Presentation on theme: "IAEA International Atomic Energy Agency IAEA Office of Nuclear Securitys Initiatives in Cyber and Information Security Khammar Mrabit Director Office of."— Presentation transcript:
IAEA International Atomic Energy Agency IAEA Office of Nuclear Securitys Initiatives in Cyber and Information Security Khammar Mrabit Director Office of Nuclear Security
IAEA IAEA Role Ministerial Declaration We, Ministers of the Member States of the International Atomic Energy Agency (IAEA),...: Recognize the IAEAs efforts to raise awareness of the growing threat of cyber-attacks and their potential impact on nuclear security, and encourage the IAEA to make further efforts to foster international cooperation and to assist States, upon request, in this area through the establishment of appropriate guidance and by providing for its application. 2
IAEA Computer and Information Security The Computer and Information Security programme is focused on preventing computer acts that could directly or indirectly lead to: a. unauthorized removal of nuclear/other radioactive material b. sabotage against nuclear material or nuclear facilities c. theft of nuclear sensitive information. 3
IAEA New Targets Control and Instrumentation System 4 Mobile Computing Devices
IAEA International Instruments FUNDAMENTAL PRINCIPLE G: Threat The States PP should be based on the States current evaluation of the threat. FUNDAMENTAL PRINCIPLE I: Defence in Depth The States requirements PP should reflect a concept of several layers and methods of protection (structural or other technical, personnel and organizational) that have to be overcome or circumvented by an adversary in order to achieve his objectives. FUNDAMENTAL PRINCIPLE L: Confidentiality The State should establish requirements for protecting the confidentiality of information, the unauthorized disclosure of which could compromise the physical protection of nuclear material and nuclear facilities. 5
IAEA International Instruments Protection of computer systems associated with Other Radioactive Materials Such systems may include: Inventory systems/records Physical access control Security monitoring Operational Calibration Boarder monitoring 6
IAEA Nuclear Security Fundamentals (NSS 20) Provide for the establishment of regulations and requirements for protecting the confidentiality of sensitive information and for protecting sensitive information assets; Ensuring through appropriate arrangements that sensitive information or other information exchanged in confidence is adequately and appropriately protected. cyber security Routinely performing assurance activities to identify and address issues and factors that may affect the capacity to provide adequate nuclear security, including cyber security, at all times. 7
IAEA Current Technical Guidance NSS17 Computer Security at Nuclear Facilities 8 The objective of the document is to provide guidelines to personnel designing, implementing, and managing Instrumentation and Control (I&C) and Information systems and networks at nuclear facilities. The guidance addresses prevention and detection of potential attacks through reference to best practices in architecture, assurance and management of security information and I&C systems.
IAEA Fundamentals: NSS No. 20 Objective and Essential Elements of a States Nuclear Security Regimeobjectives, concepts, principles Recommendations: NSS No. 13 Nuclear Security Recommendations on Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 5) NSS No. 14 Nuclear Security Recommendations on Radioactive Material and Associated Facilities Implementing Guides: NSS XXX Information Security: Protection and Confidentiality of Sensitive Information in Nuclear Security Technical Guidance: NSS 17 Computer Security for Nuclear Facilities Other areas: Conducting Computer Security Assessments; Computer Security of Nuclear I&C Systems; Computer Incident Response 9 Guidance published and in Draft
IAEA 10 Proposed Additional Guidance Nuclear Security Recommendations or Implementing Guide for Computer Security ? Computer Security Systems and Measures for Nuclear Facilities (implementing guide) ? Computer Security Practices for Nuclear Facilities (Technical Guide) ? These documents are designed to build a top to bottom framework to support Member States, Competent Authorities, and nuclear organizations in developing and conducting assurance activities for computer security. The development of these documents will be discussed at the next Nuclear Security Guidance Committee Meeting in October.
IAEA International Physical Protection Advisory Service (IPPAS) New Information and Computer Security Review conducted during IPPAS Missions to: 2012 - Netherlands, Finland, Romania 2013 - Laboratories in Seibersdorf, Hungary 11 Convergence of Physical Protection and Cyber Security
IAEA Training Activities The request for awareness and advanced training by Member States continues to grow. This trend will only continue. 2007 2008200920102011201220132014 Primary Training Courses 1.Basic Information and Computer Security Awareness 2.Conducting Cyber Security Assessments 3.Advanced Course in Information and Computer Security 4.Professional Development Course for Nuclear Security Professionals Requests are currently in place for 2014 Estimate a sustained 6-9 courses per year Training Events Projected 12
IAEA 2015 Cyber Security Conferences 13 IAEA International Conference on Cyber Security: Nuclear Security in a Computer World: Prevention, Detection and Resistance to Emerging Cyber Threats 8-12 June 2015
IAEA Cyber Security Users Group IAEAs information portal for cyber security https://nusec.iaea.org/portal/UserGroups/CyberSecurity/CyberSecurityOverview/tabid/503/Default.aspx 14