Estimating the frequency of cyber threats to nuclear power plants based on operating experience analysis

Abstract

The necessity and importance of cyber risk assessments at nuclear power plants is increasingly being recognized in recent times. However, the cyber risk assessment methods developed thus far have focused on engineering evaluations and expert judgments. Moreover, there is no available probabilistic database of cyber threats for nuclear power plants. In this study the frequencies of cyber threats were estimated based on operating experience analysis. The operating experiences are grouped by their characteristics to suggest the list of cyber threats, and the frequency of each cyber threat is calculated by two-stage Bayesian updates. This research is significant because it is the first study on a probabilistic approach to estimate cyber threats. Furthermore, this research offers the advantage of being able to update the threat frequencies with additional data accumulation. We expect that this approach can also be applied to probabilistic safety assessment, which is the most widely used method for nuclear power plant risk assessment.