Simulated nuclear facilities offer hands-on cybersecurity learning

UNIVERSITY PARK, Pa. — Historically, nuclear power plants have been controlled using analog tools, such as switches that can be physically adjusted. While the advent of new digital systems has improved the operations efficiency and safety of nuclear facilities, these systems introduce the newfound risk of cyberattacks.

According to Matthew Zerphy, professor of practice of nuclear engineering and assistant dean for operations in the Penn State College of Engineering, this trend calls for an energy workforce trained in nuclear cybersecurity, an emerging field focused on protecting power plants and other facilities that contain nuclear or radioactive materials from potential cyber threats.

“Compared to the nuclear facilities themselves, nuclear cybersecurity is relatively new,” Zerphy said. “Since the instructions controlling these facilities travel over networks, that makes them potentially subject to any number of cybersecurity concerns. The same is true of other facilities that use radioactive materials, like some cancer treatment facilities.”

Zerphy teaches NUCE/CYBER 443: Cybersecurity for Nuclear Facilities, a full-semester course designed to help undergraduate and graduate students from various degree programs prepare for this new frontier of nuclear technology. The course is among the first in the world to implement the Asherah Nuclear Power Plant Simulator (ANS) 2.0, an application developed by the International Atomic Energy Agency (IAEA) to support nuclear cybersecurity training and assessment for its member states.

The ANS simulation displays the controls and environments associated with a generic pressurized water reactor, the most common type of nuclear reactor in the world. ANS 2.0 is the latest version of the application, which has been specifically adapted for use in coursework by Penn State instructors in a pilot program with Lancaster University in the United Kingdom, the University of São Paulo in Brazil, Ontario Tech University in Canada and the Balseiro Institute in Argentina.

“ANS 2.0 has all these immersive scenarios that go along with it,” said Zerphy, who serves as a co-instructor for the course along with Penn State nuclear engineering alumnus and current Penn State IT consultant Gary Meyers. “There’s a representative threat actor, and there are fictional countries with fictional nuclear facilities. There are simulated emails being sent, and the students have to read them and interpret what’s going on as the scenario unfolds over time. Students learn how to set up a defensive computer security architecture that is consistent with IAEA and U.S. Nuclear Regulatory Commission guidance, and they can have a lot of fun in the process.”

According to Zerphy, the course offers a combination of traditional lectures and hands-on activities. Teams of students use ANS 2.0 to launch and prevent simulated cyberattacks, observing both the mechanisms and consequences of digital modifications. Students also visit Penn State’s Breazeale Reactor at the University’s Radiation Science and Engineering Center to compare simulated architectures with real-world reactor facilities.

Zerphy and Meyers highlighted the course with their ANS 2.0 collaborators at the International Conference on Computer Security in the Nuclear World: Securing the Future (CyberCon26), which was hosted by the IAEA from May 11-15 in Vienna, Austria.

“Students taking this course will be a part of the connection between policy, operations and engineering design,” Zerphy said. “International affairs students can gain an appreciation of the laws and regulations surrounding nuclear energy in the U.S. and in other countries. Meanwhile, engineering and cybersecurity students can learn about all the factors to consider when developing systems that are responsive to those regulations.”

In addition to using ANS 2.0, the course also makes use of the Advanced Reactor Cyber Analysis and Development Environment (ARCADE), a suite of tools developed by Sandia National Laboratories (SNL). Although ARCADE was originally designed for nuclear power plant research and development, it has proven highly effective in education, Zerphy explained. The suite enables the integration of industrial control system emulations with physics simulators, allowing users to predict the effects of cyberattacks on both cyber and physical systems.

Together, Zerphy said, ANS 2.0 and ARCADE offer an engaging platform for scenario-based experiential learning, supporting skill development regardless of students’ prior familiarity with nuclear facilities or cybersecurity.

“By uniting the skillsets of research faculty and the IT experts at Penn State, I believe we have created a unique learning experience that is accessible for both students in the classroom and students participating through World Campus,” Zerphy said.

He explained that he aims to leverage this critical support from both the IAEA and the SNL to help students from all backgrounds build essential knowledge and skills for careers in cybersecurity applied to nuclear and other critical energy infrastructure. This is critical, he noted, because the energy outlook is changing due to the large-scale deployment of artificial intelligence (AI) data centers.

“The total energy demand is rapidly skyrocketing, and right now, fission-based nuclear technology is the only thing that consistently gets us the amount of power we need at the intensity and efficiency we need it,” Zerphy said. “As the land-grant institution of Pennsylvania, Penn State is supporting workforce development across all sectors necessary to operate nuclear facilities. That includes not just engineers, but also people in construction, maintenance, security, finance, outreach and communications and marketing. All of that is needed.”