Audit finds network vulnerabilities at NRC
While rating the IT security as "generally effective," an audit of the Nuclear Regulatory Commission's Region IV office found several lapses that could leave sensitive data exposed.
An independent audit focused on the Nuclear Regulatory Commission found that one of its main offices may have network vulnerabilities and recommends more-frequent updates of the commission's cybersecurity policies and procedures.
The NRC is split into four regional offices across the country; Region IV's office is located in Arlington, Texas. Overall the audit, conducted in July 2017 by Richard S. Carson & Associates on behalf of NRC's Office of the Inspector General, found that Region IV's IT security program was "generally effective," but did find lapses in a handful of areas that have left the network vulnerable to cyber intruders.
One of the problems discovered was that the office has been lax in updating its IT security policy guidelines. The NRC is required to periodically update its 110 policy guides, annually for some and every three years for others. The audit found four policy guides around IT and security that had gone more three years without review or update, and another three that had gone more than a year, including the region's main IT security guideline. Auditors also found that the region's procedures for backing up critical systems and data were out of step with NIST guidelines.
"Outdated procedures can result in important steps or processes being missed. In addition, outdated procedures make it more difficult when training new personnel to handle a specific activity," the auditors wrote.
Perhaps most concerning, auditors ran a network vulnerability scan and found holes in both Region IV IT components as well as within the larger NRC infrastructure. The scan found both moderate areas of concern and high-risk critical problems, but the audit does not go into detail about the vulnerabilities or what information may have been unprotected. The NRC handles both classified and unclassified information regarding the physical protection and safeguarding of nuclear materials and facilities.
The commission may have reason to worry. In June 2017, the Department of Homeland Security and FBI sent out an alert to power providers that there were ongoing cyber intrusions at a number of nuclear facilities dating back to May, with hackers using phishing attacks in an attempt to gain the credentials of senior control engineers. A 2016 audit also found that cyber attacks on the commission have been steadily rising in recent years, outpacing many other departments and agencies.
The NRC agreed with the findings and opted not to submit formal comment to auditors.