Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Cyber security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 199 records · Page 11
All sourcesNASA NTRSDOE OSTI
DOE OSTI2015

Measuring Human Performance within Computer Security Incident Response Teams

Human performance has become a pertinent issue within cyber security. However, this research has been stymied by the limited availability of expert cyber security professionals. This is partly attributable to the ongoing workload faced by cyber security professionals, which is compound ed by the limited number of qualified personnel and turnover of personnel across organizations. Additionally, it is difficult to conduct research, and particularly, openly published research, due to the sensitivity inherent to cyber ope rations at most organizations. As an alternative, the current research has focused on data collection during cyber security training exercises. These events draw individuals with a range of knowledge and experience extending from seasoned professionals to recent college graduates to college students. The current paper describes research involving data collection at two separate cyber security exercises. This data collection involved multiple measures which included behavioral performance based on human - machine transactions and questionnaire - based assessments of cyber security experience.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2019

Methodology Development for Cybersecurity Robustness and Vulnerability Assessment of University Research Reactors

In 2012, the U.S. Nuclear Regulatory Commission (NRC) formed a working group in collaboration with the Test, Research and Training Reactors (TRTR) group to review cyber security programs at US nuclear nonpower reactor (NPR) facilities. Following their review of cyber security at four different university NPR (i.e. university research reactor (URR)) facilities, the NRC staff made recommendations for improvements at URR including 1) augmenting the URR licensees’ understanding of the protective features provided with their physical security systems, 2) educating URR facility staff on cyber security issues, and 3) developing guidance to help the URR facilities maintain adequate cyber security going forward. This three-year project to develop and implement a cyber-security risk assessment methodology and defense-in-depth mitigation strategy for application at URR facilities provides solutions effectively addressing each of the recommendations given in the NRC review referenced above. In support of this project, cyber security documentation and guidance from the NRC, Department of Homeland Security (DHS) Industrial Control Systems (ICS) Cyber Emergency Response Team (CERT), National Institute of Standards and Technology (NIST), and the International Atomic Energy Agency (IAEA), were reviewed. Most of this documentation did not take the unique resources, configuration, and infrastructure associated with URR facilities into account. The NRC-TRTR effective practices document provides useful guidance for implementing cyber security protections at URR, but lacks a structured framework for systematically auditing facility digital control assets (DCA) and evaluating associated cyber threats, vulnerabilities, and risk. The outcomes from this project, therefore, seek to build on the general resources above by providing a straightforward DCA auditing and risk assessment methodology, as well as mitigation strategies, that may be implemented to address the risk of cyber-attack at URR facilities.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2014

Development and Demonstration of a Security Core Component

In recent years, the convergence of a number of trends has resulted in Cyber Security becoming a much greater concern for electric utilities. A short list of these trends includes: · Industrial Control Systems (ICSs) have evolved from depending on proprietary hardware and operating software toward using standard off-the-shelf hardware and operating software. This has meant that these ICSs can no longer depend on “security through obscurity. · Similarly, these same systems have evolved toward using standard communications protocols, further reducing their ability to rely upon obscurity. · The rise of the Internet and the accompanying demand for more data about virtually everything has resulted in formerly isolated ICSs becoming at least partially accessible via Internet-connected networks. · “Cyber crime” has become commonplace, whether it be for industrial espionage, reconnaissance for a possible cyber attack, theft, or because some individual or group “has something to prove.” Electric utility system operators are experts at running the power grid. The reality is, especially at small and mid-sized utilities, these SCADA operators will by default be “on the front line” if and when a cyber attack occurs against their systems. These people are not computer software, networking, or cyber security experts, so they are ill-equipped to deal with a cyber security incident. Cyber Security Manager (CSM) was conceived, designed, and built so that it can be configured to know what a utility’s SCADA/EMS/DMS system looks like under normal conditions. To do this, CSM monitors log messages from any device that uses the syslog standard. It can also monitor a variety of statistics from the computers that make up the SCADA/EMS/DMS: outputs from host-based security tools, intrusion detection systems, SCADA alarms, and real-time SCADA values – even results from a SIEM (Security Information and Event Management) system. When the system deviates from “normal,” CSM can alert the operator in language that they understand that an incident may be occurring, provide actionable intelligence, and informing them what actions to take. These alarms may be viewed on CSM’s built-in user interface, sent to a SCADA alarm list, or communicated via email, phone, pager, or SMS message. In recognition of the fact that “real world” training for cyber security events is impractical, CSM has a built-in Operator Training Simulator capability. This can be used stand alone to create simulated event scenarios for training purposes. It may also be used in conjunction with the recipient’s SCADA/EMS/DMS Operator Training Simulator. In addition to providing cyber security situational awareness for electric utility operators, CSM also provides tools for analysts and support personnel; in fact, the majority of user interface displays are designed for use in analyzing current and past security events. CSM keeps security-related information in long-term storage, as well as writing any decisions it makes to a (syslog) log for use forensic or other post-event analysis.

