In May, a mock nuclear reactor site at Sandia National Laboratories in Albuquerque, New Mexico, became the training grounds for a first of its kind incident response exercise – responding to a blended cyber and physical attack. It’s an example of just one of many collaborative exercises that experts at Canadian Nuclear Laboratories (CNL), with the support of industry partners, are undertaking to evolve preparedness and response to security risks for critical infrastructure organizations. Teams of cyber security experts from both CNL and Sandia, led the hands-on event to demonstrate and evaluate the detection and response in a dual attack scenario. The event also showcased the impact of a collaborative approach to tackling the growing frequency and sophistication of cyber-attacks on operational technology (OT).
“The nuclear industry, including national laboratories, bring significant expertise and capabilities to tackling what is becoming a very costly problem for many industrial organizations,” says Bill Ulicny, Head of the Safety and Security Directorate at CNL. “CNL, for example, has decades of experience in the design and operation of systems core to nuclear power plants and the industry’s high standard and strong record for safety are the result of decades of knowledge and experience in emergency preparedness and incident response.”
The exercise served as the capstone activity of a US-Canada collaboration which began in 2021 led by Atomic Energy of Canada Limited (AECL) and the U.S. National Nuclear Security Administration, to allow seamless work and coordination between CNL and the U.S. national laboratories. As part of the agreement, two previous incident response exercises tested CNL’s state-of-the-art facility in Fredericton, New Brunswick.
An exercise of this magnitude was a first for the organizations involved – including approximately 60 participants and 12 months of planning. The five-hour real-time event included several actors, exercise controllers, evaluators and observers from utilities, government agencies and regulators. Experienced physical and cyber security teams from Bruce Power also contributed to ensure scenarios were realistic and relevant, but also provided the exercise players who would be testing their incident response training and organizational procedures.
The hard work paid off – the hands-on experience proved to be very effective for evaluating and improving cyber security and physical security incident response capabilities.
“Building resilience in our cyber security capabilities is a national and strategic priority. This work funded under AECL’s Federal Nuclear Science and Technology Work Plan is strengthening our partnerships between government and industry domestically and internationally,” says Karen Huynh, Director Strategic Programs & Partnerships, AECL. “This type of hands-on exercise provides a unique opportunity to build our cyber security capabilities to support regulations and enable industry.”
Exercise Feedback:
“It’s been a real pleasure to work with such a strong bilateral team on this important and consequential project. I think what we started here will significantly contribute to nuclear security globally.”
– Pratap Sadasivan, Senior Advisor, U.S. DOE National Nuclear Security Administration (NNSA) Office of International Nuclear Security.
“The Cyber/Physical exercise held at Sandia in May 2023 was a fantastic opportunity for Bruce Power to exercise our combined response teams to a hybrid attack scenario in a realistic environment. Bruce Power was able to capture several opportunities to improve process and interfaces that would have been difficult to identify without being fully submersed within the mock nuclear reactor cyber/physical facility. Bruce Power is very happy to contribute ideas back to our peer organizations by allowing observation of our Cyber/Physical teams executing our incident response plans during this exercise, as well as providing valuable feedback to CNL/SNL on how to host future exercises.”
– Greg Kuhl, Senior Information Systems Analyst, Bruce Power
“Bruce Power is proud to have been a key stakeholder in both the development and execution of this industry-first exercise. Working with national and international partners, this exercise demonstrated the industry’s commitment to the safe and reliable use of nuclear technology to benefit society through energy production and research.”
– Chris Allen, Section Manager with Fire and Security Training, Bruce Power
