Regulatory analysis and enhancement opportunities for supply chain cybersecurity in Korean nuclear facilities

초록

The surge in cyber incidents such as the SolarWinds, Log4j, and MOVEit attacks, underscores the need for a comprehensive supply chain cybersecurity framework. It is particularly important for critical infrastructure, such as nuclear facilities, where a breach could have catastrophic human and environmental consequences. This study defines the necessary scope of supplier organizational and linkage security management throughout the entire lifecycle of nuclear facilities. A comparative analysis is then conducted with Korean nuclear cybersecurity regulations, focusing on the regulatory standard KINAC/RS-015 and its 101 cybersecurity controls. Certain controls requiring supplier organizational and linkage security serve as a solid foundation for comprehensive supply chain cybersecurity management. The controls within the development organizational security scope are generally well established, which is encouraging given the growing emphasis on secure software development and continuous vulnerability management. Some deficiencies are also identified. The current framework primarily focuses on the licensee, outlining cybersecurity implementation from its perspective. As a result, regulations remain largely confined to activities within nuclear facilities and impose few explicit requirements on suppliers. However, given the inevitability of supply chain threats, the regulatory focus must extend beyond nuclear facilities to ensure their safety.

키워드