CS Measures for Nuclear Power Plant Protection: A Systematic Literature Review

Abstract

As digital instrumentation in Nuclear Power Plants (NPPs) is becoming increasingly complex, both attack vectors and defensive strategies are evolving based on new technologies and vulnerabilities. Continued efforts have been made to develop a variety of measures for the cyber defense of these infrastructures, which often consist in adapting security measures previously developed for other critical infrastructure sectors according to the requirements of NPPs. That being said, due to the very recent development of these solutions, there is a lack of agreement or standardization when it comes to their adoption at an industrial level. To better understand the state of the art in NPP Cyber-Security (CS) measures, in this work, we conduct a Systematic Literature Review (SLR) to identify scientific papers discussing CS frameworks, standards, guidelines, best practices, and any additional CS protection measures for NPPs. From our literature analysis, it was evidenced that protecting the digital space in NPPs involves three main steps: (i) identification of critical digital assets; (ii) risk assessment and threat analysis; (iii) establishment of measures for NPP protection based on the defense-in-depth model. To ensure the CS protection of these infrastructures, a holistic defense-in-depth approach is suggested in order to avoid excessive granularity and lack of compatibility between different layers of protection. Additional research is needed to ensure that such a model is developed effectively and that it is based on the interdependencies of all security requirements of NPPs.

Critical Infrastructures: Reliability, Resilience and Wastage

“…The selection of keywords is based on adopting a novel approach for the investigation. As defined in the Introduction, other SLR works tend to focus on synergies between natural resources [21], disaster management [4] or cyber-security [22]. However, at the time of writing this article, SLRs on waste behaviours within the critical infrastructure domain are lacking.…”

“…Sänger et al [9] investigated critical health infrastructure resilience, focusing primarily on water supply. Guo et al [4] focus on resilience under disasters and disruptive events, and Chowdhury [22] focuses on cyber-security specifically for nuclear power plants. However, the research in this article stands apart from other works by focusing on human-based waste behaviours within the critical infrastructure domain, where limited work has been conducted.…”

“…Within existing SLR reviews, the duration of the paper search period varies. For example, Chowdhury [22] considers works from the last 10 years, whereas Sänger et al [9] include articles from the last 30. In [25,26], the authors consider articles from the last 5 years, and this is a process we have also adopted in this investigation.…”

Benefits of PLT for Cybersecurity Training

“…In Chowdhury [11], the authors conduct an SLR of CS measures for NPPs. the authors define CS measures as "any type of method or instrument that has been de-veloped and applied for NPP CS, including all types of CS procedures, tools, or other instrumentation, such as Intrusion Detection and Protection Systems (IDPSs), CS awareness and training campaigns, and any other type of solution used for CS assurance in NPPs" [11].…”

“…In Chowdhury [11], the authors conduct an SLR of CS measures for NPPs. the authors define CS measures as "any type of method or instrument that has been de-veloped and applied for NPP CS, including all types of CS procedures, tools, or other instrumentation, such as Intrusion Detection and Protection Systems (IDPSs), CS awareness and training campaigns, and any other type of solution used for CS assurance in NPPs" [11]. According to the authors, NPP CS requires three criti-cal, sequential phases: (i) identifying critical digital assets using discovery methods; (ii) establishing and con-ducting a risk assessment and threat analysis; (iii) in-stalling a layer of protective measures for NPPs' I&C systems against vulnerabilities and attacks.…”