Post on 13-Oct-2020
Overview of NRC
Joe RiversOffice of Nuclear Security and Incident Response
May 17, 2018
Outline
• NRC Regulatory Approach• Key Focus Areas• International Engagement
2
NRC Regulatory Approach
3
4
NRC Mission Statement
License and regulate the Nation's civilian use of byproduct, source, and special nuclear materials (SNM) to ensure adequate protection of public health and safety, to promote the common defense and security, and to protect the environment
5
Scope of Responsibility
Three main areas: Reactors: commercial reactors for generating electric
power and non-power reactors used for research, testing, and training
Materials: uses of radioactive materials in medical, industrial, and academic settings; and nuclear materials and facilities associated with the nuclear fuel cycle
Waste: transportation, storage, and disposal of nuclear materials and waste, and decommissioning of facilities
6
Historical Background
Atomic Energy Act of 1954 (as amended)
Initial statutory basis for civilian use of SNM Established minimum safety and security requirements License granted by Atomic Energy Commission (AEC)
Energy Reorganization Act of 1974
AEC abolished and NRC created - civilian uses of nuclear materials and facilities
DOE responsible for weapons program - promotion of nuclear power, and other energy-related work
7
Purpose of NRC-regulatedPhysical Protection
10 CFR 73 – Requirements for the establishment and maintenance of a physical protection system which will have capabilities for the protection of SNM at fixed sites and in transit and of plants in which SNM is used
Physical protection systems are designed to protect against acts of radiological sabotage and to prevent the theft of special nuclear material.
8
NRC Regulation ofCommercial Nuclear Facilities
Regulations (10 CFR 1 thru 199)
Orders
Security Plans / Licensee Implementation
Inspection / Evaluation of Performance / Enforcement
9
Power Reactor & CAT ISecurity Comprehensive Security Programs, including:
Physical Security• Barriers Detection & Assessment Systems• Access Control Alarm Stations• Well-Trained Guard Force Response Strategies
Personnel Security• Background Checks Access Authorization• Fitness for Duty
Information Security & Cybersecurity
Robust Structures with Redundant Safety
Key Focus Areas
• Drones/Unmanned Aerial Vehicles (UAVs)• Cyber Security• Insiders• Modeling and Simulation
10
Unmanned Aerial Systems(a.k.a., Drones)
Should We BeConcerned?
• They are used in the Middle East to deliver a variety of payloads and to provide surveillance
• There were simultaneous overflights of French nuclear facilities
• There have been numerous overflights of DoD nuclear facilities
12
Regulatory Issues
• Drones regulated by Federal Aviation Administration (FAA) with a very strong lobby
• Federal Communications Commission (FCC) regulated wireless communication
• DoD and DOE have some legal authority
13
Technical Issues
• Rapidly evolving technology• Difficult to detect• Multiple technologies used for guidance• Countering is a challenge
14
Coordination
• Other Government Agencies• Other Governments• Industry
15
Detection Technologies
• Radar• Visual• Radio Frequency Scanning
16
Countering Technologies
• Jamming• Taking over controls• Kinetic• Nets• Hawks/Eagles
17
Next Steps
• Vulnerability study by Sandia for NPPs and Fuel Cycle Facilities
• Recommendation to the Commission
18
NRC Cyber Security Regulatory Overview
05/01/201819
20
US NRC Cyber Security Program
NRC Issues various Orders & Guidance Documents for
NPPs to address the Physical & Cyber Threat
Industry’s Voluntary Implementation of an Interim Cyber Security Program
NRC Conducts Assessment Visits
Development of the Cyber Rule 10 CFR73.54 for NPPs
DBT UpdatePublic Law 109-58
Energy Policy Act 2005
Updated DBT 10 CFR 73.1
05/01/2018
21
US NRC Cyber Security ProgramRG 5.71 & NEI 08-09
Implementation Guidance Acceptable
for Use
NRC & Industry collaborative work on
implementation guidance:
• Security Frequently Asked Questions
(SFAQs)
• NEI 13-10 Assessment of Security Controls
• NRC Participates in Industry Workshops
20102009 2011 2013 2014 2015 2016Cyber Security Implementation
Inspections2017
Industry’s Interim Implementation Schedule
MS 1 – 7 Inspections
All NPPs Cyber Security Plans & Implementation
