Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “software vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 235 records · Page 13
All sourcesNASA NTRSDOE OSTI
NASA NTRS2017

Preliminary Investigation of Impact of Technological Impairment on Trajectory-Based Operations

The Next Generation Air Transportation System (NextGen) incorporates collaborative air traffic management and Trajectory-Based Operations (TBO) in order to significantly increase the capacity, efficiency, and predictability of operations in the National Airspace System (NAS), without decreasing safety. This is enabled by airspace users and service providers sharing knowledge about operations that allows prediction of the complete 4D flight trajectory with as little uncertainty as possible. Additionally, new software and hardware technology is critical to reaching NextGen goals, especially with regard to TBO. What if the technologies that are critical for TBO were to be impaired or fail completely? Should there be a malfunction of a piece of the technology, it must be ensured that the whole system does not break down completely or suffer severe impairment. Instead, operations need to be maintained proportionally to the problem and safety needs to be ensured (graceful degradation). This paper proposes a systematic framework to investigate the vulnerability of TBO to technology disruption, and determine the impact of technological impairment on TBO. Two representative technologies are chosen for detailed investigation and the impact of their impairment on the degradation of TBO is illustrated using a weather-related scenario. XXXX There are several possible directions of future work. We believe it is desirable to develop methods to quantitatively assess the impact of technological disruption on TBO and to have the simulation tools to validate the impact. The availability of prognostics and health management methods could be leveraged to predict technological failure/disruption, thus predicting how TBO will be a ected, and possibly pro-actively mitigating the impact. It is important to develop large-scale scenarios where the e ect of technological impairment is prominent, and identify methods to quantitatively assess the extent of TBO degradation. An important goal of such an investigation is the development of failure-resistant resilient trajectory-based oper- ations. Resilience14, 15 is the property of a system to \bounce back" and resume at least a signi cant portion of its functionalities after degradation due to technological impairment(s). A systems resilience includes properties such as \bu ering capacity" (quantifying disruptions the system can absorb or adapt to without a fundamental breakdown in performance or in the systems structure), \ exibility" (ability to restructure itself in response to external changes or pressures), "margin" (how closely the system is currently operating rela- tive to one or another kind of performance boundary), \tolerance" (whether the system gracefully degrades as stress/pressure increase, or collapses quickly when pressure exceeds adaptive capacity), etc. Future work needs to focus on quantifying and improving the resilience of TBO, and identifying resilient design solutions for aviation.

TBO↗
NASA NTRS2014

IT Security Support for the Spaceport Command Control System Development

My job title is IT Security support for the Spaceport Command & Control System Development. As a cyber‐security analyst it is my job to ensure NASA's information stays safe from cyber threats, such as, viruses, malware and denial-of-service attacks by establishing and enforcing system access controls. Security is very important in the world of technology and it is used everywhere from personal computers to giant networks ran by Government agencies worldwide. Without constant monitoring analysis, businesses, public organizations and government agencies are vulnerable to potential harmful infiltration of their computer information system. It is my responsibility to ensure authorized access by examining improper access, reporting violations, revoke access, monitor information request by new programming and recommend improvements. My department oversees the Launch Control System and networks. An audit will be conducted for the LCS based on compliance with the Federal Information Security Management Act (FISMA) and The National Institute of Standards and Technology (NIST). I recently finished analyzing the SANS top 20 critical controls to give cost effective recommendations on various software and hardware products for compliance. Upon my completion of this internship, I will have successfully completed my duties as well as gain knowledge that will be helpful to my career in the future as a Cyber Security Analyst.

