• Nuclear Engineering and Technology
• /
• v.55 no.6
• /
• pp.2034-2046
• /
• 2023

Industrial control systems in nuclear facilities are facing increasing cyber threats due to the widespread use of information and communication equipment. To implement cyber security programs effectively through the RG 5.71, it is necessary to quantitatively assess cyber risks. However, this can be challenging due to limited historical data on threats and customized Critical Digital Assets (CDAs) in nuclear facilities. Previous works have focused on identifying data flows, the assets where the data is stored and processed, which means that the methods are heavily biased towards information security concerns. Additionally, in nuclear facilities, cyber threats need to be analyzed from a safety perspective. In this study, we use the system theoretic process analysis to identify system-level threat scenarios that could violate safety constraints. Instead of quantifying the likelihood of exploiting vulnerabilities, we quantify Security Control Measures (SCMs) against the identified threat scenarios. We classify the system and CDAs into four consequence-based classes, as presented in NEI 13-10, to analyze the adversary impact on CDAs. This allows for the ranking of identified threat scenarios according to the quantified SCMs. The proposed framework enables stakeholders to more effectively and accurately rank cyber risks, as well as establish security and response strategies.

• Economic and Environmental Geology
• /
• v.50 no.5
• /
• pp.363-373
• /
• 2017

In the present study, adaptability of cyber-physical system (CPS) for risk management of $CO_2$ storage site is examined and the subagging regression (SBR) method is proposed as a key component of the cyber-twin to estimate the risk due to potential $CO_2$ leakage. For these purposes, $CO_2$ concentration data monitored from a controlled $CO_2$ release field experiment is employed to validate the potentialities of the SBR method. From the validation study, it is found that the SBR method has robust estimation capability by showing minimal influence from anomalous measurements, and makes stable and sound predictions for the forthcoming $CO_2$ concentration trend. In addition, the method is found to be well suited as a tool of operational risk assessment based on real-time monitoring data due to the computational efficiency. The overall results suggest that the SBR method has potential to be an important component comprising the cyber twin of CPS for risk management of $CO_2$ storage site.

• Journal of Digital Contents Society
• /
• v.15 no.1
• /
• pp.121-128
• /
• 2014

SSE-CMM for security engineering, engineering, assurance, risk is divided into three elements of the process maturity assessment model and the level of information security presented. Maturity measurement of privacy, vulnerability diagnosis and risk analysis methodologies is used in practical field for present a comprehensive conclusion. The common cyber services are internet banking, mobile banking, telephone banking and the like. Transaction structure, a kind of cyber-banking system, information security maturity of the existing measurement methodologies for research purposes, vulnerability diagnosis and risk analysis methodologies to be used in practical field present a comprehensive conclusion. To ensure safety and convenience for the user, convenient to deal with cyber environment is the key to the activation of cyber trading. Particularly by measuring the maturity of cyber banking system to ensure the safety of the practice field much effects are expected as a result.

• Convergence Security Journal
• /
• v.20 no.4
• /
• pp.187-196
• /
• 2020

In order to manage information security risk, various information security level evaluation and information security management system certification have been conducted on a larger scale than ever. However, there are continuous cases of infringement of information protection for companies with excellent information security evaluation and companies with excellent information security management system certification. The existing information security risk management methodology identifies and analyzes risks by identifying information assets inside the information system. Existing information security risk management methodology lacks a review of where cyber threats come from and whether security devices are properly operated for each route. In order to improve the current risk management plan, it is necessary to look at where cyber threats come from and improve the containment level for each inflow section to absolutely reduce unnecessary cyber threats. In addition, it is essential to measure and improve the appropriate configuration and operational level of security equipment that is currently overlooked in the risk management methodology. It is necessary to block and enter cyber threats as much as possible, and to detect and respond to cyber threats that inevitably pass through open niches and use security devices. Therefore, this paper proposes additional evaluation items for evaluating the containment level against cyber threats in the ISMS-P authentication items and vulnerability analysis and evaluation items for major information and communication infrastructures, and evaluates the level of security equipment configuration for each inflow.

• Nuclear Engineering and Technology
• /
• v.51 no.1
• /
• pp.138-145
• /
• 2019

With the application of digital technology to safety-critical infrastructures, cyber-attacks have emerged as one of the new dangerous threats. In safety-critical infrastructures such as a nuclear power plant (NPP), a cyber-attack could have serious consequences by initiating dangerous events or rendering important safety systems unavailable. Since a cyber-attack is conducted intentionally, numerous possible cases should be considered for developing a cyber security system, such as the attack paths, methods, and potential target systems. Therefore, prior to developing a risk-informed cyber security strategy, the importance of cyber-attacks and significant critical digital assets (CDAs) should be analyzed. In this work, an importance analysis method for cyber-attacks on an NPP was proposed using the probabilistic safety assessment (PSA) method. To develop an importance analysis framework for cyber-attacks, possible cyber-attacks were identified with failure modes, and a PSA model for cyber-attacks was developed. For case studies, the quantitative evaluations of cyber-attack scenarios were performed using the proposed method. By using quantitative importance of cyber-attacks and identifying significant CDAs that must be defended against cyber-attacks, it is possible to develop an efficient and reliable defense strategy against cyber-attacks on NPPs.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.3
• /
• pp.639-648
• /
• 2015

