increasingly provided to citizens by a network of collaboration that includes multiple providers and locations. Typically, that collaboration is on an ad-hoc basis via phone calls, faxes, and paper based documentation. Internet and wireless technologies provide an opportunity to improve this situation via electronic data sharing. These new technologies make possible new ways of working and collaboration but it can be difficult for health care organizations to understand how to use the new technologies while still ensuring that their policies and objectives are being met. It is also important to have a systematic approach to validate that e-health processes deliver the performance improvements that are expected. Using a case study of a palliative care patient receiving home care from a team of collaborating health organizations, we introduce a framework based on requirements engineering. Key concerns and objectives are identified and modeled (privacy, security, quality of care, and timeliness of service). And, then, proposed business processes which use new technologies are modeled in terms of these concerns and objectives to assess their impact and ensure that electronic data sharing is well regulated.

  9. Cyber security competencies : cyber security education and research in Finnish universities

    OpenAIRE

    Lehto, Martti

    2015-01-01

    The revolution in information technology that began in the 1990s has been transforming Finland into an information society. Imaginative data processing and utilization, arising from the needs of citizens and the business community, are some of the most important elements in a thriving society. Information and know-how have become key ‘commodities’ in society, and they can be utilized all the more efficiently through information technology. Individuals, public and private organi...

  10. Use of models to support the monitoring requirements in the water framework directive

    NARCIS (Netherlands)

    Højberg, A.L.; Refsgaard, J.C.; Geer, F. van; Jørgensen, L.F.; Zsuffa, I.

    2007-01-01

    Implementation of the EU Water Framework Directive (WFD) poses many new challenges to European water managers. Monitoring programmes play a key role to assess the status and identify possible trends in the environmental conditions of river basins; to gain new knowledge on water processes and to

  11. International Policy Framework for Protecting Critical Information Infrastructure: A Discussion Paper Outlining Key Policy Issues

    NARCIS (Netherlands)

    Brown, B.; Goetz, E.; Verhoest, P.; Helmus, S.; Luiijf, H.A.M.; Bruce, R.; Dynes, S.; Brechbuhl, H.

    2005-01-01

    Cyber security is a uniquely challenging policy issue with a wide range of public and private stakeholders within countries and beyond national boundaries. This executive summary and the full discussion paper delineate the need on a high priority basis to address cyber security issues and develop an

  12. Understanding the Paris agreement: analysing the reporting requirements under the enhanced transparency framework

    DEFF Research Database (Denmark)

    Desgain, Denis DR; Sharma, Sudhir

    At the Paris climate conference (COP-21) in December 2015, the Conference of the Parties decided to adopt the Paris Agreement under the United Nations Framework Convention on Climate Change. This was the first time that 195 Parties had agreed on a universal, legally binding climate instrument......th October 2016, 74 Par¬ties had ratified the Agreement, accounting for 58.82% of global GHG emissions.1 The Paris Agreement will thus enter into force on 4th November 2016....

  13. Cost-effectiveness of Security Measures: A model-based Framework

    DEFF Research Database (Denmark)

    Pieters, Wolter; Probst, Christian W.; Lukszo, Zofia

    2014-01-01

    Recently, cyber security has become an important topic on the agenda of many organisations. It is already widely acknowledged that attacks do happen, and decision makers face the problem of how to respond. As it is almost impossible to secure a complex system completely, it is important to have...... an adequate estimate of the effectiveness of security measures when making investment decisions. Risk concepts are known in principle, but estimating the effectiveness of countermeasure proves to be difficult and cannot be achieved by qualitative approaches only. In this chapter, the authors consider...... the question of how to guarantee cost-effectiveness of security measures. They investigate the possibility of using existing frameworks and tools, the challenges in a security context as opposed to a safety context, and directions for future research....

  14. Transaction-based building controls framework, Volume 2: Platform descriptive model and requirements

    Energy Technology Data Exchange (ETDEWEB)

    Akyol, Bora A. [Pacific Northwest National Laboratory (PNNL), Richland, WA (United States); Haack, Jereme N. [Pacific Northwest National Laboratory (PNNL), Richland, WA (United States); Carpenter, Brandon J. [Pacific Northwest National Laboratory (PNNL), Richland, WA (United States); Katipamula, Srinivas [Pacific Northwest National Laboratory (PNNL), Richland, WA (United States); Lutes, Robert G. [Pacific Northwest National Laboratory (PNNL), Richland, WA (United States); Hernandez, George [Pacific Northwest National Laboratory (PNNL), Richland, WA (United States)

    2015-07-31

    Transaction-based Building Controls (TBC) offer a control systems platform that provides an agent execution environment that meets the growing requirements for security, resource utilization, and reliability. This report outlines the requirements for a platform to meet these needs and describes an illustrative/exemplary implementation.

  15. A Framework for the Management of Evolving Requirements in Software Systems Supporting Network-Centric Warfare

    National Research Council Canada - National Science Library

    Reynolds, Linda K

    2006-01-01

    .... There are many sources of requirements for these software systems supporting NCO, which may increase in number as the Services continue to develop the capabilities necessary for the transformation...

  16. A framework for characterizing usability requirements elicitation and analysis methodologies (UREAM)

    NARCIS (Netherlands)

    Trienekens, J.J.M.; Kusters, R.J.; Mannaert, H.

    2012-01-01

    Dedicated methodologies for the elicitation and analysis of usability requirements have been proposed in literature, usually developed by usability experts. The usability of these approaches by non-expert software engineers is not obvious. In this paper, the objective is to support developers and

  17. A Framework for Assessing Continuing Professional Development Activities for Satisfying Pharmacy Revalidation Requirements

    Science.gov (United States)

    Donyai, Parastou; Alexander, Angela M.; Denicolo, Pam M.

    2013-01-01

    Introduction: The United Kingdom's pharmacy regulator contemplated using continuing professional development (CPD) in pharmacy revalidation in 2009, simultaneously asking pharmacy professionals to demonstrate the value of their CPD by showing its relevance and impact. The idea of linking new CPD requirements with revalidation was yet to be…

  18. Cost optimal building performance requirements. Calculation methodology for reporting on national energy performance requirements on the basis of cost optimality within the framework of the EPBD

    Energy Technology Data Exchange (ETDEWEB)

    Boermans, T.; Bettgenhaeuser, K.; Hermelink, A.; Schimschar, S. [Ecofys, Utrecht (Netherlands)

    2011-05-15

    On the European level, the principles for the requirements for the energy performance of buildings are set by the Energy Performance of Buildings Directive (EPBD). Dating from December 2002, the EPBD has set a common framework from which the individual Member States in the EU developed or adapted their individual national regulations. The EPBD in 2008 and 2009 underwent a recast procedure, with final political agreement having been reached in November 2009. The new Directive was then formally adopted on May 19, 2010. Among other clarifications and new provisions, the EPBD recast introduces a benchmarking mechanism for national energy performance requirements for the purpose of determining cost-optimal levels to be used by Member States for comparing and setting these requirements. The previous EPBD set out a general framework to assess the energy performance of buildings and required Member States to define maximum values for energy delivered to meet the energy demand associated with the standardised use of the building. However it did not contain requirements or guidance related to the ambition level of such requirements. As a consequence, building regulations in the various Member States have been developed by the use of different approaches (influenced by different building traditions, political processes and individual market conditions) and resulted in different ambition levels where in many cases cost optimality principles could justify higher ambitions. The EPBD recast now requests that Member States shall ensure that minimum energy performance requirements for buildings are set 'with a view to achieving cost-optimal levels'. The cost optimum level shall be calculated in accordance with a comparative methodology. The objective of this report is to contribute to the ongoing discussion in Europe around the details of such a methodology by describing possible details on how to calculate cost optimal levels and pointing towards important factors and

  19. Towards tributyltin quantification in natural water at the Environmental Quality Standard level required by the Water Framework Directive.

    Science.gov (United States)

    Alasonati, Enrica; Fettig, Ina; Richter, Janine; Philipp, Rosemarie; Milačič, Radmila; Sčančar, Janez; Zuliani, Tea; Tunç, Murat; Bilsel, Mine; Gören, Ahmet Ceyhan; Fisicaro, Paola

    2016-11-01

    The European Union (EU) has included tributyltin (TBT) and its compounds in the list of priority water pollutants. Quality standards demanded by the EU Water Framework Directive (WFD) require determination of TBT at so low concentration level that chemical analysis is still difficult and further research is needed to improve the sensitivity, the accuracy and the precision of existing methodologies. Within the frame of a joint research project "Traceable measurements for monitoring critical pollutants under the European Water Framework Directive" in the European Metrology Research Programme (EMRP), four metrological and designated institutes have developed a primary method to quantify TBT in natural water using liquid-liquid extraction (LLE) and species-specific isotope dilution mass spectrometry (SSIDMS). The procedure has been validated at the Environmental Quality Standard (EQS) level (0.2ngL(-1) as cation) and at the WFD-required limit of quantification (LOQ) (0.06ngL(-1) as cation). The LOQ of the methodology was 0.06ngL(-1) and the average measurement uncertainty at the LOQ was 36%, which agreed with WFD requirements. The analytical difficulties of the method, namely the presence of TBT in blanks and the sources of measurement uncertainties, as well as the interlaboratory comparison results are discussed in detail. Copyright © 2016 Elsevier B.V. All rights reserved.

  20. Framework for the quality assurance of 'omics technologies considering GLP requirements.

    Science.gov (United States)

    Kauffmann, Hans-Martin; Kamp, Hennicke; Fuchs, Regine; Chorley, Brian N; Deferme, Lize; Ebbels, Timothy; Hackermüller, Jörg; Perdichizzi, Stefania; Poole, Alan; Sauer, Ursula G; Tollefsen, Knut E; Tralau, Tewes; Yauk, Carole; van Ravenzwaay, Ben

    2017-12-01

    'Omics technologies are gaining importance to support regulatory toxicity studies. Prerequisites for performing 'omics studies considering GLP principles were discussed at the European Centre for Ecotoxicology and Toxicology of Chemicals (ECETOC) Workshop Applying 'omics technologies in Chemical Risk Assessment. A GLP environment comprises a standard operating procedure system, proper pre-planning and documentation, and inspections of independent quality assurance staff. To prevent uncontrolled data changes, the raw data obtained in the respective 'omics data recording systems have to be specifically defined. Further requirements include transparent and reproducible data processing steps, and safe data storage and archiving procedures. The software for data recording and processing should be validated, and data changes should be traceable or disabled. GLP-compliant quality assurance of 'omics technologies appears feasible for many GLP requirements. However, challenges include (i) defining, storing, and archiving the raw data; (ii) transparent descriptions of data processing steps; (iii) software validation; and (iv) ensuring complete reproducibility of final results with respect to raw data. Nevertheless, 'omics studies can be supported by quality measures (e.g., GLP principles) to ensure quality control, reproducibility and traceability of experiments. This enables regulators to use 'omics data in a fit-for-purpose context, which enhances their applicability for risk assessment. Copyright © 2017 Elsevier Inc. All rights reserved.