Schedules Approved
Pilot Inspections Conducted at 2 NPPs
NRC & Industry agree on MS 1 – 7 Implementation
Schedule
2012
21
NRC Cyber Security
Notification Rule10 CFR 73.77
05/01/2018
• Tabletops to assess inspection
procedure
• Development of Additional Guidance
for Implementation Schedules
• Meetings with the Industry
22
1. Cyber Security Assessment Team
2. Identify Critical Digital Assets (CDAs)
3. Implement Defensive Architecture
4. Apply Security Controls
RG 5.71, “Cyber Security Program for Nuclear Facilities”
05/01/2018
7 Interim Milestones (Complete 2012)
23
MS 1 MS 2 MS 3 MS 4 MS 5 MS 6 MS 7
Establish the Cyber
Security Assessment
Team
Identify Critical Digital Assets
Implement One-way
Deterministic Device
Access Control for Portable &
Mobile Devices
Implement Observation & Identification of Obvious
Cyber Tampering
Apply Security
Controls to Most
Important Critical Digital
Assets
Implement Ongoing &
Assessment Activities for
Controls Applied
Full Implementation Inspection Program 2017 - 2020
Inspection Program2013 2015
05/01/2018
Full Implementation (MS8)
• Expands scope to include all Critical Digital Assets (CDAs)• All Safety & Security – Full
Cyber Controls• Graded Approach for Important-
to-Safety, Emergency Preparedness (EP) & Balance-of-Plant (BoP)
• Attack Mitigation and Incident Response Testing and Drills
• Continuity of Operations Training, Testing
• Secure Communication Pathways to CDAs• Ensure only authorized,
protected communication from known devices is permitted
• Supply Chain• Adds security requirements
relevant to vendors, contractors, and developers
• Ensure Availability and Integrity of Information To, From, and On CDAs• Prevent CDAs from accessing,
receiving, transmitting, or producing unverified or untrusted information
• Configuration Management• Ongoing Evaluation and
Management of Cyber Risk• Audit and Accountability
05/01/201824
Insider Mitigation Program for Nuclear Facilities
Concept of the Insider Threat Is Not New
• Quis custodiet ipsos custodes? is a Latin phrase attributed to the Roman poet Juvenal from his Satires(Satire VI, lines 347–8), which is literally translated as "Who will guard the guards themselves?“
• While the concept of the insider threat is not new, an insider mitigation program must be adaptable to meet the challenges of an ever changing global threat environment.
1
Legislative & Regulatory Authority Important to Success of Programs
• Insider mitigation programs are more effective with standards that have a basis in law and are codified within a regulatory framework.– Establishes minimum requirements which can be inspected by an
independent regulatory body to ensure processes and procedures within programs are functioning as intended.
– Provides oversight and clarity for the facility owners and/or operators
– Public confidence is enhanced with an independent regulator– Regulatory frameworks benefit from processes that provide a
means to accommodate changes as necessary.• Rulemaking• Orders & Generic Communications• Guidance documents
2
Technology Component of Insider Mitigation Strategy
• Advances in technology adapt to the changing threat environment– Biometric identity verification tools
• Hand geometry for access to protected areas• Retina scans for access to protected areas• Finger print scanning devices
– Access to criminal history and other robust databases – State-of-the-art video surveillance– Explosive and metal detection devices– Detection devices for drug and alcohol use
3
Behavior ObservationProgram (BOP) Component
• Training on warning signs of aberrant or other behavior not conducive to trustworthiness and reliability• What to do if you observe aberrant behavior – see something,
say something• Processes in place to address aberrant behavior for the
protection of the workers and the facility• Hot line• Employees assistance program• Regular supervisory reviews
• Fair and balanced application of a BOP• Consent forms• Appeal process
4
Objective of the NRC Insider Mitigation Program (IMP)
• Licensee oversight and monitoring of the initial and continuing trustworthiness and reliability of individualsby -• Minimizing the potential for an insider to directly or indirectly
have an adverse impact on the licensee’s capability to prevent significant core damage or spent fuel sabotage.
