U.S. NRC Blog

Transparent, Participate, and Collaborate

Category Archives: General

Five Questions With Tom Rich

Tom Rich is head of the agency’s Information Security Directorate

  1. How would you describe your job in three sentences or less?

5 questions_9with boxMy job is to work with others to protect NRC’s information and information systems. This includes providing security training, performing security assessments, testing the vulnerability of our IT systems to phishing and penetration attacks, responding to security incidents and keeping up with situational awareness to see where we may need to strengthen our defenses.

  1. What is the single most important thing you do at work?

Communication with NRC managers and employees regarding threats to our IT systems and data. We do security briefings, security awareness events for staff, and daily meetings with the Chief Information Officer.

  1. What is the single biggest challenge you face?

tomrichThe dynamic pace of technology changes and the need for cyber defenders to keep up. With the “Internet of Things” becoming more and more a part of our daily lives, the devices we now use in virtually everything we do present security and privacy concerns and introduce a much larger avenue of attack. These devices want to communicate, in some cases sensitive data, through multiple channels with each other and cloud services. The challenge is that these devices do not have adequate security controls built into their design.

  1. What would you consider one of your biggest successes on the job?

We established a cyber security dashboard that measures the NRC’s improvements in security practices. This is an internal mechanism to let NRC stakeholders see what they are doing well and where improvements are needed. Since implementation, we have seen significant improvement in cybersecurity across the agency.

  1. What one thing about the NRC do you wish more people knew?

That we have Resident Inspectors at each of the nuclear plants. I think a lot of the public believe we regulate and inspect from a distance. I do not believe many know we have feet on the ground at the nuclear plants.

Five Questions With is an occasional series where we pose the same five questions to NRC staff.

ncsam-web_edited-1For more information on National Cyber Security Awareness Month, go here.

REFRESH: Protecting the NRC’s Cyber Frontier

By David McIntyre
Public Affairs Officer

The email was flagged urgent and screamed in capital letters: YOUR IMMEDIATE ATTENTION REQUIRED! The message said a software update was needed to avoid major system disruption, and to click a link and enter a network password.

cybersecThe NRC employee who received the email thought the message looked suspicious. Instead of clicking on the link, she forwarded the message as an attachment to the NRC’s Computer Security Incident Response Team.

Within minutes, a CSIRT member was analyzing the email on a computer unconnected to the NRC network. He quickly determined the message was bogus, a “phishing” attempt to gain unauthorized access to the system. He instructed the employee to delete the message and block the sender to avoid receiving any further attempted intrusions from that Internet address.

Had the employee provided her username and password, she could have exposed the NRC’s computer network and its sensitive information to compromise and possible disruption. Personal information about NRC employees would have been at risk, as well as sensitive pre-decisional information about agency policies and licensees.

While Safeguards and classified information about the security and status of nuclear plants is maintained on separate higher security systems, the information we process on the NRC corporate network must also be protected.

CSIRT, part of the NRC’s Computer Security Office, is a small group of experts, all highly trained in cyber defense. Their mission is to detect and thwart attacks on the NRC’s computer networks and prevent “spills” of sensitive information. Such attacks can come through phishing attempts, such as the fictional incident described above, malware implanted in website advertisements or viruses and malware on portable data devices.

The team routinely works with other federal agencies, including the Homeland Security Department’s U.S. Computer Emergency Response Team (US-CERT) to stay up to date on the latest vulnerabilities. They even practice “white hat” hacking to test the NRC’s systems.

As a response team, CSIRT investigates suspicious emails that have already passed through the NRC’s extensive SPAM filters and Internet firewall, robust cyber security defenses mounted by the Office of Information Systems.

ncsam-web_edited-1About 10 million emails are directed to NRC.gov addresses each month, and nearly 90 percent of them are blocked by the agency’s network security technologies as spam or for carrying viruses or suspicious attachments, says Mike Lidell, IT Specialist in the OIS Security Operations and Systems Engineering Branch. The OIS team administers the NRC’s firewalls, intrusion detection systems and spam filters.

While the percentage of blocked emails seems high, Lidell says it’s pretty much “par for the course” for any large organization or government agency. Emails that get through the initial line of defense are scanned again by the internal servers and a third time by the end-user’s individual computer. Internet data returned from the Web is scanned by NRC servers and individual workstations as well to guard against “drive-by downloads” of malicious software.

As Lidell points out, the “defense in depth” is necessary because the attacks are always evolving and changing. Thorne Graham, CSIRT’s team leader, praises a fourth line of defense against email attacks on the agency’s network: The NRC’s 4,000 employees. All NRC employees take annual online computer security training.

“Our best defense is the individual employee,” Graham says. “Security is everyone’s business.”

REFRESH is an occasional series where we republish previous posts. This originally ran in November 2014.

Five Questions with the NRC’s SECY

Annette Vietti-Cook is the NRC’s Secretary of the Commission

  1. How would you describe your job in three sentences or less?

5 questions_9with boxEvery day I work directly with the Commission offices managing the Commission’s decisionmaking process, and as the official record keeper, historian, and meeting coordinator. I oversee the planning of Commission meetings, drafting of Commission decisions, tracking of Commission requirements, and managing of Commission correspondence and records, and rulemaking and adjudicatory dockets. I also work with the agency’s historian.