  1. Requirement Management between Regulatory Framework and Dismantling Activities for Decommissioning of a Nuclear Facility

    International Nuclear Information System (INIS)

    Park, H.S.; Jin, H.G.; Hong, Y.J.; Choi, J.W.; Park, S.

    2016-01-01

    Full text: The decommissioning and environmental remediation (D&ER) projects require stepwise long-term research and development (R&D) such as a shutdown, transition, decontamination and decommissioning (D&D) activities, radioactive waste management, and site restoration. During each step of the D&ER projects, a significant amount of information and knowledge such as experimental data, databases, design drawings, technical reports, guidelines, operation manuals, and modeling and simulation reports are produced. Knowledge based on experiences by staff members participating in each step of the D&ER project are also very important. Such knowledge based on experiences may disappear with the retirement of staff members if there are no effective and systematic approaches for its acquisition and storage. Therefore, to perform the D&ER project successfully, it is necessary to preserve written theses and experiences systematically. The integrated knowledge management system (KMS) for the D&ER projects have never been developed. Therefore, the establishment of an integrated KMS is necessary for the effective performance of D&ER projects. This study introduces a decommissioning procedure requirement management system as a part of the KMS related to the D&ER projects. (author

  2. 75 FR 35508 - Draft Regulatory Guide: Issuance, Availability

    Science.gov (United States)

    2010-06-22

    ... Systems and Networks,'' requires licensees to develop cyber-security plans and programs to protect....71, ``Cyber Security Programs for Nuclear Facilities,'' provides guidance to meet the requirements of... address these issues, DG-1249: 1. Eliminates all reference to cyber security, malicious activity, or...

  3. 75 FR 1416 - Final Memorandum of Understanding Between the U.S. Nuclear Regulatory Commission and the North...

    Science.gov (United States)

    2010-01-11

    ... application of their respective cyber security requirements for the protection of digital assets at commercial... regulations, the NRC and NERC each have responsibility for establishing and enforcing cyber security... they relate to the application of their respective cyber security requirements for the protection of...

  4. Radiation safety requirements for radioactive waste management in the framework of a quality management system

    International Nuclear Information System (INIS)

    Salgado, M.M.; Benitez, J.C.; Pernas, R.; Gonzalez, N.

    2007-01-01

    The Center for Radiation Protection and Hygiene (CPHR) is the institution responsible for the management of radioactive wastes generated from nuclear applications in medicine, industry and research in Cuba. Radioactive Waste Management Service is provided at a national level and it includes the collection and transportation of radioactive wastes to the Centralized Waste Management Facilities, where they are characterized, segregated, treated, conditioned and stored. A Quality Management System, according to the ISO 9001 Standard has been implemented for the RWM Service at CPHR. The Management System includes the radiation safety requirements established for RWM in national regulations and in the Licence's conditions. The role of the Regulatory Body and the Radiation Protection Officer in the Quality Management System, the authorization of practices, training and personal qualification, record keeping, inspections of the Regulatory Body and internal inspection of the Radiation Protection Officer, among other aspects, are described in this paper. The Quality Management System has shown to be an efficient tool to demonstrate that adequate measures are in place to ensure the safety in radioactive waste management activities and their continual improvement. (authors)

  5. Framework conditions and requirements to ensure the technical functional safety of reprocessed medical devices.

    Science.gov (United States)

    Kraft, Marc

    2008-09-03

    Testing and restoring technical-functional safety is an essential part of medical device reprocessing. Technical functional tests have to be carried out on the medical device in the course of the validation of reprocessing procedures. These ensure (in addition to the hygiene tests) that the reprocessing procedure is suitable for the medical device. Functional tests are, however, also a part of reprocessing procedures. As a stage in the reprocessing, they ensure for the individual medical device that no damage or other changes limit the performance. When determining which technical-functional tests are to be carried out, the current technological standard has to be taken into account in the form of product-specific and process-oriented norms. Product-specific norms primarily define safety-relevant requirements. The risk management method described in DIN EN ISO 14971 is the basis for recognising hazards; the likelihood of such hazards arising can be minimised through additional technical-functional tests, which may not yet have been standardised. Risk management is part of a quality management system, which must be bindingly certified for manufacturers and processors of critical medical devices with particularly high processing demands by a body accredited by the competent authority.

  6. A Framework for Integrating Biosimilars Into the Didactic Core Requirements of a Doctor of Pharmacy Curriculum.

    Science.gov (United States)

    Li, Edward; Liu, Jennifer; Ramchandani, Monica

    2017-04-01

    Biologic drugs approved via the abbreviated United States biosimilar approval pathway are anticipated to improve access to medications by addressing increasing health care expenditures. Surveys of health care practitioners indicate that there is inadequate knowledge and understanding about biosimilars; this must be addressed to ensure safe and effective use of this new category of products. Concepts of biosimilar development, manufacturing, regulation, naming, formulary, and inventory considerations, as well as patient and provider education should be included within the doctor of pharmacy (PharmD) curriculum as preparation for clinical practice. Based on these considerations, we propose that PharmD graduates be required to have knowledge in the following domains regarding biologics and biosimilars: legal definition, development and regulation, state pharmacy practice laws, and pharmacy practice management. We link these general biosimilar concepts to the Accreditation Council for Pharmacy Education (ACPE) Standards 2016 and Center for the Advancement of Pharmacy Education (CAPE) Outcomes 2013, and provide example classroom learning objectives, in-class activities, and assessments to guide implementation.

  7. Risk assessment of agricultural water requirement based on a multi-model ensemble framework, southwest of Iran

    Science.gov (United States)

    Zamani, Reza; Akhond-Ali, Ali-Mohammad; Roozbahani, Abbas; Fattahi, Rouhollah

    2017-08-01

    Water shortage and climate change are the most important issues of sustainable agricultural and water resources development. Given the importance of water availability in crop production, the present study focused on risk assessment of climate change impact on agricultural water requirement in southwest of Iran, under two emission scenarios (A2 and B1) for the future period (2025-2054). A multi-model ensemble framework based on mean observed temperature-precipitation (MOTP) method and a combined probabilistic approach Long Ashton Research Station-Weather Generator (LARS-WG) and change factor (CF) have been used for downscaling to manage the uncertainty of outputs of 14 general circulation models (GCMs). The results showed an increasing temperature in all months and irregular changes of precipitation (either increasing or decreasing) in the future period. In addition, the results of the calculated annual net water requirement for all crops affected by climate change indicated an increase between 4 and 10 %. Furthermore, an increasing process is also expected regarding to the required water demand volume. The most and the least expected increase in the water demand volume is about 13 and 5 % for A2 and B1 scenarios, respectively. Considering the results and the limited water resources in the study area, it is crucial to provide water resources planning in order to reduce the negative effects of climate change. Therefore, the adaptation scenarios with the climate change related to crop pattern and water consumption should be taken into account.

  8. Deriving Requirements for Pervasive Well-Being Technology From Work Stress and Intervention Theory: Framework and Case Study.

    Science.gov (United States)

    Koldijk, Saskia; Kraaij, Wessel; Neerincx, Mark A

    2016-07-05

    Stress in office environments is a big concern, often leading to burn-out. New technologies are emerging, such as easily available sensors, contextual reasoning, and electronic coaching (e-coaching) apps. In the Smart Reasoning for Well-being at Home and at Work (SWELL) project, we explore the potential of using such new pervasive technologies to provide support for the self-management of well-being, with a focus on individuals' stress-coping. Ideally, these new pervasive systems should be grounded in existing work stress and intervention theory. However, there is a large diversity of theories and they hardly provide explicit directions for technology design. The aim of this paper is to present a comprehensive and concise framework that can be used to design pervasive technologies that support knowledge workers to decrease stress. Based on a literature study we identify concepts relevant to well-being at work and select different work stress models to find causes of work stress that can be addressed. From a technical perspective, we then describe how sensors can be used to infer stress and the context in which it appears, and use intervention theory to further specify interventions that can be provided by means of pervasive technology. The resulting general framework relates several relevant theories: we relate "engagement and burn-out" to "stress", and describe how relevant aspects can be quantified by means of sensors. We also outline underlying causes of work stress and how these can be addressed with interventions, in particular utilizing new technologies integrating behavioral change theory. Based upon this framework we were able to derive requirements for our case study, the pervasive SWELL system, and we implemented two prototypes. Small-scale user studies proved the value of the derived technology-supported interventions. The presented framework can be used to systematically develop theory-based technology-supported interventions to address work stress. In

  9. Suggestion of a Framework to Analyze Failure Modes and Effect of Cyber Attacks in NPP

    Energy Technology Data Exchange (ETDEWEB)

    Lee, Chan Young; Seong, Poong Hyun [KAIST, Daejeon (Korea, Republic of)

    2016-05-15

    The cyber security issue on NPP is inevitable issue. Unlike general cyber security, cyber-physical system like NPP can induce serious consequences such as core damage by cyber-attack. So in this paper, to find how hacker can attack the NPP, (1) PSA results were utilized to find the relationship between physical system and cyber-attack and (2) vulnerabilities on digital control systems were investigated to find how hacker can implement the possible attack. It is expected that these steps are utilized when establishing penetration test plans or cyber security drill plans.

  10. Suggestion of a Framework to Analyze Failure Modes and Effect of Cyber Attacks in NPP

    International Nuclear Information System (INIS)

    Lee, Chan Young; Seong, Poong Hyun

    2016-01-01

    The cyber security issue on NPP is inevitable issue. Unlike general cyber security, cyber-physical system like NPP can induce serious consequences such as core damage by cyber-attack. So in this paper, to find how hacker can attack the NPP, (1) PSA results were utilized to find the relationship between physical system and cyber-attack and (2) vulnerabilities on digital control systems were investigated to find how hacker can implement the possible attack. It is expected that these steps are utilized when establishing penetration test plans or cyber security drill plans

  11. [Required Framework for the Collection of Real-life Data: An Example from University Eye Hospital Munich].

