Browse > Article
http://dx.doi.org/10.13089/JKIISC.2018.28.6.1539

A Study on Vulnerability Assessment for the Digital Assets in NPP Based on Analytical Methods  

Kim, In-kyung (Korea Institute of Nuclear nonproliferation And Control)
Kwon, Kook-heui (Korea Institute of Nuclear nonproliferation And Control)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.28, no.6, 2018 , pp. 1539-1552 More about this Journal
Abstract
The necessity of establishing a more secure cyber security system is emerging to protect NPP against cyber attacks as nuclear facilities become increasingly reliant on digital system. Proper security measures should be established through periodic analysis and evaluation of vulnerabilities. However, as Nuclear facilities has safety characteristics as their top priority and it requires a lot of time and cost to construct regarding the activities for vulnerability analysis, it is difficult to apply the existing vulnerability analysis environment and analysis tools. In this study, We propose a analytical vulnerability assessment method to overcome the limitations of existing vulnerability analysis methods through analysis the existing vulnerability analysis methods and the issues to be considered when applying the vulnerability analysis method.
Keywords
Nuclear digital assets; Control system cyber security; Vulnerability assessment;
Citations & Related Records
Times Cited By KSCI : 2  (Citation Analysis)
연도 인용수 순위
1 K. J. Cha, J. H. Ahn, Y. M. Kim, and Y. G. Kwon, "A Study of PLC System Vulnerability Checklists in Nuclear Power Plants", Transactions of the Korean Nuclear Society Autumn Meeting, Oct, 2012.
2 Lee Cheol Kwon, "Nuclear Power Plant Instrumentation and Control Systems Cyber Security Technology Trends," Journal of The Korea Institute of information Security & Cryptology, vol. 22, no. 5, pp. 28-34, Aug. 2012.
3 D. W. Kim, B. G. Min, H. D. Park, and S. W. Park, "PLC -Based Control System Vulnerability Analysis Method", Journal of The Korea Institute of information Security & Cryptology, vol. 25, no. 5, pp.26-36, Oct. 2015.
4 Choi Myeonggil Choi, "A Study on Security Evaluation Methodology for Industrial Control Systems", Journal of The Korea Institute of information Security & Cryptology, vol. 23, no. 2, pp. 287-298, Apr. 2013.   DOI
5 B. G. Min, W. G. Ahn, J. T. Seo, "Vulnerability Analysis Method according to Cyber Security Threat Change", Journal of The Korea Institute of information Security & Cryptology, vol. 24, no. 1, pp. 7-12, Feb. 2014.
6 Kim Do Yeon, "Vulnerability Analysis for Industrial Control System Cyber Security", Journal of The Korea Institute of electronic communication sciences, vol. 9, no. 1, pp. 137-142, Jan. 2013.   DOI
7 U,S.Nuclear Regulatory commission(U.S.NRC), NUREG/CR-6463, "Review Guidelines on Software Language for Use in Nuclear Power Plants Safety Systems", Jun. 1996.
8 Park Sang-Hyung, "An Empirical Study of the Method of Vulnerabilities Analysis on Instrumentation & Control System for Nuclear Power Plant", PH.D. Thesis, Graduate School of Soongsil University, Jun. 2011.
9 Kang Young doo, "A Study on Cyber Security Assessment Methodology of Instrumentation& Control Systems for Nuclear Power Plants", PH.D. Thesis, Graduate School of Chonbuk National University, Feb. 2010.
10 J. G. Song, J. W. Lee, G. Y. Park, K. C. Kwon, D. Y. Lee, and C. K. Lee. "An Analysis of Technical Security Control Requirements for Digital I&C Systems in Nuclear Power Plants". Nuclear Engineering and Technology, Vol.45, No.5, Mar. 2013.
11 Chatham House, "Cyber Security at Civil Nuclear Facilities", Sep. 2015.
12 Department of Homeland Security (DHS), "NCCIC/ICS-CERT FY 2015 Annual Vulnerability Coordination Report", 2015.
13 Ministry of Science and ICT, "The Analysis and Evaluation Standards for Information and Communication Infrastructure, vol. 2013, no. 37, Oct. 2013.
14 National Cybersecurity and Communications Integration Center(NCCIC), "ICS-CERT Annual Assessment Report", 2016.
15 M. Holt, A. Andrews, CRS Report RL34331, "Nuclear Power Plant Security and Vulnerabilities", Jan. 2014.
16 National Cyber Security Center(NCSC), " Checklist security of ICS/SCADA systems(Take organisational and technical measures)", May. 2016.
17 National Institute of Standards Technology(NIST), 800-82(rev2) "Guide to Industrial Control Systems (ICS) Security", May. 2015.
18 Department of Homeland Security (DHS), "Common Cyber security Vulnerabilities in Industrial Control Systems", May. 2011.
19 Department of Energy/Idaho National Laboratory(DOE/INL), "Vulnerability Analysis of Energy Delivery Control Systems", Sep. 2011.
20 National Institute of Standards Technology(NIST). 800-53(rev.4) "Recommended Security Controls for Federal Information Systems and Organizations", Apr. 2013.
21 U,S.Nuclear Regulatory commissio(U.S.NRC), Regulatory Guide(R.G) 1.152(Rev.3), "Criteria for Use of Computers in Safety Systems of Nuclear Power Plants", Jul. 2011.
22 International Atomic Energy Agency (IAEA), Nuclear Security Series No. 13, "Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities" (INFCIRC/225/Revision 5), Jan. 2011.
23 International Atomic Energy Agency (IAEA), "Nuclear Security Series No. 17, Computer Security at Nuclear Facilities", Dec. 2011.
24 Korea Institute of Nuclear Nonproliferation And Control(KINAC), KINAC/RS-015, "Regulatory Standard on Computer Security of Nuclear Facilities", Dec. 2016.
25 Korea Institute of Nuclear Nonproliferation And Control(KINAC), KINAC/ RS-019, "Regulatory Standard on Critical Digital Assets of Nuclear Facilities", Dec. 2015.
26 U,S.Nuclear Regulatory commissio(U.S.NRC), Regulatory Guide 5.71(R.G 5.71), "Cyber Security Programs for Nuclear Facilities", Jan. 2010.
27 U,S.Nuclear Regulatory commissio(U.S.NRC), 10 CFR 73.54, "Protection of Digital Computer and Communication Systems and Networks", Mar. 2009.
28 Nuclear Energy Institute(NEI), NEI 10-09(rev.0) "Addressing Cyber Security Controls for Nuclear Power Reactors", Sep. 2011.
29 U,S.Nuclear Regulatory commission(U.S.NRC), NUREG/CR-6847, "Cyber Security Self-Assessment Method for U.S. Nuclear Power Plants", Oct. 2004.
30 Nuclear Energy Institute(NEI), NEI 08-09(Rev.6), "Cyber Security Plan for Nuclear Power Reactors", Apr. 2010.