# CS Measures for Nuclear Power Plant Protection: A Systematic Literature Review
## 4 Literature Review
### Measures for NPP Protection
The authors of [33] proposed a quantitative method for evaluating changes in CS when specific CS controls are applied in NPPs. The amount of improvement achieved by security controls was defined as the reduction of the probability that the system would fail to protect essential functions from a cyber attack. Additionally, the authors applied the concept of the intrusion-tolerant system. According to this concept, the tolerance to intrusion of a system is defined as the extent to which the system is able to provide the minimum level of safe operation when facing unexpected intrusions. The authors then constructed an event tree with the investigated intrusion-tolerant strategies for the case of protecting the availability of essential functions. The authors concluded that there still exist some limitations in estimating the efficacy of CS controls due to the lack of detail in the methods for obtaining the probability of the detection strategy and the GD strategy. Many researchers have realized in recent years that the concept of having a multi-layered CS defense system should not be exclusive to the implementation of safety and security measures, such as firewalls, intrusion detection systems, and fail-safe safety systems. It is not wise to expect that these measures will be able to anticipate all attack vectors and, as such, it is highly recommended that operators are readily responsive when it comes to detecting and preventing these types of incidents. The authors of [40] reviewed the role of reactor operators in detecting and mitigating cyber attacks in nuclear power plants. The authors introduced the idea of a cyber concept of operations, in which operators treat cyber intrusions in the same way that they would other hardware faults at the plant. A pilot study was conducted, in which reactor operators were asked to and succeeded in navigating the plant to a safe state despite cyber spoofing across multiple scenarios. The findings from the experiments confirmed that having dedicated operators can help ensure plant resilience to cyber attacks. By using n-conventional Fault Tree (FT) analysis, the author of kim2017 systematic conducted a study on the effects of safety system unavailability on plant safety and analyzed human actions based on emergency operating procedures. Based on this combined analysis, the authors suggested a novel method of systematically developing cyber attack propagation scenarios, where a cyber attack is linked to its consequences. The analysis was focused on the operator's actions and the effects on the system in case of the failure of action. Future research should focus on the study of the generation of the initiating event of a cyber attack, which was not discussed in this author's work. In addition, operator behavior should also be analyzed in future studies in order to understand the effects of different types of training and any other factors that may influence their behavior. When it comes to evaluating the operator's ability to successfully respond to malicious attacks or undesired events, the authors of [38] suggested using a cyber emulation of a digital control system coupled with a training simulator of a Generic Pressurized Water Reactor (GPWR). In an experiment set up by the authors, licensed operators were asked to complete a series of scenarios on the simulator, some of which were purposefully obfuscated. The results from the experiments showed that even after obfuscating certain indicators, the combination of security systems and operator actions was sufficient to detect the attack and protect the system. Limitations in the number of participants and indicator values should be overcome in later iterations of such experiments to allow for more realistic evaluations.