Digital Instrumentation & Control (I&C) Systems and Cyber Security: Is Supply Chain the Weak Link?

The global concerns over cyber security threats to nuclear facilities have been increasing since the Stuxnet case. Cyber attacks may occur in digital instrumentation and control (I&C) systems due to, among other causes, malicious code hidden in hardware devices or inserted during code development or code maintenance or repair, and also through infrastructure breaches (e.g. the use of infected USB memory sticks). Cyber attacks may include the digital data communication network that could allow malicious code to access and change specific hardware behavior. The increasing use of commercial off-the-shelf (COTS) items, the fast obsolescence and replacement of digital components, the great number of digital products vendors in the utility supply chain, the interconnectivity of digital equipments, and the use of open development tools are some of the reasons that point to the digital I&C supply chain as the cyber security weak link, and utilities cyber security programs must address this vulnerability. Though most cyber attacks on utilities have focused on stealing proprietary information, attacks on a utility digital I&C system could seriously affect many elements beyond the utility itself (environment, economic, human life, industrial etc). (author)