Development of a quantitative method for evaluating the efficacy of cyber security controls in NPPs based on intrusion tolerant concept

Abstract

Many regulatory documents, guides, and standards for cyber security issues in the nuclear industry have been published since Digital Instrumentation and Control (DI&C) systems were introduced to Nuclear Power Plants (NPPs). However, there are still difficulties when it comes to deciding which security controls are needed and to defining appropriate security control requirements for NPPs. With these regard, a quantitative method for evaluating the efficacy of security controls for DI&C systems in NPPs based on the intrusion tolerant concept is proposed in this study. The essence of the suggested method, Intrusion Tolerance based Cyber Security Index (InTo-CSI), is defined as a reduction ratio of probability that a cyber-attack damages a target system. The intrusion tolerant concept is applied to the evaluation method because availability of system's safety functions is the first priority in the nuclear industry. "How much the system is intrusion-tolerant" means that to what extent does the system provide the minimum level of safe operation when facing unexpected intrusions. Based on intrusion tolerant strategies, an event tree was constructed, and InTo-CSI was estimated by failure probability of intrusion tolerant strategies: the resistance strategy, the detection strategy, and the graceful-degradation strategy. Among these three strategies, quantifying failure probability of the resistance strategy is more challenging than the other two strategies because its relation with attack-difficulty. Attack-difficulty has a strong dependence on unexpected and abstract factors such as attacker's skills and accessibility to information of the target system. For this reason, the model of Mean Time To Compromise (MTTC) was adopted to estimate abstract variables, and the adopted model was revised in accordance with the suggested evaluation method. Validity of the suggested method was proven by conducting a case study. The suggested method can help assess how much the system security can be improved by applying specific cyber security controls, and which types of additional cyber security controls should be taken. Furthermore, InTo-CSI can make security designers achieve efficacy levels of the specific target system by quantitatively evaluating cyber security controls. (C) 2017 Elsevier Ltd. All rights reserved.