공격 트리를 이용한 다양성보호계통 사이버보안 위험 평가
Cybersecurity Risk Assessment of a Diverse Protection System Using Attack Trees
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Instrumentation and control systems measure and control various variables of nuclear facilities to operate nuclear power plants safely. A diverse protection system, a representative instrumentation and control system, generates a reactor trip and turbine trip signal by high pressure in a pressurizer and containment to satisfy the design requirements 10CFR50.62. Also, it generates an auxiliary feedwater actuation signal by low water levels in steam generators. Cybersecurity has become more critical as digital technology is gradually applied to solve problems such as performance degradation due to aging of analog equipment, increased maintenance costs, and product discontinuation. This paper analyzed possible cybersecurity threat scenarios in the diverse protection system using attack trees. Based on the analyzed cybersecurity threat scenario, we calculated the probability of attack occurrence and confirmed the cybersecurity risk in connection with the asset value.
Abstract
Instrumentation and control systems measure and control various variables of nuclear facilities to operate nuclear power plants safely. A diverse protection system, a representative instrumentation and control system, generates a reactor trip and turbine trip signal by high pressure in a pressurizer and containment to satisfy the design requirements 10CFR50.62. Also, it generates an auxiliary feedwater actuation signal by low water levels in steam generators. Cybersecurity has become more critical as digital technology is gradually applied to solve problems such as performance degradation due to aging of analog equipment, increased maintenance costs, and product discontinuation. This paper analyzed possible cybersecurity threat scenarios in the diverse protection system using attack trees. Based on the analyzed cybersecurity threat scenario, we calculated the probability of attack occurrence and confirmed the cybersecurity risk in connection with the asset value.
참고문헌 (15)
- 이철권, "원전 계측제어시스템 사이버보안 기술동향", 정보보호학회지, 22(5), pp.28~34 (2012), 한국정보보호학회
- 송재구, "원자력발전소 디지털 제어기의 사이버보안 기능 적합성 시험방법 연구", 정보보호학회논문지, 29(6), pp.1425~1435 (2019), 한국정보보호학회[DOI]
- U.S. NRC, "Cyber Security Programs for Nuclear Facilities, Regulatory Guide 5.71", ~ (2010)
- 원자력 시설 등의 컴퓨터 및 정보시스템 보안 기술기준, "한국원자력통제기술원", ~, pp.KINAC RS-015 (2016)
- NIST, "Guide for assessing the security controls in federal information systems, SP800-53A Revision 1", ~ (2010)
- Computer security at nuclear Facilities, "IAEA", ~, pp.Nuclear Security Series No.17 (2011)
- NEI, "Cyber Security Control Assessments, NEI 13-10 Revision 6", ~ (2017)
- NEI, "Cyber Security Plan for Nuclear Power Reactors, NEI 08-09 Revision 6", ~ (2010)
- Bruce. Schneier, "Attack Trees", Dr. Dobb's Journal, 24(12), pp.21~29 (1999)
- 김경아, "공격 트리를 이용한 산업 제어 시스템 보안 위험 분석", 융합보안 논문지, 11(6), pp.53~58 (2011), 한국융합보안학회
- 오양균, "Fault-Tolerant Design for Advanced Diverse Protection System", Nuclear Engineering and Technology, 45(6), pp.795~802 (2013), 한국원자력학회
- 정성민, "원전 다양성 보호계통 사이버보안 테스트베드 설계", 2020온라인 춘계학술발표대회 논문집, 27(1), pp.292~294 (2020), 한국정보처리학회
- DHS, "Common Cybersecurity Vulnerabilities in Industrial Control Systems", ~ (2011)
- NIST, "Standards for Security Categorization of Federal Information and Information Systems, FIPS PUB 199", ~ (2004)
- Indrajit Ray and Nayot Poolsapassit, "Using Attack Trees to Identify Malicious Attacks from Authorized Insiders", 10th European Symposium on Research in Computer Security, 3679, pp.231~246 (2005)