    Science.gov (United States)

    Kortüm, Karsten; Kern, Christoph; Meyer, Gerhard; Priglinger, Siegfried; Hirneiß, Christoph

    2017-12-01

    Background The importance of evaluating real-life data is constantly increasing. Currently available computer systems better allow for analyses of data, as more and more data is available in a digital form. Before a project for real-life data analyses is started, technical considerations and staff, legal, and data protection procedures need to be addressed. In this manuscript, experiences made at the University Eye Hospital in Munich will be shared. Materials and Methods Legal requirements, as found in laws and guidelines governing documentation and data privacy, are highlighted. Technical requirements for information technology infrastructure and software are defined. A survey conducted by the German Ophthalmological Society, among German eye hospitals investigating the current state of digitalization, was conducted. Also, staff requirements are outlined. Results A database comprising results of 330,801 patients was set up. It includes all diagnoses, procedures, clinical findings and results from diagnostic devices. This database was approved by the local data protection officer. In less than half of German eye hospitals (n = 21) that participated in the survey (n = 54), a complete electronic documentation is done. Fourteen institutions are completely paper-based, and the remainder of the hospitals used a mixed system. Conclusion In this work, we examined the framework that is required to develop a comprehensive database containing real-life data from clinics. In future, these databases will become increasingly important as more and more innovation are made in decision support systems. The base for this is comprehensive and well-curated databases. Georg Thieme Verlag KG Stuttgart · New York.

  12. Cyber crisis management: a decision-support framework for disclosing security incident information

    NARCIS (Netherlands)

    Kulikova, Olga; Heil, Ronald; van den Berg, Jan; Pieters, Wolter

    2012-01-01

    The growing sophistication and frequency of cyber attacks force modern companies to be prepared beforehand for potential cyber security incidents and data leaks. A proper incident disclosure strategy can significantly improve timeliness and effectiveness of incident response activities, reduce legal

  13. Understanding of the Cyber Security and the Development of CAPTCHA

    Science.gov (United States)

    Yang, Yu

    2018-04-01

    CAPTCHA is the abbreviation of "Completely Automated Public Turing Test to Tell Computers and Humans Apart", which is a program algorithm for distinguishing between computers and humans. It is able to generate and evaluate tests that are easy for human to pass yet are not possible for computers to. Common CAPTCHA generally contains symbols, text, pictures, and even videos, which is mainly used for human-computer verification. With the popularization of the Internet and its related applications, many malicious attacks against websites, systems and servers gradually appear. Therefore, the research on CAPTCHA is especially important. This article will briefly summarize and introduce the existing CAPTCHA technology, and summarizes the common problems of network attacks and information security. After listing the common type of CAPTCHA, it will finally propose feasible suggestions for the development of CAPTCHA.

  14. Performance Analysis of Cyber Security Awareness Delivery Methods

    Science.gov (United States)

    Abawajy, Jemal; Kim, Tai-Hoon

    In order to decrease information security threats caused by human-related vulnerabilities, an increased concentration on information security awareness and training is necessary. There are numerous information security awareness training delivery methods. The purpose of this study was to determine what delivery method is most successful in providing security awareness training. We conducted security awareness training using various delivery methods such as text based, game based and a short video presentation with the aim of determining user preference delivery methods. Our study suggests that a combined delvery methods are better than individual secrity awareness delivery method.

  15. Cyber security challenges in Smart Cities: Safety, security and privacy

    Science.gov (United States)

    Elmaghraby, Adel S.; Losavio, Michael M.

    2014-01-01

    The world is experiencing an evolution of Smart Cities. These emerge from innovations in information technology that, while they create new economic and social opportunities, pose challenges to our security and expectations of privacy. Humans are already interconnected via smart phones and gadgets. Smart energy meters, security devices and smart appliances are being used in many cities. Homes, cars, public venues and other social systems are now on their path to the full connectivity known as the “Internet of Things.” Standards are evolving for all of these potentially connected systems. They will lead to unprecedented improvements in the quality of life. To benefit from them, city infrastructures and services are changing with new interconnected systems for monitoring, control and automation. Intelligent transportation, public and private, will access a web of interconnected data from GPS location to weather and traffic updates. Integrated systems will aid public safety, emergency responders and in disaster recovery. We examine two important and entangled challenges: security and privacy. Security includes illegal access to information and attacks causing physical disruptions in service availability. As digital citizens are more and more instrumented with data available about their location and activities, privacy seems to disappear. Privacy protecting systems that gather data and trigger emergency response when needed are technological challenges that go hand-in-hand with the continuous security challenges. Their implementation is essential for a Smart City in which we would wish to live. We also present a model representing the interactions between person, servers and things. Those are the major element in the Smart City and their interactions are what we need to protect. PMID:25685517

  16. Applications for cyber security - System and application monitoring

    International Nuclear Information System (INIS)

    Marron, J. E.

    2006-01-01

    Standard network security measures are adequate for defense against external attacks. However, many experts agree that the greater threat is from internal sources. Insiders with malicious intentions can change controller instructions, change alarm thresholds, and issue commands to equipment which can damage equipment and compromise control system integrity. In addition to strict physical security the state of the system must be continually monitored. System and application monitoring goes beyond the capabilities of network security appliances. It will include active processes, operating system services, files, network adapters and IP addresses. The generation of alarms is a crucial feature of system and application monitoring. The alarms should be integrated to avoid the burden on operators of checking multiple locations for security violations. Tools for system and application monitoring include commercial software, free software, and ad-hoc tools that can be easily created. System and application monitoring is part of a 'defense-in-depth' approach to a control network security plan. Layered security measures prevent an individual security measure failure from being exploited into a successful security breach. Alarming of individual failures is essential for rapid isolation and correction of single failures. System and application monitoring is the innermost layer of this defense strategy. (authors)

  17. Gebrek aan cyber security bedreigt autonoom rijdende auto

    NARCIS (Netherlands)

    Leenstra, H.; van den Berg, J.; van Wee, G.P.

    2017-01-01

    Connected- en de autonoom rijdende auto’s communiceren constant met hun omgeving. Deze rijdende computers zijn nooit ontworpen om kwaadwillende hackers buiten te houden. Het is tijd om de ICT architectuur in onze auto’s grondig te herzien om ervoor te zorgen dat de fysieke consumentenveiligheid

  18. Cyber security challenges in Smart Cities: Safety, security and privacy.

    Science.gov (United States)

    Elmaghraby, Adel S; Losavio, Michael M

    2014-07-01

    The world is experiencing an evolution of Smart Cities. These emerge from innovations in information technology that, while they create new economic and social opportunities, pose challenges to our security and expectations of privacy. Humans are already interconnected via smart phones and gadgets. Smart energy meters, security devices and smart appliances are being used in many cities. Homes, cars, public venues and other social systems are now on their path to the full connectivity known as the "Internet of Things." Standards are evolving for all of these potentially connected systems. They will lead to unprecedented improvements in the quality of life. To benefit from them, city infrastructures and services are changing with new interconnected systems for monitoring, control and automation. Intelligent transportation, public and private, will access a web of interconnected data from GPS location to weather and traffic updates. Integrated systems will aid public safety, emergency responders and in disaster recovery. We examine two important and entangled challenges: security and privacy. Security includes illegal access to information and attacks causing physical disruptions in service availability. As digital citizens are more and more instrumented with data available about their location and activities, privacy seems to disappear. Privacy protecting systems that gather data and trigger emergency response when needed are technological challenges that go hand-in-hand with the continuous security challenges. Their implementation is essential for a Smart City in which we would wish to live. We also present a model representing the interactions between person, servers and things. Those are the major element in the Smart City and their interactions are what we need to protect.

  19. 76 FR 22409 - Nationwide Cyber Security Review (NCSR) Assessment

    Science.gov (United States)

    2011-04-21

    ... assessment stakeholders will be states and large urban areas. The NCSR is a voluntary self- assessment designed to measure cybersecurity preparedness and resilience. Through the NCSR, CSEP will examine... other forms of information technology, e.g., permitting electronic submissions of responses. Analysis...

  20. 76 FR 43696 - Nationwide Cyber Security Review (NCSR) Assessment

    Science.gov (United States)

    2011-07-21

    ... other forms of information technology, e.g., permitting electronic submissions of responses. FOR FURTHER... Emergency Readiness Team (US-CERT) Secure Portal. The assessment stakeholders will be states and major urban... resilience. Through the NCSR, CSEP will examine relationships, interactions, and processes governing IT...

  1. IEC 61850 and IEC 62351 Cyber Security Acceleration Workshop

    Energy Technology Data Exchange (ETDEWEB)

    Clements, Samuel L.; Edgar, Thomas W.; Manz, David O.

    2012-04-01

    The purpose of this workshop was to identify and discuss concerns with the use and adoption of IEC 62351 security standard for IEC 61850 compliant control system products. The industry participants discussed performance, interoperability, adoption, challenges, business cases, and future issues.

  2. Cyber Security and Reliability in a Digital Cloud

    Science.gov (United States)

    2013-01-01

    Runs the Mission  Mr. Bret Hartman  RSA  The Intelligent Security  Operations Center and  Advanced Persistent Threats  Mr. Chris C. Kemp  OpenStack  Cloud...Software  OpenStack  Cloud Software  Mr. Pravin Kothari  CipherCloud  Cloud Data Protection  Dr. John C. Mitchell  Stanford University  Innovation in

  3. Cyber Security Scenarios and Control for Small and Medium Enterprises

    OpenAIRE

    Nilaykumar Kiran SANGANI; Balakrishnan VIJAYAKUMAR

    2012-01-01

    As the world advances towards the computing era, security threats keeps on increasing in the form of malware, viruses, internet attack, theft of IS assets / technology and a lot more. This is a major concern for any form of business. Loss in company’s status / liability / reputation is a huge downfall for a running business. We have witnessed the attacks getting carried out; large firm’s data getting breached / government bodies’ sites getting phished / attacked. These huge entities hav...

  4. Strengthening DoD Cyber Security with the Vulnerability Market

    Science.gov (United States)

    2014-01-01

    50,000 – $100,000 Windows $60,000 – $120,000 Firefox or Safari $60,000 – $150,000 Chrome or Internet Explorer $80,000 – $200,000 iOS $100,000...the CTB metric for the Google Chrome OS at $110,000. Accordingly, this metric could be used by Google to compare its security to other operating...Mozilla Foundation. (n.d.). Mozilla. Retrieved from https://www.mozilla. org/en-US/foundation/ Thomson, I. (2013, March 8). Pwn2Own: IE10, Firefox

  5. The process matters: cyber security in industrial control systems

    NARCIS (Netherlands)

    Hadziosmanovic, D.

    2014-01-01

    An industrial control system (ICS) is a computer system that controls industrial processes such as power plants, water and gas distribution, food production, etc. Since cyber-attacks on an ICS may have devastating consequences on human lives and safety in general, the security of ICS is important.

  6. Data Mining for Cyber Security | Ikemelu | AFRREV STECH: An ...

    African Journals Online (AJOL)

    If you would like more information about how to print, save, and work with PDFs, Highwire Press provides a helpful Frequently Asked Questions about PDFs. Alternatively, you can download the PDF file directly to your computer, from where it can be opened using a PDF reader. To download the PDF, click the Download link ...

  7. Improving Cyber-Security of Power System State Estimators

    OpenAIRE

    Giannini, Martina

    2014-01-01

    During the last century, technological advances have deeply renewed many critical infrastructures, such as transportation networks and power systems. In fact, the strong interconnection between physical process, communication channels, and control systems have led to the new concept of cyber-physical systems. Next to countless new advantages, these systems unfortunately have also new weaknesses. An example is cyber-attacks: malicious intrusions into the communication channel turned to manipul...

