Critical Infrastructure Protection and Information Security

Abstract

One morning on a brisk fall day in early November, technicians at the Springfield Nuclear Power Plant notice a malfunctioning steam release valve on Cooling Tank One. A mechanical problem was discovered in a leaky seal that had been recently patched. No one thought to check the plant’s supervisory control and data acquisition (SCADA) system, which controls the cooling function for the plant. Technicians quickly recognized the leaky seal and corrected the problem without any impact on the plant’s overall operation. Shortly after the repair a similar situation is discovered in Cooling Tanks Two and Three. This time the technicians did not discover any mechanical failures and did not recognize the significance in reoccurring events. It is not until an examination of the SCADA system that the problem is diagnosed; the automated software has given the command to close the valves in Cooling Tanks Two and Three when hot air should have been vented. How did this occur? Only authorized plant employees have access to the software, which is password protected.