Towards Software Bill of Materials in the Nuclear Industry

Technical Report · Thu Sep 01 00:00:00 EDT 2022

DOI:https://doi.org/10.2172/1901825· OSTI ID:1901825

Eggers, Shannon Leigh ^[1]; Simon, Tori Brooke ^[1]; Morgan, Baleigh Rae ^[1]; Bauer, Ethan S. ^[1]; Christensen, Drew ^[2]

---

1. Idaho National Laboratory (INL), Idaho Falls, ID (United States)
2. Pacific Northwest National Laboratory (PNNL), Richland, WA (United States)

Large, modern industrial facilities often incorporate thousands of digital assets in their operational technology. Regulated facilities, such as nuclear power plants (NPPs), maintain robust cybersecurity and configuration management programs that often use bills of materials (BOMs) for these assets, including make, model, and version of hardware, firmware, and software. However, these BOMs typically capture only first- or second-tier information provided by the original equipment manufacturer (OEM). Unfortunately, as indicated by the increasing number and sophistication of software supply chain attacks, this level of detail is insufficient for identifying all the potential vulnerabilities and risks in software applications. Software BOMs (SBOMs) provide detailed enumeration of components and dependencies within the product or devices, including firmware. SBOMs can be combined with vulnerability data sources and vendor vulnerability attestations to improve vulnerability management and enable rapid identification of affected components when new software vulnerabilities are discovered. Ideally, SBOMs are created by the OEM prior to installation. However, since this practice is not yet commonplace and since NPPs are typically slow to adopt new technology, most NPPs do not incorporate SBOMs into their asset or configuration management programs. Fortunately, SBOMs can be generated by NPPs on existing digital assets to provide further insight into risk management decisions. This report provides an overview of the current SBOM ecosystem and recommends guidance on how to get started in a “crawl, walk, run” manner to develop and implement a sustainable SBOM program for digital assets in an NPP.

• Research Organization: Idaho National Laboratory (INL), Idaho Falls, ID (United States)
• Sponsoring Organization: USDOE Office of Nuclear Energy (NE)
• DOE Contract Number: AC07-05ID14517
• OSTI ID: 1901825
• Report Number(s): INL/RPT-22-68847-Rev000
• Country of Publication: United States
• Language: English

Related Subjects

22 GENERAL STUDIES OF NUCLEAR REACTORS
97 MATHEMATICS AND COMPUTING
CCE
CIE
Consequence-based Targeting
Consequence-Driven Cyber-Informed Engineering
Cyber
Cyber Risk
Cyber Supply Chain Risk
Cyber Threat and Vulnerability
Cyber-Informed Engineering
Cyber-Resilience
Cybersecurity Resilience
Energy Transition
Integrating Cybersecurity
SBOM
Software Bill of Materials