  8. Cyber security challenges in Smart Cities: Safety, security and privacy

    Directory of Open Access Journals (Sweden)

    Adel S. Elmaghraby

    2014-07-01

    Full Text Available The world is experiencing an evolution of Smart Cities. These emerge from innovations in information technology that, while they create new economic and social opportunities, pose challenges to our security and expectations of privacy. Humans are already interconnected via smart phones and gadgets. Smart energy meters, security devices and smart appliances are being used in many cities. Homes, cars, public venues and other social systems are now on their path to the full connectivity known as the “Internet of Things.” Standards are evolving for all of these potentially connected systems. They will lead to unprecedented improvements in the quality of life. To benefit from them, city infrastructures and services are changing with new interconnected systems for monitoring, control and automation. Intelligent transportation, public and private, will access a web of interconnected data from GPS location to weather and traffic updates. Integrated systems will aid public safety, emergency responders and in disaster recovery. We examine two important and entangled challenges: security and privacy. Security includes illegal access to information and attacks causing physical disruptions in service availability. As digital citizens are more and more instrumented with data available about their location and activities, privacy seems to disappear. Privacy protecting systems that gather data and trigger emergency response when needed are technological challenges that go hand-in-hand with the continuous security challenges. Their implementation is essential for a Smart City in which we would wish to live. We also present a model representing the interactions between person, servers and things. Those are the major element in the Smart City and their interactions are what we need to protect.

  9. Cyber Security on Nuclear Power Plant's Computer Systems

    International Nuclear Information System (INIS)

    Shin, Ick Hyun

    2010-01-01

    Computer systems are used in many different fields of industry. Most of us are taking great advantages from the computer systems. Because of the effectiveness and great performance of computer system, we are getting so dependable on the computer. But the more we are dependable on the computer system, the more the risk we will face when the computer system is unavailable or inaccessible or uncontrollable. There are SCADA, Supervisory Control And Data Acquisition, system which are broadly used for critical infrastructure such as transportation, electricity, water management. And if the SCADA system is vulnerable to the cyber attack, it is going to be nation's big disaster. Especially if nuclear power plant's main control systems are attacked by cyber terrorists, the results may be huge. Leaking of radioactive material will be the terrorist's main purpose without using physical forces. In this paper, different types of cyber attacks are described, and a possible structure of NPP's computer network system is presented. And the paper also provides possible ways of destruction of the NPP's computer system along with some suggestions for the protection against cyber attacks

  10. Cyber security awareness initiatives in South Africa: a synergy approach

    CSIR Research Space (South Africa)

    Dlamini, Z

    2012-03-01

    Full Text Available Technological advances have changed the manner in which ordinary citizens conduct their daily activities. Many of these activities are carried out over the Internet. These include filling tax returns, online banking, job searching and general...

  11. Cyber-security in smart cities: The case of Dubai

    OpenAIRE

    Efthymiopoulos, Marios-Panagiotis

    2016-01-01

    The city of Dubai emerges as a leading partner in not only technology innovation but also designed infrastructure and strategic security. There is a strategy, which will globally add the city and leadership to the leading smart cities of the world. Considering current and future challenges, the strategic aim is to "smart" wire the city of Dubai by 2020. Dubai is a city of strategic technology, innovation and management. It is a global, vibrant and emerging economy among others, that can becom...

  12. Study on Cyber Security and Threat Evaluation in SCADA Systems

    Science.gov (United States)

    2012-03-01

    125 4.3.2 ISO 27001 , 27002 ............................................................................................ 125 4.3.3...system environments. 4.3.2 ISO 27001 , 27002 The ISO 27001 and 27002 standards ensure proper security processes and technology are implemented in...asset owner, integrators, and vendors. Now it is an independent set of 3 standards which resemble the ISO /IEC 27001 and 27002 standards. ISO /IEC

  13. Efficient packet forwarding using cyber-security aware policies

    Science.gov (United States)

    Ros-Giralt, Jordi

    2017-10-25

    For balancing load, a forwarder can selectively direct data from the forwarder to a processor according to a loading parameter. The selective direction includes forwarding the data to the processor for processing, transforming and/or forwarding the data to another node, and dropping the data. The forwarder can also adjust the loading parameter based on, at least in part, feedback received from the processor. One or more processing elements can store values associated with one or more flows into a structure without locking the structure. The stored values can be used to determine how to direct the flows, e.g., whether to process a flow or to drop it. The structure can be used within an information channel providing feedback to a processor.

  14. Cyber Security: Big Data Think II Working Group Meeting

    Science.gov (United States)

    Hinke, Thomas; Shaw, Derek

    2015-01-01

    This presentation focuses on approaches that could be used by a data computation center to identify attacks and ensure malicious code and backdoors are identified if planted in system. The goal is to identify actionable security information from the mountain of data that flows into and out of an organization. The approaches are applicable to big data computational center and some must also use big data techniques to extract the actionable security information from the mountain of data that flows into and out of a data computational center. The briefing covers the detection of malicious delivery sites and techniques for reducing the mountain of data so that intrusion detection information can be useful, and not hidden in a plethora of false alerts. It also looks at the identification of possible unauthorized data exfiltration.

  15. Governmental, Legal and Regulatory Framework for Safety. General Safety Requirements. Part 1 (French Edition); Cadre gouvernemental, legislatif et reglementaire de la surete. Prescriptions generales de surete. Partie 1

    Energy Technology Data Exchange (ETDEWEB)

    NONE

    2010-11-15

    The objective of this publication is to establish requirements in respect of the governmental, legal and regulatory framework for safety. It covers the essential aspects of the framework for establishing a regulatory body and taking other actions necessary to ensure the effective regulatory control of facilities and activities utilized for peaceful purposes. Other responsibilities and functions, such as liaison within the global safety regime and on support services for safety (including radiation protection), emergency preparedness and response, nuclear security, and the State system of accounting for and control of nuclear material, are also covered.

  16. Governmental, Legal and Regulatory Framework for Safety. General Safety Requirements. Part 1 (Spanish Edition); Marco gubernamental, juridico y regulador para la seguridad. Requisitos de Seguridad Generales. Parte 1

    Energy Technology Data Exchange (ETDEWEB)

    NONE

    2010-11-15

    The objective of this publication is to establish requirements in respect of the governmental, legal and regulatory framework for safety. It covers the essential aspects of the framework for establishing a regulatory body and taking other actions necessary to ensure the effective regulatory control of facilities and activities utilized for peaceful purposes. Other responsibilities and functions, such as liaison within the global safety regime and on support services for safety (including radiation protection), emergency preparedness and response, nuclear security, and the State system of accounting for and control of nuclear material, are also covered.

  17. UNRAVELING THE CYBER SECURITY MARKET: THE STRUGGLES AMONG CYBER SECURITY COMPANIES AND THE PRODUCTION OF CYBER (IN)SECURITY

    OpenAIRE

    LUÍSA CRUZ LOBATO

    2016-01-01

    A presente dissertação investiga o papel das companhias de segurança cibernética na produção da segurança cibernética contemporânea. A crescente pressão para securitizar o ciberespaço contribuiu para o crescimento de um lucrativo mercado voltado para a provisão de produtos e serviços para clientes comerciais e governamentais. Utilizando uma perspectiva inspirada em Bourdieu, o trabalho: analisa as condições históricas nas quais as tecnologias da informação ganharam terreno no debate de segura...

  18. A framework for quality assessment of just-in-time requirements : The case of open source feature requests

    NARCIS (Netherlands)

    Heck, P.M.; Zaidman, A.E.

    2017-01-01

    Until now, quality assessment of requirements has focused on traditional up-front requirements. Contrasting these traditional requirements are just-in-time (JIT) requirements, which are by definition incomplete, not specific and might be ambiguous when initially specified, indicating a different

  19. Optimal Management of DoD Lands for Military Training, Ecosystem Services, and Renewable Energy Generation: Framework and Data Requirements

    Science.gov (United States)

    2013-01-01

    published by ERDC, visit the ERDC online library at http://acwc.sdp.sirsi.net/ client /default. Base Facilities Environmental Quality ERDC/CERL TR...generation—on the primary land-management driver, the military training. 1.3 Approach The modeling framework was developed to generate a Pareto

  20. Trust Management Considerations For the Cooperative Infrastructure Defense Framework: Trust Relationships, Evidence, and Decisions

    Energy Technology Data Exchange (ETDEWEB)

    Maiden, Wendy M.

    2009-12-01

    Cooperative Infrastructure Defense (CID) is a hierarchical, agent-based, adaptive, cyber-security framework designed to collaboratively protect multiple enclaves or organizations participating in a complex infrastructure. CID employs a swarm of lightweight, mobile agents called Sensors designed to roam hosts throughout a security enclave to find indications of anomalies and report them to host-based Sentinels. The Sensors’ findings become pieces of a larger puzzle, which the Sentinel puts together to determine the problem and respond per policy as given by the enclave-level Sergeant agent. Horizontally across multiple enclaves and vertically within each enclave, authentication and access control technologies are necessary but insufficient authorization mechanisms to ensure that CID agents continue to fulfill their roles in a trustworthy manner. Trust management fills the gap, providing mechanisms to detect malicious agents and offering more robust mechanisms for authorization. This paper identifies the trust relationships throughout the CID hierarchy, the types of trust evidence that could be gathered, and the actions that the CID system could take if an entity is determined to be untrustworthy.

  1. Advancing Marine Biological Observations and Data Requirements of the Complementary Essential Ocean Variables (EOVs and Essential Biodiversity Variables (EBVs Frameworks

    Directory of Open Access Journals (Sweden)

    Frank E. Muller-Karger

    2018-06-01

    Full Text Available Measurements of the status and trends of key indicators for the ocean and marine life are required to inform policy and management in the context of growing human uses of marine resources, coastal development, and climate change. Two synergistic efforts identify specific priority variables for monitoring: Essential Ocean Variables (EOVs through the Global Ocean Observing System (GOOS, and Essential Biodiversity Variables (EBVs from the Group on Earth Observations Biodiversity Observation Network (GEO BON (see Data Sheet 1 in Supplementary Materials for a glossary of acronyms. Both systems support reporting against internationally agreed conventions and treaties. GOOS, established under the auspices of the Intergovernmental Oceanographic Commission (IOC, plays a leading role in coordinating global monitoring of the ocean and in the definition of EOVs. GEO BON is a global biodiversity observation network that coordinates observations to enhance management of the world's biodiversity and promote both the awareness and accounting of ecosystem services. Convergence and agreement between these two efforts are required to streamline existing and new marine observation programs to advance scientific knowledge effectively and to support the sustainable use and management of ocean spaces and resources. In this context, the Marine Biodiversity Observation Network (MBON, a thematic component of GEO BON, is collaborating with GOOS, the Ocean Biogeographic Information System (OBIS, and the Integrated Marine Biosphere Research (IMBeR project to ensure that EBVs and EOVs are complementary, representing alternative uses of a common set of scientific measurements. This work is informed by the Joint Technical Commission for Oceanography and Marine Meteorology (JCOMM, an intergovernmental body of technical experts that helps international coordination on best practices for observing, data management and services, combined with capacity development expertise

  2. 75 FR 71152 - Southern California Edison; San Onofre Nuclear Generating Station, Unit 2 and Unit 3; Exemption

    Science.gov (United States)

    2010-11-22

    ... requirements of this section through its Commission-approved Physical Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Cyber Security Plan referred to collectively hereafter as...