IT Security↗
DOE OSTI2020

Accelerating Hanford Site Cleanup through Operations Research Modeling - 20238

The Hanford Site cleanup effort will require the integration of dozens of unique facilities and processes, many of which will be first-of-a-kind in implementation and design. Each facility will be governed by its own set of operating logic, configured with a unique array of unit operations, and subject to a set of constraints that will affect its behavior. The collection of facilities have multiple points of interface, making the operations of any one facility potentially significant to the operations of other up- or downstream processes. It is therefore highly desirable to accurately predict these operations, as it allows for Site officials to identify and preempt bottlenecks and vulnerabilities before they unexpectedly inhibit the cleanup mission. With the quantity and complexity of the processes that will be on Site, building a pen-and-paper or even a spreadsheet-assisted model of the cleanup mission quickly becomes overwhelming in scope and inaccurate in execution. The Engineering organization for the Site's Tank Operations Contract (TOC) has therefore implemented the use of operations research (OR) modeling to simulate and predict future operations of Site facilities. These models are created using a discrete event simulation tool that allows for the development of detailed, versatile, and robust models. Not only can these models account for complex logical behaviors, but they can also simulate process details down to the level of vessel sizing, labor utilization, equipment reliability, and resource availability. To date, the TOC has developed OR models for several facilities on Site, including for single-shell tank (SST) farms, double-shell tank (DST) farms, the Effluent Treatment Facility (ETF), and the waste transfer system. These models have focused on identifying bottlenecks and operational constraints, and have been used to quantify the effects of implementing process changes. This latter point is particularly valuable, as it allows for several alternatives to be studied in a virtual setting before committing resources to making a change in the field. The decision to develop OR models has gained tremendous support from the Site's stakeholders and the U.S. Department of Energy (DOE) management, and has prompted the use of the tool to support additional internal and external initiatives. Recently, an initiative was proposed to use the models to help identify and provide quantitative backing for risks and opportunities for the TOC. This application of OR could not only help inform how the TOC manages its risks (e.g. quantities and types of spare parts), but could also help drive process improvements whose benefits might otherwise be hard to quantify. The models have also been used to drive the TOC's cloud computing, artificial intelligence (AI), and machine learning (ML) initiatives. These initiatives will not only improve the ability of the TOC to more rapidly respond to the needs of its customers, but it will also aid in the ability of the TOC to analyze and improve the processes it studies. Partnership with two external software development and consulting companies (Lanner and Ynformed) has furthered not only the application of AI and ML within the TOC, but has also spurred the development of new/improved software tools and platforms used by the companies. These partnerships have proven to be mutually beneficial and productive, and have set a precedent for the types of gains that can be made by exploring such options. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
NASA NTRS2019

NASA IV&V's Cyber Range for Space Systems

A cyber range is a virtual environment that is used for cyberwarfare training and cyber technology development. It provides tools that help strengthen the stability, security and performance of cyber infrastructures and IT systems. NASA IV&V has created an adaptable virtual environment that is representative of a typical NASA mission system of systems environment that serves multiple purposes: Training of network defenders. Ability to perform simulated red vs blue training events. Ability to deploy mission specific technologies in a cyber contested environment. Ability to demonstrate vulnerabilities and their impact to ground and space systemsThe overall system is comprised of more than 70 virtual machines and physical infrastructure to demonstrate real-world cyber attacks against: email users, wireless networks, and physically implanted devices with command and control call-back. The cyber range was built to emulate a NASA precipitation satellite infrastructure.This presentation will give an overview of the virtual cyber range and how it was used to conduct a simulate red vs blue exercise with the goal of compromising the simulated spacecraft that utilizes real NASA flight software.

test and evaluation DT&E↗
DOE OSTI2017

Multi-Scenario Use Case based Demonstration of Buildings Cybersecurity Framework Webtool

The purpose of this paper is to demonstrate the cybersecurity and software capabilities of Buildings Cybersecurity Framework (BCF) webtool. The webtool is designed based on BCF document and existing NIST standards. It’s capabilities and features are depicted through a building usecase with four different investment scenarios geared towards improving the cybersecurity posture of the building. BCF webtool also facilitates implementation of the goals outlined in Presidential Executive Order (EO) on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure (May 2017. In realization of the EO goals, BCF includes five core elements: Identify, Protect, Detect, Respond, and Recover, to help determine various policy and process level vulnerabilities and provide mitigation strategies. With the BCF webtool, an organization can perform a cybersecurity self-assessment; determine the current cybersecurity posture; define investment based goals to achieve a target state; connect the cybersecurity posture with business processes, functions, and continuity; and finally, develop plans to answer critical organizational cybersecurity questions. In this paper, the webtool and its core capabilities are depicted by performing an extensive comparative assessment over four different scenarios.

Gourisetti, Sri Nikhil G.↗
DOE OSTI2022

Cyber risk assessment and investment optimization using game theory and ML-based anomaly detection and mitigation for wide-area control in smart grids

