GATES, GUARDS, GUNS AND GEEKS: The Changing Face of Nuclear Security and the IAEA s Leading Role in Promoting Computer Security for Nuclear Facilities

Transcription

1 GATES, GUARDS, GUNS AND GEEKS: The Changing Face of Nuclear Security and the s Leading Role in Promoting Computer Security for Nuclear Facilities Presented by: Donald D. Dudenhoeffer International Atomic Energy Agency

2 Computer and Information Security The s Division of Nuclear Security (NSNS) Information and Computer Security programme is focused on preventing computer acts that could directly or indirectly lead to: unauthorized removal of nuclear/other radioactive material sabotage against nuclear material or nuclear facilities theft of nuclear sensitive information. 2

3 Role in Computer Security The Division of Nuclear Security (NSNS) seeks to support Member States in enhancing their computer security with their nuclear security regime through the development of guidance documents, expert meetings, training and supporting activities. The resolution GC(57)/RES/10 of the 57th General Conference which noted the s efforts to raise awareness of the threat of cyber-attacks and their potential impact on nuclear security, and encouraged the to make further efforts to improve international cooperation in this regard.

4 The Changing Face of Nuclear Security Nuclear security is the protection of nuclear material, other radioactive material, associated facilities, and associated activities, including transport security. Nuclear security measures are designed to support the prevention of, detection of, and response to, criminal or intentional unauthorized acts involving or directed at such materials, facilities, operations. GATES GUARDS GUNS GEEKS A new security expert is in town 4

5 Same Threat Actors with a new weapon Disgruntled Employee Internal Covert Agent Human Error Threat Origins Extremist Groups Terrorist Groups External Organized Crime Nation States Target of Opportunity Threat = capability + intent + opportunity 5

6 Threat and Attack Characteristics Less Strategic Information Warfare Major Economic Gain Cyber Terrorism Asymmetric Warfare Sophisticated Injection Poison Data Compromise Process LIKELIHOOD Very Directed Cyber Attacks Structured Hackers Direct & Targeted Monetary Gain Extreme Activist / Groups Disgruntled Employee Disruption General Cyber Attacks - Less Structured Notoriety and Fame Just to Do It Worm Hacking Economy DOS Probe System Control System Compromise GRP I Mainstream GRP II & III Concentrated DDOS Directed Corruption GRP II Organized Crime Competitors Hackers for Hire Low & slow Persistent Presence GRP III Nation States Terrorist Smallest CONSEQUENCES Slide Courtesy of Idaho National Laboratory Largest 6

7 Computer Security Events Presented multiple computer security events that had direct impact or relevance for Nuclear Monju NPP (Japan) Compromise of control room computer and release of information Korea Hydro and Nuclear Power (KHNP) Computer compromise and release of NPP documents German Steel Mill Attack Control system compromise causing physical damage. Hackers had good understanding of control system operation. What does 2015 Hold?

8 Computer Security Events -continued Facilities are not just the only targets of attack! 2012 Compromise of an old server resulted in the release of addresses and other information USNRC Victim of multiple attacks that compromised s and accounts. Areva(France) Reports in 2011 of a targeted attack against Areva RSA(USA) Reports in 2011 of a phishing compromise and loss of data related to security products

9 Terms and Interfaces Computer Security Why not? Cyber security, IT security, ICT security, ICS security, digital system security. Information Security is not Computer Security Information security deals with the larger area of sensitive information identification, classification, marking, and handling 9

10 Safety and Security Interface Die Sicherheit DBA DBT Fault Trees Safety People Process Equip. Attack Trees Security ICS/IC IT PPS 10

11 NSNS Information and Computer Security NSNS Information and Computer Security Program Objective: The objective of NSNS s related activities is to provide States with the guidance and expertise they need to develop and implement effective information and computer security to enhance their overall national nuclear security regime. Activities and Resources provided by the under this program include: Technical Guidance Documents Expert Meetings and Technical Information exchange forums (CN, CS, TM) Regional and National Training Activities Regional/International Exercise Support Outreach 11

12 Information and Computer Security support at the multiple levels for building a robust and tested Information and Computer Security Programme Exercise the Programme Assess and Evaluate Core Elements: Prevent Detect Respond Implement the Programme Build Awareness Develop Policy 12

