atw 2018-05v6

• Short-link
• Link
• Embed

<strong>atw</strong> Vol. 63 (<strong>2018</strong>) | Issue 5 ı May ENVIRONMENT AND SAFETY 288 | | Fig. 6. Attack Tree Analysis based on Security Controls. then associated to a timeline. Therefore log file either should be on or enabled. Record 1 (deleted) Record 2 (new generated) 4. Direct logging without relying on process control software Direct and completely independent logging of the data is another detective security control. The data should be stored in analog and binary variables before collecting it together like in Security Information and Event Management (SIEM) [20]. As shown in the Figure 7, the values of regular changes in centrifuge pump speed could be stored in a separate system before sending them to the central data storage system. This security control will help to keep the data secured in case of attacker makes any changes in the central display of the data. 5. Other security controls Periodical scan of the software should be done to avoid some abnormal things in the system. And also handling of new generated file is important to avoid any cyber-attack. | | Fig. 7. Direct Logging of Speed of a Centrifuge Pump. 100_Room1_ 2016-06-15_12:38 | | Tab. 1. An Example of Naming Convention. 250_Room1_ 2016-06-15_12:38 NEI 08-09 requires log records are reviewed at least every 92 days, or as required by the Physical Security Plan. In addition, each generated new file should follow the predefined naming. Individual generated file should have a source. In addition, new created file should have property to specify its source as shown in the Table 1 so that no one can override the existing file with malicious codes. Conclusion Non-targeted cybersecurity attacks, e.g. malware that is not conceived for the manipulation a specific target, can be sophisticated. Completely preventing these attacks as well as Advance Persistent Threats cannot be addressed only by protective security controls. Detective security controls are necessary to identify attacks within a reasonable time frame and they are the precondition for initiating the application of protective controls. Accordingly, resilient implementations of detective security controls are needed, in line with the stringency of the security grading. In this paper the most important detective controls, like the logging at all relevant levels were addressed. The benefits of securing the information generated by the detective controls by using data diodes were explained together with example architectures that merge the collected security intelligence as input of a central Security Information and Event System. As two important conceptual extensions, the security controls based on independent data collection, directly from physical devices and the monitoring and evaluation of analog and binary signal value transients were introduced. Implementing appro priate combinations of these resilient detective security controls will help in improving the security posture of refurbished and new power plants. Environment and Safety Detective Application Security Controls for Nuclear Safety ı Deeksha Gupta, Karl Waedt and Yuan Gao

