On the Nuclear Threat Initiative's Report on Cybersecurity Risks at Nuclear Plants

Herb Lin
Tuesday, January 19, 2016, 9:09 PM

Paul Rosenzweig offers a critique of the Nuclear Threat Initiative’s report on cybersecurity risks at nuclear power plants that is summarized in his statement that

The NTI assessment is based on a legal and policy analysis, not a practical examination of actual vulnerability.

Meet The Authors

Published by The Lawfare Institute
in Cooperation With
Brookings

Subscribe to Lawfare

Paul Rosenzweig offers a critique of the Nuclear Threat Initiative’s report on cybersecurity risks at nuclear power plants that is summarized in his statement that

The NTI assessment is based on a legal and policy analysis, not a practical examination of actual vulnerability.

I understand and share his disappointment that the report did not address actual vulnerabilities. But he concludes his piece by saying that “Starting at the top is probably the wrong place to begin.”

I’m not so sure about that part. I’ve tracked cybersecurity issues at nuclear plants for a while, and I am pleased that the NTI report was written. That is, I think we’re better off with the report in hand compared to the alternative – the report not being in hand. Paul’s right that we can’t stop with fixing the problems identified in the report, but telling people what they should be doing is for me a necessary precondition to getting them to do those things.

I should point out that this (small) difference between Paul and me reflects a broader question—do security checklists and the like contribute in a meaningful way to cybersecurity? I think the answer can be yes, but not if they become mindless check-the-box activities, which do all too often. Paul, I suspect, would say no, because becoming mindless check-the-box activities is inevitable.

Back to Top
Herb Lin

Herb Lin

HerbLinCyber
Read More
Dr. Herb Lin is senior research scholar for cyber policy and security at the Center for International Security and Cooperation and Hank J. Holland Fellow in Cyber Policy and Security at the Hoover Institution, both at Stanford University. His research interests relate broadly to policy-related dimensions of cybersecurity and cyberspace, and he is particularly interested in and knowledgeable about the use of offensive operations in cyberspace, especially as instruments of national policy. In addition to his positions at Stanford University, he is Chief Scientist, Emeritus for the Computer Science and Telecommunications Board, National Research Council (NRC) of the National Academies, where he served from 1990 through 2014 as study director of major projects on public policy and information technology, and Adjunct Senior Research Scholar and Senior Fellow in Cybersecurity (not in residence) at the Saltzman Institute for War and Peace Studies in the School for International and Public Affairs at Columbia University. Prior to his NRC service, he was a professional staff member and staff scientist for the House Armed Services Committee (1986-1990), where his portfolio included defense policy and arms control issues. He received his doctorate in physics from MIT.

Subscribe to Lawfare