Home > About NRC > How We Regulate > Research Activities > Digital I&C > Program Activities > Security Aspects of Digital Systems

Security Aspects of Digital Systems

The security of digital safety systems involves addressing potential security vulnerabilities as part of the system development process and maintaining the security of the system after it is installed. Since the staff has already reviewed and approved (for generic use) most digital system development platforms that are anticipated for use in the nuclear industry, security assessments of digital systems are being performed on the systems (composed of commercial off-the-shelf digital equipment) that have been developed using these platforms.

Security assessments of cyber vulnerabilities will determine if NRC-approved digital systems have any inherent susceptibility to malicious activity through computing resources. The project is currently focused on the three major NRC-approved digital safety systems, and it involves fault-injection testing (e.g., penetration testing) of the systems to determine failure modes/characteristics. Representative configurations of nuclear power plant installations will be assessed in laboratory settings. Knowledge gained from these laboratory assessments will be utilized in site assessments at various nuclear plants containing the NRC-approved systems. For example, using the knowledge gained from the in-laboratory penetration testing of the NRC-approved systems, an NRC test team will collaborate with a licensee (e.g., pilot plant) on assessing the licensee’s specific configuration in the context of NEI-04-04. This assessment will take an inside-out approach that would start at the innermost ring of critical assets and work successively outward to identify potential vulnerabilities of the site’s configuration. The data obtained from the laboratory and site assessments will be used by the Network Security project to identify protection and mitigation measures appropriate to nuclear power plant environments. Starting in mid-2007, the Network Security project will evaluate architectures for compliance with NRC regulatory requirements and NEI-04-04 that provide the best chances to survive cyber security attacks (i.e., I&C architectures resilient against cyber attacks). The data obtained from the laboratory and site assessments will also form the bases for regulatory guidance to the NRC staff (for licensing reviews and inspections) as well as licensees and vendors.

In early 2007, the NRC will begin assessment of the electromagnetic (EM) environment at nuclear power plants and its potential impacts on digital safety systems. The project will build upon previous research at Sandia National Laboratory (SNL). The SNL work evaluated a worst-case EM environmental impact on an example nuclear power plant, with generic extensions to other plants. Security assessments of EM environmental impacts will take an approach similar to that of the earlier study by SNL. First, the worst-case EM model will be updated using recent research results from all available sources, including the classified domain. Second, advances in technology will be considered when developing the model and during subsequent analyses. Consideration of advances in technology may lead the staff to consider a different set of example plants than that previously utilized by SNL in order to obtain an accurate assessment of digital safety system susceptibility to EM effects. In late 2008, the results of this assessment of EM environmental impacts on digital safety systems will be produced in the form of regulatory guidance and updates to the staff review guidance.

Privacy Policy | Site Disclaimer
Wednesday, July 11, 2007