  3. 75 FR 11947 - STP Nuclear Operating Company, South Texas Project, Units 1 and 2; Exemption

    Science.gov (United States)

    2010-03-12

    ... requirements of this section through its Commission-approved Physical Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Cyber Security Plan referred to collectively hereafter as...

  4. 75 FR 9449 - Virginia Electric and Power Company; North Anna Power Station, Unit Nos. 1 and 2

    Science.gov (United States)

    2010-03-02

    ... requirements of this section through its Commission-approved Physical Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Cyber Security Plan referred to collectively hereafter as...

  5. Science of Security Lablet - Scalability and Usability

    Science.gov (United States)

    2014-12-16

    Cybersecurity_Framework.ashx Byres, Eric and Justin Lowe, 2004, The Myths and Facts behind Cyber Security Risks for Industrial Control Systems, Proceedings of the VDE ...Myths and Facts behind Cyber Security Risks for Industria l Control Systems, Proceedings of the VDE Kongress, 2004. Kshetri, Nir, 2005, Pattern of

  6. Deception used for Cyber Defense of Control Systems

    Energy Technology Data Exchange (ETDEWEB)

    Wayne F. Boyer; Miles A. McQueen

    2009-05-01

    Control system cyber security defense mechanisms may employ deception to make it more difficult for attackers to plan and execute successful attacks. These deceptive defense mechanisms are organized and initially explored according to a specific deception taxonomy and the seven abstract dimensions of security previously proposed as a framework for the cyber security of control systems.

  7. Price and tax measures and illicit trade in the framework convention on tobacco control: what we know and what research is required.

    Science.gov (United States)

    van Walbeek, Corne; Blecher, Evan; Gilmore, Anna; Ross, Hana

    2013-04-01

    Article 6 of the Framework Convention on Tobacco Control commits Parties to use tax and price policies to reduce tobacco use, whereas Article 15 commits Parties to implement measures to eliminate the illicit trade in tobacco products. This paper identifies research gaps/needs, especially in low- and middle-income countries, which, if adequately addressed, would help in implementing Articles 6 and 15. Based on a recent comprehensive review on the impact of tax and price on tobacco consumption and a summary of reviews and narratives about the illicit tobacco market, research gaps are identified. Countries have highly diverse research needs, depending on the stage of the tobacco epidemic, previous research and data availability, and making a ranking of research needs infeasible. Broad issues for further research are the following: (1) monitoring tobacco consumption, prices, and taxes, (2) assessing the effectiveness of the tax structure in generating revenue and reducing tobacco use, (3) strengthening the tax administration system in order to reduce tax evasion and tax avoidance, (4) improving our understanding of the political economy of tobacco tax policy, and (5) employing a multidisciplinary approach to assessing the magnitude of illicit tobacco trade. At a technical level, the case for increasing excise taxes to improve public health and increase government revenue is easily made, but the political and policy environment is often not supportive. In order to effectively impact policy, the required approach would typically make use of rigorous economic techniques, and be cognizant of the political economy of raising excise taxes.

  8. Detecting Human Hydrologic Alteration from Diversion Hydropower Requires Universal Flow Prediction Tools: A Proposed Framework for Flow Prediction in Poorly-gauged, Regulated Rivers

    Science.gov (United States)

    Kibler, K. M.; Alipour, M.

    2016-12-01

    Achieving the universal energy access Sustainable Development Goal will require great investment in renewable energy infrastructure in the developing world. Much growth in the renewable sector will come from new hydropower projects, including small and diversion hydropower in remote and mountainous regions. Yet, human impacts to hydrological systems from diversion hydropower are poorly described. Diversion hydropower is often implemented in ungauged rivers, thus detection of impact requires flow analysis tools suited to prediction in poorly-gauged and human-altered catchments. We conduct a comprehensive analysis of hydrologic alteration in 32 rivers developed with diversion hydropower in southwestern China. As flow data are sparse, we devise an approach for estimating streamflow during pre- and post-development periods, drawing upon a decade of research into prediction in ungauged basins. We apply a rainfall-runoff model, parameterized and forced exclusively with global-scale data, in hydrologically-similar gauged and ungauged catchments. Uncertain "soft" data are incorporated through fuzzy numbers and confidence-based weighting, and a multi-criteria objective function is applied to evaluate model performance. Testing indicates that the proposed framework returns superior performance (NSE = 0.77) as compared to models parameterized by rote calibration (NSE = 0.62). Confident that the models are providing `the right answer for the right reasons', our analysis of hydrologic alteration based on simulated flows indicates statistically significant hydrologic effects of diversion hydropower across many rivers. Mean annual flows, 7-day minimum and 7-day maximum flows decreased. Frequency and duration of flow exceeding Q25 decreased while duration of flows sustained below the Q75 increased substantially. Hydrograph rise and fall rates and flow constancy increased. The proposed methodology may be applied to improve diversion hydropower design in data-limited regions.

  9. 78 FR 9951 - Excepted Service

    Science.gov (United States)

    2013-02-12

    ...) Not to exceed 3000 positions that require unique cyber security skills and knowledge to perform cyber..., distributed control systems security, cyber incident response, cyber exercise facilitation and management... and program (GS-0301) series when those positions require unique cyber security skills and knowledge...

  10. Price and Tax Measures and Illicit Trade in the Framework Convention on Tobacco Control: What We Know and What Research Is Required

    Science.gov (United States)

    2013-01-01

    Introduction: Article 6 of the Framework Convention on Tobacco Control commits Parties to use tax and price policies to reduce tobacco use, whereas Article 15 commits Parties to implement measures to eliminate the illicit trade in tobacco products. This paper identifies research gaps/needs, especially in low- and middle-income countries, which, if adequately addressed, would help in implementing Articles 6 and 15. Methods: Based on a recent comprehensive review on the impact of tax and price on tobacco consumption and a summary of reviews and narratives about the illicit tobacco market, research gaps are identified. Results: Countries have highly diverse research needs, depending on the stage of the tobacco epidemic, previous research and data availability, and making a ranking of research needs infeasible. Broad issues for further research are the following: (1) monitoring tobacco consumption, prices, and taxes, (2) assessing the effectiveness of the tax structure in generating revenue and reducing tobacco use, (3) strengthening the tax administration system in order to reduce tax evasion and tax avoidance, (4) improving our understanding of the political economy of tobacco tax policy, and (5) employing a multidisciplinary approach to assessing the magnitude of illicit tobacco trade. Conclusions: At a technical level, the case for increasing excise taxes to improve public health and increase government revenue is easily made, but the political and policy environment is often not supportive. In order to effectively impact policy, the required approach would typically make use of rigorous economic techniques, and be cognizant of the political economy of raising excise taxes. PMID:22987785

  11. A Modeling Framework to Support Resilient Evolution Planning of Smart Grids

    NARCIS (Netherlands)

    Zoppi, Tomasso; Bessler, Sanford; Ceccarelli, Andrea; Lambert, Edward; Tseng Lau, Eng; Vasenev, Alexandr; Lau, Eng Tseng; Chai, Michael K.K.; Chen, Yue; Jung, Oliver; Leung, Victor C.M.; Yang, Kun; Bessler, Sandford; Loo, Jonathan; Nakayama, Tomonori

    2017-01-01

    Cyber security is becoming more and more relevant with the advent of large-scale systems made of independent and autonomous constituent systems that interoperate to achieve complex goals. To ensure security of cyber-physical systems, it is important to analyze identified threats and their possible

  12. Cost-effectiveness of Security Measures: A model-based Framework

    NARCIS (Netherlands)

    Pieters, Wolter; Probst, Christian W.; Lukszo, Zofia; Montoya, L.; Tsiakis, Theodosios; Kargidis, Theodorus; Katsaros, Panagiotis

    Recently, cyber security has become an important topic on the agenda of many organisations. It is already widely acknowledged that attacks do happen, and decision makers face the problem of how to respond. As it is almost impossible to secure a complex system completely, it is important to have an

  13. A Requirements-Based Exploration of Open-Source Software Development Projects--Towards a Natural Language Processing Software Analysis Framework

    Science.gov (United States)

    Vlas, Radu Eduard

    2012-01-01

    Open source projects do have requirements; they are, however, mostly informal, text descriptions found in requests, forums, and other correspondence. Understanding such requirements provides insight into the nature of open source projects. Unfortunately, manual analysis of natural language requirements is time-consuming, and for large projects,…

  14. Cyber Risk Management for Critical Infrastructure: A Risk Analysis Model and Three Case Studies.

    Science.gov (United States)

    Paté-Cornell, M-Elisabeth; Kuypers, Marshall; Smith, Matthew; Keller, Philip

    2018-02-01

    Managing cyber security in an organization involves allocating the protection budget across a spectrum of possible options. This requires assessing the benefits and the costs of these options. The risk analyses presented here are statistical when relevant data are available, and system-based for high-consequence events that have not happened yet. This article presents, first, a general probabilistic risk analysis framework for cyber security in an organization to be specified. It then describes three examples of forward-looking analyses motivated by recent cyber attacks. The first one is the statistical analysis of an actual database, extended at the upper end of the loss distribution by a Bayesian analysis of possible, high-consequence attack scenarios that may happen in the future. The second is a systems analysis of cyber risks for a smart, connected electric grid, showing that there is an optimal level of connectivity. The third is an analysis of sequential decisions to upgrade the software of an existing cyber security system or to adopt a new one to stay ahead of adversaries trying to find their way in. The results are distributions of losses to cyber attacks, with and without some considered countermeasures in support of risk management decisions based both on past data and anticipated incidents. © 2017 Society for Risk Analysis.

  15. PHP frameworks

    OpenAIRE

    Srša, Aljaž

    2016-01-01

    The thesis presents one of the four most popular PHP web frameworks: Laravel, Symfony, CodeIgniter and CakePHP. These frameworks are compared with each other according to the four criteria, which can help with the selection of a framework. These criteria are size of the community, quality of official support, comprehensibility of framework’s documentation and implementation of functionalities in individual frameworks, which are automatic code generation, routing, object-relational mapping and...