SInce 2000, Instrumentation and Control(I&C) systems of Nuclear Power Plant(NPP) based on analog technology began to be applied to the digital technology. NPPs under construction in the country with domestic APR1400 I&C system, most devices were digitalized. Cyber security of NPP I&C systems has emerged as an important issue because digital devices compared to the existing analog equipment are vulnerable to cyber attacks. In this paper, We proposed the risk rating process of cyber security threats in NPP I&C system and applied the proposed process to the Reactor Protection System(RPS) developed through Korea Nuclear Instrumentation & Control System(KINCS) project for evaluating the risk of cyber security threats.

• Journal of Digital Convergence
• /
• v.17 no.8
• /
• pp.105-113
• /
• 2019

The purpose of this study is to analyze cyber security risk modeling of critical infrastructure, draw out limitations and improvement measures. This paper analyzed cyber security risk modeling of national critical infrastructure like as electricity sector, nuclear power plant, SCADA. This paper analyzed the 26 precedent research cases of risk modeling in electricity sector, nuclear power plant, SCADA. The latest Critical Infrastructure is digitalized and has a windows operating system. Critical Infrastructure should be operated at all times, it is not possible to patch a vulnerability even though find vulnerability. This paper suggest the advanced cyber security modeling characteristic during the life cycle of the critical infrastructure and can be prevented.

• Convergence Security Journal
• /
• v.19 no.2
• /
• pp.59-72
• /
• 2019

In this day and age physical and cyber boundaries have converged due to the development of new technologies, such as the Internet of Things (IoT) and the Cyber Physical System (CPS). As the relationship between physical system and cyber technology strengthens, more diverse and complex forms of risk emerge. As a result, it is becoming difficult for single organization or government to fully handle this situation alone and cooperation based on information sharing and the strengthening of active defense systems are needed. Shifting to a system in which information suitable for various entities can be shared and automatically responded to is also necessary. Therefore, this study tries to find improvements for the current system of threat information collecting and sharing that can actively and practically maintain cyber defense posture, focusing particularly on the structuring of information sharing platforms. To achieve our objective, we use a risk communication theory from the safety field and propose a new platform by combining an action-oriented security process model.

• Convergence Security Journal
• /
• v.16 no.2
• /
• pp.11-17
• /
• 2016

The purpose of this research is to explore the effective response methods for the prevention of cyber-terror in South Korea. This research used an analysis of literature research. From the result of this research, the researchers suggested 1) enactment of the 'Cyber-terror Prevention Act' in order to enhance the effectiveness against cyber-terror; 2) establishment of practical control tower for cyber-terror; 3) expansion of the expert training for cyber-terror. The limitations of this research and the recommendations for future research were discussed at the last part of this research.

• Radiation Oncology Journal
• /
• v.34 no.4
• /
• pp.260-264
• /
• 2016

Purpose: Stereotactic body radiotherapy (SBRT) takes advantage of low ${\alpha}/{\beta}$ ratio of prostate cancer to deliver a large dose in few fractions. We examined clinical outcomes of SBRT using CyberKnife for the treatment of low- and intermediate-risk prostate cancer. Materials and Methods: This study was based on a retrospective analysis of the 33 patients treated with SBRT using CyberKnife for localized prostate cancer (27.3% in low-risk and 72.7% in intermediate-risk). Total dose of 36.25 Gy in 5 fractions of 7.25 Gy were administered. The acute and late toxicities were recorded using the Radiation Therapy Oncology Group scale. Prostate-specific antigen (PSA) response was monitored. Results: Thirty-three patients with a median 51 months (range, 6 to 71 months) follow-up were analyzed. There was no biochemical failure. Median PSA nadir was 0.27 ng/mL at median 33 months and PSA bounce occurred in 30.3% (n = 10) of patients at median at median 10.5 months after SBRT. No grade 3 acute toxicity was noted. The 18.2% of the patients had acute grade 2 genitourinary (GU) toxicities and 21.2% had acute grade 2 gastrointestinal (GI) toxicities. After follow-up of 2 months, most complications had returned to baseline. There was no grade 3 late GU and GI toxicity. Conclusion: Our experience with SBRT using CyberKnife in low- and intermediate-risk prostate cancer demonstrates favorable efficacy and toxicity. Further studies with more patients and longer follow-up duration are required.