분석적 방법을 적용한 원전디지털자산 취약점 평가 연구
A Study on Vulnerability Assessment for the Digital Assets in NPP Based on Analytical Methods
2
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
원자력 발전소의 디지털화로 인한 사이버위협 노출로 보다 확고한 사이버보안 체계 구축 필요성이 대두되고 있으며 주기적인 취약점 분석 및 평가를 통한 적합한 보안대책 정립이 필요하다. 그러나 원전시스템은 안전성을 최우선으로 둔 특성 및 취약점 분석을 위한 제반사항 구축에 많은 비용 및 시간 등이 필요하여 기존의 취약점 분석 환경및 분석 도구를 적용하는데 어려움이 있다. 이에 본 연구에서는 원전디지털자산 취약점 분석 시 고려해야 할 사항및 일반적인 취약점 분석 방법들을 비교하여 기존의 취약점 분석 방법의 한계점을 보완하는 원전디지털자산에 적합한 취약점 평가 방법에 대해 제시하고 시범 적용한 결과를 기술하고자 한다.
Abstract
The necessity of establishing a more secure cyber security system is emerging to protect NPP against cyber attacks asnuclear facilities become increasingly reliant on digital system. Proper security measures should be established throughperiodic analysis and evaluation of vulnerabilities. However, as Nuclear facilities has safety characteristics as their toppriority and it requires a lot of time and cost to construct regarding the activities for vulnerability analysis, it is difficult toapply the existing vulnerability analysis environment and analysis tools. In this study, We propose a analytical vulnerabilityassessment method to overcome the limitations of existing vulnerability analysis methods through analysis the existingvulnerability analysis methods and the issues to be considered when applying the vulnerability analysis method.
참고문헌 (30)
- National Institute of Standards Technology, "800-82(rev2), Guide to Industrial Control Systems (ICS) Security", ~ (2015)
- Department of Homeland Security, "Common Cyber security Vulnerabilities in Industrial Control Systems", ~ (2011)
- Vulnerability Analysis of Energy Delivery Control Systems, "Department of Energy", Idaho National Laboratory(DOE, pp.2011, ~
- National Institute of Standards Technology, "800-53(rev.4), Recommended Security Controls for Federal Information Systems and Organizations", ~ (2013)
- The Analysis and Evaluation Standards for Information and Communication Infrastructure, "Ministry of Science", ~, pp.vol. 2013, no. 37 (2013)
- Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities(INFCIRC, "225", Revision 5), pp.2011, ~[DOI]
- Computer Security at Nuclear Facilities, "International Atomic Energy Agency", ~, pp.Nuclear Security Series No. 17 (2011)
- Regulatory Standard on Computer Security of Nuclear Facilities, "Korea Institute of Nuclear Nonproliferation And Control", ~, pp.KINAC (2016), RS-015
- Regulatory Standard on Critical Digital Assets of Nuclear Facilities, "Korea Institute of Nuclear Nonproliferation And Control", ~, pp.KINAC (2015), RS-019
- U,S.Nuclear Regulatory commissio, "Regulatory Guide 5.71(R.G 5.71), Cyber Security Programs for Nuclear Facilities", ~ (2010)
- U,S.Nuclear Regulatory commissio, "Regulatory Guide(R.G)1.152(Rev.3), Criteria for Use of Computers in Safety Systems of Nuclear Power Plants", ~ (2011)
- U,S.Nuclear Regulatory commissio, "10 CFR 73.54, Protection of Digital Computer and Communication Systems and Networks", ~ (2009)
- Nuclear Energy Institute, "NEI 10-09(rev.0), Addressing Cyber Security Controls for Nuclear Power Reactors", ~ (2011)
- Cyber Security Self-Assessment Method for U.S. Nuclear Power Plants, "U,S.Nuclear Regulatory commission", ~, pp.NUREG (2004), CR-6847
- Nuclear Energy Institute, "NEI 08-09(Rev.6), Cyber Security Plan for Nuclear Power Reactors", ~ (2010)
- K. J. Cha, "A Study of PLC System Vulnerability Checklists in Nuclear Power Plants", Transactions of the Korean Nuclear Society Autumn Meeting (2012)
- Lee Cheol Kwon, "Nuclear Power Plant Instrumentation and Control Systems Cyber Security Technology Trends", Journal of The Korea Institute of information Security &Cryptology, 22(5), pp.28~34 (2012)
- D. W. Kim, "PLC –Based Control System Vulnerability Analysis Method", Journal of The Korea Institute of information Security &Cryptology, 25(5), pp.26~36 (2015)
- 최명길, "제어시스템 보안성 평가 방법에 관한 연구", 정보보호학회논문지, 23(2), pp.287~298 (2013), 한국정보보호학회
- B. G. Min, "Vulnerability Analysis Method according to Cyber Security Threat Change", Journal of The Korea Institute of information Security &Cryptology, 24(1), pp.7~12 (2014)
- 김도연, "산업제어시스템의 사이버보안을 위한 취약점 분석", 한국전자통신학회 논문지, 9(1), pp.137~142 (2014), 한국전자통신학회
- Park Sang-Hyung, "An Empirical Study of the Method of Vulnerabilities Analysis on Instrumentation & Control System for Nuclear Power Plant", PH.D, pp.2011
- Kang Young doo, "A Study on Cyber Security Assessment Methodology of Instrumentation& Control Systems for Nuclear Power Plants", PH.D, pp.2010
- 송재구, "An Analysis of Technical Security Control Requirements for Digital I&C Systems in Nuclear Power Plants", Nuclear Engineering and Technology, 45(5), pp.637~652 (2013), 한국원자력학회
- Review Guidelines on Software Language for Use in Nuclear Power Plants Safety Systems, "U,S.Nuclear Regulatory commission", ~, pp.NUREG (1996), CR-6463
- Chatham House, "Cyber Security at Civil Nuclear Facilities", ~ (2015)
- NCCIC, "ICS-CERT FY 2015Annual Vulnerability Coordination Report", Department of Homeland Security, 2015
- ICS-CERT Annual Assessment Report, "National Cybersecurity and Communications Integration Center", ~ (2016)
- Nuclear Power Plant Security and Vulnerabilities, "M. Holt", ~, pp.CRS Report RL34331 (2014)
- National Cyber Security Center, "Checklist security of ICS", SCADA systems(Take organisational and technical measures), 2016