On Cybersecurity Risk Assessment in Nuclear Power Systems

Abstract

Witnessing a present-day radical shift from carbonized power towards renewables and smart energy systems, one should recognize nuclear power to be an equal partner, not opponent, to the sustainable types of energy. However, in contrast to systems based on renewable resources, nuclear energy production is highly risky, and NPP industrial control systems (ICS) impose the growing demands on safety and security. In order to meet pressing security challenges and perform an effective risk management, one of the fundamental steps to be taken is to conduct a comprehensive risk assessment, which in the context of today's transition from conventional control to digital, aka digitalization, should more accurately refer to cybersecurity. To carry out a cybersecurity risk assessment, a standard assets-based CIA risk assessment approach operating with confidentiality, integrity, and availability attributes is commonly utilized. Nevertheless, for NPP ICS, the approach happens to be slightly different because, firstly, industrial control is normally established with the primary aim of performing functions, e.g., control and monitoring ones, but not dealing with and managing assets, and, secondly, the availability property of control takes the major priority over other CIA attributes. The article investigates the cybersecurity risk assessment in the NPP ICS perspective. Clarifying the priority of control systems performance, it presents an approach adapted to NPP ICS and a modified equation for the first iteration of the potential cybersecurity risk calculation where the assets are replaced by functions. For the assignment of values for the availability property of NPP ICS functions, a metric based on delay is recommended. The ICS availability reference model, in particular, the system domain and so the dependency between system components is utilized for the accurate metric calculation.