• Applies to all individuals following licensee’s initial unescorted access (UA) and unescorted access authorization (UAA) determination and/or certification of UA & UAA.
• Applies to individuals who retain UA or UAA to the protected and vital areas.
5
Examples of What to Look ForIn the IMP
• Tampering with equipment and/or systems – Valves out of proper position– Fluid levels (DORL 4 Belgium incident)– Workers in areas where they have no business
• Aberrant behavior or unexplained absences from work• Disgruntled employee• Radicalization or extremist views
• Shariff Mobley incident in 2010
• Drug or alcohol abuse
• Affiliations with criminal elements
1 1
Warning Signs Questionable Affiliations
• Security force member (Critical Group) at nuclear plant active member of outlaw motorcycle gang– Never returned to work after being interviewed about his
affiliations by access authorization staff at the plant.
12
Disgruntle Employees With Unescorted Access
• November 1979 - Two employees working at Surry Nuclear power plant attempted to damage new fuel assemblies.
– One employee had served aboard ship in the U.S. Navy’s nuclear program
– Both employees had been granted unescorted access to a vital area in the plant
– Both employees were convicted of intentional damage to a facility which furnishes electric power to the public and sentenced to two years in prison
– The Nuclear Regulatory Commission issued information notice 79-12 to all nuclear power plants to share the information with the licensees that own and operate the plants.
13
$ Socio-Economic Impact $Tampering Incident
At Belgian Nuclear Plant• August 2014 - Belgian energy company Electrabel reported that its Doel 4
nuclear reactor would stay offline until the end of year after major damage to its steam turbine was caused by a leak of 65,000 liters of oil.
– Reuters news quoted a spokesman for GDG Suez which is the French parent company - “There was an intentional manipulation”.
– Prosecutors familiar with the incident would not confirm that it was sabotage and they would not exclude sabotage either.
$ 37 Million to repair turbine in Germany
$ Loss of ~ 1 gigagwatt of generating capacity to consumers during colder months & reduced company earnings for GDG Suez.
14
Offsite Behavior Matters • NRC regulations require self-reporting of any criminal charges or
arrests• Two Senior Reactor Operators (Critical Group) arrested for
aggravated car-jacking and fled to Venezuela.
• Two Non-licensed Operators arrested for aggravated assault on and obstructing a peace officer at offsite party.
15
Why use modeling and simulation?
• It helps us better understand how the security system elements work together
• It helps us understand the strengths and weaknesses of the security system
• It provides a cost-effective way to perform a systematic evaluation of security system effectiveness
37
What Simulations Don’t Do
• Simulations cannot predict the future– They can’t tell when or how an attack will occur
• Simulations are not the solution by themselves– Security personnel must still perform effectively– They do not eliminate the need for FoF– They do not eliminate the need for performance
testing
38
Evaluating Complex SecuritySystems
• Simulations are used to understand the interactions and relationships within a complex system– People can understand and analyze system components, but are
limited by scope, scale and personal biases– Computer simulations offer objectivity, and they can more easily
assess greater scope and scale of systems
39
How Simulations Are Used
• Pathway Analysis– Identify most vulnerable pathways for an adversary– Probability of detection (Pd)
• Neutralization– Determine outcome of attack scenario– Probability of neutralization (Pn)
• System Effectiveness– Pe = Pd x Pn
40
Other Uses for Simulation
• Training• Tabletop exercises• Insider analysis• Site visualization• Sensor coverage• What if analysis• Defense-in-depth analysis
41
Some of the Benefits
• Computing system effectiveness• Cost-benefit analysis• Planning for upgrades or new construction• Right-sizing defensive forces• Technology evaluations
42
International Engagement
• IPPAS Missions• Bilateral Engagements• IAEA Meetings
43
IPPAS Missions
• NRC hosted an IPPAS Mission in the Fall of 2013
• NRC supports IPPAS missions and follow-up missions on a regular basis
44
Bilateral Engagements
• NRC supports US Government bilateral interactions with governments around the world
• NRC conducts its own bilateral exchanges with governments around the world
45
IAEA Meetings
• NRC staff participate in a wide variety of IAEA meetings– Technical Meetings– Consultants Group Meetings– Coordinated Research Projects– Training Courses– Conferences
46
47
Questions?