Nuclear I&C Cyber Risk Modeling Toolkit

With the growing increase of digital components in Nuclear Instrumentation and Control (I&C) systems, nuclear power plants have become increasingly vulnerable to cyber-attacks. This is also reflected in worldwide regulatory guidelines being established addressing cybersecurity related concerns relating to nuclear systems (e.g., NRC Regulatory Guide 5.71 Revision 1 ľ Feb. 2023). While it is clear that cybersecurity evaluation of safety-critical nuclear systems is a critical requirement, given their uniqueness in function, connectivity, and interdependency, as well as their requirements for redundancy and diversity, existing endpoint and ICS/SCADA cyber evaluation solutions often fall short in capturing Nuclear I&C architecture intricacies sufficiently from a cyber perspective. Solution: BlueRISC proposes an AI-driven Nuclear I&C Cyber Risk Modeling toolkit that is both integrative and agile. The proposed solution supports an intuitive user interface to facilitate Nuclear I&C system modeling, a Dynamic Bayesian Network supporting cyber risk inference, interactive consequence of compromise evaluation and maintenance impact assessments. Phase I: The goal of the Phase I effort is to validate feasibility for the approach via the generation of a proof-of-concept demonstration. Emphasis will be placed on the key components of the solution including the user interface for Nuclear I&C system modeling, automated generation of a Dynamic Bayesian Network for cyber risk inference, consequence of compromise evaluation and supporting maintenance impact assessments. Sufficiently increasing maturity of these key components will enable a seamless transition into Phase II where a prototype solution will be developed. Commercial Applications and Other Benefits: While architected specifically to meet the unique requirements that exist in Nuclear I&C architectures, the underlying technology can be easily augmented to also target commercial verticals ľ such as ICS/SCADA. BlueRISC has active, relevant relationships for both DoE targeted opportunities as well as in the commercial ICS/SCADA space that will be leveraged.