Quantification of Human Errors in Cyber Security in the Nuclear Sector

“英国的民用核安全战略（2017年2月）将CS和混合攻击确定为一个主要问题，并建议英国核部门和相关供应链中的组织应增加对CS风险的了解并减轻安全漏洞。在CyberUK 2017上，NCSC以人为本的安全负责人发表了与英国国家战略相关的主题演讲，并重点关注人员在防止这些攻击方面所发挥的重要作用。人为任务包括识别和响应攻击、维护防御屏障、监控人员、决策和态势感知，以及避免无意中削弱这些防御。人为错误，包括无意的错误和违规行为，这是有意识的行为，不符合规定的方法或组织政策，是出于非恶意的原因（例如，因为一个人不认为他们是必要的）。这两种情况都涉及到许多CSB，因此，了解潜在的人为因素问题将使评估人员能够识别会增加人为错误风险的任务特征。该项目将开发一种结构化的方法，以研究人的认知能力、局限性和绩效形成因素为基础，开发的工具将使核设施能够量化CSB预防任务的风险，从而可以识别任何弱点，降低危及CS的人为错误的风险。开发的工具将涵盖防止CS或混合攻击的硬件或软件实际或通过互联网进入核站点的任务;访问控制任务;监察互联网通讯，并在有需要时采取有效的预防措施，以防网络受到攻击。该计划将由风险管理、人为因素及人的可靠性分析方面的知名专家，尤其是在核竞技场。高级CS专业知识来自肯特大学，该大学是网络安全研究卓越学术中心（ACE CSR）机构的一部分。"

"The UK's Civil Nuclear Security Strategy (Feb 2017) identifies CS and blended attacks as being a major concern and proposes that organisations in the UK Nuclear Sector and the associated supply chain should increase their understanding of CS risks and mitigate security vulnerabilities. At CyberUK 2017, the NCSC People-Centred Security Lead presented a keynote speech linked to the UK national strategy and the focus on the essential roles that personnel take in preventing these attacks. Human tasks include identifying and responding to attacks, maintaining defensive barriers, monitoring personnel, decision-making and situation awareness and avoiding inadvertently weakening these defences.Human errors, including both unintentional errors and violations, which are conscious acts that do not conform to the prescribed methods or organisational policies that are undertaken for non-malicious reasons (e.g. because a person does not consider them to be necessary). Both of these have been implicated in many CSBs and so, understanding the underlying human factors issues will enable assessors to identify the task features that will increase the risk of human errors. This project will develop a structured approach underpinned by research into human capabilities in terms of cognitive strengths, limitations and performance shaping factors.The tool that will be developed will enable nuclear installations to quantify the risks for CSB prevention tasks, so that any weaknesses can be identified and the risk of human errors that compromise CS can be reduced. The tool that is developed will cover tasks to prevent hardware or software for a CS or blended attack from entering a nuclear site physically or via the internet; access control tasks; monitoring internet traffic and if necessary, undertaking effective preventive actions in the event of an attack.The project will be undertaken by CRA who are renowned experts in the field of risk management, human factors and human reliability analysis, especially in the nuclear arena. Advanced CS expertise comes from the University of Kent which is part of the Academic Centres of Excellence in Cyber Security Research (ACE CSR) institution."