Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “vulnerability assessment”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

Towards Automated Assessment of Vulnerability Exposures in Security Operations

Current approaches for risk analysis of software vulnerabilities using manual assessment and numeric scoring do not complete fast enough to keep pace with the maintenance work rate to patch and mitigate the vulnerabilities. This paper proposes a new approach to modeling software vulnerability risk in the context of the network environment and firewall configuration. In the approach, vulnerability features are automatically matched up with networking, target asset, and adversary features to determine whether adversaries can exploit a vulnerability. The ability of adversaries to reach a vulnerability is modeled by automatically identifying the network services associated with vulnerabilities through a pipeline of machine learning and natural language processing and automatically analyzing network reachability. Our results show that the pipeline can identify network services accurately. We also find that only a small number of vulnerabilities pose real risks to a system. However, if left unmitigated, adversarial reach to vulnerabilities may extend to nullify the effect of firewall countermeasures.

Huff, Philip↗
DOE OSTI2024

Interdisciplinary Approaches to Cyber-vulnerability Impact Assessment for Energy Critical Infrastructure

As energy infrastructure becomes more interconnected, understanding cybersecurity risks to production systems requires integrating operational and computer security knowledge. We interviewed 18 experts working in the field of energy critical infrastructure to compare what information they find necessary to assess the impact of computer vulnerabilities on energy operational technology. These experts came from two groups: 1) computer security experts and 2) energy sector operations experts. We find that both groups responded similarly for general categories of information and displayed knowledge about both domains, perhaps due to their interdisciplinary work at the same organization. Yet, we found notable differences in the details of their responses and in their stated perceptions of each group’s approaches to impact assessment. Their suggestions for collaboration across domains highlighted how these two groups can work together to help each other secure the energy grid. Our findings inform the development of interdisciplinary security approaches in critical-infrastructure contexts.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Assessing the vulnerability of solar inverters to EMPs: Port testing, PCI modeling, and protection strategies

Renewable energy sources are becoming an ever-larger contributor to the power grid. These renewable energy sources depend upon the power electronic devices, specifically inverters, being essential for connecting Photovoltaic (PV) generation to the grid. However, the Electromagnetic Pulses (EMPs) caused by the high-altitude nuclear explosions can generate fast broad-band pulses with nanosecond rise time, potentially causing damage or destruction to electronic components. To assess the vulnerability of PV inverters to high-altitude EMPs, the port testing and Pulsed Current Injection (PCI) modeling schemes are proposed based on the port impedance analysis. Wide-band frequency measurements are achieved by fusing impedance results from three vector network analyzers. Then, a PCI model is used to simulate the induced response to EMP, with two typical immunity levels of EC5 and EC8 tested. Here, the experiment successfully excites the induced voltage and current under EMP, where the voltage and current can reach 1500V/40A and 8000V/150Aunder EC5 andEC8, respectively. The port vulnerability analysis results demonstrate that only some ports can survive under EC5. To defend against the impact of EMP, three protection strategies are discussed.

42 ENGINEERING↗
DOE OSTI2023

MARVEL 90% Final Design Report

This document provides documentation of the Microreactor Applications Research Validation and Evaluation Project’s (MARVEL) 90% Final Design, as required by U.S. Department of Energy (DOE) Standard-1189, “Integration of Safety into the Design Process." Per DOE-STD-1189-2016, the 90% Final Design documentation focuses on design completion, at a level capable of supporting procurement, construction, testing, and operation. At this phase, the design organization finalizes the hazards and accident analyses, Fire Hazard Analysis (FHA), security vulnerability assessments, and other supporting analyses for design completion. The objective of this report is to provide a high-level summary of the design thus far and provide references including, but not limited to, the following design deliverables: • Complete final drawings, specifications and commercial grade dedications that may be released for bid and/or construction. • Clearly defined testing plans for the safety and functionality of all subsystems. • Quality Assurance Program for Design, Testing and Procurement. • Software Quality Assurance Plan. • Code of Record (COR), applicable design requirements including codes and standards. • Final design that meets all the requirements stipulated in the COR. • Final design review, consisting of final validation of comment resolution from previous reviews, and a review of any additional developments since the last review. • Updated Safety Design Strategy. • Hazard Analysis. • Fire Hazard Analysis. • Accident analysis. • Security vulnerability assessment. • Current and detailed cost estimate. • Current construction schedule, and • Risk & Opportunities Assessment.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2023

Community Resilience Indicator Analysis: Commonly Used Indicators from Peer-Reviewed Research (Updated for Research Published 2003-2021)

