Principles for relating cybersecurity and safety in the UK nuclear industry

摘要

Safety and security of automated systems are closely related; however, although they both deal with the identification and management of risk, they have evolved as separate disciplines. This is not surprising, as the safety case approach used in the UK's nuclear industry developed when computing was not ubiquitous, computing elements in nuclear control systems were isolated and highly specialised, and skill sets required for developing and maintaining them were not part of mainstream computer science, let alone distributed more widely in the population. Even the words 'safety', 'risk', and 'security' have acquired overlapping and sometimes contradictory meanings.