원자력발전소 디지털 제어기의 사이버보안 기능 적합성 시험방법 연구
Research of Cyber Security Function Test Method for Digital I&C Device in Nuclear Power Plants
2
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
디지털 제어기 적용의 확대로 원자력 시설에 대한 사이버보안 이슈가 대두되었다. 이에 대처하기 위해 공표된 국내원자력 시설에 대한 사이버보안 기술기준 RS-015에서는 원자력 시스템 개발자에게 보안 기능의 적용과 아울러 알려진 취약점 분석, 보안 기능에 대한 시험 및 평가를 요구하고 있다. 이를 위해서는 원자력 사이버보안 기술기준에 따른보안 기능 적합성 시험 절차 및 방법 개발이 필요하다. 본 연구에서는 RS-015의 기술적, 운영적, 관리적 보안조치에대한 세부항목을 분류하여 기기 수준에서 요구되는 보안 요건을 도출하고 기기에 구현되는 보안 기능이 보안 요건을만족하는지를 시험하는 절차와 방법을 개발하였다. 본 논문에서는 보안 기능 적합성 시험 절차 및 방법 개발을 위한과정을 설명하고 개발된 시험사례를 제시한다.
Abstract
The expanded application of digital controls has raised the issue of cyber security for nuclear facilities. To cope withthis, the cyber security technical standard RS-015 for Korean nuclear facilities requires nuclear system developers to applysecurity functions, analyze known vulnerabilities, and test and evaluate security functions. This requires the development ofprocedures and methods for testing the suitability of security functions in accordance with the nuclear cyber securitytechnical standards. This study derived the security requirements required at the device level by classifying the details of thetechnical, operational and administrative security controls of RS-015 and developed procedures and methods to test whetherthe security functions implemented in the device meet the security requirements. This paper describes the process fordeveloping security function compliance test procedures and methods and presents the developed test cases.
참고문헌 (21)
- "NERC CIP compliance for the power generation industry, Developing a comprehensive program to comply with NERC CIP cyber security requirements"[URL]
- "Schneider Electric achieves industry-first ISA Secure®Level Two Security Development Life cycle Assurance certification"[URL]
- "Waterfall for NRC Compliance with regard to NIST 800.53 and 800.82: Using Waterfall’s Unidirectional Security Solution to Achieve True Security & NRC Compliance Ver. 1.4"[URL]
- "Security with SIMATIC-S7controllers"[URL]
- LogRhythm Support for NRC RG. 5.71, "LogRhythm", LogRhythm Inc, ~, pp.White paper -Compliance Support for NRC RG 5.71 (2014)
- "Regulatory Standard 015, Regulatory standard on computer security of nuclear facilities", KINAC, ~ (2014)
- "Regulatory Guide 5.71, Cyber Security Programs for Nuclear Facilities", U.S. Nuclear Regulatory Commission, ~ (2010)
- "NIST SP800-53A Revision 1, Guide for assessing the security controls in federal information systems", National Institute of Standards and Technology, ~ (2010)
- Computer security at nuclear Facilities, , International Atomic Energy Agency, ~, pp.IAEA Nuclear Security Series No.17 (2011)
- Cyber Security Control Assessments, "NEI 13-10 Revision 5", Nuclear Energy Institute, ~ (2017)
- Cyber Security Plan for Nuclear Power Reactors, , Nuclear Energy Institute, ~, pp.NEI 08-09 Revision 6 (2010)
- "IEEE Standard 1012-2016, IEEE Standard for System, Software, and Hardware Verification and Validation", Institute of Electrical and Electronics Engineers, ~ (2017)
- 권기춘, "원전 디지털 원자로보호계통 소프트웨어 안전보증 패러다임 적용 및 분석", 정보과학회 컴퓨팅의 실제 논문지, 23(6), pp.335~342 (2017), 한국정보과학회[DOI]
- "Korea IT Security Evaluation and Certification Scheme"[URL]
- "TTA.KO-12.0307-part1, Security Requirements for Industrial Control System - Part 1: Concepts and Reference Model", Telecommunications Technology Association, ~ (2017)
- "TTA.KO-12.0307-part2, Security Requirements for Industrial Control System - Part 2: Field Device Layer", Telecommunications Technology Association, ~ (2017)
- "TTA.KO-12.0307-part3, Security Requirements for Industrial Control System - Part 3: Control Layer", Telecommunications Technology Association, ~ (2017)
- TTA, "TTA.KO-12.0307-part4, Security Requirements for Industrial Control System - Part 4: Operation Layer", Telecommunications Technology Association, ~ (2017)
- 송재구, "An Analysis of Technical Security Control Requirements for Digital I&C Systems in Nuclear Power Plants", Nuclear Engineering and Technology, 45(5), pp.637~652 (2013), 한국원자력학회
- "NEI 18-08, Portable Media Scanning Stations", Kiosk cyber Security Controls Evaluation Template, 2018
- J. Searle, "Guide to Penetration Testing for Electric Utilities Revision 3", National Electric Sector Cybersecurity Organization Resource, ~ (2016)