The Approaches of Prevention, Detection, and Response for Cybersecurity of I&C Systems in NPPs

Abstract

The framework of prevention, detection, and response has been proven an effective approach to enhance cybersecurity of Information Technology (IT) systems. This framework can be also applied to Instrumentation and Control (I&C) systems in Nuclear Power Plants (NPPs), although there are significant differences between IT systems and I&C systems. The differences include the operational real-time requirement, the distinct communication protocols, and the continuous availability of the systems. These specified requirements must be well addressed when applying the framework of prevention, detection, and response to I&C systems. Therefore, the specific approaches to implement this framework for I&C systems are proposed. For prevention, the monitoring and auditing for I&C systems is suggested to meet the real-time requirement. For detection, the intrusion detection approach based on physical data is presented to deal with the distinct communication protocols. For response, the intrusion-tolerant control is proposed to maintain the continuous availability. The above three approaches together form the overall solution for cybersecurity of I&C systems in NPPs. The reasons why these proposed approaches can deal with the specified challenges of I&C systems security are elaborated in this paper.