, SecurityFocus 2005-01-25
Federal regulators are proposing to add computer security standards to their criteria for installing new computerized safety systems in nuclear power plants.The U.S. Nuclear Regulatory Commission (NRC) quietly launched a public comment period late last month on a proposed
The replacement would expand existing safety and reliability requirements for digital safety system, and infuse security requirements into every stage of a system's lifecycle, from drawing board to retirement.
Last year the United Nations' International Atomic Energy Agency (IAEA) warned of growing international concern about the potential for cyber attacks against nuclear facilities, and said it was finalizing new security guidelines of its own. No successful targeted attacks against plants have been publicly reported, but in 2003 the Slammer worm
The NRC draft advises against such interconnections. It also advises plant operators to consider the effect of each new system on the plant's cyber security, and to develop response plans to deal with computer incidents. Vendors are told how to reduce the risk of saboteurs planting backdoors and logic bombs in safety system software during the development phase.
"I really liked the notion of making people aware that they need to address security throughout the process of developing new software and systems, and not just as a test at the end," says Chris Wysopal, a Boston-based computer security researcher with the Symantec Corporation. (Symantec publishes SecurityFocus ). "They talked about that going all the way back to the requirement phase, which I thought was good"
But for all its breadth, adherence to the new guidelines would be strictly voluntary for operators of the 103 nuclear reactors already running in the U.S. -- a detail that irks some security experts. In filed comments, Joe Weiss, a control systems cyber security consultant at KEMA, Inc., argued the regulatory guide shouldn't be limited to plant safety systems, and that existing plants should be required to comply.
"There have been numerous cases of control system cyber security impacts including several in commercial nuclear plants," Weiss wrote. "Many nuclear plants have connected their plant networks to corporate networks making them potentially vulnerable to cyber intrusions."
Wysopal, who reviewed the draft at SecurityFocus' request, agrees that it could use more juice. "It's kind of sad," he says. "I see that people have all these great notions of how we can build software and systems more securely, but it's always voluntary."
The NRC is accepting public comments on the new guide until February 11th.