가동 중 원자력시설의 SBOM(Software Bill Of Materials)구현방안 연구
Study on the Implementation of SBOM(Software Bill Of Materials) in Operational Nuclear Facilities
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 APR1400 노형과 같이 원자력발전소의 디지털 기술 적용에 따라 “이블 PLC”같은 원자력시설 대상의 공급망 공격이 증가하는 추세이다. 원자력 공급망 보안에 있어 산업 특성상 수많은 공급업체가 존재하기에 이를 체계적으로 관리할 수 있는 자원 관리 시스템이 필요하다. 하지만, 제어시스템 특성상 소프트웨어 자산의 긴 생명 주기로 인해 속성 정보가 일관되지 않게 관리된다는 문제점이 존재한다. 또한, 운영 환경의 가용성 문제로 인해 형상 관리 자동화 도입이 미흡한 상태에서 입력 오류와 같은 한계점이 존재한다. 본 연구에서는 SBOM(Software Bill Of Materials)을 적용한 체계적인 자산 관리 방안 및 자연어처리 기법을 적용한 입력 오류에 관한 개선 방안을 제안한다.
Abstract
Recently, supply chain attacks against nuclear facilities such as "Evil PLC" are increasing due to the application of digital technology in nuclear power plants such as the APR1400 reactor. Nuclear supply chain security requires a asset management system that can systematically manage a large number of providers due to the nature of the industry. However, due to the nature of the control system, there is a problem of inconsistent management of attribute information due to the long lifecycle of software assets. In addition, due to the availability of the operational technology, the introduction of automated configuration management is insufficient, and limitations such as input errors exist. This study proposes a systematic asset management system using SBOM(Software Bill Of Materials) and an improvement for input errors using natural language processing techniques.
참고문헌 (24)
- LIM, SOO MIN, "International Nuclear Power Digital Asset Supply Chain Cybersecurity Regulatory Trends", Jonornal of The Korea Institute of information Security &Cryptology, 26(1), pp.54~60 (2016)
- "Evil PLC" (2024)[URL]
- KIN, "KINS", GI-N001 Vol.4, Rev.6p.779, 2020
- Do-Yeon Kim, "Security Criteria for Design and Evaluation of Secure Plant Data Network on NuclearPower Plants", 9(2), pp.267~271 (2014)
- "PSEG Nuclear LLC" (2024)[URL]
- DELIVER UNCOMPROMISED: SECURING CRITICAL SOFTWARE SUPPLY CHAINS, "MITRE Corporation", 9~ (2021)
- Eggers, S., "A novel approach for analyzing the nuclear supply chain cyber-attack surface", Nuclear Engineering and Technology, 53(3), pp.879~887 (2020)
- "International Electrotechnical Commission “ICS Security” Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components", ~ (2019)
- NEI 08-09Cyber Security Plan for Nuclear Power Reactors, "Nuclear Energy Institute", ~ (2010)
- Kaspersky, "Kaspersky Industrial CyberSecurity for Networks", ~ (2024)
- INCIBE-CERT, "Guide for an asset inventory management in industrial control systems(pp. 8-13)", INCIBECERT, ~ (2020)
- Korea Energy Economics Institute, "World Nuclear Power Market INSIGHT", 8~ (2021)
- Chowdhury, N., "CS measures for nuclear power plant protection: A systematic literature review", Signals, 2(4), pp.803~819 (2021)
- "Asset Management" (2024)[URL]
- "Common Platform Enumeration" (2024)[URL]
- A Study on Factors Affecting the Intention to Adopting Software Bill of Materials for Cyber Security, "Hyeong-Dong Lee", ~ (2023)
- "SBOMM & CVE" (2024)[URL]
- Pascal Ackerman, "Industrial Cybersecurity:Efficiently secure critical infrastructure systems", pp.41~43 (2017)
- NEI 13-10, Rev. 5, Cyber Security Control Assessments, "Nuclear Energy Institute", ~ (2017)
- Vatanen, T., "Language Identification of Short Text Segments with N-gram Models", LREC, pp.3423~3430 (2010)
- Ivchenko, G. I., "On the jaccard similarity test", Journal of Mathematical Sciences, 88, pp.789~794 (1998)
- Status Report 103–Advanced Power Reactor (APR1000), "Acronym, A. P. R.", ~
- "VxWorks CPE" (2024)[URL]
- "ICS-CERT Adviories" (2024)[URL]