The UK Nuclear Industry Needs To Take Cybersecurity More Seriously

Uploaded on 2023-12-12 in TECHNOLOGY--Resilience, GOVERNMENT-National, FREE TO VIEW, BUSINESS-Production-Energy

A recent Guardian investigation alleges that the Sellafield nuclear waste management site in the UK has been subjected to numerous cybersecurity breaches over the years.

These alleged breaches are wide-ranging, including an insecure server network which according to the Guardian, hackers have been able to access for years. Other alleged unsafe working practices are also identified, such as contractors being able to plug USB sticks into the system unsupervised when servicing it.

While the UK government response said there was no evidence of a hack by state actors, the Office for Nuclear Regulation (ONR) has placed Sellafield under ‘significantly enhanced regulatory attention’ as it was not satisfied with cybersecurity standards at the site.

Sellafield is not the only UK nuclear site which has received this label recently. Earlier this year, the energy company EDF, which runs five of the UK’s active nuclear power plants, as well as three which are decommissioning, was also placed under ‘significantly enhanced regulatory attention’ due to its cybersecurity practices.

The ONR was not satisfied with the cybersecurity standard in several of EDF’s nuclear power plants and will need to see enhancements at the next inspection to change the company’s status to a lower-risk one. EDF had already been alerted in 2022 that it would need to upgrade its cybersecurity practices for nuclear power plants but fell short of ONR’s expectations.

Longstanding Issues With UK Nuclear Cybersecurity

It is disappointing to see significant cybersecurity issues remain in the UK nuclear industry. The nuclear industry overall was relatively late to the cybersecurity conversation, as previous Chatham House research identified, and this is by no means a new conversation.

Concerns about cybersecurity have existed for decades. Because of the nuclear industry’s strong emphasis on physical security, and the fact that much of the control software used in nuclear power plants was at first bespoke or only distributed to a small number of specialized facilities, there was a sense throughout the industry that it was managing cybersecurity risks adequately.

But, as the use of IT systems spread further and upgrades included off-the-shelf software packages, the nuclear industry’s cybersecurity practices did not keep pace.

The cybersecurity standard for nuclear sites is applied unevenly, depending on government and operator awareness and capacity.

The International Atomic Energy Agency (IAEA) has issued a set of recommendations and standards which states should adhere to, but their implementation is left up to each individual state government. This means that the cybersecurity standard for nuclear sites is applied unevenly, depending on government and operator awareness and capacity.

This could have far-reaching consequences. At Sellafield, the Guardian claims include concerns that the hackers have had access to information about the UK’s nuclear materials management and other sensitive data.

Security Threats

The alleged security breaches could have long-term security implications for the UK and for nuclear security, depending on exactly what kind of data hackers might have had access to.

Digital access to IT infrastructure could grant physical control over systems, as was the case in the Stuxnet attack on Iran’s nuclear centrifuges.

Although highly unlikely in the UK, due to the safety measures in place, such an attack could lead to an accident which could result in radiation being released, causing damage to people’s health and contaminating the environment.

There are also risks of disrupting the UK’s energy supply if an attack targets a nuclear power plant, and the threat of hackers holding data or other sensitive information for ransom. The UK’s Civil Nuclear Cyber Strategy 2022 recognizes these risks and lays out a plan to address them, but the time frame to 2026 seems too generous given that several of these risks have been known for years and should have been mitigated years ago.

With the UK’s nuclear sector expected to grow in size and importance due to net zero commitments, this is an urgent area for improvement.

Simple, Urgent Actions For The Industry

Some simple steps are already recognized as best practice and could be taken far quicker than over the next four years. Cyber security maturity assessments and PEST analysis as used in other sectors, would assist nuclear risk insurers and regulators to ascertain the effectiveness of responses to cyber threats.

Greater transparency would also help. It is very difficult to know what exactly is going on at Sellafield, or at the EDF sites under significantly enhanced ONR attention

ONR reports do not tend to go into significant detail, beyond saying whether or not cybersecurity standards have been reached. It would be worth looking at other industries which have made big strides forward in cybersecurity and see which solutions can be applied quickly across the UK nuclear industry.

While it does not share the same materials challenges the nuclear industry faces, the finance industry has invested heavily in cybersecurity practices and could serve as an example of a high-risk industry. There are also obvious parallels with other critical national infrastructure sectors like water management or transport. A UK-wide CNI sector dialogue on cybersecurity could help ensure that industries learn from each other.

This could be followed up with a prioritized list of how to tackle the remaining challenges where prioritization takes into account risk, as well as the time required to mitigate it.

It seems that nearly a decade after the conversation around enhancing the cybersecurity of civilian nuclear sites began, the UK’s industry is less far along in mitigating risks and making improvements than it should be.

Given the expected growth and diversification across the industry, with new reactor types being designed, it is urgent that nuclear industry intensifies and sustains its work on cybersecurity.

Dr. Marion Messmer is Senior Research FellowSenior Research Fellow at Chatham House

You Might Also Read:

The Nuclear Governance Model Won’t Work For AI:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.