Cyber-attack on the Kudankulam Nuclear Power Plant raises certain important questions about the security of our critical infrastructure and more importantly the adequacy of our response. This is not the first time that nuclear facilities have been attacked. The most well-known example is the Stuxnet attack on Iran’s uranium enrichment facility, generally attributed to the U.S. and Israel. The question is how prepared we are to respond to such digital warfare.

Possible Impacts Of Digital Attacks On Nuclear Power Plants

1. Any type of attack on a nuclear plant is very concerning. An attack that allows hackers to manipulate the systems that control a nuclear reactor could have very serious consequences, including potentially nuclear reactor core damage and off-site release of radiation.
2. The consequences of a cyber-based intrusion at a nuclear power plant could range from loss of a confidential employee or business information to potentially causing a reactor shutdown or physical damage.
3. The Stuxnet, which destroyed Iran’s uranium enrichment facility in 2010, suggests that NPPs could even lead to an accident involving the release of radioactive materials due to cyberattacks.
4. Digital warfare on nuclear power plants (NPPs) can severely impact and destabilise Nuclear Command, Control and Communications (C3) of the plant.
5. If a hostile power can conduct a cyber-attack on our nuclear facilities, the implications for India’s national security are unimaginable.

Challenges Faced By India

1. Cyberattacks are getting increasingly sophisticated. Complex attacks are no longer just the purview of nations but can now be conducted by smaller groups which are difficult to detect and deal with effectively.
2. Nuclear power plants which may have been analogue at one time are increasingly becoming digital and this poses challenges in terms of cyber intrusions and attacks.
3. Shortcomings in the nuclear power industry’s approach to cybersecurity, from regulation to training to user behaviour. Nuclear power plant operators have failed to broaden their cultures of safety and security to include an awareness of cyberthreats.
4. Kundankulam network is “stand-alone” and not connected to the internet. It is evident from other cyber-attacks that air-gapping does not effectively secure operational networks at plants.

Measures

Kudankulam Nuclear Power Plant (NPP) is one of the country’s most advanced nuclear plants in India. This incident should serve as a wake-up call that the nuclear power industry needs to take cybersecurity more seriously.

1. To prevent and respond to cyber threats, it is necessary to select the predictable cyber-attacks against the NPPs and evaluate cybersecurity conformance for digital devices that can guarantee reliability and performance.
2. To predict the cyber-attacks on NPPs, there should be cyber-attack case studies based on a cyber-attack taxonomy that reflects the characteristics of NPPs.
3. Public-private partnerships like the World Institute for Nuclear Security and World Association of Nuclear Operators which can share information about best practices and can serve as a knowledge conduit for states are needed.
4. India now has an opportunity to become a leader in nuclear cybersecurity. India has established the Global Centre for Nuclear Energy Partnership as a forum for bilateral and multilateral cooperation in nuclear security that could be widened to include cybersecurity.

The cyber threat to nuclear facilities is serious, but the challenge going forward is evident. It is heartening to note that India has announced the formation of a tri-service for cyber warfare. Governments, regulators, facility operators, vendors, and experts need to accelerate efforts to develop new approaches that can scale to the threats of the future. The nuclear industry’s history of safety and security culture, and the body of research on sector-specific cybersecurity recommendations, together can offer a path toward a nuclear power industry that better defends itself against cyber threats.