The attack was contained to the business associated side of the plant, and evidence indicates that critical infrastructure was not affected.But cyber security experts say that now that the network has been infiltrated, the nuclear systems have become "much more vulnerable."
Hackers have been penetrating the computer networks of companies that operate nuclear power stations and other energy facilities, as well as manufacturing plants in the United States and other countries.
But hackers can’t affect a nuclear power plant operations or safety systems. They can hack some business, personnel and other non-essential files, which may be embarrassing and costly, but not dangerous. These reactors are truly operational islands wholly disconnected from the Internet.
The origins of the hackers are not known, although a joint report from the DHS and the FBI suggests many of the hackers are backed by governments like Russia. In a joint statement, the government agencies said, “There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks.”
America’s nuclear plants are one of the best protected of all systems from possible cyber threats. The safety and control systems for our nuclear reactors and other vital plant components are not connected to business networks or the Internet. We learned a lot from Stuxnet, the malicious computer worm that substantially damaged Iran’s nuclear program and that was introduced with a thumb drive.
Unlike other industries, the nuclear power industry conducts regular briefings, and receives quarterly classified briefings on cyber and physical threats, with the FBI and the DHS to discuss threat assessments, to strategize on guarding against them and to maintain situational awareness.
The nuclear industry does not use firewalls to isolate these systems, that’s not good enough. The plants use hardware based data diode technologies developed for high assurance environments, like the DOD. Data diodes allow information to be sent out, like operational and monitoring data, but ensure that information cannot flow back into the plant.
But hackers can’t affect a nuclear power plant operations or safety systems. They can hack some business, personnel and other non-essential files, which may be embarrassing and costly, but not dangerous. These reactors are truly operational islands wholly disconnected from the Internet.
The origins of the hackers are not known, although a joint report from the DHS and the FBI suggests many of the hackers are backed by governments like Russia. In a joint statement, the government agencies said, “There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks.”
America’s nuclear plants are one of the best protected of all systems from possible cyber threats. The safety and control systems for our nuclear reactors and other vital plant components are not connected to business networks or the Internet. We learned a lot from Stuxnet, the malicious computer worm that substantially damaged Iran’s nuclear program and that was introduced with a thumb drive.
Unlike other industries, the nuclear power industry conducts regular briefings, and receives quarterly classified briefings on cyber and physical threats, with the FBI and the DHS to discuss threat assessments, to strategize on guarding against them and to maintain situational awareness.
The nuclear industry does not use firewalls to isolate these systems, that’s not good enough. The plants use hardware based data diode technologies developed for high assurance environments, like the DOD. Data diodes allow information to be sent out, like operational and monitoring data, but ensure that information cannot flow back into the plant.
Updating software and equipment using portable devices, have strict restrictions. Outside laptops and thumb drives cannot be used without serious scrubbing, if at all.
The NRC has established regulations that thoroughly monitor and inspect cyber security at all U.S. reactors. But the nuclear energy industry took the initiative to implement a cyber security program for those digital assets needed to maintain nuclear safety and continuity of power well before the NRC mandated such a program. The Nuclear Energy Institute’s cyber security task force, formed in 2002, continuously monitors possible cyber threats and upgraded protective approaches needed to counter them.
The NRC has established regulations that thoroughly monitor and inspect cyber security at all U.S. reactors. But the nuclear energy industry took the initiative to implement a cyber security program for those digital assets needed to maintain nuclear safety and continuity of power well before the NRC mandated such a program. The Nuclear Energy Institute’s cyber security task force, formed in 2002, continuously monitors possible cyber threats and upgraded protective approaches needed to counter them.
No comments:
Post a Comment