Report finds many nuclear power plant systems “insecure by design”

A study of the information security measures at civilian nuclear energy facilities around the world found a wide range of problems at many facilities that could leave them vulnerable to attacks on industrial control systems—potentially causing interruptions in electrical power or even damage to the reactors themselves.

The study, undertaken by Caroline Baylon, David Livingstone, and Roger Brunt of the UK international affairs think tank Chatham House, found that many nuclear power plants’ systems were “insecure by design” and vulnerable to attacks that could have wide-ranging impacts in the physical world—including the disruption of the electrical power grid and the release of “significant quantities of ionizing radiation.” It would not require an attack with the sophistication of Stuxnet to do significant damage, the researchers suggested, based on the poor security present at many plants and the track record of incidents already caused by software.

The researchers found that many nuclear power plant systems were not “air gapped” from the Internet and that they had virtual private network access that operators were “sometimes unaware of.” And in facilities that did have physical partitioning from the Internet, those measures could be circumvented with a flash drive or other portable media introduced into their onsite network—something that would be entirely too simple given the security posture of many civilian nuclear operators. The use of personal devices on plant networks and other gaps in security could easily introduce malware into nuclear plants’ networks, the researchers warned.
The security strategies of many operators examined in the report were “reactive rather than proactive,” the Chatham House researchers noted, meaning that there was little in the way of monitoring of systems for anomalies that might warn of a cyber-attack on a facility. An attack could be well underway before it was detected. And because of poor training around information security, the people responsible for operating the plants would likely not know what to do.

That problem is heightened by what the researchers characterized as a “communication breakdown” between IT security professionals and the plant operations staff, and a simple lack of awareness among plant operations people about the potential dangers of cyber-attacks. Cultural differences between IT and nuclear engineering culture cause friction at some facilities, in fact—making it difficult for IT and security staff to get across the problem with the poor security practices in the plants.

Unfortunately, there’s no way to tell how bad the problem really is, because the nuclear industry doesn’t talk about breaches.

“The infrequency of cyber security incident disclosure at nuclear facilities makes it difficult to assess the true extent of the problem and may lead nuclear industry personnel to believe that there are few incidents,” the researchers wrote in their summary. ”Moreover, limited collaboration with other industries or information-sharing means that the nuclear industry tends not to learn from other industries that are more advanced in this field.”

These issues, combined with a lack of regulation, may lead to an underestimation of risk by nuclear operators and result in a lack of budgeting or planning for reducing the risk of attack. More

 

©

Devastating torrents: Raging waters slam D G Khan, Rajanpur

As torrential rains continued to wreak havoc countrywide, the Rajanpur and Dera Ghazi Khan districts of Punjab, where a state of emergency has been declared, were the worst-hit regions in the country.

Army troops had been called to join rescue work as heavy downpours set off hill torrents in the two districts on Sunday night, while the nuclear facility in D G Khan was also reportedly inundated, causing panic and fear among the concerned authorities, an official told The Express Tribune.

“Wadore torrent (a torrent that comes from the hills and into the river) hit DG Khan for the first time in history, and has devastated the whole city. The length of the torrent is roughly around 45 miles while it is around 15 miles wide. It has inundated a vast area and displaced around 0.7 million people in the area,” said Punjab chief minister’s senior adviser Senator Sardar Zulfiqar Khan Khosa.

The torrent, which flows adjacent to the nuclear installation in D G Khan, was diverted overnight by the concerned authorities towards the city. However, despite this extreme measure, the torrents entered the facility and inundated a vast area of the installation, officials in the local administration, the Pakistan Atomic Energy Commission (PAEC) and the military told The Express Tribune.

The city is protected by three barriers: local bunds, the D G Khan Canal and the railway line, an official said, adding that torrents which pass from Wadore hardly ever reached the D G Khan Canal.

The officials added that the unexpected water flow forced officials at the nuclear facility to direct the local administration to allow the breaching of the D G Khan Canal and the railway lines in order to reduce water pressure on the side of the nuclear installations. More

This is the third year in a row that Pakistan has had devastating flooding. It is readily apparent that the country needs a major initiative in flood mitigation. This can encompass reforestation, and the planting of plants like Vetiver grass (Chrysopogon zizanioides) <http://en.wikipedia.org/wiki/Chrysopogon_zizanioides> used in conjunction with on contour swales to control runoff on hillsides that lack vegetation. Several aspects of vetiver make it an excellent erosion control plant in warmer climates. Unlike most grasses, it does not form a horizontal mat of roots; rather, the roots grow almost exclusively downward, 2–4 m, which is deeper than some tree roots.[3] This makes vetiver an excellent stabilizing hedge for stream banks, terraces, and rice paddies, and protects soil from sheet erosion. The roots bind to the soil, therefore it can not dislodge. The plant also penetrates and loosens compacted soils. Editor

 

Nuclear Review to Make "Progress" in Advancing Obama Disarmament Vision, Official Says

WASHINGTON -- Thursday, July 23, 2009. A major nuclear weapons review under way at the Defense Department should result in "progress" toward implementing U.S. President Barack Obama's long-term vision for disarmament, a senior Pentagon official said today.

"The vision is clear and I think progress will be made," Michael Vickers, who advises Defense Secretary Robert Gates on strategic capabilities and operations, told reporters at a Defense Writers Group breakfast.
The Pentagon is leading the congressionally mandated Nuclear Posture Review, a sweeping assessment of nuclear strategy, forces and operations that is to conclude by the end of the year.
In an April speech in Prague, Obama pledged that "the United States will take concrete steps towards a world without nuclear weapons." He called the "existence of thousands of nuclear weapons" the "most dangerous legacy of the Cold War," vowing to launch negotiations with Moscow to take reductions in force levels. More >>>