Suggestion of Initiating Threats and Bounding Groups for NPP Cyber Risk Assessment

The aim of this study is to propose initiating threats and their bounding groups in order to identify cyber threats in NPPs (Nuclear Power Plants). NPP has been generally thought to be secure from cyber-attacks, since the control/monitoring network and business network in NPP are separated from the external network. However, consecutive incidents in nuclear facilities, such as Hatch NPP incident in 2008, Natanz nuclear facility incident in 2010, Monju NPP incident in 2014, and Gudremmingen NPP incident in 2016, revealed the necessity of cyber security management for NPPs. Suggested initiating threats and their bounding groups for NPP have an accent on first attempt to consider the breaching sequences in determining threats.