Stuxnet Scenario: Power Plant Maintenance Window

Columbia River Power Station: Nuclear facility, 1,200 employees, critical infrastructure
APT • Stuxnet
STAKES
Regional power grid + Nuclear safety systems + Critical infrastructure protection
HOOK
Columbia River Power Station is in the middle of their scheduled annual maintenance outage, with multiple safety systems temporarily bypassed for equipment upgrades. The sophisticated attack began when contractors introduced infected USB drives during the maintenance window, and the malware is now spreading through air-gapped industrial control networks while safety systems are at their most vulnerable.
PRESSURE
Maintenance window ends in 72 hours - plant must restart safely or region faces power shortages
FRONT • 150 minutes • Expert
Columbia River Power Station: Nuclear facility, 1,200 employees, critical infrastructure
APT • Stuxnet
NPCs
  • Dr. Catherine Walsh (Plant Manager): Responsible for safe plant restart after maintenance, discovering that control systems show anomalous behavior during critical safety testing
  • Robert Chen (Chief Nuclear Officer): Oversees all nuclear safety systems, must balance cybersecurity response with nuclear regulatory requirements and public safety
  • Maria Rodriguez (Control Systems Engineer): Detecting unusual behavior in centrifuge and cooling system controls, realizes sophisticated malware may have compromised industrial safety systems
  • Andrew Thompson (Contractor Supervisor): Leading maintenance team that may have inadvertently introduced attack vector, represents third-party vendor relationships and supply chain security
SECRETS
  • Air-gapped industrial control networks were bridged during maintenance for software updates and diagnostic access
  • Nation-state adversary specifically targeted nuclear facilities during maintenance periods when security is reduced
  • Sophisticated malware uses four zero-day exploits and can manipulate industrial control systems while appearing normal

Planning Resources

Tip📋 Comprehensive Facilitation Guide Available

For detailed session preparation support, including game configuration templates, investigation timelines, response options matrix, and round-by-round facilitation guidance, see:

Stuxnet Power Plant Maintenance Planning Document

Planning documents provide 30-minute structured preparation for first-time IMs, or quick-reference support for experienced facilitators.

Note🎬 Interactive Scenario Slides

Ready-to-present RevealJS slides with player-safe mode, session tracking, and IM facilitation notes:

Stuxnet Power Plant Maintenance Scenario Slides

Press ‘P’ to toggle player-safe mode • Built-in session state tracking • Dark/light theme support

Scenario Details for IMs

Columbia River Power Station: Nuclear Facility Crisis During Maintenance Deadline

Organization Profile

  • Type: Nuclear power generation facility providing baseload electricity for regional power grid serving 2.8 million residents and commercial customers across four-state service area
  • Size: 1,200 employees including 450 reactor operations personnel managing nuclear fuel cycles, cooling systems, and turbine generation on rotating 24/7 shifts, 280 maintenance technicians conducting scheduled equipment inspections and component replacements, 180 instrumentation and control engineers maintaining SCADA systems monitoring reactor parameters, 120 Nuclear Regulatory Commission compliance specialists managing safety documentation and regulatory reporting, 85 security officers enforcing physical protection protocols for nuclear materials, 60 emergency response coordinators maintaining radiological incident preparedness, and 25 executive leadership coordinating utility operations
  • Annual Operations: Generating 1,200 megawatts of carbon-free baseload power providing 15% of regional electricity supply serving 2.8 million residents, operating pressurized water reactor requiring continuous monitoring of core temperature, pressure, coolant flow, and containment integrity through industrial control systems executing safety-critical automation, conducting mandatory 18-month refueling outages requiring temporary reactor shutdown for fuel assembly replacement and safety system testing, maintaining NRC operating license requiring compliance with 10 CFR Part 50 safety regulations and cybersecurity protection standards, coordinating with regional grid operators to ensure power supply reliability during peak demand periods, operating air-gapped SCADA networks physically isolated from external connectivity to protect critical safety systems from cyber threats, and supporting regional economic stability where Columbia River Power Station represents $800 million annual economic impact through employment and tax revenue
  • Current Maintenance Crisis: Scheduled 18-month refueling outage ending in 72 hours—plant must restart operations or regional power grid faces capacity shortages during summer peak demand, but Stuxnet discovery during maintenance threatens both restart timeline and nuclear safety system integrity requiring NRC notification

