Preventive and Protective Measures against Insider Threats

• Publisher: International Atomic Energy Agency
• Year: 2020
• ISBN:
  9789201038210
• Topic: Technik & Maschinenbau
• Subtopic: Maschinenbau

This publication is a revision of IAEA Nuclear Security Series No. 8, Preventive and Protective Measures against Insider Threats, published in 2008. The new publication provides updated guidance to States, their competent authorities and operators, and shippers and carriers on selecting, implementing and evaluating measures for addressing insider threats. It applies to any type of nuclear facility, notably nuclear power plants, research reactors and other nuclear fuel cycle facilities (e.g. enrichment plants, reprocessing plants, fuel fabrication plants, storage facilities), whether in design, redesign, construction, commissioning, operation, shutdown or decommissioning.

1. INTRODUCTION

Background

1.1. The IAEA Nuclear Security Series provides guidance for States to assist them in implementing, reviewing and, when necessary, strengthening a national nuclear security regime. The series also provides guidance for States on fulfilling their obligations and commitments with respect to binding and non-binding international instruments. The Nuclear Security Fundamentals publication (IAEA Nuclear Security Series No. 20 [1]) provides the objective and essential elements for the entire nuclear security regime. Recommendations publications indicate what a nuclear security regime should address for the physical protection of nuclear material and nuclear facilities [2], radioactive material and associated facilities [3], and nuclear and other radioactive material out of regulatory control [4]. These publications, as well as many others in the IAEA Nuclear Security Series (Refs [5­–12]), recognize the particular threats that could be posed by insiders, as well as the need to implement specific measures against insider threats and to evaluate those measures accordingly.

1.2. This publication is an update of IAEA Nuclear Security Series No. 8, Preventive and Protective Measures against Insider Threats, published by the IAEA in 20081. This revision was undertaken to better align this Implementing Guide with the Nuclear Security Fundamentals and with the Recommendations that were published after 2008, to cross-reference other relevant Implementing Guides published since 2008, and to add further detail on certain topics based on the experience of the IAEA and Member States in using IAEA Nuclear Security Series No. 8.

Objective

1.3. The objective of this Implementing Guide is to provide updated guidance to States, their competent authorities and operators2, shippers, and carriers on selecting, implementing and evaluating measures for addressing insider threats. Threats to nuclear facilities can involve external or insider adversaries or both together in collusion (cooperation for an illegal or malicious purpose with another insider adversary or with an external adversary).

Scope

1.4. This publication applies to preventing and protecting against unauthorized removal of nuclear material and sabotage of nuclear material and facilities by insiders. This publication applies to any type of nuclear facility — notably nuclear power plants, research reactors and other nuclear fuel cycle facilities (e.g. enrichment plants, reprocessing plants, fuel fabrication plants, storage facilities) — whether in design, redesign, construction, commissioning, operation, shutdown or decommissioning.

1.5. The guidance in this publication on insider threats may also be applied to preventing and protecting against unauthorized removal and sabotage of radioactive material and associated facilities [3]; securing nuclear and radioactive materials undergoing transport [6, 13]; and the prevention and detection of, and response to, nuclear and other radioactive material out of regulatory control [4]. This guidance may also be applied to securing facility information held or obtained by other stakeholders, including the competent authority [8].

1.6. For the purposes of this publication, insider access to a facility includes physical access to locations and material; internal or authorized remote computer or network access; and access to sensitive information about the facility.

1.7. While safety considerations are not addressed in this publication, the preventive and protective measures described should be implemented in a balanced manner that is compatible with safety considerations and that considers worker radiation protection. Security measures and safety measures should be designed and implemented in an integrated manner to develop synergy between these two areas and in such a way that security measures do not compromise safety and safety measures do not compromise security [1].

Structure

1.8. After this introduction, this publication is separated into four sections. Section 2 introduces insider threats and ways to categorize insiders. Section 3 identifies the targets and facility systems to be protected against malicious acts by insiders. Section 4 discusses implementation at the facility level of preventive and protective measures to address insider threats. Section 5 discusses the evaluation of the measures discussed in Section 4.

2. IDENTIFICATION OF INSIDER THREATS

2.1. The term ‘adversary’ is used to describe any individual performing or attempting to perform a malicious act. An adversary could be an insider or could be external.

2.2. The term ‘insider’ is used to describe

“an individual with authorized access to [nuclear material,] associated facilities or associated activities or to sensitive information or sensitive information assets, who could commit, or facilitate the commission of criminal or intentional unauthorized acts involving or directed at nuclear material, other radioactive material, associated facilities or associated activities or other acts determined by the State to have an adverse impact on nuclear security” [1].

The term ‘external adversary’ is used to describe an adversary other than an insider.

Attributes of insiders

2.3. Insiders possess at least one of the following attributes that provide advantages over external adversaries when attempting malicious activities:

(a) Access: Insiders have authorized access to the areas, equipment and information needed to perform their work. Access includes physical access to nuclear facilities; nuclear materials and associated systems, components and equipment; and computer systems. Access also includes remote computer access to a facility, such as access to computer systems and networks that control processes, provide safety, contain sensitive information or otherwise contribute to nuclear security. The operator should not permit remote access to critical systems, such as systems relevant to safety.

(b) Authority: Insiders are authorized to conduct operations as part of their assigned duties and may also have the authority to direct other employees. This authority may be used to support malicious acts, incl...

Table of contents

• 1. INTRODUCTION