  16. Development of a concept for the environmental risk assessment of biocidal products for authorization purposes. (BIOEXPO) Part 1: Framework and data requirements for environmental compartments

    NARCIS (Netherlands)

    Dokkum, H.P. van; Scholten, M.C.T.; Bakker, D.J.; Jak, R.G.; Bowmer, C.T.

    1998-01-01

    The BIOEXPO project is focussed on test data, required for the authorization of biocidal products. The draft EC Biocidal Products Directive distinguishes between a common core data set (Annex II) and an additional data set, with specific data requirements for biocidal product types (Annex III). The

  17. Law of the electricity sector in France. The legal framework for the French electricity supply between legal market deregulation requirements and public service obligations

    International Nuclear Information System (INIS)

    Buckler, Julius

    2016-01-01

    The process of creating an internal electricity market is still unfinished. This has, in addition to technical reasons, also legal reasons: The persistence of the structures and regulatory frameworks that have grown during monopoly times, in part is very strong, which is particularly evident in France. The power supply there is intensively controlled by its state as a public service, both indirectly by the state-owned company EDF and directly by statutory regulations. The market deregulation is not thereby completely prevented. However, together with the particular importance of nuclear power for the French power supply, considerable barriers to market opening are emerging. Against this background and out of the historical development, the author examines the current French law of the electricity sector across all value-creation stages in its relations to EU law. [de

  18. Specification of requirements for upgrades using digital instrument and control systems. Report prepared within the framework of the international working group on nuclear power plant control and instrumentation

    International Nuclear Information System (INIS)

    1999-01-01

    The need to develop good specifications of requirements for instrument and control (I and C) systems applies throughout the world and is becoming more and more important as more upgrades are planned. Better guidance on how to develop good requirements specifications would support safer, more effective and more economical refits and upgrades. The need for this was pointed out by the IAEA International Working Group on Nuclear Power Plant Control and Instrumentation (IWG-NPPCI). This report is the result of a series of advisory and consultants meetings held by the IAEA in 1997 and 1998 in Vienna. The scope of the activities described covers a methodology for the determination of requirements and the development of the necessary specifications and plans needed through the life-cycle of digital instrumentation and control systems. It is restricted to technical aspects and indicates subjects which should be included in specifications and plans at different phases

  19. Situational Awareness Analysis Tools for Aiding Discovery of Security Events and Patterns

    National Research Council Canada - National Science Library

    Kumar, Vipin; Kim, Yongdae; Srivastava, Jaideep; Zhang, Zhi-Li; Shaneck, Mark; Chandola, Varun; Liu, Haiyang; Choi, Changho; Simon, Gyorgy; Eilertson, Eric

    2005-01-01

    .... The University of Minnesota team has developed a comprehensive, multi-stage analysis framework which provides tools and analysis methodologies to aid cyber security analysts in improving the quality...

  20. Growth potential and habitat requirements of endangered age-0 pallid sturgeon (Scaphirhynchus albus) in the Missouri River, USA, determined using a individual-based model framework

    Science.gov (United States)

    Deslauriers, David; Heironimus, Laura B.; Rapp, Tobias; Graeb, Brian D. S.; Klumb, Robert A.; Chipps, Steven R.

    2018-01-01

    An individual-based model framework was used to evaluate growth potential of the federally endangered pallid sturgeon (Scaphirhynchus albus) in the Missouri River. The model, developed for age-0 sturgeon, combines information on functional feeding response, bioenergetics and swimming ability to regulate consumption and growth within a virtual foraging arena. Empirical data on water temperature, water velocity and prey density were obtained from three sites in the Missouri River and used as inputs in the model to evaluate hypotheses concerning factors affecting pallid sturgeon growth. The model was also used to evaluate the impacts of environmental heterogeneity and water velocity on individual growth variability, foraging success and dispersal ability. Growth was simulated for a period of 100 days using 100 individuals (first feeding; 19 mm and 0.035 g) per scenario. Higher growth was shown to occur at sites where high densities of Ephemeroptera and Chironomidae larvae occurred throughout the growing season. Highly heterogeneous habitats (i.e., wide range of environmental conditions) and moderate water velocities (0.3 m/s) were also found to positively affect growth rates. The model developed here provides an important management and conservation tool for evaluating growth hypotheses and(or) identifying habitats in the Missouri River that are favourable to age-0 pallid sturgeon growth.

  1. Framework of orientation for the discussion of measures required to maintain and further the expert knowledge and qualification of nuclear power plant managers and supervisors

    International Nuclear Information System (INIS)

    Farber, G.

    1984-01-01

    This report is focussed on the important aspects of the training and retraining of nuclear power plant managers and supervisors. The functional levels of the onsite operating organization of nine nuclear power plants are described and analyzed in order to determine the comparability of management positions as well as the responsibilities of the job incumbents. Retraining requirements are suggested depending on position, responsibilities, and relevance to safety. The manager's role in case of emergencies leads to specific demands with regard to regular training to cope with inadequate core cooling and to mitigate accidents. (orig.) [de

  2. A Framework for Better Understanding and Enhancing Direct Contact Membrane Distillation (DCMD) in Terms of Module Design, Cost Analysis and Energy Required

    KAUST Repository

    AbuHannoud, Ali

    2011-07-01

    Water is becoming scarcer and several authors have highlighted the upcoming problem of higher water salinity and the difficulty of treating and discharging water. Moreover, current discoveries of problems with chemicals that have been used for pretreating or post-treating water alerted scientists to research better solutions to treat water. Membrane distillation (MD) is a promising technology that might replace current processes as it has lower pretreatment requirements combined with a tremendous ability to treat a wide range of feed sources while producing very high product quality. If it enters the market, it will have a big influence on all products, from food industry to spaceflight. However, there are several problems which make MD a hot topic for research. One of them is the question about the real cost of MD in terms of heating feed and cooling distillate over time with respect to product quantity and quality. In this work, extensive heating and cooling analyses are covered to answer this question in order to enhance the MD process. Results show energy cost to produce water and the main source of energy loss for direct contact membrane distillation (DCMD), and several suggestions are made in order to better understand and hence enhance the process.

  3. Critical Infrastructure Protection: Comments on the Proposed Cyber Security Information Act of 2000

    National Research Council Canada - National Science Library

    2000-01-01

    .... The concern over cyber threats is well placed. While the explosive growth in interconnectivity has contributed immeasurably to the nation's economy and well being, it also presents significant risks to our nation's computer systems and to the...

  4. Strengthening US DoD Cyber Security with the Vulnerability Market

    Science.gov (United States)

    2013-06-01

    Executable Source Lines of Code for Selected Weapon Systems [9] ..............10 Figure 2.2 Valley of Vulnerabilities...the remaining vulnerabilities is a function of time, funds, expertise, and system exposure. 11 Figure 2.2 Valley of Vulnerabilities...4.1 Quantitative Measurements: System_A Asset Valuation Components Value Justification Direct Costs Inventory $100,000 Financial Databases

  5. Cyber-Security Concerns Mount as Student Hacking Hits Schools: Districts Straining to Safeguard Online Networks

    Science.gov (United States)

    Borja, Rhea R.

    2006-01-01

    While schools rightly fear break-ins to their computer systems by professional criminals, students are increasingly giving educators almost as much to worry about. Reports of students' gaining access to school networks to change grades, delete teachers' files, or steal data are becoming more common, experts say, and many districts remain highly…

  6. Civil society must get up to speed on cyber security, watchdog warns ...

    International Development Research Centre (IDRC) Digital Library (Canada)

    2010-10-06

    Oct 6, 2010 ... As states encroach on Internet governance around the world, IDRC is ... if they fail to get up to speed on information security in the digital era, he says. ... an IDRC -funded project that is helping to build a regional network of ...

  7. Cyber Security and Habeas Data: The Latin American response to information security and data protection

    Directory of Open Access Journals (Sweden)

    Luisa Parraguez Kobek

    2016-11-01

    Full Text Available Habeas Data is not a commonly known concept, yet it is widely acknowledged in certain circles that deal with information security and data protection. Though it has been around for decades, it has recently gained momentum in Latin America. It is the legal notion that protects any and all information pertaining to the individual, from personal to financial, giving them the power to decide how and where such data can be used. At the same time, most Latin American countries have created laws that protect individuals if their  information is misused. This article examines the concept of Habeas Data from its inception to its current applications, and explains the different approaches and legislations passed in Latin American countries on data protection due to the rise of global cybercrime.

  8. Unlocking User-Centered Design Methods for Building Cyber Security Visualizations

    Science.gov (United States)

    2015-10-03

    3, 10, 24, 25, 30]. Personas are doc- uments meant to foster communication within a design team as archetypes of users, their behaviors, and their...to evaluation, these two user archetypes became the key motivation to justify and balance all our decisions as a design team. Outcomes We present the...domain-specific task for each archetypal user and visually illustrated the user’s cyber knowl- edge and situational awareness (SA) focus. We also

  9. Good governance and virtue in South Africa's cyber security policy implementation

    CSIR Research Space (South Africa)

    Burmeister, O

    2015-01-01

    Full Text Available Good governance from an ethical perspective in cyberdefence policy has been seen in terms of duty and consequentialism. Yet the negotiated view of virtue ethics can also address how nation states mitigate the risks of a cyber attack...

  10. Summary of The 3rd Control System Cyber-Security (CS)2/HEP Workshop

    CERN Document Server

    Lüders, S

    2011-01-01

    Over the last decade modern accelerator and experiment control systems have increasingly been based on commercial-off-the-shelf products (VME crates, programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, etc.), on Windows or Linux PCs, and on communication infrastructures using Ethernet and TCP/IP. Despite the benefits coming with this (r)evolution, new vulnerabilities are inherited, too: Worms and viruses spread within seconds via the Ethernet cable, and attackers are becoming interested in control systems. The Stuxnet worm of 2010 against a particular Siemens PLC is a unique example for a sophisticated attack against control systems [1]. Unfortunately, control PCs cannot be patched as fast as office PCs. Even worse, vulnerability scans at CERN using standard IT tools have shown that commercial automation systems lack fundamental security precautions: Some systems crashed during the scan, others could easily be stopped or their process data being ...

  11. Improving Student Engagement in the Study of Professional Ethics: Concepts and an Example in Cyber Security

    OpenAIRE

    Bustard, John D.

    2017-01-01

    In spite of the acknowledged importance of professional ethics, technical students often show little enthusiasm for studying the subject. This paper considers how such engagement might be improved. Four guiding principles for promoting engagement are identified: (1) aligning teaching content with student interests; (2) taking a pragmatic rather than a philosophical approach to issue resolution; (3) addressing the full complexity of real-world case studies; and (4) covering content in a way th...