Key Assets & Impact

Asset Category 1: Maintenance Deadline & Regional Power Grid Stability - 72-hour window to complete refueling and restart reactor, delays create power shortages affecting 2.8 million residents during summer peak demand, grid reliability depends on Columbia River baseload capacity

Asset Category 2: Nuclear Safety System Integrity & Regulatory Compliance - Stuxnet manipulates SCADA controlling reactor safety parameters, compromised instrumentation threatens core temperature monitoring and emergency shutdown systems, NRC license suspension if safety cannot be verified

Asset Category 3: Air-Gapped Network Security & Nation-State Infrastructure Targeting - Maintenance procedures temporarily bridged air-gapped networks enabling Stuxnet infiltration, malware uses four zero-day exploits specifically targeting nuclear facilities, demonstrates nation-state capability for critical infrastructure disruption

Immediate Business Pressure

Monday Morning, 6:00 AM - 72 Hours Until Maintenance Window Closes:

Plant Manager Dr. Robert Martinez discovered Stuxnet malware operating within Columbia River’s industrial control systems during final pre-restart testing. The sophisticated nation-state malware—specifically designed to manipulate nuclear facility SCADA systems—had infiltrated air-gapped networks during maintenance window when contractors temporarily connected diagnostic equipment, compromising reactor monitoring instrumentation and safety automation controlling core cooling parameters.

The scheduled refueling outage must complete in 72 hours. Regional grid operators depended on Columbia River’s 1,200 megawatt baseload capacity to prevent power shortages during summer peak demand affecting 2.8 million residents. Any restart delay created cascading grid instability requiring emergency load shedding and potential rolling blackouts.

But Nuclear Regulatory Commission cybersecurity standards required immediate incident notification for safety system compromise—triggering federal investigation potentially suspending operating license until malware remediation validated and new security controls implemented, guaranteeing missed restart deadline and regional power crisis.

Critical Timeline & Operational Deadlines

  • 18-month refueling outage: Scheduled reactor shutdown for fuel assembly replacement and safety testing
  • Maintenance window: Temporary air-gap bridging for contractor diagnostic equipment and software updates
  • Monday, 6:00 AM (Session Start): Stuxnet discovery during pre-restart safety verification testing
  • Thursday (72 hours): Maintenance window closes, reactor must restart or grid faces capacity shortages
  • Post-discovery: NRC incident notification obligations, federal cybersecurity investigation, safety system validation

Cultural & Organizational Factors

Factor 1: Maintenance window operational pressure created temporary air-gap bridging for contractor equipment access despite cybersecurity protocols

Factor 2: Refueling deadline emphasis prioritized restart schedule over comprehensive SCADA security verification

Factor 3: Physical isolation confidence reduced monitoring for sophisticated malware exploiting maintenance procedures

Factor 4: Regional grid dependency created organizational pressure to complete restart preventing power shortage discussions

Operational Context

Nuclear power facilities operate under Nuclear Regulatory Commission safety framework enforcing reactor protection, radiological containment, and cybersecurity resilience through 10 CFR Part 50 operating license requirements and cybersecurity protection standards—these regulations create absolute safety obligations beyond economic considerations where public protection takes priority over grid reliability or maintenance schedules, with safety system compromise potentially triggering license suspension until NRC validates remediation effectiveness.

Key Stakeholders

Stakeholder 1: Dr. Robert Martinez - Plant Manager Stakeholder 2: Sarah Chen - Chief Nuclear Officer Stakeholder 3: James Williams - Director of Instrumentation and Controls Stakeholder 4: Nuclear Regulatory Commission Regional Inspector

Why This Matters

You’re not just removing SCADA malware from nuclear facilities—you’re determining whether maintenance deadline pressure overrides nuclear safety verification when Stuxnet compromise threatens both regional power grid stability and reactor protection system integrity.