The electric power grid is increasingly becoming susceptible to cyber attacks that exploit vulnerabilities in the smart grid control, information, and physical layers. Successful cyber attacks can have catastrophic impacts on the social and economic well-being of any nation all over the globe. It has, thus, become imperative to secure the smart grid against such adversarial actions to ensure stable, secure, and reliable operation of the grid. The existing research and industry practices prove to be inadequate in terms of providing pragmatic and effective defense methodologies and measures for long-term cybersecurity planning and real-time cybersecurity for grid operation. For example, existing works lack models that incorporate uncertain behavior of cyber-attackers and pragmatic defense measures for cyber risk assessment and cybersecurity investment optimization which often provide unreliable and strictly qualitative solutions to these problems. At the same time, with the growing number of cyber incidents in the grid, there still exists a need to develop attack-resilient algorithms for wide-area monitoring, protection, and control (WAMPAC) applications like the wide-area voltage control systems (WAVCS) for Flexible AC Transmissions Systems (FACTS) that lack in scalable and feasible solutions from the cybersecurity perspective. This dissertation proposes novel models and methodologies for: (1) Cybersecurity planning, and (2) Cybersecurity for system operation. The cybersecurity planning is achieved through cyber risk assessment and cybersecurity resource investment optimization for long-term cybersecurity of the grid using game theory and attack-defense trees. Cybersecurity for system operation consists of development of cyber anomaly detection and mitigation algorithms for flexible AC transmission system (FACTS) controller-based wide-area voltage control systems (WAVCS) using machine learning (ML), and software defined networking-based moving target defense network routing for achieving real-time cyber-physical security for grid operations. This is followed by hardware-in-the-loop (HIL) implementation and evaluation of these attack prevention, detection, and mitigation algorithms and methodologies showcasing their feasibility in a close to real-world environment. For cybersecurity planning, a novel approach involving a combination of game theory and attack defense trees (ADT) for optimal cybersecurity resource allocation in the smart grid is proposed. This methodology involves modeling of the cyber-physical smart grid substations as ADTs, defining attacker costs, defense costs, and attack probabilities for attack access points. Using game theoretical formulation, optimal defense strategies for the defender of the system to invest cybersecurity resources in the grid are obtained. Additionally, a game-theoretic framework is developed for quantitative cyber-physical risk assessment of the grid under a dynamically changing cyber threat space and uncertain behavior of cyber attackers which is further used to optimize investments in the smart grid's cybersecurity resources. The attacker, defender, and the smart grid system are modeled while incorporating attacker-stochasticity and federal guidelines for smart grid cybersecurity. This allows quantification of threat, vulnerabilities, and attack impact of the grid for quantitative risk assessment. The defender's budget to invest in the security resources in the grid is optimized based on the strategies leading to minimum system risk. The evaluation of the proposed solutions highlight the feasibility for practical implementation of these methodologies and algorithms in the smart grid, while taking the federal requirements and guidelines for smart grid security into consideration. For achieving cybersecurity for system operation, attack prevention, detection, and mitigation algorithms and methodologies are developed specifically for FACTS-based WAVCS. Anomaly detection and mitigation in the WAVCS are achieved using algorithms based on machine learning which involves offline training and testing of ML models with CPS datasets incorporating physics-based features that allow accurate distinction between system faults and cyber attacks. For attack prevention, a methodology based on software defined network (SDN)-based moving target defense (MTD) network routing is proposed that enables prevention of Denial of Service (DoS) type attacks on the smart grid communication system. Subsequently, these methodologies and algorithms are implemented and evaluated on an HIL testbed that allows for real-time attack prevention, detection, and mitigation of emulated cyber attacks on the WAVCS in a close to real-world environment. The results show highly accurate and efficient performance of the implemented algorithms and methodologies with the smart grid system operating within the NERC's system operation limits even in the presence of DoS and data integrity cyber attacks. This work opens up future research opportunities in other directions such as (1) Expanding cybersecurity planning methodologies to real-time cyber contingency analysis with different game formulations; and (2) Applying the cybersecurity for system operation algorithms to broader categories of wide-area control applications.

24 POWER TRANSMISSION AND DISTRIBUTION↗
NASA NTRSDate not supplied

Assessing Alaskan boreal forest landcover affected by climate-wildfire interactions from ground truth surveys and NASA airborne remote sensing

Alaska’s boreal forest is facing unprecedented challenges under rapid climate warming (increasingly severe fires, droughts, pest/disease outbreaks) that may destabilize its function as a global carbon sink. Forests near Fairbanks may be especially vulnerable, impacting air quality and ecosystem services. We combined GT (ground truthing) with Airborne Visible InfraRed Imaging Spectrometer (AVIRIS-NG) images collected by the NASA Arctic-Boreal Vulnerability Experiment (ABoVE) program (2017-2019) to assess landcover change at five recently burned sites (2001-2019) of different fire severities and moisture regimes within 30 miles of Fairbanks. GT included tree seedling counts, understory % cover and >50% leaf canopy color assessment. 36 circular plots (1/30 ha radius) including 6 moderate to severely burned plots were selected across sites. 31 additional sites including 12 burned sites were geotagged in photos. AVIRIS images were processed from 29 spectral bands selected to identify changes in chlorophyll and water content. Images were segmented into natural boundaries (polygons) using ENVI 5.5 software. A spectral library of 8 AVIRIS bands with high between-class/low within-class variation was used in two random forest models to predict vegetation classes (model 1: 12 classes, model 2: 14 classes) in each AVIRIS scene, using 20% of the data as training data. Model 2 classified 20% more polygons overall, but only 42% of GT/geotagged polygons were correctly classified by both models. More forest sites were correctly classified (63%) than open vegetation (32%) or post-fire sites (46%). 50% of aspen forest and post-fire polygons were misclassified as shrubland. GT revealed that post-fire plots supported 134,000 (± 48,000) tree seedlings and saplings ha-1 (0.2 - 4 m height, 64% deciduous) versus 2500 (± 2100) shrubs ha-1 (1-6 m height). > 50% canopy browning was observed in conifer forest (8 plots) with no signs of insect infestation. Canopy herbivory > 50% (leaf miner, leaf beetle) and moose herbivory of tree bark was seen across aspen sites. Our study suggests: 1) low canopy vegetation presents challenges for improved landcover classification, and 2) aspen forest should be differentiated in vegetation maps which would aid in tracking herbivory.