In 2017, FEMA’s National Integration Center (NIC) Technical Assistance (TA) Branch identified a need to establish a data-driven basis for prioritizing locations for TA investment and guiding local emergency management planning. To achieve this goal, FEMA tasked Argonne National Laboratory (Argonne) with identifying commonly used indicators of community resilience across the landscape of published peer-reviewed research. FEMA and Argonne completed the first Community Resilience Indicator Analysis (CRIA) in 2018 and repeated the process in 2022. The CRIA process begins with a literature review and cataloguing of published peer-reviewed assessment methodologies on social vulnerability and community resilience. The literature review findings are then filtered by inclusion criteria established by the CRIA research team to ensure the methodologies are: (1) Quantitative, (2) Data and methodology are publicly available, (3) Calculated at the county level or lower, (4) Examine generalized hazard risk (rather than a singular hazard), and (5) Focused on pre-disaster community conditions. After this, the research team identifies the commonly used indicators across these methodologies and selects the best data source for each indicator. Finally, the research team bins the data for visual display, conducts a correlation analysis and creates a composite index, the FEMA Community Resilience Index (FEMA CRI). In 2018, the CRIA identified eight resilience and vulnerability assessment methodologies and 20 commonly used indicators (indicators used in three or more of the eight methodologies). The FEMA CRI in 2018 was created from these 20 indicators and was produced for at the county level. The 2022 CRIA updated the literature review to expand the list of methodologies examined and followed the same process, resulting in an analysis of 14 methodologies published between 2003 and 2021 and 22 indicators identified as commonly used (indicators used in five or more of the 14 methodologies). In 2022, the research team produced the FEMA CRI at the county and the census tract levels. To make the CRIA data more accessible and more actionable, each individual indicator and the FEMA CRI is binned and included in FEMA’s Resilience Analysis and Planning Tool (RAPT). RAPT enables emergency managers and community partners to quickly visualize relative differences in potential resilience by county, tribe and census tract. By reviewing the data for each of these 22 indicators individually, emergency managers can gain insights for targeted outreach strategies, planning, mitigation investments and response and recovery operations. Communities, regional governments and others can use this data to better understand potential challenges to resilience. As the social science field of examining and validating indicators of resilience evolves, FEMA will update RAPT to provide emergency managers and community partners with additional data and tools to inform planning, mitigation, response and recovery. It is important to understand that the role of the emergency manager is not to change or to “improve” the data, but to plan appropriately for the community characteristics reflected in the data. These datasets are community characteristics that researchers have identified as important considerations for resilience. For example, people with disabilities may have greater challenges to be resilient to disasters. If a community has a high population of people with disabilities, the emergency manager(s) may need to create tailored preparedness outreach programs and strategies to ensure those residents have support if evacuation is necessary. Rather than label these indicators as an absolute measure of resilience, FEMA considers “potential challenges to resilience” a better frame to understand these indicators. Everyone is vulnerable to disasters. While scholars theorize that certain characteristics may make an individual or a household more socially vulnerable, the data does not reflect measures that individuals and/or communities have taken to address potential challenges, such as emergency management planning and outreach or household preparedness measures. To aid emergency managers in understanding how to use these indicators, calling them potential challenges to resilience supports a more positive and strategic application of the data in all phases of emergency management.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2022

Development of a vadose zone advanced monitoring system: Tools to assess groundwater vulnerability

Performing repeat pore-fluid sampling over long time-scales can provide valuable information on unsaturated zone contaminants and their potential flux to ground water. This information can be used to manage groundwater remedies and identify contaminants that need to be sequestered in the vadose zone to minimize flux to ground water. Pore-water samples are commonly used to obtain contaminant concentrations within the vadose zone, but existing methods are limited as they only provide a single sample at one location and time. The vadose zone advanced monitoring system (VZAMS) has been designed to integrate multiple technologies into a single down-borehole system that allows for sampling of pore fluids (liquid and gas) to provide information about contamination and hydraulic conditions at multiple depths (~0.3-m intervals) within a cased borehole. Testing has been completed at the laboratory scale to verify the sampling elements of VZAMS, including geochemical testing for representative contaminants known to exist at the Hanford Site, located in southeastern Washington State. Physical tests focused on the ability of the sampler to draw fluid under unsaturated conditions. Initial geochemical testing showed that the stainless steel material used with the porous cuff may affect the sampled concentrations of redox-sensitive contaminants under very dry conditions. Additional laboratory testing demonstrated that the VZAMS components are able to collect representative samples for substances of interest under expected field conditions. In this paper, the design and functionality of a novel instrument are demonstrated in support of subsequent testing in the field.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

Strategic roadmap to assess forest vulnerability under air pollution and climate change

Abstract Although it is an integral part of global change, most of the research addressing the effects of climate change on forests have overlooked the role of environmental pollution. Similarly, most studies investigating the effects of air pollutants on forests have generally neglected the impacts of climate change. We review the current knowledge on combined air pollution and climate change effects on global forest ecosystems and identify several key research priorities as a roadmap for the future. Specifically, we recommend (1) the establishment of much denser array of monitoring sites, particularly in the South Hemisphere; (2) further integration of ground and satellite monitoring; (3) generation of flux‐based standards and critical levels taking into account the sensitivity of dominant forest tree species; (4) long‐term monitoring of N, S, P cycles and base cations deposition together at global scale; (5) intensification of experimental studies, addressing the combined effects of different abiotic factors on forests by assuring a better representation of taxonomic and functional diversity across the ~73,000 tree species on Earth; (6) more experimental focus on phenomics and genomics; (7) improved knowledge on key processes regulating the dynamics of radionuclides in forest systems; and (8) development of models integrating air pollution and climate change data from long‐term monitoring programs.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Assessing the Vulnerability of Unmanned Aircraft Systems to Directed Acoustic Energy