You’re not just meeting grid reliability commitments—you’re defining whether critical infrastructure operators prioritize transparent NRC incident reporting protecting public safety, or delay notifications preserving restart schedules despite safety system compromise.

IM Facilitation Notes

1. Emphasize dual stakes—regional power grid reliability AND nuclear safety system integrity both at risk

2. Make maintenance deadline tangible—72-hour window with 2.8 million residents depending on baseload capacity

3. Use air-gap bridging during maintenance to explore operational security trade-offs in critical infrastructure

4. Present Stuxnet as deliberate nation-state nuclear facility targeting during maintenance vulnerability windows

5. Address nuclear operator responsibility balancing grid reliability against regulatory transparency obligations

6. Celebrate NRC incident reporting prioritizing public safety despite grid disruption and economic impacts

Opening Presentation

“It’s Wednesday morning at Columbia River Power Station, and the annual maintenance outage is in its final phase. Nuclear reactors are offline, safety systems are being tested, and the plant must restart within 72 hours to meet regional power demands. But during routine control system testing, engineers are discovering anomalous behavior in critical safety systems. Preliminary investigation suggests sophisticated malware has somehow penetrated the air-gapped industrial control networks, potentially compromising nuclear safety systems during the most vulnerable maintenance period.”

Initial Symptoms to Present:

Warning🚨 Initial User Reports
  • “Industrial control systems showing subtle anomalies during safety system testing”
  • “Centrifuge and cooling system controls responding differently than expected to operator commands”
  • “Network monitoring detecting unexpected traffic on supposedly air-gapped industrial networks”
  • “Contractor USB drives triggering security alerts when scanned by updated antivirus systems”

Key Discovery Paths:

Detective Investigation Leads:

  • Forensic analysis reveals sophisticated malware designed specifically for industrial control systems
  • USB device examination shows infection vector through contractor maintenance equipment
  • Timeline analysis reveals compromise occurred during maintenance window when air-gap security was reduced

Protector System Analysis:

  • Industrial control system monitoring reveals subtle manipulation of centrifuge speeds and cooling controls
  • Nuclear safety system integrity checks show potential compromise of critical safety functions
  • Network architecture assessment reveals temporary bridging of air-gapped networks during maintenance

Tracker Network Investigation:

  • Traffic analysis reveals covert communication channels established across supposedly isolated networks
  • Command and control analysis shows sophisticated nation-state-level operational security
  • Attribution investigation suggests advanced persistent threat group targeting critical infrastructure

Communicator Stakeholder Interviews:

  • Nuclear engineers report subtle but concerning changes in control system behavior
  • Maintenance contractors explain procedures that may have introduced USB-based infection vectors
  • Regulatory affairs staff describe federal requirements for nuclear incident reporting and response

Mid-Scenario Pressure Points:

  • Hour 1: Nuclear Regulatory Commission inspector arrives for scheduled post-maintenance safety verification
  • Hour 2: Regional power grid operator inquires about plant restart schedule due to increasing electricity demand
  • Hour 3: Control systems engineer reports that centrifuge systems are operating outside normal parameters
  • Hour 4: Plant manager must decide whether to proceed with reactor restart or extend maintenance outage

Evolution Triggers:

  • If malware remains undetected, plant restart could trigger physical damage to critical systems
  • If maintenance deadline is missed, regional power grid faces potential shortages affecting millions
  • If attack attribution involves nation-state adversary, federal counterintelligence and national security agencies become involved

Resolution Pathways:

Technical Success Indicators:

  • Team identifies sophisticated malware and industrial control system compromise
  • Air-gapped network security restored through comprehensive malware removal and system validation
  • Advanced attribution analysis provides intelligence on nation-state threat actor capabilities and objectives

Business Success Indicators:

  • Nuclear safety systems verified clean and functional before reactor restart authorization
  • Plant maintenance schedule adjusted to accommodate cybersecurity response without compromising safety
  • Federal regulatory compliance maintained throughout incident response and recovery process

Learning Success Indicators:

  • Team understands advanced persistent threat capabilities and nation-state attack sophistication
  • Participants recognize critical infrastructure cybersecurity challenges and air-gapped network vulnerabilities
  • Group demonstrates coordination between cybersecurity, nuclear safety, and national security considerations

Common IM Facilitation Challenges:

If Nuclear Safety Context Is Overwhelming:

“The nuclear technical details are complex, but the core question is simple: can the team ensure that control systems are safe and trustworthy before the reactor restarts and begins generating power for millions of people?”

