Stuxnet Scenario: Power Plant Maintenance Window

Columbia River Power Station: Nuclear facility, 1,200 employees, critical infrastructure
APT • Stuxnet
STAKES
Regional power grid + Nuclear safety systems + Critical infrastructure protection
HOOK
Columbia River Power Station is in the middle of their scheduled annual maintenance outage, with multiple safety systems temporarily bypassed for equipment upgrades. The sophisticated attack began when contractors introduced infected USB drives during the maintenance window, and the malware is now spreading through air-gapped industrial control networks while safety systems are at their most vulnerable.
PRESSURE
Maintenance window ends in 72 hours - plant must restart safely or region faces power shortages
FRONT • 150 minutes • Expert
Columbia River Power Station: Nuclear facility, 1,200 employees, critical infrastructure
APT • Stuxnet
NPCs
  • Dr. Catherine Walsh (Plant Manager): Responsible for safe plant restart after maintenance, discovering that control systems show anomalous behavior during critical safety testing
  • Robert Chen (Chief Nuclear Officer): Oversees all nuclear safety systems, must balance cybersecurity response with nuclear regulatory requirements and public safety
  • Maria Rodriguez (Control Systems Engineer): Detecting unusual behavior in centrifuge and cooling system controls, realizes sophisticated malware may have compromised industrial safety systems
  • Andrew Thompson (Contractor Supervisor): Leading maintenance team that may have inadvertently introduced attack vector, represents third-party vendor relationships and supply chain security
SECRETS
  • Air-gapped industrial control networks were bridged during maintenance for software updates and diagnostic access
  • Nation-state adversary specifically targeted nuclear facilities during maintenance periods when security is reduced
  • Sophisticated malware uses four zero-day exploits and can manipulate industrial control systems while appearing normal

Scenario Details for IMs

Opening Presentation

“It’s Wednesday morning at Columbia River Power Station, and the annual maintenance outage is in its final phase. Nuclear reactors are offline, safety systems are being tested, and the plant must restart within 72 hours to meet regional power demands. But during routine control system testing, engineers are discovering anomalous behavior in critical safety systems. Preliminary investigation suggests sophisticated malware has somehow penetrated the air-gapped industrial control networks, potentially compromising nuclear safety systems during the most vulnerable maintenance period.”

Initial Symptoms to Present:

  • “Industrial control systems showing subtle anomalies during safety system testing”
  • “Centrifuge and cooling system controls responding differently than expected to operator commands”
  • “Network monitoring detecting unexpected traffic on supposedly air-gapped industrial networks”
  • “Contractor USB drives triggering security alerts when scanned by updated antivirus systems”

Key Discovery Paths:

Detective Investigation Leads:

  • Forensic analysis reveals sophisticated malware designed specifically for industrial control systems
  • USB device examination shows infection vector through contractor maintenance equipment
  • Timeline analysis reveals compromise occurred during maintenance window when air-gap security was reduced

Protector System Analysis:

  • Industrial control system monitoring reveals subtle manipulation of centrifuge speeds and cooling controls
  • Nuclear safety system integrity checks show potential compromise of critical safety functions
  • Network architecture assessment reveals temporary bridging of air-gapped networks during maintenance

Tracker Network Investigation:

  • Traffic analysis reveals covert communication channels established across supposedly isolated networks
  • Command and control analysis shows sophisticated nation-state-level operational security
  • Attribution investigation suggests advanced persistent threat group targeting critical infrastructure

Communicator Stakeholder Interviews:

  • Nuclear engineers report subtle but concerning changes in control system behavior
  • Maintenance contractors explain procedures that may have introduced USB-based infection vectors
  • Regulatory affairs staff describe federal requirements for nuclear incident reporting and response

Mid-Scenario Pressure Points:

  • Hour 1: Nuclear Regulatory Commission inspector arrives for scheduled post-maintenance safety verification
  • Hour 2: Regional power grid operator inquires about plant restart schedule due to increasing electricity demand
  • Hour 3: Control systems engineer reports that centrifuge systems are operating outside normal parameters
  • Hour 4: Plant manager must decide whether to proceed with reactor restart or extend maintenance outage

Evolution Triggers:

  • If malware remains undetected, plant restart could trigger physical damage to critical systems
  • If maintenance deadline is missed, regional power grid faces potential shortages affecting millions
  • If attack attribution involves nation-state adversary, federal counterintelligence and national security agencies become involved

Resolution Pathways:

Technical Success Indicators:

  • Team identifies sophisticated malware and industrial control system compromise
  • Air-gapped network security restored through comprehensive malware removal and system validation
  • Advanced attribution analysis provides intelligence on nation-state threat actor capabilities and objectives

Business Success Indicators:

  • Nuclear safety systems verified clean and functional before reactor restart authorization
  • Plant maintenance schedule adjusted to accommodate cybersecurity response without compromising safety
  • Federal regulatory compliance maintained throughout incident response and recovery process

Learning Success Indicators:

  • Team understands advanced persistent threat capabilities and nation-state attack sophistication
  • Participants recognize critical infrastructure cybersecurity challenges and air-gapped network vulnerabilities
  • Group demonstrates coordination between cybersecurity, nuclear safety, and national security considerations

Common IM Facilitation Challenges:

If Nuclear Safety Context Is Overwhelming:

“The nuclear technical details are complex, but the core question is simple: can the team ensure that control systems are safe and trustworthy before the reactor restarts and begins generating power for millions of people?”

If Nation-State Attribution Is Avoided:

“Your technical analysis suggests this isn’t ordinary cybercrime - the sophistication and targeting suggest state-sponsored activity. How does this change your investigation and response approach?”

If Air-Gapped Network Compromise Is Misunderstood:

“Maria just confirmed that the affected systems were supposed to be completely isolated from any network connections. How did this malware cross the air gap, and what does that tell you about the sophistication of this threat?”

Success Metrics for Session: