Great risk of cyber attack on nuclear facilities
UK nuclear facilities are at risk of a major cyber attack due to a lack of security awareness among senior management and a growing trend towards digitalisation, according to a new report.
Chatham House spoke to 30 “leading industry professionals” to compile this report, which is titled: “Cyber Security at Civil Nuclear Facilities: Understanding the Risks.”
The report highlighted serious shortcomings in the supply chain, meaning that nuclear power plant equipment could be compromised at any stage.
Also highlighted are the overly reactive approach to cybersecurity, the lack of staff training, and the unclear, ineffective communication between engineers and security personnel.
The facilities are not 'air gapped', as many believe, but are connected to the Internet, which means they are exposed to all the associated risks, the report states, among other things. And hackers can easily find critical infrastructure components through a simple web search.
The report recommends the development of risk assessment guidelines and the issuance of regulatory rules.
It also suggests that nuclear facilities introduce and implement good “IT hygiene” rules, and that engineers and contractors be trained on cybersecurity risks.
Tony Berning, senior manager at OPSWAT, said that mobile devices are being used to spread malware to air-gapped systems. He also warned that many of the SCADA and ICS systems running at nuclear plants were created decades ago, when cybersecurity was not yet a major issue.