If Nation-State Attribution Is Avoided:

“Your technical analysis suggests this isn’t ordinary cybercrime - the sophistication and targeting suggest state-sponsored activity. How does this change your investigation and response approach?”

If Air-Gapped Network Compromise Is Misunderstood:

“Maria just confirmed that the affected systems were supposed to be completely isolated from any network connections. How did this malware cross the air gap, and what does that tell you about the sophistication of this threat?”

Success Metrics for Session:

Template Compatibility

This scenario adapts to multiple session formats with appropriate scope and timing:

Quick Demo (35-40 minutes)

Structure: 3 investigation rounds, 1 decision round Focus: Core ICS/SCADA compromise discovery and immediate nuclear safety response Simplified Elements: Streamlined nation-state attribution and regulatory compliance complexity Key Actions: Identify malware targeting control systems, implement emergency safety verification, coordinate plant restart decision

Round-by-Round Breakdown:

Setup & Opening (5 minutes): Columbia River Power Station during scheduled annual maintenance outage - plant must restart in 72 hours or region faces power shortages. Engineers discover anomalous control system behavior during critical safety testing. Sophisticated malware penetrated air-gapped ICS through contractor USB drives.

Investigation Round 1 (10 minutes) - “How did malware penetrate air-gapped nuclear control systems?” Detective findings: USB-based infection from maintenance contractors. Protector findings: Air-gapped networks bridged during maintenance for updates. Tracker findings: Attack targeted maintenance window vulnerability. Communicator insights: Contractors inadvertently introduced attack vector. Teaching moment: Maintenance windows reduce security creating exploitation opportunities.

Investigation Round 2 (10 minutes) - “What ICS manipulation threatens nuclear safety?” Detective findings: Malware targets centrifuge and cooling system controls. Protector findings: Safety system compromise discovered during testing. Tracker findings: Nation-state sophistication indicated. Communicator insights: Robert Chen must balance cybersecurity with safety requirements. Teaching moment: ICS malware can manipulate safety-critical systems.

Investigation Round 3 (10 minutes) - “What immediate response ensures safe restart?” Detective findings: Identify nation-state threat indicators. Protector findings: Safety system integrity verification required. Tracker findings: Four zero-day exploits discovered. Communicator insights: NRC compliance necessary. Teaching moment: Nuclear safety prioritizes over operational pressure.

Decision Round (5 minutes) - “Plant restart decision?” Options: Emergency shutdown with complete validation vs. accelerated response vs. selective isolation. Discuss 72-hour deadline, regional power impact, NRC requirements. Debrief: APT capabilities, air-gap vulnerabilities, nuclear safety prioritization.

Lunch & Learn (75-90 minutes)

Structure: 5 investigation rounds, 2 decision rounds Focus: Comprehensive air-gapped network investigation and nuclear safety system validation Added Depth: Contractor supply chain security and maintenance window vulnerabilities Key Actions: Complete forensic analysis of USB-based compromise, coordinate with Nuclear Regulatory Commission, restore industrial control system security with verification

Round-by-Round Breakdown:

Setup & Opening (8 minutes): Full maintenance context - Columbia River Power Station 72 hours from restart deadline. Dr. Catherine Walsh responsible for safe restart discovers control anomalies. Robert Chen balances cybersecurity with NRC requirements. Maria Rodriguez detects unusual centrifuge/cooling behavior. Andrew Thompson leads contractors who may have introduced attack.

Investigation Round 1 (15 minutes) - “How did USB-based attack compromise air-gapped nuclear systems?” Detective: USB infection from contractor diagnostic tools and software updates. Protector: Air-gap temporarily bridged during maintenance for legitimate access. Tracker: Attack timing specifically targeted annual maintenance window when security reduced. Communicator: Contractor procedures explained showing inadvertent introduction vector. Teaching moment: Air-gaps vulnerable when operational needs require removable media and contractor access.

Investigation Round 2 (15 minutes) - “What ICS manipulation threatens nuclear control and cooling systems?” Detective: Malware specifically targets centrifuge speeds and cooling system controls critical for safe reactor operation. Protector: Safety systems showing anomalous responses during post-maintenance testing. Tracker: Nation-state sophistication using four zero-day exploits. Communicator: Nuclear engineers describe safety implications of control system compromise. Teaching moment: ICS malware targets operational technology with safety-critical consequences.

Investigation Round 3 (12 minutes) - “What contractor supply chain security gaps enabled compromise?” Detective: Maintenance contractors using USB drives across multiple nuclear facilities created propagation vector. Protector: Third-party vendor access necessary for maintenance but created security vulnerability. Tracker: Attack demonstrates understanding of nuclear maintenance procedures and contractor workflows. Communicator: Andrew describes vendor security protocols and gaps. Teaching moment: Supply chain security must address contractor access and removable media policies.

Decision Round 1 (8 minutes) - “Immediate containment approach?” Guide toward decision on emergency SCADA isolation vs. phased validation. Discuss NRC inspector arrival, 72-hour deadline pressure, regional power grid dependency.

Investigation Round 4 (12 minutes) - “What NRC compliance and federal coordination is required?” Detective: Federal reporting requirements for nuclear facility cybersecurity incidents. Protector: NRC safety verification protocols before restart authorization. Tracker: FBI notification for nation-state attribution. Communicator: Regulatory compliance staff explain federal coordination complexity. Teaching moment: Nuclear incidents require multi-agency federal coordination balancing safety, security, and operations.

Investigation Round 5 (12 minutes) - “What long-term maintenance security enhancement prevents recurrence?” Detective: Enhanced contractor security protocols and USB device management. Protector: Improved air-gap integrity during maintenance windows. Tracker: Threat intelligence sharing across nuclear industry. Communicator: Industry coordination for supply chain security. Teaching moment: Critical infrastructure protection requires industry-wide coordination and enhanced vendor security.

Decision Round 2 (8 minutes) - “Plant restart and long-term security approach?” Present comprehensive response options balancing safety verification, restart timeline, and security enhancement. Discuss lessons learned for future maintenance windows. Debrief: APT capabilities, air-gap maintenance vulnerabilities, contractor supply chain security, NRC coordination, nuclear safety prioritization, industry security enhancement.

Full Game (120-140 minutes)

Structure: 7 investigation rounds, 3 decision rounds Focus: Complete nation-state critical infrastructure attack investigation with federal coordination Full Complexity: NRC compliance protocols, regional power grid implications, long-term nuclear security enhancement Key Actions: Comprehensive nation-state attribution analysis, coordinate federal counterintelligence response, implement enhanced critical infrastructure protection while maintaining operational capability

Round-by-Round Breakdown:

Setup & Opening (10 minutes): Complete nuclear maintenance crisis - Columbia River Power Station serving 1,200 employees serving regional power grid. Annual maintenance must complete in 72 hours or regional power shortages impact millions. Dr. Walsh discovers control anomalies. Robert Chen coordinates NRC compliance. Maria detects ICS compromise. Andrew’s contractor team may have introduced USB-based attack. Nation-state targeting nuclear maintenance windows.

Invest Round 1 (18 min) - “How did nation-state attack exploit maintenance window vulnerability?” Full forensics of USB contractor vector, air-gap bridging during maintenance, attack timing precision, zero-day exploitation. Teaching: Maintenance windows create planned vulnerability periods requiring enhanced security.

Invest Round 2 (15 min) - “What ICS manipulation targets nuclear safety systems?” Comprehensive analysis of centrifuge and cooling control targeting, safety system manipulation, operational concealment techniques. Teaching: ICS attacks achieve physical objectives through precise OT manipulation.

Invest Round 3 (15 min) - “What supply chain compromise scope affects nuclear industry?” Contractor security across multiple facilities, vendor access protocols, industry-wide vulnerability assessment. Teaching: Supply chain attacks scale across shared vendors and contractors.

Decision Round 1 (12 min) - “Emergency response balancing safety and regional power?” NRC inspector pressure, 72-hour deadline, grid stability requirements. Complete shutdown vs. accelerated response vs. selective isolation.

Invest Round 4 (15 min) - “What federal coordination addresses nation-state critical infrastructure targeting?” NRC protocols, FBI counterintelligence, DHS critical infrastructure protection, multi-agency coordination complexity. Teaching: Nation-state attacks require federal coordination across regulatory, law enforcement, intelligence agencies.

Invest Round 5 (15 min) - “What attribution evidence connects attack to nation-state campaign?” Technical indicators, strategic objectives, capability requirements, geopolitical context analysis. Teaching: Attribution requires analyzing technical and strategic evidence comprehensively.

Decision Round 2 (12 min) - “Regional power grid and federal coordination approach?” Grid operator coordination, federal agency collaboration, public communication strategy.

Invest Round 6 (12 min) - “What OT/IT security convergence protects nuclear facilities?” ICS security requirements, air-gap enhancement, contractor management, continuous monitoring integration. Teaching: Critical infrastructure requires specialized OT security expertise integrated with IT capabilities.

Invest Round 7 (12 min) - “What industry-wide nuclear security enhancement prevents future attacks?” Threat intelligence sharing, maintenance security protocols, vendor requirements, regulatory framework evolution. Teaching: Critical infrastructure protection requires industry coordination and regulatory adaptation.

Decision Round 3 (15 min) - “Comprehensive long-term nuclear security architecture?” Final decision on restart, security transformation, industry coordination, federal partnership. Lessons for critical infrastructure protection. Debrief: Full nation-state APT understanding, maintenance window vulnerabilities, supply chain security, federal multi-agency coordination, OT/IT convergence, industry security enhancement, regional infrastructure interdependency.

Advanced Challenge (150-170 minutes)

Structure: 8-9 investigation rounds, 4 decision rounds Expert Elements: Multi-vector zero-day exploitation analysis, nuclear safety system technical depth, nation-state operational security Additional Challenges: Mid-scenario plant restart deadline pressure, regulatory inspection requirements, public safety communication complexity Key Actions: Complete investigation under nuclear safety constraints, coordinate multi-agency federal response, implement comprehensive critical infrastructure defense architecture while ensuring safe reactor restart

Round-by-Round Breakdown:

Setup & Opening (12 min): Expert-level nuclear maintenance crisis with full technical depth. Columbia River serving regional grid must restart in 72 hours. Dr. Walsh coordinates NRC/federal agencies balancing safety/security. Robert Chen manages nuclear regulatory requirements. Maria discovers sophisticated ICS manipulation. Andrew leads contractors who introduced USB attack. Four zero-day exploits, stolen certificates, detailed SCADA knowledge indicate nation-state targeting critical maintenance windows.

Invest Round 1 (15 min) - “What zero-day exploitation chain enabled air-gap penetration?” MS10-046/061/067 plus Siemens vulnerabilities, USB autorun/LNK exploitation, contractor workflow targeting, certificate-based trust bypass. Teaching: Zero-day chains require millions in development indicating nation-state resources.

Invest Round 2 (15 min) - “How did attackers achieve persistent air-gap access during maintenance?” Rootkit capabilities, kernel-mode drivers, Step 7 project file infection, peer-to-peer update mechanisms, operational security concealment. Teaching: Sophisticated persistence survives across air-gap transitions through operational workflow exploitation.

Invest Round 3 (15 min) - “What precision ICS manipulation threatens nuclear safety and physical equipment?” Frequency converter targeting, centrifuge speed manipulation sequences, cooling system control compromise, SCADA monitoring concealment creating operator blind spots. Teaching: Nation-state ICS attacks achieve physical sabotage through precise OT manipulation while hiding from monitoring.

Decision Round 1 (12 min) - “Emergency nuclear safety response under 72-hour restart pressure?” Introduce NRC inspector discovers investigation during routine verification. Complete shutdown vs. accelerated validation vs. selective isolation. Regional power grid dependency, public safety prioritization, federal reporting requirements.

Invest Round 4 (13 min) - “What supply chain compromise scope extends beyond single facility?” Stolen certificates from Realtek/JMicron affect trust architecture globally, contractor USB propagation across nuclear industry, vendor security infiltration depth, certificate revocation impossible choice. Teaching: Supply chain attacks undermine trust foundations requiring systemic security transformation.

Invest Round 5 (13 min) - “What nation-state attribution connects technical capabilities to strategic objectives?” Targeting pattern analysis, capability requirements, intelligence gathering scope, geopolitical context, strategic timing assessment. Teaching: Attribution synthesizes technical indicators with strategic analysis to identify state actors.

Decision Round 2 (12 min) - “Federal coordination balancing regulatory compliance and counterintelligence?” Introduce regional power grid operator inquires about restart schedule. NRC protocols, FBI investigation, DHS coordination, intelligence sensitivity vs. industry warning requirements.

Invest Round 6 (12 min) - “What OT/IT convergence and ICS security paradigm shift does attack necessitate?” Traditional IT vs. OT security priorities (CIA vs. ARS), air-gap enhancement strategies, application whitelisting for ICS, behavioral anomaly detection, operational technology expertise integration. Teaching: Critical infrastructure requires specialized ICS security discipline converging IT expertise with OT operational knowledge.

Invest Round 7 (12 min) - “What threat detection evolution distinguishes APT from conventional malware?” Signature-based detection failure against zero-days, behavioral analytics requirements, threat hunting methodologies, industrial process monitoring, assume-breach posture. Teaching: Nation-state threats require fundamentally different detection approaching assuming compromise.

Decision Round 3 (12 min) - “Nuclear modernization balancing advancement with threat landscape?” Introduce CEO pressure - can facility operate securely with nation-state threats? IoT/Industry 4.0 implications, vendor security requirements, OT/IT integration strategies, workforce development needs.

Invest Round 8 (12 min) - “What regulatory framework and industry coordination addresses critical infrastructure protection?” NRC cybersecurity rule evolution, nuclear industry ISAC establishment, maintenance security protocol standardization, federal-private partnership models. Teaching: Critical infrastructure protection requires regulatory adaptation and industry-wide coordination beyond individual facility security.

Invest Round 9 (Optional, 10 min) - “What lessons from maintenance-targeted attack inform contemporary operations?” Evolution of maintenance security practices, contractor vetting enhancement, removable media policies, continuous monitoring during vulnerable windows. Teaching: Maintenance windows remain persistent vulnerability requiring specialized security protocols.

Decision Round 4 (15 min) - “Comprehensive restart decision and long-term defense architecture?” Synthesize all investigation insights into final decision. Safe restart verification, security transformation roadmap, industry coordination, federal partnership, public communication strategy. Address how maintenance security lessons apply across critical infrastructure. Debrief: Expert-level nation-state APT capabilities, zero-day exploitation economics, air-gap operational workflow vulnerabilities, precision ICS sabotage achieving physical objectives, supply chain trust architecture compromise, nation-state attribution methodologies, federal multi-agency coordination complexity, OT/IT security convergence, threat detection evolution, regulatory framework adaptation, industry coordination requirements, maintenance window security specialization.

Quick Demo Materials (35-40 min)

Guided Investigation Clues

Progressive hints to maintain engagement and learning momentum:

If team is uncertain where to start investigation:

“Control Systems Engineer Maria Rodriguez has been analyzing the infected systems. She’s discovered that the malware spread across networks that were supposed to be completely air-gapped - physically isolated from any external connections. The only way data moves in or out is through USB drives used by maintenance contractors. What does this tell you about how the attack vector entered the facility?”

Teaching moment: Air-gapped networks provide strong isolation, but they’re vulnerable during maintenance windows when contractors need to update software and perform diagnostics using USB drives that may have been compromised.