Alaska↗
DOE OSTI2016

Water Network Tool for Resilience Version 0.1

Water utilities are vulnerable to a wide variety of human-caused and natural disasters. These disruptive events can result in loss of water service, contaminated water, pipe breaks, and failed equipment. Furthermore, long term changes in water supply and customer demand can have a large impact on the operating conditions of the network. The ability to maintain drinking water service during and following these types of events is critical. Simulation and analysis tools can help water utilities explore how their network will respond to disruptive events and plan effective mitigation strategies. The U.S. Environmental Protection Agency and Sandia National Laboratories are developing new software tools to meet this need. The Water Network Tool for Resilience (WNTR, pronounced winter) is a Python package designed to help water utilities investigate resilience of water distribution systems over a wide range of hazardous scenarios and to evaluate resilience-enhancing actions. The following documentation includes installation instructions and examples, description of software features, and software license. It is assumed that the reader is familiar with the Python Programming Language.

42 ENGINEERING↗
DOE OSTI2019

Coherency-Based Detection Algorithm for Synchrophasor Cyberattacks

The wide area monitoring system (WAMS) is critical for power system situational awareness, but represents a growing cybersecurity vulnerability. Malicious adversaries may seek to compromise one or more PMUs in order to effect control decisions that unnecessarily disrupt typical grid operations. One example of a particularly pernicious attack vector is the spoofing or replaying of a fault event using one or more compromised PMUs. This work documents the development and validation of a coherency-based cyberattack detection algorithm that integrates a sliding-window singular value decomposition (SVD) with physics-based partitioning analysis to achieve accurate classification of events. Special consideration is given to discerning a sophisticated fault-replay or fault spoofing attack from actual faults. A software-based cybersecurity testbed has been developed for rigorous testing of the algorithm. The algorithm is further validated using simulated synchrophasor datasets obtained from a MinniWECC 63-bus test system. Results show that the algorithm can successfully detect fault-replay attacks even when over half of the PMUs are compromised.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

On the Limits of EM Based Detection of Control Logic Injection Attacks In Noisy Environments

The difficulty in applying traditional security mechanisms in Industrial Control System (ICS) environments makes a large portion of these mission-critical assets vulnerable to cyber attacks. Therefore, there is a dire need for the development of novel security mechanisms specifically designed to protect such critical systems. Recently a lot of attention has been given to mechanisms that exploit the EM emanations of devices for defense purposes. Such practices may lead to the development of robust external and non-intrusive anomaly detection systems. Nevertheless, the majority of current work in the area neglects to consider the implications of real-life environments, particularly environmental noise. In this work, we explore the limits of EM-based anomaly detection towards identifying injection attacks in control logic software in noisy environments. Our study conducted upon both synthetically generated and real signals identified that indeed environmental noise might significantly degrade the accuracy of the anomaly detection process. Experiments done upon synthetic data indicated that assuming that signals are captured with high sampling rates, even minor code injections can be detected with above-90% accuracy in noisy environments where SNR is up to -2dB. This is true even if naive detection methods are considered. Moreover, experiments done using a real-life testbed attest that even single-instruction injections can be detected with near-perfect accuracy in relatively clean environments. Finally, noise-elimination techniques can drastically improve the reliability of the detection mechanism even in noisy environments.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2014

Water Security Toolkit User Manual Version 1.2.

