ML22038A946: Difference between revisions

From kanterella
Jump to navigation Jump to search
(StriderTol Bot change)
(StriderTol Bot change)
 
Line 15: Line 15:


=Text=
=Text=
{{#Wiki_filter:IAEA Technical Meeting on Instrumentation and Control and Computer Security for Small Modular Reactors and Microreactors February 21-25, 2022
{{#Wiki_filter:U.S.A. Regulatory Efforts for Cyber Security of Advanced Reactors Juris Jauntirans Cyber Security Specialist U.S. Nuclear Regulatory Commission Ismael Garcia Senior Level Advisor, Cyber Security and Digital Instrumentation and Control U.S. Nuclear Regulatory Commission Michael T. Rowland Sandia National Laboratory IAEA Technical Meeting on Instrumentation and Control and Computer Security for Small Modular Reactors and Microreactors February 21-25, 2022


U.S. A. Regulatory Efforts for Cyber Security of Advanced Reactors
Draft Cyber Security Requirements for Advanced Reactors 2


Juris Jauntirans Ismael Garcia Michael T. Rowland Cyber Security Specialist Senior Level Advisor, Cyber Security and Sandia National Laboratory U.S. Nuclear Regulatory Commission Digital Instrumentation and Control U.S. Nuclear Regulatory Commission Draft Cyber Security Requirements fo r Advanced Re a c t o rs
Background -
Power Reactors Cyber Requirements Found in 10 CFR 73.54 Protect digital assets that perform specified functions Protect from cyber attacks up to an including a DBT 3


2 Background - Found in 10 CFR 73.54 Po w e r Reactors Protect digital assets that perform Cyber specified functions Requirements Protect from cyber attacks up to an including a DBT
Proposed New Cyber Requirements 4
10 CFR Part 53 development for Advanced Reactors Preliminary Proposed Rule Language Publicly Available New Cyber Requirements in Proposed Rule


3 Proposed New Cyber Requirements
Preliminary Proposed Cyber Requirements 5
 
10 CFR Part 53 Preliminary New Cyber development for Proposed Rule Requirements in Advanced Reactors Language Proposed Rule Publicly Available
 
4 Preliminary Proposed Cyber Requirements


==Reference:==
==Reference:==
Part 73.110, "Technology Neutral Requirements for Protection of Digital Computer and Communication Systems and Networks, ADAMS Accession Number ML21308A026 5 10 CFR 73.110 D ra f t Regulatory Guide Concepts
Part 73.110, "Technology Neutral Requirements for Protection of Digital Computer and Communication Systems and Networks, ADAMS Accession Number ML21308A026
 
6 Draft Regulatory Guide Development
 
An acceptable Effective guidance Leverage approach for to support a IAEA and IEC meeting the performance-security 10 CFR 73.110 based regulatory approaches requirements framework
 
7 Facility Level D ra f t Regulatory Guide - Function Level Three-Tier Analysis Approach System Level
 
8 CEAS: Cyber-Enabled Accident Scenario Important Terminology CEIS: Cyber-Enabled Physical Intrusion Scenario
 
9 Overview of Draft Regulatory Guide Performance-based/Risk Informed Approach
 
S TA R T -
Existing Safety and Security Analyses
 
Evaluate DB and PPS for Update protection against CEAS DB and/or PPS Facility and CEIS Level Ye s CEAS or CEIS Security result in 10 CFR By 73.110(a) Ye s Design consequences? Feasible?
 
No No DB elements and PPS features ensure that Develop Adversary potential cyber attacks do not result in 10 CFR 73.110(a) Functional Scenarios Function consequences Level
 
DB - Design Basis PPS-Physical Protection Systems CEIS-Cyber Enabled Intrusion Scenario CEAS-Cyber Enabled Accident Scenario 10 Overview of Draft Regulatory Guide Performance -based/Risk Informed Approach (Cont.)
 
Specify CSP and DCSA elements (e. g.,
prohibitions, passive/deterministic devices) to eliminate or mitigate attacks Ye s
 
Function Do unmitigated Level Passive Ye s Adversary Defense Functional Feasible? Scenarios remain?


No No
10 CFR 73.110 Draft Regulatory Guide Concepts 6


Document CSP and DCSA Optional elements required to prevent credible cyber attack scenarios
Draft Regulatory Guide Development 7
An acceptable approach for meeting the 10 CFR 73.110 requirements Effective guidance to support a performance-based regulatory framework Leverage IAEA and IEC security approaches


CSP-Cyber Security Plan DCSA-Defensive Computer Security Architecture 11 Overview of Draft Regulatory Guide Performance-based/Risk Informed Approach (Cont.)
Draft Regulatory Guide -
Three-Tier Analysis Approach 8
Facility Level Function Level System Level


Identify Critical Functions and Systems
Important Terminology CEAS: Cyber-Enabled Accident Scenario CEIS: Cyber-Enabled Physical Intrusion Scenario 9


