Cyber norms for civilian nuclear power plants

Abstract

The international community agrees that the safe operation of civilian nuclear infrastructure is in every population’s best interest. One challenge each government must address is defining and agreeing to a set of acceptable norms of behavior in cyberspace as they relate to these facilities. The introduction of digital systems and networking technologies into these environments has led to the possibility that control and supporting computer systems are now accessible and exploitable, especially where interconnections to global information and communications technology (ICT) networks exist. The need for norms of behavior in cyberspace includes what is expected of system architects and cyber defenders as well as adversaries who should abide by rules of engagement even while conducting acts that violate national and international laws. The goal of this paper is to offer three behavioral cyber norms to improve the overall security of the ICT and Operational Technology (OT) networks and systems that underlie the operations of nuclear facilities. These norms of behavior will be specifically defined with the goals of reducing the threats associated to the theft of nuclear materials, accidental release of radiation and sabotage of nuclear processes. These norms would also include instances where an unwitting attacker or intelligence collection entity inadvertently makes their way into a nuclear facility network or system and can recognize they are in a protected zone and an approach to ensuring that these zones are not exploitable by bad actors to place their sensitive cyber effect delivery systems.