Speaker
Description
Recently, many Nuclear Power Plants (NPPs) have been upgraded from analogue systems to computer-based control systems. The control systems perform data acquisition, control actuation, and information indication based on software. The digitalization of nuclear facilities has brought many benefits, including high performance and convenient maintainability, in terms of facility operation. With the growing trend in using safety-critical software as an embedded system in many critical applications in nuclear facilities, where such systems contain sensitive data and perform both safety and security functions.
Cyber security regulations require developing secure software development methodology for Instrumentation and Control (I&C) systems to prevent the digital system from cyber-attacks.
I&C systems are considered to be the brain of the NPPs, and recently with the growing trend of using digital I&C systems, digital I&C systems are computer-based systems.
However, use of the digital I&C system can introduce the cyber security problem that may compromise important functions such as reactor shutdown or the mitigation of release of radioactive materials. Therefore, protection from cyber-attacks has been one of the key issues in nuclear facilities.
The unauthorized modification of these systems (in software or hardware) or disruption of its functions can significantly affect the plant operation. It may affect the plant safety in case of safety functions are affected or normal operation in case of safety-related or other control functions are affected. Consequently, Security became an essential requirement for developing critical software for such systems. So developing secure software is a critical issue, especially for NPPs. The impact of a software malfunction or security breach can result in loss of sensitive data, and system malfunctioning due to either intentional or unintentional interference. The consequence of such interference could be an accident or system fail to perform its intended protective action. Traditionally, security is usually unnoticed during the early phases of the software life cycle.
Unfortunately, Security testing performed near the end of the software development lifecycle, prior to deployment, but that process can put release schedules at risk and late-found defects cost more to address. However, there is still no clear software development process regarding security activities. Cyber security regulations require developing secure software development methodology for Instrumentation and Control (I&C) systems to prevent the digital system from cyber-attacks.
To more effectively address security, critical software system must be developed in a secured environment and each phase of software development should be designed, implemented, and executed under suitable security measures. In this paper, the main objective is to focus on security processes at each phase of the software development life cycle. An adapted V-model has been designed for developing secure critical software system where security deliverables are inserted in all phases of development. In adapted V model, security life cycle processes should be integrated into software development life cycle phases such as security requirements elicitation, definition, and analysis, secure design based on design principles for security, hazard analysis by using analysis tools, secure reviews and inspections, and security testing. This paper outlines the security attributes, activities, and procedures that should be inserted into all phases of software development life cycle for developing secure software that can stand up under attack, and provide confidence in the security-related properties and functions of the developed software.
| State | Egypt |
|---|---|
| Gender | Male |
