Effectiveness evaluation of a nuclear facility security system under a cyber-physical attack scenario

This work aims to evaluate the effectiveness of physical protection system of a nuclear facility model, where attack scenarios involving opponents with both cyber and physical capabilities are considered. Amid a propitious global context of increasing of attacks, involving the theft and sabotage on nuclear materials, the swift evolution and diversity of cyber-attacks in different sectors of society and the growing variety and complexity of that types of attacks, it is very difficult to assess the security of critical infrastructures. Considering confidentiality about the design of real facilities and their systems, a nuclear facility and its physical and cyber security systems were modeled in this work. This model is based on international trainings held by the International Atomic Energy Agency (IAEA). Moreover, the cyber-attack scenario was modeled over one of the critical digital assets of the physical protection system as part of a physical attack. The impacts on the probabilistic performance parameters of the physical protection system, particularly the probability of effectiveness (P
E
), were evaluated using tools traditionally used in physical systems assessment, such as the EASI (Estimate of Adversary Sequence Interruption), Adversary Sequence Diagrams (ASD) and Multipath Analysis. The results of the study show a significant decrease in the physical protection system effectiveness resulting from a blended cyber-physical attack, enabling not only improvements of nuclear security controls, but also the applicability to other types of critical infrastructure that could not be foreseen by simple regulatory compliance verifications.