Turke, Andy↗
NASA NTRS2017

Managing Cyber Risk: from the Ground to the Air and Beyond Out There

Experts from the aerospace sector with the focus of presenting current state-of-the-art in aviation cyber security and discussing major challenges, requirements, and developments. A variety of topics will be addressed by the panel, including: Aviation cyber security regulations, standards, and best practices Aviation information sharing and analysis challenges Aircraft systems and avionics cyber security challenges Airline and airport stakeholder cyber perspectives CNSATM cyber security challenges UAS cyber security and privacy requirements Military aviation cyber security issues in the NAS

Davis, Jerry L.↗
DOE OSTI2017

Characterizing cyber tools for monitoring power grid systems: what information is available and who needs it?

Abstract—The power grid is a complex, interconnected system that requires the coordination of multiple entities ensure the reliability of the system. System operators must be aware of the impacts of various natural and man-made contingencies through telemetry from their control systems, and they must also be aware of the integrity and availability of the cyber assets on their systems. A team of researchers from PNNL and INL have conducted a series of observations and interviews at power utilities to identify what information needs to be available for both control room dispatchers and cyber security analysts to maintain situation awareness of cyber security to effectively monitor the cyber assets on utility control systems. The researchers interviewed and observed control room dispatchers and spoke with regional control system engineers and cyber security analysts to define the context in which such information would be used. The results of this work will inform the design of a tool that will enhance cyber situation awareness and help facilitate effective communication between the various roles and organizations with utility and other regional authorities during contingencies. Index Terms—

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Wintap

Wintap is an extensible, general purpose agent framework for the Windows operating system. It provides an easy-to-use plugin architecture, an integrated streaming analytics engine, and real-time event subscriptions for host-based data. Wintap can support a wide variety of applications across production operations, cyber security operations, and cyber security research.

Frye, DavidJ↗
DOE OSTI2014

Project Boeing SGS (Final Report)

Boeing and its partner, PJM Interconnection, teamed to bring advanced “defense-grade” technologies for cyber security to the US regional power grid through demonstration in PJM’s energy management environment. Under this cooperative project with the Department of Energy, Boeing and PJM have developed and demonstrated a host of technologies specifically tailored to the needs of PJM and the electric sector as a whole. The team has demonstrated to the energy industry a combination of processes, techniques and technologies that have been successfully implemented in the commercial, defense, and intelligence communities to identify, mitigate and continuously monitor the cyber security of critical systems. Guided by the results of a Cyber Security Risk-Based Assessment completed in Phase I, the Boeing-PJM team has completed multiple iterations through the Phase II Development and Phase III Deployment phases. Multiple cyber security solutions have been completed across a variety of controls including: Application Security, Enhanced Malware Detection, Security Incident and Event Management (SIEM) Optimization, Continuous Vulnerability Monitoring, SCADA Monitoring/Intrusion Detection, Operational Resiliency, Cyber Range simulations and hands on cyber security personnel training. All of the developed and demonstrated solutions are suitable for replication across the electric sector and/or the energy sector as a whole. Benefits identified include; Improved malware and intrusion detection capability on critical SCADA networks including behavioral-based alerts resulting in improved zero-day threat protection; Improved Security Incident and Event Management system resulting in better threat visibility, thus increasing the likelihood of detecting a serious event; Improved malware detection and zero-day threat response capability; Improved ability to systematically evaluate and secure in house and vendor sourced software applications; Improved ability to continuously monitor and maintain secure configuration of network devices resulting in reduced vulnerabilities for potential exploitation; Improved overall cyber security situational awareness through the integration of multiple discrete security technologies into a single cyber security reporting console; Improved ability to maintain the resiliency of critical systems in the face of a targeted cyber attack of other significant event; Improved ability to model complex networks for penetration testing and advanced training of cyber security personnel

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2016

Operationally-Relevant Cyber Situational Awareness Tool Development.

Research was undertaken to gain an understanding of the interplay between cyber security professionals and the software tools utilized in performing their jobs. Substantial investments are devoted to purchasing and developing software tools targeting cyber security operations. However, development is largely based on anecdotal knowledge concerning the work processes, cognitive demands, and the needs and requirements of cyber security analysts. The current study first characterized the workflow of a Cyber Security Incidence Response (CSIRT) team, including their use of software tools, and instantiated this workflow within a simulation model. Next, data was collected during cyber security training exercises reflecting the use of software tools. It was discovered that while cyber security professionals rely heavily on specialized software tools, their jobs require that they effectively integrate the use of specialized software tools with the use of general- purpose software tools.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2018

Nuclear Power Plant Simulation and Cybersecurity

Critical infrastructure protection is vital to the day-to-day operation of any country, and those systems need to be protected to the fullest extent possible. As with what was seen in Ukraine in late 2016, with the cyber attack on the power grid, these systems are susceptible to attacks that can cause serious damage, both physically and economically. This incident shut down the power grid for 6 hours, with nearly 80,000 people affected. Cyber security can be referred to as the protection of data and systems in networks, both wired and wireless, from unauthorized access or attack. In nuclear power plants, assessments of cyber security are critical to ensuring the safe and reliable operation of the systems used. According to the Nuclear Regulatory Commission (NRC), the purpose of cyber security assessments is to detect and then eliminate or mitigate vulnerabilities in the digital system that could be exploited either from outside or inside the digital system protected area. These cyber security assessments are essentially intended to reduce cyber security risk. The NRC refers to cyber security risk as the combination of the consequence to the nuclear power plant and the susceptibility of a digital system to internal and external cyber attack.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2023

Flexible visualization of a 3rd party Intrusion Prevention (Security) tool: A use case with the ELK stack

A difficult aspect of cyber security is the ability to achieve automated real time intrusion prevention across various sets of systems. To this extent, several companies are offering comprehensive solutions that leverage an "accuracy of scale" and moving much of the intelligence and detection on the Cloud, relying on an ever-growing set of data and analytics to increase decision accuracy. Often, they provide tools to visualize the decision workflows in attack prevention (as well as tune the algorithm) but those solutions are not always practical as companies see the problem as "global" that is, from a unified Cyber-security standpoint. However, a key to a successful Cyber-security program is transparency and trust: from an experimental team viewpoint, this specifically means having the ability to immediately see what and from where, who has been blocked and being able to inform the community in case of a revoked access without the need for filing a "ticket" (that may eventually be answered) – in other words, rapid response to their user-base is essential but solutions targeting "sub-groups" in an organization are not often available. We have come up with a versatile solution leveraging the ELK stack (Elasticsearch, Logstash, & Kibana) and an IPS (Intrusion Prevention System) based WAF (Web Application Firewall) from Signal Sciences. Signal Science allows the streaming of detailed logs in a Logstash format suitable for custom solutions for visualization. By combining these two tools, we have strengthened our security posture and enabled individual experiments to monitor their own traffic. Specifically, the IPS WAF provides unique data such as country of origin, protocol, response code, source IP, and paths accessed. In this contribution, we will show how we engineered a visualization solution so experiment groups could access a dashboard with predefined graphs but also, where they can create individual customizable dashboards used to display blocked traffic and troubleshoot latency issues. We will discuss the details and procedures for developing and configuring these tools and how it benefits cyber security postures across our scientific based environment.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
DOE OSTI2016

Final LDRD Report: Using Linkography of Cyber Attack Patterns to Inform Honeytoken Placement

The war to establish cyber supremacy continues, and the literature is crowded with strictly technical cyber security measures. We present the results of a three year LDRD project using Linkography, a methodology new to the field of cyber security, we establish the foundation necessary to track and profile the microbehavior of humans attacking cyber systems. We also propose ways to leverage this understanding to influence and deceive these attackers. We studied the science of linkography, applied it to the cyber security domain, implemented a software package to manage linkographs, generated the preprocessing blocks necessary to ingest raw data, produced machine learning models, created ontology refinement algorithms and prototyped a web application for researchers and practitioners to apply linkography. Machine learning produced some of our key results: We trained and validated multinomial classifiers with a real world data set and predicted the attacker's next category of action with 86 to 98% accuracy; dimension reduction techniques indicated that the linkography-based features were among the most powerful. We also discovered ontology refinement algorithms that advanced the state of the art in linkography in general and cyber security in particular. We conclude that linkography is a viable tool for cyber security; we look forward to expanding our work to other data sources and using our prediction results to enable adversary deception techniques.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

A Four-Layer Cyber-Physical Security Model for Electric Machine Drives Considering Control Information Flow

Despite the IEEE Power Electronics Society (PELS) establishing Technical Committee 10 on Design Methodologies with a focus on the cyber-physical security of power electronics systems, a holistic design methodology for addressing security vulnerabilities remains underdeveloped. This gap largely stems from the limited integration of computer science and power/control engineering studies in this interdisciplinary field. Addressing the inadequacy of unilateral cyber or control perspectives, this article presents a novel four-layer cyber-physical security model specifically designed for electric machine drives. Central to this model is the innovative control information flow (CIF) model, residing within the control layer, which serves as a pivotal link between the cyber layer's vulnerable resources and the physical layer's state-space models. By mapping vulnerable resources to control variable space and tracing attack propagation, the CIF model facilitates accurate impact predictions based on tainted control laws. The effectiveness and validity of this proposed model are demonstrated through hardware experiments involving two typical cyber-attack scenarios, underscoring its potential as a comprehensive framework for multidisciplinary security strategies.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2016

Identification of Significant NPP Cyber-Attack Scenarios based on Risk Information

For the last decades, analog instrumentation and control (I and C) systems have been replaced with digital systems in nuclear power plants (NPPs). While there are various advantages of the digital technology for the plant safety, new threats have been introduced such as cyber security. In fact, there have been cyber-attacks on nuclear facilities adopting digital systems. The cyber-attack on the Iran nuclear facility is a typical example which shows the possibility of a cyber-attack on safety critical infrastructures with intra-network. Cyber security has been introduced as one of the significant issues for NPP safety and recently its importance has been more highlighted, but the research in this field is not mature yet. Moreover, there is not much information about cyber security of NPPs. In this work, as a fundamental research for risk evaluation of cyber-attacks, a method to identify significant cyber-attack scenarios on NPPs was proposed based on the probabilistic risk assessment (PRA) method which is widely used for evaluating the safety of NPPs. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2021

Hardware-in-the-Loop Testbed for Cyber-Physical Security of Photovoltaic Farms

In the last decades, modem grids with distributed energy resources, such as photovoltaic (PV) farms, are increasingly vulnerable to cyber-attacks that seriously affect the stability and performance of the power system. While cyber-physical security of smart grids is extensively studied, most of the existing work focuses on the grid level and neglects the modeling and features of device-level power electronics converters (PECs). Furthermore, establishing a high-fidelity simulation testbed that can simulate harmonic frequencies of the PV farm is in urgent need. In this paper, a high-fidelity and real-time hardware-in- the-loop testbed is built to simulate the harmonics of power electronics converters for cyber-physical security of PEC-enabled PV farms. Based on this testbed, the impact of typical cyber-attacks and physical faults on the PV converter can be analyzed, thus providing a foundation for cyber-attack detection, root cause diagnosis, and resilient control to mitigate the adverse effects of cyber-attacks.

14 SOLAR ENERGY↗
DOE OSTI2014

Centralized Cryptographic Key Management and Critical Risk Assessment - (CRADA Final Report)

The Department of Energy Office of Electricity Delivery and Energy Reliability (DOE-OE) Cyber Security for Energy Delivery Systems (CSEDS) industry led program (DE-FOA-0000359) entitled "Innovation for Increasing Cyber Security for Energy Delivery Systems (12CSEDS)," awarded a contract to Sypris Electronics LLC to develop a Cryptographic Key Management System for the smart grid (Scalable Key Management Solutions for Critical Infrastructure Protection). Oak Ridge National Laboratory (ORNL) and Sypris Electronics, LLC as a result of that award entered into a CRADA (NFE-11-03562) between ORNL and Sypris Electronics, LLC. ORNL provided its Cyber Security Econometrics System (CSES) as a tool to be modified and used as a metric to address risks and vulnerabilities in the management of cryptographic keys within the Advanced Metering Infrastructure (AMI) domain of the electric sector. ORNL concentrated our analysis on the AMI domain of which the National Electric Sector Cyber security Organization Resource (NESCOR) Working Group 1 (WG1) has documented 29 failure scenarios. The computational infrastructure of this metric involves system stakeholders, security requirements, system components and security threats. To compute this metric, we estimated the stakes that each stakeholder associates with each security requirement, as well as stochastic matrices that represent the probability of a threat to cause a component failure and the probability of a component failure to cause a security requirement violation. We applied this model to estimate the security of the AMI, by leveraging the recently established National Institute of Standards and Technology Interagency Report (NISTIR) 7628 guidelines for smart grid security and the International Electrotechnical Commission (IEC) 63351, Part 9 to identify the life cycle for cryptographic key management, resulting in a vector that assigned to each stakeholder an estimate of their average loss in terms of dollars per day of system operation. To further address probabilities of threats, information security analysis can be performed using game theory implemented in dynamic Agent Based Game Theoretic (ABGT) simulations. Such simulations can be verified with the results from game theory analysis and further used to explore larger scale, real world scenarios involving multiple attackers, defenders, and information assets. The strategy for the game was developed by analyzing five electric sector representative failure scenarios contained in the AMI functional domain from NESCOR WG1. From these five selected scenarios, we characterized them into three specific threat categories affecting confidentiality, integrity and availability (CIA). The analysis using our ABGT simulation demonstrated how to model the AMI functional domain using a set of rationalized game theoretic rules decomposed from the failure scenarios in terms of how those scenarios might impact the AMI network with respect to CIA.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2017

Demand Response and Smart Buildings: A Survey of Control, Communication, and Cyber-Physical Security

In this paper, we perform a comprehensive survey of the technical aspects related to the implementation of demand response and smart buildings. Specifically, we discuss various smart loads such as heating, ventilating, and air-conditioning (HVAC) systems and plug-in electric vehicles (PEVs); the power architecture with multibus characteristics; different control algorithms such as the hybrid centralized and decentralized control and the distributed coordination among buildings; the communication technologies and network architectures; and the potential cyber-physical security issues and possible mechanisms for enhancing the system security at both cyber and physical layers. Finally, the current status of the demand response in United States, Europe, Japan, and China is reviewed, and the benefits, costs, and challenges of implementing and operating demand response and smart buildings are also discussed.

42 ENGINEERING↗
DOE OSTI2018

Stream-Processing Architecture for Real-time Cyber-physical Security (SPARCS) v0.9

The Stream-Processing Architecture for Real-time Cyber-physical Security is a generalized framework for extracting power-related sensor information from sensors, optionally analyzing that data on computing platforms local to the sensors, transmitting that information to a central location, storing that information, running centralized analytics on the information, and providing both API and visual access to that information.

Mcparland, Charles McparlandP↗