The Water Security Toolkit (WST) is a suite of open source software tools that can be used by water utilities to create response strategies to reduce the impact of contamination in a water distribution network . WST includes hydraulic and water quality modeling software , optimizati on methodologies , and visualization tools to identify: (1) sensor locations to detect contamination, (2) locations in the network in which the contamination was introduced, (3) hydrants to remove contaminated water from the distribution system, (4) locations in the network to inject decontamination agents to inactivate, remove, or destroy contaminants, (5) locations in the network to take grab sample s to help identify the source of contamination and (6) valves to close in order to isolate contaminate d areas of the network. This user manual describes the different components of WST , along w ith examples and case studies. License Notice The Water Security Toolkit (WST) v.1.2 Copyright c 2012 Sandia Corporation. Under the terms of Contract DE-AC04-94AL85000, there is a non-exclusive license for use of this work by or on behalf of the U.S. government. This software is distributed under the Revised BSD License (see below). In addition, WST leverages a variety of third-party software packages, which have separate licensing policies: Acro Revised BSD License argparse Python Software Foundation License Boost Boost Software License Coopr Revised BSD License Coverage BSD License Distribute Python Software Foundation License / Zope Public License EPANET Public Domain EPANET-ERD Revised BSD License EPANET-MSX GNU Lesser General Public License (LGPL) v.3 gcovr Revised BSD License GRASP AT&T Commercial License for noncommercial use; includes randomsample and sideconstraints executable files LZMA SDK Public Domain nose GNU Lesser General Public License (LGPL) v.2.1 ordereddict MIT License pip MIT License PLY BSD License PyEPANET Revised BSD License Pyro MIT License PyUtilib Revised BSD License PyYAML MIT License runpy2 Python Software Foundation License setuptools Python Software Foundation License / Zope Public License six MIT License TinyXML zlib License unittest2 BSD License Utilib Revised BSD License virtualenv MIT License Vol Common Public License vpykit Revised BSD License Additionally, some precompiled WST binary distributions might bundle other third-party executables files: Coliny Revised BSD License (part of Acro project) Dakota GNU Lesser General Public License (LGPL) v.2.1 PICO Revised BSD License (part of Acro project) i Revised BSD License Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of Sandia National Laboratories nor Sandia Corporation nor the names of its con- tributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IM- PLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL SANDIA CORPORATION BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUD- ING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ii Acknowledgements This work was supported by the U.S. Environmental Protection Agency through its Office of Research and Development (Interagency Agreement # DW8992192801). The material in this document has been subject to technical and policy review by the U.S. EPA, and approved for publication. The views expressed by individual authors, however, are their own, and do not necessarily reflect those of the U.S. Environmental Protection Agency. Mention of trade names, products, or services does not convey official U.S. EPA approval, endorsement, or recommendation. The Water Security Toolkit is an extension of the Threat Ensemble Vulnerability Assessment-Sensor Place- ment Optimization Tool (TEVA-SPOT), which was also developed with funding from the U.S. Environ- mental Protection Agency through its Office of Research and Development (Interagency Agreement # DW8992192801). The authors acknowledge the following individuals for their contributions to the devel- opment of TEVA-SPOT: Jonathan Berry (Sandia National Laboratories), Erik Boman (Sandia National Laboratories), Lee Ann Riesen (Sandia National Laboratories), James Uber (University of Cincinnati), and Jean-Paul Watson (Sandia National Laboratories). iii Acronyms ATUS American Time-Use Survey BLAS Basic linear algebra sub-routines CFU Colony-forming unit CVAR Conditional value at risk CWS Contamination warning system EA Evolutionary algorithm EDS Event detection system EPA U.S. Environmental Protection Agency EC Extent of Contamination ERD EPANET results database file GLPK GNU Linear Programming Kit GRASP Greedy randomized adaptive sampling process HEX Hexadecimal HTML HyperText markup language INP EPANET input file LP Linear program MC Mass consumed MILP Mixed integer linear program MIP Mixed integer program MSX Multi-species extension for EPANET NFD Number of failed detections NS Number of sensors NZD Non-zero demand PD Population dosed PE Population exposed PK Population killed TAI Threat assessment input file TCE Tailed-conditioned expectation TD Time to detection TEC Timed extent of contamination TEVA Threat ensemble vulnerability assessment TSB Tryptic soy broth TSG Threat scenario generation file TSI Threat simulation input file VAR Value at risk VC Volume consumed WST Water Security Toolkit YML YAML configuration file format for WST iv Symbols Notation Definition Example { , } set brackets { 1,2,3 } means a set containing the values 1,2, and 3. [?] is an element of s [?] S means that s is an element of the set S . [?] for all s = 1 [?] s [?] S means that the statement s = 1 is true for all s in set S . P summation P n i =1 s i means s 1 + s 2 + * * * + s n . \ set minus S \ T means the set that contains all those elements of S that are not in set T . %7C given %7C is used to define conditional probability. P ( s %7C t ) means the prob- ability of s occurring given that t occurs. %7C ... %7C cardinality Cardinality of a set is the number of elements of the set. If set S = { 2,4,6 } , then %7C S %7C = 3. v

