원전디지털자산 사이버보안 규제 요건 개발을 위한 보안조치 적용 방안에 대한 분석
Analysis of the Application Method of Cyber Security Control to Develop Regulatory Requirement for Digital Assets in NPP
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
원자력 발전소의 사이버위협이 현실화되면서 국제사회 및 국내에서는 사이버보안 규제지침 마련을 통해 필수디지털자산에 대한 적절한 보안조치를 적용하도록 요구하고 있다. 그러나 각 필수디지털자산에 대해 일괄적으로 동일한사이버 보안조치 적용에 대해 규제 대상 내에서도 원전의 비상정지를 일으키고, 노심 손상을 유발할 수 있는 사고와직접적으로 관련된 디지털자산에 단계적 접근방식을 적용한 규제 효과성 제고가 필요하다. 이에 본 연구에서는 원전사고와 직접 관련된 디지털자산에 대하여 단계적 접근방식의 규제요건 개발을 위한 보안조치 적용 방안을 제시하였다. 단계적 접근방식의 기본적 고려사항인 규제 대상 설비의 침해영향도(Consequence)를 기반으로 한 규제 요건적용을 위해 기존의 필수디지털자산에 요구되고 있는 보안조치를 보다 강화하거나 추가적인 보안조치를 개발하여 원전 사고와 직접 관련된 디지털자산에 요구하는 방식과 기존의 보안조치를 재분석하여 원전 사고와 직접 관련되지 않는 필수디지털자산에 대해서는 최소한의 보안조치를 요구하는 방식으로 크게 나누고 각 방안 별 세부적 사항을 기술하였다.
Abstract
As the cyber threats of nuclear power plants become more necessary to systematically prepare against the cyber attack,the international community and the domestic government are urged to apply proper security controls for Critical DigitalAssets (CDA) through cyber security regulatory guidelines. In this study, we suggests the application of security controls todevelop the regulatory requirements of the graded approach through the analysis of domestic and foreign cyber securityregulation guidelines and best practices for digital assets directly related to nuclear accidents. In order to apply theregulatory requirements based on the consequence(impact of infringement) of the regulated facility, which is a basicconsideration of the graded approach, we will classify two methods and describe details of each method. By reanalyzingexisting security controls, it is introduced that the method of demanding digital assets directly related to accident to enhancesecurity controls required for existing CDA or develop additional security controls and requiring minimum security controlsfor CDA that are not directly related to accident.
참고문헌 (14)
- Korea Institute of Nuclear Nonprolifer ation And Control, "KINAC", R S-015, Regulatory Standard on Computer Security of Nuclear Facilities, 2016
- Korea Institute of Nuclear Nonprolifer ation And Control, "KINAC", R S-019, Regulatory Standard on Critical Digital Assets of Nuclear Facilitie s, 2015
- "U,S.Nuclear Regulatory commissio(U. S.NRC), Regulatory Guide 5.71(R.G 5. 71), Cyber Security Programs for Nuclear Facilities", ~ (2010)
- "U,S.Nuclear Regulatory commissio(U. S.NRC), Regulatory Guide(R.G) 1.152(Rev.2), Criteria for Use of Computers in Safety Systems of Nuclear Power Plants", ~ (2006)
- "U,S.Nuclear Regulatory commissio(U. S.NRC), 10 CFR 73.54, Protection of Digital Computer and Communication Systems and Networks", ~ (2009)
- Nuclear Energy Institute, "Addressing Cyber Security Controls for Nuclear Power Reactor s", ~ (2011)
- Nuclear Energy Institute, "Cyber Security Plan for Nuclear Power Reactors", ~ (2010)
- Nuclear Energy Institute, "Identifying Systems and Assets Subject to the Cyber Security Rule", ~ (2012)
- Nuclear Energy Institute, "Cyber Security Control Assessments", ~ (2017)
- International Atomic Energy Agency, "Nuclear Security Series No. 13, Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities(INFCIRC", 225, pp.2011, ~
- International Atomic Energy Agency, "Nuclear Security Series No. 17, Computer Security at Nuclear Facilities", ~ (2011)
- International Atomic Energy Agency, "Nuclear Security Series No. 13-T, Computer Security of Instrumentation and Control Systems at Nuclear Facilities", ~ (2018)
- National Institute of Standards Technology, "Recommen ded Security Controls for Federal Information Systems and Organizations", ~ (2015)
- National Institute of Standards Technology, "Guide to Industrial Control Systems (ICS) Secu rity, 2015. hash protocols, CS-2006-20", Computer Science Department, Uni versity of Virginia, ~ (2006)