24
NuclearPlantJournal.com Nuclear Plant Journal, July-August 2015
a relatively small attack surface, while
a digital control system has a more
complex attack surface and likely would
require additional levels of security and
protection.
In response to emerging technical
and regulatory requirements, EPRI is
developing a graded approach to cyber
security for nuclear plants that will
help assess what protective measures
are needed for a given cyber asset
(computer, network, programmable
logic controller) to mitigate a specific
cyber security vulnerability. The research
will develop and validate a cyber asset
classification scheme based on common
vulnerabilities and attack surface profiles
within a nuclear plant environment. The
assessment profiles and device attack
surface criteria developed through this
effort will enable users to reduce the
time and effort required to conduct
controls assessments, provide consistent
assessments across similar devices, and
enable the sharing and reuse of completed
assessment data for identical devices to
drive efficiencies in the cyber security
assessment process. Phase I will address
devices with small attack surfaces that
do not have general purpose network
interfaces, removable media, or advanced
serial interfaces. Candidate devices
include instrument transmitters, valve
actuators and controllers (positioners),
digital chart recorders, and single loop
controllers.
Results will consist of attack surface
criteria and security control methods
to mitigate that small attack surface
profile. These profiles can then be used
to consistently identify and protect assets
that match the attack surface criteria.
The profiles also will be expressed in
Excel formatted files for easy import into
a plant’s security assessment tool. The
Phase I technical report (3002004999) is
planned for completion in fall 2015.
Phase II and later phases will address
equipment with progressively more
complex attack surfaces, such as network
interfaces and programmable logic. EPRI
also plans to develop an attack surface
methodology enabling users to evaluate
assets too complex for the common
profiles.
Contact: Matt Gibson, EPRI, email:
Acoustic Mouse
A prototype of EPRI’s acoustic
mouse system has been demonstrated in
the laboratory, indicating that handheld
ultrasonic testing (UT) technology can
generate accurate, computer-encoded
images of inspection volumes. This
breakthrough is expected to revolutionize
nondestructive
evaluation
(NDE)
practices in the nuclear power industry—
and beyond—by combining the best
features of manual and automated
ultrasonic inspection methods.
Research &
Development...
Nuclear Plant Journal Advertiser Web Directory
Allied Technical
Resources, Inc.
AREVA Inc.
Birns
Ellis &Watts Global
Industries, LLC
ENERCON
GE Hitachi Nuclear Energy
HydroAire Service, Inc.
iRobot Corporation
Mitsubishi Nuclear Energy
Systems, Inc.
NuScale
Nutherm International, Inc.
OTEK Corporation
Radiation Protection
Systems, Inc.
Rolls-Royce
Rusatom International
Network
Sargent & Lundy LLC
SSM Industries, Inc.
Structural Integrity
Associates, Inc.
Sulzer Pumps Chattanooga
Nuclear Service Center
Victoreen
Warren Laboratories, LLC
Westinghouse Electric
Company LLC
Zachry Nuclear
Engineering, Inc