Klise, Katherine A.↗
DOE OSTI2016

Cybersecurity Assessment Methodology for International Safeguards

International nuclear safeguards are technical measures implemented by the International Atomic Energy Agency (IAEA) to verify the correctness and completeness of declarations made by States about their nuclear activities. The systems used to verify such activities include electronic and digital hardware and software components capable of data collection, processing, analysis, storage and transmission. Despite increasing efforts to protect digital systems against unauthorized access or attack through cybersecurity measures, these systems are not immune to cyber exploitation that could compromise their integrity or reliability. Previous versions of these systems did not include capabilities that exist today, such as BluetoothTM and GPS. The inclusion of these new capabilities, as well as new data processing and storage mechanisms, adds new attack vectors and opportunities for adversaries to exploit the devices that did not previously exist. As mentioned in the above referenced Cybersecurity for Safeguards study, cyber-domain vulnerabilities present risks to the equipment used to perform the international nuclear safeguards mission. The IAEA has produced guidance on the protection of nuclear facilities and their computer systems against cyber threats, but these documents do not specifically address the risks to safeguards or safeguards equipment. In response, the U.S. Department of Energy National Nuclear Security Administration (DOE/NNSA) Office of International Nuclear Safeguards/Safeguards Technology Development (NA-241) sponsored Sandia National Laboratories (Sandia, SNL) and the Idaho National Laboratory (Idaho, INL) to conduct a one-year study to evaluate cyber related vulnerabilities in safeguards equipment and develop recommendations for the mitigation of any identified risks.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

A Cybersecurity Threat Profile for a Connected Lighting System

In anticipation of improved energy performance and cost savings, cities and building owners are increasingly considering “smart lighting initiatives” that aim to convert their collection of simple luminaires (i.e., lighting fixtures) into an intelligent connected lighting system (CLS) capable of remotely monitoring energy consumption and fault conditions, and possibly implementing adaptive lighting schemes. The U.S. Department of Energy (DOE) has set an national goal of tripling the energy efficiency and demand flexibility of the buildings sector by 2030, relative to 2020 levels 1. It is forecast that connected lighting systems can contribute to that goal by delivering 125 TWh of annual energy savings by 2035 2, equivalent to the annual output of 50 typical (500 MW) power plants. However, these energy savings and the DOE goal are put at significant risk if connected technologies are not adopted due to real or perceived cybersecurity concerns. Connected IoT devices such as these have historically been rife with vulnerabilities which sometimes put security considerations secondary to functionality and operability. What are the cybersecurity threats that will impact these systems, as formerly banal luminaires transition into intelligent connected devices that collect information about themselves, their surrounding environment, and possibly us? In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement. Fifty-seven threats were identified. Among our key findings: (1) 65% (37/57) of the threats did not involve the luminaires, but rather the other components needed to communicate with and manage them; (2) 63% (36/57) of the threats could have been mitigated through manufacturer-implemented defensive techniques or “controls”; and (3) 23% (13/57) of the threats were dependent on the network configuration. Recommendations based on the results of this work are made to key stakeholder groups. Notably, lighting technology developers are advised to address all threats that can be reasonably controlled with baked-in technology solutions (e.g., encryption or authentication controls), and employ some form of secure supply chain management and tracking where other parts (e.g., sensors, microprocessors) of a luminaire must also be built and manufactured with the proper security controls in place. Developers should also review threats involving assets not developed in-house to understand how connectivity with other devices will affect their product during system operation and determine if a compensating control for a defense-in-depth strategy will be needed. Finally, those interested in deploying CLS should compare the differences between cloud and on-premise models to determine which is more suitable for their needs and the abilities of their security team.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2026

Validating a Dynamic PWR Safety and Security Model?

Nuclear power plants (NPPs) are assessed for safety and security using separate models that cannot capture how an attacker's decisions and a plant's response unfold together in real time, leaving regulators and operators without a complete picture of true plant vulnerability. Traditional probabilistic risk assessment (PRA) methods treat adversarial events as fixed initiators with predetermined outcomes, and are structurally incapable of representing the time-dependent interplay between physical security events, safety system response, and operator mitigative actions. At Idaho National Laboratory (INL), I contributed to the development and validation of Modeling and Analysis for Safety and Security using the Dynamic EMRALD Framework (MASS-DEF). Where static PRA relies on event-tree logic that cannot evolve mid-scenario, MASS-DEF couples a time-dependent dynamic PRA tool EMRALD (Event Modeling Risk Assessment using Linked Diagrams) with attack simulation software, allowing attacker behavior, plant system states, and operator actions to interact across time. My work focused on validating a general Pressurized Water Reactor (PWR) model. I traced model logic against PWR plant to identified errors in logic and confirm accuracy. I then built and tested attack scenarios against a general PWR model to verify that the model produced expected outcomes across all logical pathways. I also contributed a section to a related technical paper applying the same EMRALD platform to radiation dose modeling. Results show that MASS-DEF can quantitatively demonstrate that many plants exceed their regulatory security thresholds. This demonstrated margin provides a technically defensible basis for reducing the number of guards without compromising regulatory compliance. Physical security costs represent roughly 10% of annual operating budgets, making such reductions directly meaningful to INL's mission of sustaining existing commercial NPPs. This internship strengthened my understanding of nuclear systems, probabilistic modeling, and technical writing, and has solidified my pursuit of a career at a national laboratory.