  1. What is the single most important thing that you do at work?

Communicate effectively. My staff and I work closely and daily with the Commission and their staff as well as with the Executive Director for Operations staff. We provide advice on Commission policies and procedures, help to prepare items for Commission consideration, convey Commission decisions, and prepare for Commission meetings. As the Secretary, I must constructively address issues with the Commission and staff, acknowledge dissenting opinions and use good communication – and good judgement – in a way that ultimately benefits the agency’s performance of its mission.

  1. What is the single biggest challenge you face?

annettefinalTraining, developing, and mentoring employees so my office can provide outstanding support to the Commission. Commissioners come and go, so it’s important that the Office of the Secretary maintain the institutional knowledge of how the Commission does its work. The Internal Commission Procedures, which lay out how all manner of regulatory and policy issues are handled, are vitally important but can never tell the whole story. I’ve been with the agency for 34 years and Secretary for 17 years and many of my staff have similar long tenures. So we believe our institutional knowledge is a real asset.

  1. If you could change one thing at the NRC or within the nuclear industry, what would it be?

Eliminate the requirement that the NRC substantially recover the cost of its annual budget through the imposition of fees collected from NRC licensees. This structure creates the misimpression among some that NRC inappropriately considers fees in carrying out its important safety and security mission. By eliminating fees, the NRC would license and regulate independently through congressionally appropriated funds, just like most other federal agencies.

  1. What one thing about the NRC do you wish more people knew?

The NRC is full of competent, dedicated and hardworking people. There is also a squash court on the roof of the building. Yes, even regulators can have a sense of humor.

Five Questions is an occasional series in which we pose the same questions to different NRC staff members.

Election Year, the Hatch Act and NRC Employees

Eric Michel

flagLike most Americans, the employees of the NRC are watching the 2016 elections and considering who to vote for in November. But unlike most Americans, there are a number of political activities which NRC employees – as part of the federal government – cannot do.

The prohibitions are contained in the Hatch Act, a law first passed in 1939. The act restricts executive branch employees in their actions related to partisan elections – and not just at work. The intent behind the restrictions is to maintain a politically neutral federal workforce, free from partisan influence or coercion.

As outlined in the NRC’s Management Directive 7.10, NRC employees cannot engage in political activity while on duty or while inside a federal building. They can’t wear a partisan political button, display a campaign sign in their office or use their government computer to send an email advocating for or against a partisan political candidate or political party.

Even while off duty, NRC employees cannot solicit or receive funds on behalf of a partisan candidate or political party. You also won’t find NRC employees on any ballot for a partisan election – that’s prohibited, too.

Activities most NRC employees are allowed to do on their own time includes:

  • Register and vote
  • Assist in voter registration drives
  • Contribute money to political organizations
  • Distribute campaign literature
  • Attend political rallies and fundraisers
  • Volunteer for a campaign

They can also run for office in a nonpartisan campaign, such as for a seat on a school board.

Career Senior Executive Service employees are under a few additional restrictions. Senate-confirmed Presidential appointees, such as the NRC Chairman and Commissioners, have their own specific rules.

Penalties can range from being reprimanded to being fired to being fined up to $1,000.

More information about what NRC and other federal government workers can and cannot do related to elections can be found here.


Back to Basics – Seeking Comment on a New Commission Public Meeting Policy

Lance Rakovan
Senior Communications Specialist

We are always looking to make our public meetings better. To that end, we’ve drafted a new Commission policy statement on public meetings and are seeking public comment to make sure it hits the mark. The new policy statement is meant to re-affirm the importance of public participation in NRC’s public meetings and address a number of concerns noted previously by the public and NRC staff.

audienceFirst, some background. The NRC has had a formal policy regarding open meetings since 1978; the most recent revision was issued in 2002. The NRC assembled a task group on Enhancing NRC Public Meetings in June 2014. The task group recommended steps be taken to:

  • improve consistency of public meetings across the agency;
  • encourage increased management support for public interaction; and
  • seek out creative ways to effectively engage the public and promote participation.

In response to the task group’s report, the staff has begun implementing several enhancements to the existing public meeting process, including drafting the new policy statement.

The most significant proposed change to the policy statement is a revised meeting category system based on the level of public participation. The current categories of NRC public meetings are labeled 1, 2, and 3. Public participation levels for Category 1 and 2 meetings are essentially the same. However, public participation for a Category 3 meeting can range from the NRC simply engaging in dialogue with members of the public to receiving comments from the public (and responding later).

This has sometimes led to confusion over what to expect from a public meeting. The revised categorization system removes the 1, 2, and 3 labels and incorporates a clear description of the level of public participation planned for the meeting:

  • Observation Meeting
  • Information Meeting With Q&A
  • Commenting-Gathering Meeting

We hope these revised categories will help you prepare for and participate in NRC public meetings and will make more clear what you can expect. The table below compares the current categories to the proposed new categories. blog-capture_small

The NRC will be hosting a public meeting via webinar on September 29, 2016, to provide information and answer questions to help those interested in submitting comments. Formal comments, though, won’t be accepted during the meeting. To provide your comments on the draft statement, go here. Comments will be accepted until November 14, 2016.

%d bloggers like this: