Detective application security controls for nuclear safety

The current Draft Nuclear IEC 63096 New Work Item Proposal (NWIP), a new downstream standard of IEC 62645, distinguishes between preventive, detective and corrective security controls. The focus of this paper is on resilient detective cybersecurity controls that are needed especially for high security degrees in the context of Advanced Persistent Threats (APTs). The approach is fully in line with Nuclear IEC 62859 that provides requirements on coordinating safety and cybersecurity. The recommendations on separating selected detective security controls from the process control software can be achieved by avoiding an increased complexity and the possibility of retroactions of security measures on safety related functionality.