98 - NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL↗
NASA NTRS2013

IT Security Support for Spaceport Command and Control System

During the fall 2013 semester, I worked at the Kennedy Space Center as an IT Security Intern in support of the Spaceport Command and Control System under the guidance of the IT Security Lead Engineer. Some of my responsibilities included assisting with security plan documentation collection, system hardware and software inventory, and malicious code and malware scanning. Throughout the semester, I had the opportunity to work on a wide range of security related projects. However, there are three projects in particular that stand out. The first project I completed was updating a large interactive spreadsheet that details the SANS Institutes Top 20 Critical Security Controls. My task was to add in all of the new commercial of the shelf (COTS) software listed on the SANS website that can be used to meet their Top 20 controls. In total, there are 153 unique security tools listed by SANS that meet one or more of their 20 controls. My second project was the creation of a database that will allow my mentor to keep track of the work done by the contractors that report to him in a more efficient manner by recording events as they occur throughout the quarter. Lastly, I expanded upon a security assessment of the Linux machines being used on center that I began last semester. To do this, I used a vulnerability and configuration tool that scans hosts remotely through the network and presents the user with an abundance of information detailing each machines configuration. The experience I gained from working on each of these projects has been invaluable, and I look forward to returning in the spring semester to continue working with the IT Security team.

computer security↗
DOE OSTI2020

Technical Resilience Navigator

The Technical Resilience Navigator (TRN) is a systematic approach to identifying vulnerabilities with energy and water systems, and prioritizing solutions that reduce risk. The ultimate outcome of the TRN is a set of actionable resilience solutions that address the site's most important gaps in resilience and enhance the ability to maintain mission continuity. The TRN is designed to step users through this planning process, providing a framework to: assign roles and responsibilities; collect and document information and data; document key inputs and outputs for each of the TRN modules (Site Level Planning, Baseline Development, Risk Assessment, Solution Development, and Solution Prioritization); document prioritized list of resilience solutions; and track progress through the entire process. Currently "software as a service" at the listed website.

Rotondo, Julia↗
DOE OSTI2022

Prioritizing ICS Beachhead Systems for Cyber Vulnerability Testing

Cyber Testing for Resilient Industrial Control Systems™ (CyTRICS™) is the Department of Energy’s (DOE’s) program for cybersecurity vulnerability testing, digital subcomponent enumeration, and forensic assessment. CyTRICS leverages best-in-class test facilities and analytic capabilities at six DOE National Laboratories and strategic partnerships with key stakeholders including technology developers, manufacturers, asset owners and operators, and interagency partners. During the program’s development, CyTRICS established a unique methodology for prioritizing digital components within operational technology (OT) and industrial control systems (ICS) in the Energy Sector Industrial Base (ESIB) for cyber vulnerability testing. The CyTRICS Prioritization Process leverages multiple characteristics of systems, components, and their contextual deployment to calculate a quantification of individual digital components for CyTRICS testing. The initial version of the CyTRICS Prioritization Process was premised largely upon the impact which could result to an industrial control system if the digital component under testing was compromised, either through malicious means, faulty engineering, or other modes. The worldwide compromise of the SolarWinds Orion platform, first reported in December 2020, through malicious interference with the digital patching cycle was a watershed event in cyber supply chain security. The SolarWinds compromised demonstrated the strategic importance of certain types of ubiquitous software, and the ability to generate widespread cybersecurity effects. To address this challenge and as a part of the Department of Energy’s response to the SolarWinds compromise, DOE’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) directed the National Laboratories to evolve the CyTRICS Prioritization Process methodology to encompass additional factors related to the strategic importance of digital components. CESER directed CyTRICS researchers to identify, characterize, and append strategic factors to the CyTRICS Prioritization Process to provide additional weight to these characteristics. National Laboratory expert researchers identified functionality, distribution, and platform characteristics for digital components in ICS and OT that they assessed would be likely targeted in strategic initial-access cyber attack. CyTRICS has termed these factors “ICS Beachhead Systems,” leveraging a definition first advanced by Schneider Electric, which is intended as a blanket term to encompass digital components, products, and systems in OT. This paper describes the ICS Beachhead Systems identified and the rationale for inclusion. As a next step in the research and refinement process, the National Laboratories will validate this initial set of characteristics against digital components evaluated by the CyTRICS program and current implementation of the CyTRICS Prioritization Process. After validation, CyTRICS researchers will then develop a scoring methodology to generate a quantitative score to assess the degree to which a digital component is characterized as an ICS Beachhead System. Finally, the National Laboratories will append this scoring to the existing CyTRICS Prioritization Process algorithm.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2021

