Computer Security Training and Exercises in the Nuclear Sector: Insights from a User-centered Requirements Gathering Process

Computer security has been recognized as an important aspect of nuclear security: Effective measures, which include computer security education, have been integrated into nuclear security recommendations and systems. At this stage, it is crucial to understand and evaluate the current state-of-play, as perceived by (potential) recipients of education. With this understanding, informed guidance about future strategic directions can be made, to ensure that initiatives provide the most benefit to participants and the sector. The contribution of the paper is two-fold: first, results from a campaign for gathering requirements elucidate the state of computer security in the nuclear sector. Participants from thirteen countries across differ-ent roles and organization types engaged in questionnaires that aimed at identifying the state of education within their organ-izations, as well as impediments, perceived risks, recommendations for future interventions and key improvements for in-creased awareness and protection. Second, insights from the process and its results identify a set of challenges and recom-mendations for implementing user- and stakeholder-centered thinking in the given setting. This includes critically reflecting approaches to implement an iterative consultation process and to embed user involvement tools into the process, such as au-dience participation and personalized electronic questionnaires. The paper concludes with recommendations both for the design of requirements gathering processes and improved computer security training and exercises in the nuclear sector.