Security Information and Event Management Model Based on Defense-in-Depth Strategy for Vital Digital Assets in Nuclear Facilities

Abstract

After striking event of Stuxnet in Iran, international society recognizes that sabotage using cyber attack on nuclear facilities is no longer a hypothetical. The International Atomic Energy Agency, the IAEA, and the US nuclear facility regulatory authority recommends that nuclear licensees establish security measures to prevent/detect/response the cyber attack. Moreover, storing logs at the system to trace and support the incident investigation and analysis by their guidelines. In particular, since vital digital assets (VDA) to prevent and mitigate severe accidents in nuclear facilities, that possibly be direct targets for sabotage. Therefore, security measures for cyber attack detection and log collection are essential. SIEM is typical attack detection model through security information and log management, and various solutions are already used in many IT industries. But VDAs are difficult to purchase and implement commercial log collection and detection solutions. Because industrial control systems which used in VDAs are develop specifically for nuclear facilities, designed and performing safety and safety related functions. And nuclear facilities are necessary to meet safety and security requirements such as defense-in-depth strategy and boundary protection system to licensees designing SIEN network to implement central monitoring method. So we proposed DID-SIEM that is a security information and event management model based on defense-in-depth strategy. DID-SIEM is SIEM model that incorporates the design requirements to meet both the cyber security guidelines and operational constraints of nuclear facilities.