If team misses nuclear safety implications:

“Chief Nuclear Officer Robert Chen has reviewed the malware’s behavior. Unlike typical malware that steals data or disrupts operations, this malware is specifically designed to manipulate centrifuge speeds and cooling system controls - the exact systems that must function perfectly for safe reactor operation. What does this specialized targeting tell you about the attacker’s objectives and the potential consequences if the plant restarts while compromised?”

Teaching moment: Nation-state attackers targeting critical infrastructure aim for physical damage to strategic assets, not just data theft. Stuxnet-class malware can cause real-world harm by manipulating industrial processes.

If team overlooks timing significance:

“Plant Manager Dr. Walsh has reviewed the incident timeline. The malware infection occurred precisely during the annual maintenance outage - the one time each year when security is reduced, contractors have extensive access, and safety systems are temporarily bypassed for testing and upgrades. This wasn’t opportunistic - someone planned this attack around the maintenance schedule. How does this change your understanding of the threat sophistication and your response approach?”

Teaching moment: Sophisticated nation-state actors conduct extensive reconnaissance to identify vulnerability windows. Critical infrastructure is most vulnerable during planned maintenance when normal security controls are relaxed to enable necessary work.

Pre-Defined Response Options

Three balanced response approaches with trade-offs:

Option A: Emergency Shutdown & Complete System Validation

  • Action: Extend maintenance outage indefinitely, implement comprehensive malware removal across all industrial control systems, coordinate complete nuclear safety system validation with Nuclear Regulatory Commission before authorizing any reactor restart, accept regional power grid disruption.
  • Pros: Ensures absolute certainty of nuclear safety and control system integrity, provides thorough investigation of nation-state compromise, demonstrates unwavering commitment to public safety, allows comprehensive security architecture redesign.
  • Cons: Extends outage by 2-4 weeks, causes regional power shortages affecting millions of customers, generates significant financial losses and regulatory scrutiny, may trigger emergency power imports and rolling blackouts.
  • Type Effectiveness: Super effective against APT malmon type; complete industrial control system restoration prevents nation-state sabotage and ensures nuclear safety with zero compromise risk.

Option B: Accelerated Parallel Response & Conditional Restart

  • Action: Conduct intensive 48-hour malware removal and system validation using all available resources, implement enhanced monitoring and safety verification protocols, coordinate real-time assessment with NRC for conditional reactor restart authorization while maintaining elevated security posture.
  • Pros: Balances nuclear safety with regional power grid needs, provides compressed but thorough security response, demonstrates agile incident management under pressure, maintains critical infrastructure availability while addressing threat.
  • Cons: Requires extraordinary resource commitment and sustained 24/7 operations, compressed timeline increases risk of incomplete malware removal, maintains some operational uncertainty during restart phase, intensive coordination stress across multiple stakeholder groups.
  • Type Effectiveness: Moderately effective against APT malmon type; addresses immediate nuclear safety concerns while maintaining operational capability, but compressed timeline may not fully eliminate sophisticated nation-state persistence mechanisms.

Option C: Selective System Isolation & Phased Security Recovery

  • Action: Isolate compromised control systems from critical safety functions, implement manual safety verification protocols and redundant monitoring, restart reactor using verified backup control systems while conducting thorough malware investigation on isolated networks, coordinate phased security restoration aligned with power grid requirements.
  • Pros: Maintains nuclear safety through isolation and redundancy, allows regional power restoration within 72-hour deadline, provides time for thorough nation-state threat investigation, demonstrates sophisticated risk management balancing multiple critical priorities.
  • Cons: Operates with partially compromised industrial control systems under enhanced monitoring, requires sustained manual oversight and verification increasing operational complexity, extended security risk window during phased recovery, depends on effectiveness of network isolation measures against sophisticated threat.
  • Type Effectiveness: Partially effective against APT malmon type; addresses immediate safety requirements through isolation and redundancy, but extended presence of nation-state malware creates ongoing reconnaissance risk and potential for escalation if isolation fails.