13 The Nuclear Security Series (NSS) Address nuclear security issues relating to the prevention and detection of, and response to, theft, sabotage, unauthorized access and illegal transfer or other malicious acts involving nuclear material and other radioactive substances and their associated facilities. 13

14 Application and Audience International Instruments & NSS Guides International Bodies Organizations / Facilities National Authorities Competent Authorities 14

15 International Instruments examples Legally Binding - concrete obligations and relationships under international law The Convention on the Physical Protection of Nuclear Material (CPPNM)(INFCIRC/274/Rev.1)(1987) and 2005 Amendment International Convention for the Suppression of Terrorist Bombings (Terrorist Bombings Convention) International Convention for the Suppression of Acts of Nuclear Terrorism (Nuclear Terrorism Convention) UN Security Council resolutions adopted under Chapter VII of the UN Charter Resolutions 1373 (2001) and 1540 (2004) Non-binding - applied voluntarily by States Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Rev.5/NSS No. 13) The United Nations Global Counter-Terrorism Strategy (A/RES/60/288) Code of Conduct on the Safety and Security of Radioactive Sources (GOV/2004/49-GC(47)/9)(2003) 15

16 Basis - Information Security Nuclear Security Fundamentals (NSS 20) 3.3 (g) Provide for the establishment of regulations and requirements for protecting the confidentiality of sensitive information and for protecting sensitive information assets; 3.6 (e) Ensuring through appropriate arrangements that sensitive information or other information exchanged in confidence is adequately and appropriately protected. sensitive information. Information, in whatever form, including software, the unauthorized disclosure, modification, alteration, destruction, or denial of use of which could compromise nuclear security. sensitive information assets. Any equipment or components that are used to store, process, control or transmit sensitive information. 16

17 Basis - Computer Security Nuclear Security Series No 13 (INFCIRC/225/Revision 5) Computer based systems used for physical protection, nuclear safety, and nuclear material accountancy and control should be protected against compromise (e.g. cyber attack, manipulation or falsification) consistent with the threat assessment or design basis threat. 17

18 Basis - Information Security Nuclear Security Series No 23-G Security of Nuclear Information This publication provides guidance on implementing the principle of confidentiality and on the broader aspects of information security (i.e. integrity and availability). Specifically it seeks to assist states in the identification, classification, and assignment of appropriate security controls to information that could adversely impact nuclear security if compromised. 18

19 Basis - Computer Security NSS17 Computer Security at Nuclear Facilities Technical Guidance The objective of the document is to provide guidelines to personnel designing, implementing, and managing Instrumentation and Control (I&C) and Information systems and networks at nuclear facilities. The document addresses prevention and detection of potential attacks through reference to best practices in architecture, assurance and management of security information and I&C systems. 19

20 NSS and TECDOCs in Development Document TECDOC NST037 Conducting Computer Security Assessments - Provides good practices for organizing and conducting computer security assessments associated with nuclear security TECDOC NST038 Computer Security Incident Response - Provides good practices for implementing computer security incident response processes between competent authorities, operators, and technical support organizations. NSS Technical Guidance -NST036 Computer Security of I&C Systems at Nuclear Facilities. - Provides guidance on implementing computer security controls across the life cycle of nuclear instrumentation and control systems. NSS Implementing Guide NST045 Computer Security for Nuclear Security. - Provides overarching guidance to assist Member States in implementing computer security as a part their nuclear security regime. NSS Technical Guidance NST047 Computer Security Techniques for Nuclear Facilities. - Provides discussion on good practices for implementing computer security associated digital technologies at nuclear facilities. Status Document Completed. Publication in 2015 Document Completed. Publication in 2015 Approved for 120 day Member State Review. Publication in 2015/2016 Under development Under development 20