The increasingly large payloads of Unmanned Aircraft Systems (UASs) are exponentially increasing the threat to the nuclear enterprise. Current mitigation using RF interference is effective, but not feasible for fully autonomous systems and is prohibited in many areas. A new approach to UAS threat mitigation is needed that does not create radio interference but is effective against any type of vehicle. At the present time there is no commercial counter-UAS system that directly assaults the mems gyros and accelerometers in the Inertial Measurement Unit on the aircraft. But lab testing has revealed resonances in some IMUs that make them susceptible to moderate amplitude acoustic monotones. Sandia's energetic materials facility has enabled a quick and thorough exploration of UAS vulnerability to directed acoustic energy by using intense acoustic impulses to destabilize or down a UAS. We have: 1) detonated/deflagrated explosive charges of various sizes; 2) accurately measured impulse pressure and pulse duration; 3) determined what magnitude of acoustic insult to the IMU disrupts flight and for how long and; 4) determined if the air blast/shock wave on aircraft/propellers disrupts flight.

42 ENGINEERING↗
DOE OSTI2020

Lac du Flambeau - Climate Change Resilience Initiative (Final Report)

The goals of this project were to create a comprehensive Environmental Resiliency Plan and to increase the capacity of all Lac du Flambeau Tribal Program Managers to incorporate environmental impact thinking into the everyday management of their departments. Environmental Resiliency Planning utilized current Tribal documents, which include the Integrated Resource Management Plan (IRMP), the Lac du Flambeau Tribal Emergency Management Plan (EMP), and the Lac du Flambeau Strategic Energy Plan, as guidance throughout the process. A vulnerability assessment initiated our technical process and allowed us to identify, quantify, and prioritize (or rank) the vulnerabilities in our system. This set the stage for a reduction and resilience plan as well as providing insight for revisions of existing management plans such as the Energy and Integrated Resources Management Plans

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2021

A Functional All-Hazard Approach to Critical Infrastructure Dependency Analysis

The critical infrastructures protection landscape is a vast and varied pattern of independent, but interconnected infrastructure systems that are essential to the function of our modern society. The U.S. policy on critical infrastructure protection has been continually evolving since the “President’s Commission on Critical Infrastructure Protection” was published in 1997. In response to these policies, federal, state, and local governments, along with research institutions, have invested a substantial amount of time and effort into identifying and analyzing critical infrastructure, their functions, and dependencies/interdependencies to better understand their vulnerabilities. To date, the ability to assess vulnerabilities, resiliency, and priorities for protecting interdependent critical infrastructure systems from an all-hazards perspective remains a difficult problem. In this paper we introduce the All-Hazards Analysis (AHA) methodology, which provides an integrated functional basis across infrastructure systems, through the implementation of a common language and a scalable level of decomposition to effectively evaluate the resilience of interconnected infrastructure systems. AHA models infrastructure systems as directed multidimensional graphs, which enable the evaluation of cross-sector interdependencies prior to, during, and after disruptive events. Finally, and by design, AHA enables the cross linking of data taxonomies to enable more effective data sharing, such as the National Critical Functions (NCF) and Infrastructure Data Taxonomy (IDT).

02 PETROLEUM↗
DOE OSTI2024

The Meaning of Risk for Safety, Security, and Safeguards in the Design of Advanced Nuclear Reactors

What is the meaning of risk as it applies to the design of advanced reactors in the disciplines of safety, security, and safeguards? How can we find common terminology for the concept of risk and how can we find interfaces between these disciplines? These are important questions that should be explored in order that they may be applied in an integrated manner for the most effective and efficient design approaches. Eliminating or minimizing risks is a key design driver that motivates and informs the development of nuclear reactors. For safety, risk is well understood and applied in Probabilistic Risk Assessments. For security, the risk-based concepts of vulnerability assessments and vital areas are all considered in designing security systems. For safeguards, the concept of risk is not formally defined, as it relates to the design and operation of nuclear reactors. International nuclear safeguards seek to reduce the risk of proliferation in the nuclear fuel cycle and as such the concept of risk does exist. Therefore, the current understanding of the “3S’ approach, which seeks to find the interfaces and conflicts between safety, security, and safeguards requires a thorough understanding of the role that the reduction of risk plays in all three disciplines. The intersection of risk for safety and security is now being developed as there is a strong correlation between reactor design and operations and their vulnerability to sabotage. The intersection of risk for security and safeguards has to date chiefly been focused on the nuclear material control and accounting systems, which are relied on by both the operator (State) and the IAEA. This paper explores the concept of risk in each of the three disciplines, how they interact, potential conflicts and interfaces , how these might be addressed and leveraged, and a notional framework for how this could be achieved.

Kovacic, Donald N↗