POWER April 2014 - 46

NUCLEAR POWER
1. Visualize the cybersecurity implications. Creating a simple network diagram
like this one during the conceptual phase of a digital asset modification will facilitate a conversation
with the plant cybersecurity subject matter expert on required functions and cybersecurity
features for the modification. Source: EPRI
Protected
network
requirements. When combined, the full set of
requirements helps determine not only which
cybersecurity controls are required from a
supplier but also how the cybersecurity control
is implemented by the supplier.
To understand why a " one size fits all "
SLC
application
configuration
SLC
firmware
Likely data
elements
inside SLC
Item to be
procured
TB-1
HART capable
single-loop
controller (SLC)
1-AOV-1
Analog input
Analog output
1-FIC-1
1-FT-1
cybersecurity and approve the preliminary
vendor approach.
■ The cybersecurity SME provides input
into cybersecurity requirements for the
vendor in the contract for items such
as hold points reviews, vendor commitments,
and milestones as they pertain to
cybersecurity.
Cybersecurity Procurement
Methodology
The guidance provided in the second EPRI
document, Cyber Security Procurement
Methodology, puts suppliers and nuclear
plant owners on the same page so that both
are familiar with the procurement and supply
chain cybersecurity requirements and can
avoid costly rework. In the past, differing interpretations
of cybersecurity regulations often
led to varying requirements for the same
products. Suppliers also often didn't know
what role the nuclear plant owners expected
them to play in providing cybersecurity.
EPRI research has shown that a standard
set of cybersecurity control requirements
with a standard set of procurement specifications
is not feasible for the multitude of
equipment types, vendors, and use cases
that exist in the various types of facilities
and applications. Consequently, a procurement
methodology has been developed for
determining the appropriate cybersecurity
requirements for each use case as informed
by a number of factors.
Many of the cybersecurity controls can be
implemented only by the facility. Examples
include incident response policy and proce46
dures,
and physical access authorizations.
In some cases, the supplier can provide
the technology or feature to implement the
cybersecurity control, but the utility actually
implements the cybersecurity control.
Examples include password requirements
and baseline configuration. In these cases,
the supplier provides the ability to create and
manage passwords and a baseline configuration,
but the owner should perform the actual
management of passwords and maintain the
critical asset baseline configuration.
In other cases, the supplier may be able to
provide a security feature or function built
into or added onto its product, but the owner
may have already implemented a different
technology or platform at the facility. An
example could be audit reduction and report
generation, as the owner may already have an
audit log aggregation and reporting capability
in a centralized security system. The requirement
then would be for the supplier to
provide the capability to transmit audit logs
and records to the utility's existing audit reporting
system rather than use the supplier's
audit reporting system.
Cybersecurity requirements should be
considered a subset of the larger set of design
inputs and design outputs in the existing
modification and design processes. Digital
systems often have other critical requirements,
such as response time and availability
that could be negatively affected by a cybersecurity
requirement (for example, encrypting
data transmissions). These system-level functional
and performance requirements should
be considered in tandem with cybersecurity
www.powermag.com
Process data
(real time)
HART
communicator
Micro
Card
Engineering tool
workstation
Engineering tool
software
(from SLC vendor)
Tool data
associated
with SLC
cybersecurity specification is not practical,
it is helpful to use a simple mechanical
analogy. Safety-related pumps in nuclear
facilities must be anchored to their foundations.
It is not practical to write one
specification that encompasses all of the
characteristics of all of the bolts that may
be used for anchoring all pumps. It depends
on the size of the pump, its dynamic loading,
its seismic loading, and other factors.
However, it is helpful to have a methodology
for routinely determining the necessary
length, diameter, thread pitch, and material
characteristics for bolts used to anchor
pumps, so that the bolts can be specified
and procured for each application in a predictable
manner. Cybersecurity controls, in
relation to critical digital assets, should be
treated the same way.
The methods described in the report are
based on the established owner/operator cybersecurity
strategy, life-cycle processes, and
roles and responsibilities. These elements are
expected to be established, determined, or
identified before procuring a critical asset.
The report provides guidance on what
to do before communicating with the supplier,
what to do when communicating with
the supplier, how to evaluate supplier information,
and how to go about procuring
the digital asset. For example, the guidance
defines specific outcomes that should be expected
during and after communicating with
the supplier:
■ The supplier will identify and map supplier
component cybersecurity capabilities
to the security controls identified in
the cybersecurity control table.
■ The supplier will identify any deviations,
exceptions, conflicts, or options.
■ The supplier will provide documentation
for all responses.
■ The supplier will describe the supplier's
development environment and how development
assets are protected.
Based on such evaluations, it is prudent
for the plant owner to update the requirements
specification to ensure the conformed
requirements specification is issued with the
supplier prior to issuance of the contract or
as the first step toward contract execution to
avoid costly rework or change in scope.
EPRI expects to have a computer-based
training module on the procurement methodology
available in 2014 to support procurePOWER
| April 2014

http://www.powermag.com

POWER April 2014

Table of Contents for the Digital Edition of POWER April 2014