21 Training Courses (Regional and National) Nominal Training 5 day instructor based course covering Nuclear Series Guidance, international standards and industry good practices Taught by a 3-4 member team of computer/information security experts Pre 2012: Beijing Bucharest Indonesia Tunisia Lithuania ROK South Africa Germany Argentina 2013 Courses Romania (NTC) USA (RTC) China (RTC) Ghana (RTC) 2014 Courses Brazil (April - Advanced) Jordan (May Awareness) Moldova (Oct Awareness) India (Nov Advanced) Korea (Nov Assessment) Japan (NTC) Hungary (NTC) Romania (NTC) UAE (NTC) China (NTC) 21

22 NTC & RTC Computer Security Topics Primary Training Courses 1. Basic Information and Computer Security Awareness 2. Conducting Computer Security Assessments (new 2013) 3. Advanced Course in Information and Computer Security (new 2014) 4. Computer Security for Nuclear Industrial Control Security (ICS) and Instrumentation and Control (I&C) Systems (2015) Courses can be adjusted to fit national or regional needs. Basic Awareness Course Topics Threat and Consequence awareness Basic concepts Laws / Regulations / Regulatory Guidance Policy / requirements Interplay with other security domains Sensitive information management Threat / Risk Methodologies Programme assessment Security Culture/Training programme Security Control Concepts Security design Cryptography and Encryption Component/node security Network security Instrumentation and Control (I&C) security Access control System planning and acceptance Physical Protection Document and Media protection Methods of compromise Incident response / management Personnel security 22

23 Profession Development Course Nuclear Security Series No. 12 Educational Programme in Nuclear Security Goal the development of a comprehensive nuclear security human resource development programme NS22 Computer Security for Nuclear Security Professionals university course consisting of a peer-reviewed textbook, and instructional material, including exercises Supports Computer Security concepts and awareness training in the nuclear security professional community, Developed with the International Nuclear Security Education Network (INSEN) NS22 Textbook NS22 Course currently being taught at the Monterey Institute of International Studies 23

24 elearning Training Series Future courses on Information Security Conducting Assurance Activities Security of I&C Systems Incident Response 24

25 Cyber Security User s Group s information portal for cyber security 25

26 Computer Security Conference International Conference on Computer Security in a Nuclear World: Expert Discussion and Exchange Headquarters, Vienna, Austria, 1 5 June 2015 One of the key purposes of the conference is to provide a global forum for Information Exchange for competent authorities, operators, system and security vendors, and other entities engaged in computer security activities relevant to nuclear security. Key dates and Deadlines: Registration is open 31 May 2015 Early Conference check-in 1-5 June 2015 Conference Scientific Secretary: Mr Donald D. Dudenhoeffer CompSec2015@iaea.org, d.dudenhoeffer@iaea.org Current statistics (16 Feb 2015) Registered Participants: 404 Represented Countries: 89 International Organizations: 14 Submitted Papers: 150

27 Conference Team

28 Tunisia Thailand Spain Slovenia Jamaica Israel Iran, Islamic Republic of Democratic Rep. of the Congo Chile Bulgaria Bangladesh Armenia United Republic of Tanzania Russian Federation Niger Mexico Lithuania Belgium Australia Algeria South Africa Serbia Mongolia Kazakhstan Jordan Japan Italy Egypt Czech Republic Belarus Vietnam Switzerland Brazil Austria Romania Pakistan Malaysia Indonesia Ghana Korea, Republic of India Turkey Morocco Argentina Canada Slovakia Netherlands Finland United Kingdom Hungary France China Nigeria Germany United States of America Participation of Countries with Nuclear Facilities Operating/under construction/ planned NPPS Research Reactors Fuel Cycle Facilities

29 Conference Addressing the multiple aspects of Nuclear Security Tracks 1. Cyberthreats in Nuclear Security 2. Computer Security and System Design for Systems at Nuclear Facilities 3. Coordination for Ensuring Computer Security in a Nuclear Security Regime 4. Nuclear Security Regulatory Approaches to Information and Computer Security 5. Computer Security Programmes at Licensed Facilities 6. Computer Security Management in Nuclear Security 7. Computer Security Culture and Capacity Building for Nuclear Security 8. Special Topics 9. International and Legal Considerations in Relation to Computer Security at Nuclear

30 Questions? Mr Donald D. Dudenhoeffer Division of Nuclear Security Department of Nuclear Safety and Security International Atomic Energy Agency T: (+43-1)