  12. Challenges and Aspects of Cyber Security of the Republic of Croatia

    OpenAIRE

    Protrka Nikola; Marić Kristijan; Plećaš Mihael

    2017-01-01

    The development of the information and communication technology (ICT), regardless of its many advantages, unfortunately has its disadvantage – the abuse of the cyberworld. The global character of cyberspace is specific in terms of national legislation and its view of specificities. Some countries adopted the recommendation of the Convention on Cybercrime of the Council of Europe (Official Gazette NN-MU 9/02, 4/04) and amended their national legislation, whereas others kept implementing the...

  13. Programmable Logic Controllers for Research on the Cyber Security of Industrial Power Plants

    Science.gov (United States)

    2017-02-12

    any commercial carriers for shipment of the Goods . WESCO will use its reasonable efforts to comply with Buyer’s requests as to method and route of...and includes a small electrical substation control environment. The lab has already been used to support the research of the PI and his student ...large gToup of gTaduate and undergTadnatc students . The PI is also dcvclopiug a course on control systems security, and t lms wi ll use the lab to

  14. Federal Plan for Cyber Security and Information Assurance Research and Development

    Data.gov (United States)

    Networking and Information Technology Research and Development, Executive Office of the President — Powerful personal computers, high-bandwidth and wireless networking technologies, and the widespread use of the Internet have transformed stand-alone computing...

  15. Mean-Field-Game Model for Botnet Defense in Cyber-Security

    Energy Technology Data Exchange (ETDEWEB)

    Kolokoltsov, V. N., E-mail: v.kolokoltsov@warwick.ac.uk [University of Warwick, Department of Statistics (United Kingdom); Bensoussan, A. [The University of Texas at Dallas, School of Management (United States)

    2016-12-15

    We initiate the analysis of the response of computer owners to various offers of defence systems against a cyber-hacker (for instance, a botnet attack), as a stochastic game of a large number of interacting agents. We introduce a simple mean-field game that models their behavior. It takes into account both the random process of the propagation of the infection (controlled by the botner herder) and the decision making process of customers. Its stationary version turns out to be exactly solvable (but not at all trivial) under an additional natural assumption that the execution time of the decisions of the customers (say, switch on or out the defence system) is much faster that the infection rates.

  16. Cyber Security on Nuclear Power Plant's Computer Systems

    Energy Technology Data Exchange (ETDEWEB)

    Shin, Ick Hyun [Korea Institute of Nuclear Nonproliferation and Control, Daejeon (Korea, Republic of)

    2010-10-15

    Computer systems are used in many different fields of industry. Most of us are taking great advantages from the computer systems. Because of the effectiveness and great performance of computer system, we are getting so dependable on the computer. But the more we are dependable on the computer system, the more the risk we will face when the computer system is unavailable or inaccessible or uncontrollable. There are SCADA, Supervisory Control And Data Acquisition, system which are broadly used for critical infrastructure such as transportation, electricity, water management. And if the SCADA system is vulnerable to the cyber attack, it is going to be nation's big disaster. Especially if nuclear power plant's main control systems are attacked by cyber terrorists, the results may be huge. Leaking of radioactive material will be the terrorist's main purpose without using physical forces. In this paper, different types of cyber attacks are described, and a possible structure of NPP's computer network system is presented. And the paper also provides possible ways of destruction of the NPP's computer system along with some suggestions for the protection against cyber attacks

  17. Nuclear safety and (cyber)security at the heart of the digital revolution

    International Nuclear Information System (INIS)

    Kueny, L.; Levesque, J.

    2017-01-01

    The on-going digital revolution implies the sharing of data beyond the company walls, the development of connected objects and the setting of more and more complex digital networks. All of this increases the risk of being attacked by cyber-criminal and the probability is all the higher because new kinds of cyber-attacks appear every year. Originally nuclear industry has a culture of safety and has implemented numerous mechanisms of physical protection that slow down cyber-attacks. The humane factor is very often an important point for the success of a cyber-attack but the automation of repetitive tasks can reduce this risk. A cyber-attack can stay undetected if regularly overhauls of computer systems are not performed or if they are not adequately monitored. The reliability of digital tools for instance digital archives is a point that hinders the implementation of a total digital certification in the nuclear industry. (A.C.)

  18. Summary of the third control system cyber-security (CS)2/HEP workshop

    International Nuclear Information System (INIS)

    Lueders, S.

    2012-01-01

    Over the last decade modern accelerator and experiment control systems have increasingly been based on commercial-off-the-shelf products (VME crates, programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, etc.), on Windows or Linux PCs, and on communication infrastructures using Ethernet and TCP/IP. Despite the benefits coming with this (r)evolution, new vulnerabilities are inherited, too: Worms and viruses spread within seconds via the Ethernet cable, and attackers are becoming interested in control systems. The Stuxnet worm of 2010 against a particular Siemens PLC is a unique example for a sophisticated attack against control systems. Unfortunately, control PCs cannot be patched as fast as office PCs. Even worse, vulnerability scans at CERN using standard IT tools have shown that commercial automation systems lack fundamental security precautions: Some systems crashed during the scan, others could easily be stopped or their process data being altered. The third (CS)2/HEP workshop was intended to raise awareness; exchange good practices, ideas, and implementations; discuss what works and what not as well as their pros and cons; report on security events, lessons learned and successes; and update on progresses made at HEP laboratories around the world in order to secure control systems. It appears that deploying a 'Defense-in-depth approach is mandatory and corresponds to good practice while the full compliance to ISO-27000 standard is definitely both an ultimate goal and a very difficult challenge. There was a broad consensus to state that developing a 'security culture' among the players whatever they are: system experts, administrators, vendors or operators is the first step to do

  19. IAEA puts cyber security in focus for nuclear facilities in 2015

    Energy Technology Data Exchange (ETDEWEB)

    Shepherd, John [nuclear 24, Brighton (United Kingdom)

    2015-01-15

    Later in 2015 the International Atomic Energy Agency (IAEA) will convene a special conference to discuss computer security, in the wake of cyber attacks on global financial institutions and government agencies that were increasingly in the news. According to the IAEA, the prevalence of IT security incidents in recent years involving the Stuxnet malware 'demonstrated that nuclear facilities can be susceptible to cyber attack'. The IAEA said this and other events have significantly raised global concerns over potential vulnerabilities and the possibility of a cyber attack, or a joint cyber-physical attack, that could impact on nuclear security. The IAEA has correctly identified that the use of computers and other digital electronic equipment in physical protection systems at nuclear facilities, as well as in facility safety systems, instrumentation, information processing and communication, 'continues to grow and presents an ever more likely target for cyber attack'. The agency's Vienna conference, to be held in June, will review emerging trends in computer security and areas that may still need to be addressed. The meeting follows a declaration of ministers of IAEA member states in 2013 that called on the agency to help raise awareness of the growing threat of cyber attacks and their potential impact on nuclear security. The conference is being organised 'to foster international cooperation in computer security as an essential element of nuclear security', the IAEA said. Details of the IAEA's 'International Conference on Computer Security in a Nuclear World: Expert Discussion and Exchange' are on the 'meetings' section of the agency's web site.

  20. IAEA puts cyber security in focus for nuclear facilities in 2015

    International Nuclear Information System (INIS)

    Shepherd, John

    2015-01-01

    Later in 2015 the International Atomic Energy Agency (IAEA) will convene a special conference to discuss computer security, in the wake of cyber attacks on global financial institutions and government agencies that were increasingly in the news. According to the IAEA, the prevalence of IT security incidents in recent years involving the Stuxnet malware 'demonstrated that nuclear facilities can be susceptible to cyber attack'. The IAEA said this and other events have significantly raised global concerns over potential vulnerabilities and the possibility of a cyber attack, or a joint cyber-physical attack, that could impact on nuclear security. The IAEA has correctly identified that the use of computers and other digital electronic equipment in physical protection systems at nuclear facilities, as well as in facility safety systems, instrumentation, information processing and communication, 'continues to grow and presents an ever more likely target for cyber attack'. The agency's Vienna conference, to be held in June, will review emerging trends in computer security and areas that may still need to be addressed. The meeting follows a declaration of ministers of IAEA member states in 2013 that called on the agency to help raise awareness of the growing threat of cyber attacks and their potential impact on nuclear security. The conference is being organised 'to foster international cooperation in computer security as an essential element of nuclear security', the IAEA said. Details of the IAEA's 'International Conference on Computer Security in a Nuclear World: Expert Discussion and Exchange' are on the 'meetings' section of the agency's web site.

  1. National security governance exemplified by South Africa's cyber security policy implementation

    CSIR Research Space (South Africa)

    Burmeister, OK

    2014-06-01

    Full Text Available to an attack. A discourse analysis of the “0x Omar”-Israeli conflict of 2012, as reported in the Arabic and English media and on the Internet, is used to explore ethical issues that this case raises and to examine how the risks posed could be mitigated...

  2. Mean-Field-Game Model for Botnet Defense in Cyber-Security

    International Nuclear Information System (INIS)

    Kolokoltsov, V. N.; Bensoussan, A.

    2016-01-01

    We initiate the analysis of the response of computer owners to various offers of defence systems against a cyber-hacker (for instance, a botnet attack), as a stochastic game of a large number of interacting agents. We introduce a simple mean-field game that models their behavior. It takes into account both the random process of the propagation of the infection (controlled by the botner herder) and the decision making process of customers. Its stationary version turns out to be exactly solvable (but not at all trivial) under an additional natural assumption that the execution time of the decisions of the customers (say, switch on or out the defence system) is much faster that the infection rates.

  3. Summary of the Control System Cyber-Security (CS)2/HEP Workshop

    CERN Document Server

    Lüders, S

    2007-01-01

    Over the last few years modern accelerator and experiment control systems have increasingly been based on commercial-off-the-shelf products (VME crates, PLCs, SCADA systems, etc.), on Windows or Linux PCs, and on communication infrastructures using Ethernet and TCP/IP. Despite the benefits coming with this (r)evolution, new vulnerabilities are inherited, too: Worms and viruses spread within seconds via the Ethernet cable, and attackers are becoming interested in control systems. Unfortunately, control PCs cannot be patched as fast as office PCs. Even worse, vulnerability scans at CERN using standard IT tools have shown that commercial automation systems lack fundamental security precautions: Some systems crashed during the scan, others could easily be stopped or their process data be altered. The (CS)2/HEP workshop held the weekend before ICALEPCS2007 was intended to present, share, and discuss countermeasures deployed in HEP laboratories in order to secure control systems. This presentation will give a summa...

  4. Hybrid ports: the role of IoT and Cyber Security in the next decade

    Directory of Open Access Journals (Sweden)

    Andrea Chiappetta

    2017-12-01

    Full Text Available The next future will be played on a cyber level that imposes the need to merge “physical” with “digital in all fields”: phygital will be the future of current world, in many sectors, primarily in the transportation fields. Nowadays ports are doing several investment to provide technical solution to attract freight flows, are they ready to provide an answer to the cyber threat? This paper wish to present an overview of the main implications related to the cyber threats and maritime transports.

