At first glance, the headline news in late 2023 about a potential cyber security incident at the UK nuclear site Sellafield could be just another chapter in the world’s ongoing saga of cyber attacks. While the details remain hazy and Sellafield denies the Guardian’s serious allegations, the reports present some interesting learning opportunities for executives, businesses and cyber security professionals alike.
Sellafield is the UK’s primary nuclear waste storage facility, and it houses the largest store of plutonium on the planet. Its digital systems are also home to the planning documents that the UK relies on to help it respond to critical incidents – including attacks by foreign powers on the UK.
![Martin Nikel](/sites/default/files/styles/medium/public/2023-12/Martin-06.webp?itok=RoPvzlVj)
What is alleged?
The Guardian claims that, as long ago as 2015, Russian and Chinese threat actors successfully breached Sellafield’s cyber defences by using “sleeper malware”.
Sleeper malware can take many forms – sleeper ransomware, such as the Windows-based Locker, has been prevalent for more than a decade and in recent years the macOS malware Sliver Sparrow has shown its own ‘sleeper’ functionality.
The Guardian report also highlighted potential failures in basic cyber security principles. It claimed that staff at an external site had access into Sellafield servers, and that external contractors were able to plug memory sticks into Sellafield’s systems without supervision. (The latter brings back memories of the now infamous Stuxnet attack on Iranian enrichment plants, which was reportedly achieved using removable storage devices.)
The claims have been refuted by Sellafield, which says it has “no records or evidence” to indicate that its networks have been successfully breached in “the manner described” by the Guardian. Sellafield also says it has, “a high degree of confidence that no such malware exists on our system.”
The report calls into question cyber security governance at Sellafield. The Guardian claims the site was “last year placed into a form of ‘special measures’ for consistent failings on cyber security,” attributing this to sources within the security services and the Office for Nuclear Regulation (ONR).
While the ONR doesn’t directly confirm the assertion of ‘special measures,’ its published comments do confirm that Sellafield is not “meeting certain high standards that we require” and that it is now “under significantly enhanced attention.”
What might the threat actors be trying to achieve?
No ransom demand has been received, nor is there (as yet) any evidence that Sellafield’s daily operations have been disrupted.
If the site has in fact been breached, it is possible that the threat actors were simply testing the waters and are now hopeful that their access to Sellafield’s networks and data will one day prove useful to them.
Alternatively, they may have been laying the groundwork for something more far-reaching.
What are the lessons for businesses?
Sellafield is a major piece of the UK’s critical national infrastructure. It’s clear that there would be an impact far beyond the physical site itself should it be subject to a successful cyber attack or ongoing compromise of the kind described by the Guardian.
Although not all businesses grapple with securing sites designated as critical national infrastructure, the principles that should be followed are universal:
- Secure the environment: managed detection and response shapes a fully formed managed service around the technical tools and knowhow to detect and respond to the evolving digital threats.
- Quantify the risks: develop an understanding of risk from third parties (e.g. external contractors) through due diligence and assess your own risks through systems testing.
- Improve the position: embedded training through structured exercises, either with full threat simulations to test your playbooks or desktop-based scenarios to stretch your incident response plan.
- Ensure you can respond: develop a strong relationship with a trusted partner who can provide knowledge, skills and expertise to get your business back up and running after an incident happens.
![Cyber Risk Cyber Risk](/sites/default/files/default_images/02.webp)
Cyber Risk
We bring the best of our collective experience, energy and creative power to fiercely safeguard our clients and fortify their communities.
We safeguard clients and their communities
![Petroleum Development Oman Pension Fund](/sites/default/files/styles/large/public/2023-04/640%20%281%29.jpg?itok=Zaq4RnbZ)
Petroleum Development Oman Pension Fund
“Thomas Murray has been a very valuable partner in the selection process of our new custodian for Petroleum Development Oman Pension Fund.”
![ATHEX](/sites/default/files/styles/large/public/2023-04/ATHEX.webp?itok=fAZsgwVY)
ATHEX
"Thomas Murray now plays a key role in helping us to detect and remediate issues in our security posture, and to quantify ATHEX's security performance to our directors and customers."
![Communities Logo 02](/sites/default/files/styles/large/public/2023-03/clnt02.webp?itok=14mAvc3A)
Northern Trust
“Thomas Murray provides Northern Trust with a range of RFP products, services and technology, delivering an efficient and cost-effective solution that frees our network managers up to focus on higher Value activities.”
Insights
![Red Arrows aerial display team: An overview of the TIBER-EU methodology](/sites/default/files/styles/testimonial/public/2024-08/shutterstock_2358753955.jpg?itok=njwR3fdT)
An overview of the TIBER-EU methodology
The TIBER-EU methodology is a comprehensive framework designed to enhance the cyber resilience of financial institutions.
![A tree in a digital landscape: Five minutes with the PE cyber experts](/sites/default/files/styles/testimonial/public/2024-08/shutterstock_2261001445.jpg?itok=zHEAo3e8)
Five minutes with the PE cyber experts
Ed Starkie and Ben Hawkins gave us five minutes of their time to run through the current state of cyber security for private equity.
![Understanding supply chain and concentration risks in cloud services](/sites/default/files/styles/testimonial/public/2024-07/shutterstock_1319520962.webp?itok=cQDVrZGm)
Understanding supply chain and concentration risks in cloud services
The major incident on Friday, 19 July highlighted the high levels of concentration risk emerging from our technology landscape.
![A soaring eagle: Where to start with cyber security for private equity](/sites/default/files/styles/testimonial/public/2024-06/shutterstock_2250923081.webp?itok=se_s6Mxr)
Where to start with cyber security for private equity
Cyber security for private equity (PE) firms is a central concern given the sensitive nature of the data they handle.