Power Operations of the Mars Exploration Rovers

The rovers of the National Aeronautics and Space Administration’s (NASA) Mars Exploration Rovers (MER) project, Spirit (MER-A) and Opportunity (MER-B), safely landed on the surface of Mars three weeks apart during January 2004. Spirit and Opportunity were built and operated by the Jet Propulsion Laboratory (JPL), which is managed by the California Institute of Technology (Caltech) for NASA. Spirit landed at Gusev Crater, 14.8 degrees south of the equator, and operated continuously on the surface of Mars from January 4, 2004 until last contact from Spirit on March 22, 2010. Opportunity landed at Meridiani Planum, a location 2.5 degrees south of the Martian equator. Opportunity operated continuously on the Martian surface from January 25, 2004 until the last received transmission from Opportunity on June 10, 2018. The goal of the MER project was to determine if Mars ever had a habitable environment, in particular, if it ever had water. During their missions, both Spirit and Opportunity found evidence that liquid water once flowed on the surface of Mars. Both Spirit and Opportunity used a 1.33 m2 triple-junction solar array as their power sources. Based on observations of the original Mars rover, the Sojourner rover of the Mars Pathfinder mission that landed on Mars on July 4, 1997, the expectation was that the Martian dust would rapidly accumulate on the solar arrays of Spirit and Opportunity, and that the rovers would not have enough energy to continue operations after 90 Martian days (sols). Instead, due in part to lower dust accumulation rates than expected and numerous dust cleaning events, the Spirit and Opportunity rovers continued to operate on the Martian surface for over 2000 sols (MER-A) and 5000 sols (MER-B), respectively. During this time, the rovers experienced multiple Martian winters and several dust storms. Because the sources of solar array energy loss were known, the solar array energy output offered a method to scientifically estimate the loading and aeolian removal of dust from the solar arrays each sol. The MER Power operations team called this value that they calculated the solar array Dust Factor (DF). Dust Factor was defined as the fraction of sunlight that penetrates the accumulated dust on the surface of the solar array. A Dust Factor of 1.0 would indicate that the solar array was perfectly clean. A Dust Factor of 0.6 would indicate that only 60% of the available sunlight was able to penetrate the accumulated dust on the solar arrays. The MER Power subsystem operations team used the Multi-Mission Power Analysis Tool (MMPAT) to perform these Dust Factor calculations. The MMPAT software tool modeled the behavior of the solar arrays and the batteries as they interacted with the spacecraft power loads over the mission timeline. MMPAT also had knowledge (through telemetry and user inputs) of telemetered Power subsystem voltages and currents, atmospheric opacity (Tau), rover surface location, rover attitude, the planetary tilt and distance of Mars from the sun based on day of year, the instantaneous elevation of the sun based on time of day, temperatures (internal and external), terrain masking, and shadowing (due to the camera mast and antennas). Once all of the known sources of array energy loss are accounted, the remaining difference between the expected array energy and the actual array energy determines the solar array Dust Factor. The assumptions made while determining the Dust Factor are 1) that the single measured atmospheric opacity value (Tau) is constant over the course of the entire sol, 2) there is no measurable solar cell degradation, 3) there are no shorted strings and therefore, 4) all unexpected solar array energy losses are due to accumulated dust on the solar array. Although it cannot provide an absolute measure of dust loading, the determination of solar array Dust Factor provides a useful way of tracking dust accumulation and aeolian dust removal trends on Martian spacecraft. Any spacecraft on the Martian surface is vulnerable to dust, especially solar-powered spacecraft. The Spirit and Opportunity rovers were operational on the Martian surface for much longer than expected due in part to aeolian removal of dust from their solar arrays. The first few dust removal events were a pleasant surprise to the MER operations teams; however, over time a pattern began to arise. In over three Mars Years on the surface, the Power operations team tracked the solar array Dust Factor at Gusev Crater (location of MER-A) and observed that there were several significant dust removal and deposition events in Mars Year (MY) 27, even in the absence of a large dust storm. In MY 28 at Gusev Crater, the large atmospheric opacity (Tau) increase lagged significant dust removal events. Overall at Gusev Crater, there was a pattern of steady dust accumulation on the solar arrays, with a small number of significant dust cleaning events. At Meridiani Planum, where Opportunity rover operated for over seven Mars Years (late MY 26 to mid MY 34), a clear and consistent pattern of dust movement emerged. Meridiani Planum had a predictable, seasonally dependent pattern of gradual and continuous dust accumulation and removal. In summary, this paper explains the reasons for the development of the solar array Dust Factor and how it was used in mission operations. In particular, this paper describes the MMPAT software package, how it models array energy, including the important assumptions, model inputs and sources of error. And finally, this paper will show how the calculated solar array Dust Factor was used at Gusev Crater and Meridiani Planum to predict dust accumulation rates and weather patterns, and the importance of this generated data set for current and future solar- powered missions to Mars, such as the InSight lander and the planned Mars Sample Return rover.

Chin, Keith B.↗