  5. Evaluation of Cyber Security and Modelling of Risk Propagation with Petri Nets

    Directory of Open Access Journals (Sweden)

    Marcin Szpyrka

    2017-02-01

    Full Text Available This article presents a new method of risk propagation among associated elements. On thebasis of coloured Petri nets, a new class called propagation nets is defined. This class providesa formal model of a risk propagation. The proposed method allows for model relations betweennodes forming the network structure. Additionally, it takes into account the bidirectional relationsbetween components as well as relations between isomorphic, symmetrical components in variousbranches of the network. This method is agnostic in terms of use in various systems and it canbe adapted to the propagation model of any systems’ characteristics; however, it is intentionallyproposed to assess the risk of critical infrastructures. In this paper, as a proof of concept example, weshow the formal model of risk propagation proposed within the project Cyberspace Security ThreatsEvaluation System of the Republic of Poland. In the article, the idea of the method is presented aswell as its use case for evaluation of risk for cyber threats. With the adaptation of Petri nets, it ispossible to evaluate the risk for the particular node and assess the impact of this risk for all relatednodes including hierarchic relations of components as well as isomorphism of elements.

  6. Addressing the Cyber-security and Cyber-terrorism Threats [video

    OpenAIRE

    Robi Sen; Center for Homeland Defense and Security Naval Postgraduate School

    2015-01-01

    While cyber terrorism is a relatively new threat in the world of national defense, the security issues we face are not necessarily new as a genre. In this segment, Chief Science Officer Robi Sen draws on the changing attitudes towards the cyber world. Topics include cooperation between law enforcement and hackers, the major motivations behind criminal hacking, and the realistic threats of cyber terrorism.

  7. Infotech. Cyber security. Health care learns to share scares and solutions.

    Science.gov (United States)

    Colias, Mike

    2004-05-01

    Health care information technology leaders and others are coming together to share scary experiences and develop best practices to guard against crippling computer viruses, scheming hackers and other cyber threats.

  8. Interdependent Risk and Cyber Security: An Analysis of Security Investment and Cyber Insurance

    Science.gov (United States)

    Shim, Woohyun

    2010-01-01

    An increasing number of firms rely on highly interconnected information networks. In such environments, defense against cyber attacks is complicated by residual risks caused by the interdependence of information security decisions of firms. IT security is affected not only by a firm's own management strategies but also by those of others. This…

  9. Sharing Cyber Security Information : Good Practice Stemming from the Dutch Public-Private-Participation Approach

    NARCIS (Netherlands)

    Luiijf, H.A.M.; Kernkamp, A.C.

    2015-01-01

    The failure of a national critical infrastructure may seriously impact the health and well-being of citizens, the economy, the environment, and the functioning of the government. Moreover, critical infrastructures increasingly depend on information and communication technologies (ICT) or, in short,

  10. Assessing and Augmenting SCADA Cyber Security-A Survey of Techniques

    OpenAIRE

    Patel, S; Nazir, S; Patel, D

    2017-01-01

    SCADA systems monitor and control critical infrastructures of national importance such as power generation and distribution, water supply, transportation networks, and manufacturing facilities. The pervasiveness, miniaturisations and declining costs of internet connectivity have transformed these systems from strictly isolated to highly interconnected networks. The connectivity provides immense benefits such as reliability, scalability and remote connectivity, but at the same time exposes an ...

  11. The influence of cyber security levels of South African citizens on national security

    CSIR Research Space (South Africa)

    Jansen van Vuuren, J

    2012-03-01

    Full Text Available , the proliferation of mobile Internet devices and government programs aimed at bridging the digital divide through major broadband expansion projects. These measures facilitate the rapid growth of South African Internet citizens, both through desktop or laptop...

  12. Cyber Security Vulnerabilities During Long Term Evolution Power-Saving Discontinuous Reception Protocol

    Science.gov (United States)

    2014-06-01

    2G second generation 3G third generation 3GPP Third Generation Partnership Project 4G fourth generation AAA authentication, authorization and...RRC_IDLE or the RRC_CONNECTED states in 4G LTE as shown in Figure 19. 2G and 3G networks use DRX in idle mode only. In Figure 19, LTE-U_u is the new DRX...is a wireless access communications network that consists of base stations called eNodeBs (eNBs), which allow connectivity between the mobile device

  13. Cyber crisis management: a decision-support framework for disclosing security incident information

    OpenAIRE

    Kulikova, Olga; Heil, Ronald; van den Berg, Jan; Pieters, Wolter

    2012-01-01

    The growing sophistication and frequency of cyber attacks force modern companies to be prepared beforehand for potential cyber security incidents and data leaks. A proper incident disclosure strategy can significantly improve timeliness and effectiveness of incident response activities, reduce legal fines, and restore confidence and trust of a company's key stakeholders. In this paper, four factors that shape organizational preferences regarding incident information disclosure are introduced....

  14. ZEND FRAMEWORK

    Directory of Open Access Journals (Sweden)

    Lupasc Adrian

    2013-12-01

    Full Text Available In this paper we present Zend Architecture, which is an open source technology for developing web applications and services, based on object-oriented components, and the Model-View-Controller architectural pattern, also known as MVC, which is the fundament of this architecture. The MVC presentation emphasises its main characteristics, such as facilitating the components reuse by dividing the application into distinct interconnected modules, tasks distribution in the process of developing an application, the MVC life cycle and also the essential features of the components in which it separates the application: model, view, controller. The controller coordinates the models and views and it’s responsible with manipulating the user events through the corresponding actions. The model contains application rules, respectively the scripts that implement the database manipulation. The third component, the view represents the controllers interface with the user or the way it displays the response to the event triggered by the user. Another aspect treated in this paper consists in highlighting the Zend architecture advantages and disadvantages. Among the framework advantages, we can enumerate good code organization, due to its delimitation into three sections, presentation, logic and data access, and dividing the code into components, which facilitates the code reuse and testing. Other advantages are the open-source license and the support for multiple database systems. The main disadvantages are represented by its size and complexity, that makes it hard to understand for a beginner programmer, the resources it needs etc. The last section of the paper presents a comparison between Zend and other PHP architectures, like Symphony, CakePHP and CodeIgniter, which includes their essential features and points out their similarities and differences, based on the unique functions that set them apart from others. The main thing that distinguishes ZF from the

  15. Robustness - theoretical framework

    DEFF Research Database (Denmark)

    Sørensen, John Dalsgaard; Rizzuto, Enrico; Faber, Michael H.

    2010-01-01

    More frequent use of advanced types of structures with limited redundancy and serious consequences in case of failure combined with increased requirements to efficiency in design and execution followed by increased risk of human errors has made the need of requirements to robustness of new struct...... of this fact sheet is to describe a theoretical and risk based framework to form the basis for quantification of robustness and for pre-normative guidelines....

  16. The art framework

    International Nuclear Information System (INIS)

    Green, C; Kowalkowski, J; Paterno, M; Fischler, M; Garren, L; Lu, Q

    2012-01-01

    Future “Intensity Frontier” experiments at Fermilab are likely to be conducted by smaller collaborations, with fewer scientists, than is the case for recent “Energy Frontier” experiments. art is a C++ event-processing framework designed with the needs of such experiments in mind. An evolution from the framework of the CMS experiment, art was designed and implemented to be usable by multiple experiments without imposing undue maintenance effort requirements on either the art developers or experiments using it. We describe the key requirements and features of art and the rationale behind evolutionary changes, additions and simplifications with respect to the CMS framework. In addition, our package distribution system and our collaborative model with respect to the multiple experiments using art helps keep the maintenance burden low. We also describe in-progress and future enhancements to the framework, including strategies we are using to allow multi-threaded use of the art framework in today's multi- and many-core environments.

  17. 75 FR 76041 - Notice; Applications and Amendments to Facility Operating Licenses Involving Proposed No...

    Science.gov (United States)

    2010-12-07

    ... specified nuclear power plant digital computer and communication systems, networks and functions are... that specified nuclear power plant digital computer and communication systems, networks and functions... communication systems and networks,'' establish the requirements for a cyber security program. This regulation...

  18. (tpack) framework

    African Journals Online (AJOL)

    IICBA01

    2013-11-03

    Nov 3, 2013 ... This paper demonstrates this innovative model with examples from ... availability of a range of new, primarily digital, technologies and requirements for ..... which is an iterative four-step management method used in business.

  19. Second generation registry framework.

    Science.gov (United States)

    Bellgard, Matthew I; Render, Lee; Radochonski, Maciej; Hunter, Adam

    2014-01-01

    Information management systems are essential to capture data be it for public health and human disease, sustainable agriculture, or plant and animal biosecurity. In public health, the term patient registry is often used to describe information management systems that are used to record and track phenotypic data of patients. Appropriate design, implementation and deployment of patient registries enables rapid decision making and ongoing data mining ultimately leading to improved patient outcomes. A major bottleneck encountered is the static nature of these registries. That is, software developers are required to work with stakeholders to determine requirements, design the system, implement the required data fields and functionality for each patient registry. Additionally, software developer time is required for ongoing maintenance and customisation. It is desirable to deploy a sophisticated registry framework that can allow scientists and registry curators possessing standard computing skills to dynamically construct a complete patient registry from scratch and customise it for their specific needs with little or no need to engage a software developer at any stage. This paper introduces our second generation open source registry framework which builds on our previous rare disease registry framework (RDRF). This second generation RDRF is a new approach as it empowers registry administrators to construct one or more patient registries without software developer effort. New data elements for a diverse range of phenotypic and genotypic measurements can be defined at any time. Defined data elements can then be utilised in any of the created registries. Fine grained, multi-level user and workgroup access can be applied to each data element to ensure appropriate access and data privacy. We introduce the concept of derived data elements to assist the data element standards communities on how they might be best categorised. We introduce the second generation RDRF that

  20. V&V framework

    Energy Technology Data Exchange (ETDEWEB)

    Hills, Richard G. [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Maniaci, David Charles [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States); Naughton, Jonathan W. [Sandia National Lab. (SNL-NM), Albuquerque, NM (United States)

    2015-09-01

    A Verification and Validation (V&V) framework is presented for the development and execution of coordinated modeling and experimental program s to assess the predictive capability of computational models of complex systems through focused, well structured, and formal processes.The elements of the framework are based on established V&V methodology developed by various organizations including the Department of Energy, National Aeronautics and Space Administration, the American Institute of Aeronautics and Astronautics, and the American Society of Mechanical Engineers. Four main topics are addressed: 1) Program planning based on expert elicitation of the modeling physics requirements, 2) experimental design for model assessment, 3) uncertainty quantification for experimental observations and computational model simulations, and 4) assessment of the model predictive capability. The audience for this document includes program planners, modelers, experimentalist, V &V specialist, and customers of the modeling results.