核能電廠儀控資安評估與型態管理研究

Recently the products with openness and standardization are increasingly used in Instrumentation and Control (I&C) network systems of nuclear power plants to improve extensibility and interoperability. However, this causes the possibility that attackers can intrude and attack I&C system via common tools. In recent years, due to the information security accidents happening again and again, it mentions the importance of information security. In previous project, we aim at planning a dedicated system for the instrumentation and control network of nuclear power plants. The proposed system is called Instrumentation and Control Network Security Management System (ICNSMS). We expect that the proposed system will benefit the power plants and the officials in producing an Information Security Management System ISMS). In order to improve the overall security of nuclear power plant I&C system, this project will study nuclear security related standards in development to decide the information security evaluation items for nuclear power plant I&C system. The referred standards include NRC Security Rule 73.54 (10 CFR 73.54) “Protection of Digital Computers and Communications Systems and Networks”, RG 5.71 “Cyber Security Programs for Nuclear Facilities”, NEI 08-09 “Cyber Security Plan Template” and “NERC Critical Infrastructure Protection (CIP) Standard and applicability to Nuclear”, etc. Besides, according to the flows of nuclear power plant I&C system, we plan to design a graphical vulnerability analysis method. Furthermore, taking the configuration management of nuclear power plant I&C system as a target, we will apply the proposed vulnerability analysis method to describe the vulnerabilities, threats and countermeasures to improve the security of configuration management.

Project ID:PG9903-0206
External Project ID:992001INER004