Develop or Update Adversary Technical Sequences System Level Specify active CSP and DCSA
Evaluate DB and PPS for protection against CEAS and CEIS START -
Existing Safety and Security Analyses DB elements and PPS features ensure that potential cyber attacks do not result in 10 CFR 73.110(a) consequences Update DB and/or PPS CEAS or CEIS result in 10 CFR 73.110(a) consequences?
Security By Design Feasible?
Yes No Yes No Develop Adversary Functional Scenarios DB - Design Basis PPS-Physical Protection Systems CEIS-Cyber Enabled Intrusion Scenario CEAS-Cyber Enabled Accident Scenario 10 Overview of Draft Regulatory Guide Performance-based/Risk Informed Approach Facility Level Function Level


elements (e.g., detection and response systems) and System Cyber Security Controls
Do unmitigated Adversary Functional Scenarios remain?
Passive Defense Feasible?
Specify CSP and DCSA elements (e.g.,
prohibitions, passive/deterministic devices) to eliminate or mitigate attacks No Yes No Yes Document CSP and DCSA elements required to prevent credible cyber attack scenarios CSP-Cyber Security Plan DCSA-Defensive Computer Security Architecture 11 Optional Overview of Draft Regulatory Guide Performance-based/Risk Informed Approach (Cont.)
Function Level


Document CSP and DCSA Ye s NoUnmitigated elements, including cyber Sequences? security controls, needed to protect against cyber attacks
Identify Critical Functions and Systems Document CSP and DCSA elements, including cyber security controls, needed to protect against cyber attacks Develop or Update Adversary Technical Sequences Specify active CSP and DCSA elements (e.g., detection and response systems) and System Cyber Security Controls Unmitigated Sequences?
Yes No CSP-Cyber Security Plan DCSA-Defensive Computer Security Architecture 12 Overview of Draft Regulatory Guide Performance-based/Risk Informed Approach (Cont.)
System Level


CSP-Cyber Security Plan DCSA-Defensive Computer Security Architecture 12 Continue work on Proposed Cyber Requirements and draft Future Regulatory Guide Wo r k Inclusion in Part 53 rulemaking package
Future Work Continue work on Proposed Cyber Requirements and draft Regulatory Guide Inclusion in Part 53 rulemaking package 13


13 14}}
14}}

Latest revision as of 18:38, 27 November 2024

Presentation for IAEA Technical Meeting on Instrumentation and Control and Computer Security for Small Modular Reactors and Microreactors
ML22038A946
Person / Time
Issue date: 02/03/2022
From: Ismael Garcia
NRC/NSIR/DPCP
To:
Garcia I
References
Download: ML22038A946 (15)
v • d • e


Text

U.S.A. Regulatory Efforts for Cyber Security of Advanced Reactors Juris Jauntirans Cyber Security Specialist U.S. Nuclear Regulatory Commission Ismael Garcia Senior Level Advisor, Cyber Security and Digital Instrumentation and Control U.S. Nuclear Regulatory Commission Michael T. Rowland Sandia National Laboratory IAEA Technical Meeting on Instrumentation and Control and Computer Security for Small Modular Reactors and Microreactors February 21-25, 2022

Draft Cyber Security Requirements for Advanced Reactors 2

Background -

Power Reactors Cyber Requirements Found in 10 CFR 73.54 Protect digital assets that perform specified functions Protect from cyber attacks up to an including a DBT 3

Proposed New Cyber Requirements 4

10 CFR Part 53 development for Advanced Reactors Preliminary Proposed Rule Language Publicly Available New Cyber Requirements in Proposed Rule

Preliminary Proposed Cyber Requirements 5

Reference:

Part 73.110, "Technology Neutral Requirements for Protection of Digital Computer and Communication Systems and Networks, ADAMS Accession Number ML21308A026

10 CFR 73.110 Draft Regulatory Guide Concepts 6

Draft Regulatory Guide Development 7

An acceptable approach for meeting the 10 CFR 73.110 requirements Effective guidance to support a performance-based regulatory framework Leverage IAEA and IEC security approaches

Draft Regulatory Guide -

Three-Tier Analysis Approach 8

Facility Level Function Level System Level

Important Terminology CEAS: Cyber-Enabled Accident Scenario CEIS: Cyber-Enabled Physical Intrusion Scenario 9

Evaluate DB and PPS for protection against CEAS and CEIS START -

Existing Safety and Security Analyses DB elements and PPS features ensure that potential cyber attacks do not result in 10 CFR 73.110(a) consequences Update DB and/or PPS CEAS or CEIS result in 10 CFR 73.110(a) consequences?

Security By Design Feasible?

Yes No Yes No Develop Adversary Functional Scenarios DB - Design Basis PPS-Physical Protection Systems CEIS-Cyber Enabled Intrusion Scenario CEAS-Cyber Enabled Accident Scenario 10 Overview of Draft Regulatory Guide Performance-based/Risk Informed Approach Facility Level Function Level

Do unmitigated Adversary Functional Scenarios remain?

Passive Defense Feasible?

Specify CSP and DCSA elements (e.g.,

prohibitions, passive/deterministic devices) to eliminate or mitigate attacks No Yes No Yes Document CSP and DCSA elements required to prevent credible cyber attack scenarios CSP-Cyber Security Plan DCSA-Defensive Computer Security Architecture 11 Optional Overview of Draft Regulatory Guide Performance-based/Risk Informed Approach (Cont.)

Function Level

Identify Critical Functions and Systems Document CSP and DCSA elements, including cyber security controls, needed to protect against cyber attacks Develop or Update Adversary Technical Sequences Specify active CSP and DCSA elements (e.g., detection and response systems) and System Cyber Security Controls Unmitigated Sequences?

Yes No CSP-Cyber Security Plan DCSA-Defensive Computer Security Architecture 12 Overview of Draft Regulatory Guide Performance-based/Risk Informed Approach (Cont.)

System Level

Future Work Continue work on Proposed Cyber Requirements and draft Regulatory Guide Inclusion in Part 53 rulemaking package 13

14

Retrieved from "https://kanterella.com/w/index.php?title=ML22038A946&oldid=3801785"