<strong>atw</strong> Vol. 63 (<strong>2018</strong>) | Issue 5 ı May Acknowledgments Some of the addressed modelling and cybersecurity related topics are being elaborated as part of AREVA GmbH’s (today Framatome GmbH) participation in the “SMARTEST” R&D (2015-<strong>2018</strong>) with German University partners, partially funded by German Ministry BMWi. References [1] M. Holt, A. Andrews, Nuclear Power Plant Security and Vulnerabilities, Congressional Research Service. (n.d.). [2] IEC 62859:2016, NPPs – I&C Systems – Requirements for Coordinating Safety and Cybersecurity. [3] IEC 61513:2011, NPPs – I&C Important to Safety – General Requirement for Systems. [4] K. Waedt, Y. Ding: 2015, Safety and Cybersecurity Aspects in the Safety I&C Design for Nuclear Power Plants, 3 rd China ( International) Conference on Nuclear Power I&C Technology, Shanghai. [5] ISO/IEC 27005:2011 – Information Technology – Security Techniques – Information Security Risk Management. [6] M. Parekh, K. Waedt, A. Ciriello, Y. Gao: 2016, Cybersecurity During Plant Operation, 42 nd Annual Meeting of the SNE, Santander. [7] IEC 63096 (Draft): 2016, Security Controls. [8] IEC 62645:2014, NPPs – I&C Systems – Requirements for Security Programmes for Computer-Based Systems. [9] IEC 61513:2011 – NPPs – I&C important to safety – General req. for systems. [10] E. Bajramovic, D.Gupta: 2016, Providing Security Assurance in Line with National DBT Assumptions, Women in Nuclear (WiN), Shah Alam, Malaysia. [11] P. Zavarsky, K. Waedt, A. Kuskov: 2015, High Assurance Cybersecurity Controls against Persistent and Targeted Attacks on Instrumentation and Control Systems in Nuclear Facilities, 9 th International Conference on Nuclear Plant Instrumentation, Control & Human-Machine Interface Technologies (NPIC & HMIT 2015), Charlotte, USA. [12] D. Kushner: 2013, The Real Story of Stuxnet, IEEE Spectrum. [13] IAEA NSS 8:2008, Nuclear Security Series No. 8, Technical Guidance, Preventive and Protective Measures Against Insider Threats. [14] A. Scott, 2015, Tactical Data Diodes in IACS, SANS Institute. [15] E. Bajramovic, J. Bochtler, I. B. Zid, A. Lainer, 2016, Planning the Selection and Assignment of Security Forensics Countermeasures, ICONE; Shanghai. [16] J. Li, E. Bajramovic, Y. Gao, M. Parekh, 2016, Graded Security Forensics Readiness for SCADA Systems, GI 2016, Klagenfurt. [17] E. Knapp, J. Langill: 2014, Security Monitoring of Industrial Control Systems, In Industrial Network Security. 2 nd Edition, Syngress Publishing. [18] K. Waedt, A. Kuskov, P. Zavarsky: 2015, Domain Specific Cybersecurity Applied to I&C, IAEA, Vienna. [19] ISO/IEC 27002:2013 Information Technology – Security techniques – Code of Practice for Information Security Controls. [20] Y. Gao, X. Xie, M. Parekh, E. Bajramovic: 2016, SIEM: Policy-Based Monitoring of SCADA System, GI 2016, Klagenfurt. Authors Deeksha Gupta Karl Waedt Framatome GmbH ICPGOP Henri-Dunant-Straße 50 91058 Erlangen, Germany Yuan Gao Framatome GmbH and Otto-von-Guericke-Universität Magdeburg, Germany 289 ENERGY POLICY, ECONOMY AND LAW EU-Datenschutzgrundverordnung – Was bis zum 25.5.<strong>2018</strong> beachtet sein muss(te) Stefan Loubichi Mit der Datenschutzgrundverordnung (DSGVO) der Europäischen Union beginnt in ein neues Kapitel in der Geschichte des Datenschutzes. Zum 25. Mai <strong>2018</strong> werden wir in der Europäischen Union eine Harmonisierung der Datenschutzbestimmung vorfinden. Mit Geldbußen von bis zu 20 Millionen Euro und Freiheitsstrafen von bis zu 3 Jahren werden die Datenschutzbestimmungen in Zukunft einen hohen Stellenwert haben. In diesem Aufsatz werden erst einmal Gegenstand und Ziele, sach licher und räumlicher Anwendungsbereich sowie die Grundsätze für die Verarbeitung personenbezogener Daten vorgestellt. In der neuen DSGVO wurden die Rechte der betroffenen Personen präzisiert. Dies wird ebenso vorgestellt wie die zusätzlichen Pflichten von Verantwortlichen und Auftragsverarbeitern. Neue Regelungen in Bezug auf: • den Datenschutzbeauftragten • die Aufsichtsbehörde • die Haftung • die Auftragsdatenverarbeitung • das Verzeichnis der Verarbeitungstätigkeiten • die Datenschutzfolgeabschätzung • die Meldepflicht bei Datenpannen • technisch-organisatorische Maßnahmen und • die Datenübermittlung ins Ausland werden in diesem Aufsatz ebenso vorgestellt. Die DSGVO stellt einen nachhaltigen Wechsel im Datenschutz dar. Für die kommenden Jahre wird hier der Grundstock für das Vertrauen in den Datenschutz in Europa gelegt. Worum geht es eigentlich beim Datenschutz im Unternehmen? Beim Datenschutz im Unternehmen unterscheiden wir: I. den internen Bereich: Hier geht es um den datenschutzkonformen Umgang mit den personenbezogenen Daten der Beschäftigten. II. den externen Bereich: Hier geht es um den datenschutzkonformen Umgang mit den personenbezogenen Daten aller Personen, mit denen das Energy Policy, Economy and Law General Data Protection Regulation (GDPR) of the European Union – What Had to Be Considered until 25 May <strong>2018</strong> ı Stefan Loubichi