Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “security assessment”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 379 records · Page 21
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Connecting the Dots: An Assessment of Cyber-risks in Networked Building and Municipal Infrastructure Systems

The buildings and city streets we walk down are changing. Driven by various data-driven use cases, there is increased interest in networking and integrating lighting and other building systems (e.g., heating, ventilation, and air conditioning (HVAC), security, scheduling) that were previously not internet-facing, and equipping them with sensors that collect information about their environment and the people that inhabit it. These data-enabled systems can potentially deliver improved occupant and resident experiences and help meet the U.S. Department of Energy (DOE) national energy and carbon reduction goals. Deploying connected devices new to being networked, however, is not without its challenges. This paper explores tools available to system designers and integrators that facilitate a cybersecurity landscape assessment – or more specifically the identification of threats, vulnerabilities, and adversarial behaviors that could be used against these networked systems. These assessments can help stakeholders shift security prioritization proactively toward the beginning of the development process.

cyber-risk assesment, adversarial behavior, MITRE ↗
DOE OSTI2025

CyberMESA: Evaluation Procedures and Metrics for Charging Infrastructure Cybersecurity

A report detailing the cybersecurity evaluation and assessment procedures for EV charging infrastructure. This report is authored by three national lab contributors. INL, PNNL, NRL. The grid integration of Electric Vehicle Charging Infrastructure (EVCI) is a large and complex system of systems (SoS) made up of components from many manufacturers and integrated by various companies responsible for their operation and maintenance. This complexity makes it challenging to implement security standards like IEC 62443 across the entire infrastructure. This document aims to aid in the vulnerability assessments of individual devices, such as Electric Vehicle Supply Equipment (EVSE), to support vendors in adopting and implementing security standards such as UL 2900, NIST SP 800-53 and Common Criteria (CC) (ISO/IEC 15408). This document serves as a guide to help evaluate the cybersecurity posture of EVCI assets. It aims to provide a consistent method for evaluating EVCI, enabling cybersecurity research teams to systematically test a wide range of electric vehicle (EV) assets. The target audiences include cybersecurity research teams, vendor development teams, automotive OEMs, and third-party evaluators.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Los Alamos National Laboratory Floodplain Assessment for the Technical Area 72 Outdoor Live Fire Range Safety Upgrades Project

The National Nuclear Security Administration (NNSA), a semi-autonomous agency within the U.S. Department of Energy (DOE), is proposing new construction and upgrade activities in lower Sandia Canyon at Technical Area (TA) 72 at the Outdoor Live Fire Range facility at Los Alamos National Laboratory (LANL). The proposed upgrades are intended to improve range safety to help fulfill the mission requirements of maintaining a trained and qualified armed Protective Force.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

Los Alamos National Laboratory Floodplain Assessment for the Technical Area 72 Outdoor Live Fire Range Gate Installation Project

The National Nuclear Security Administration (NNSA), a semi-autonomous agency within the U.S. Department of Energy (DOE), is proposing new construction in lower Sandia Canyon at Technical Area (TA) 72 at the Outdoor Live Fire Range facility at Los Alamos National Laboratory (LANL). The proposed upgrades are intended to improve range safety.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

Los Alamos National Laboratory Wetland Assessment for the Replacement Water Lines from Technical Area 48 to Technical Area 55 Project

The National Nuclear Security Administration (NNSA), a semi-autonomous agency within the U.S. Department of Energy (DOE), is proposing to take action at Los Alamos National Laboratory (LANL) near a wetland at Technical Area (TA) 48 and under a wetland at TA-55. The project proposes to install two 12-inch water lines along an alignment from TA-48 to Pecos Road on the east side of TA-55 (Figure 1). The proposed water lines will replace aging cast iron pipes that provide water for fire suppression to buildings within TA-55, and potable water to other areas in the Pajarito Corridor. NNSA has prepared this wetland assessment in accordance with 10 Code of Federal Regulations (CFR) Part 1022 Compliance with Wetland and Wetland Environmental Review Requirements (10 CFR Part 1022) (CFR 2003) which was promulgated to implement DOE requirements under Executive Order 11988 Wetland Management (EO 1977). A wetland is defined in 10 CFR 1022 as “the lowlands adjoining inland and coastal waters and relatively flat areas and flood prone areas of offshore islands,” and a base wetland as “the 100-year wetland, that is, a wetland with a 1.0 percent chance of flooding in any given year (CFR 2003).” This wetland assessment evaluates potential impacts to wetland values and functions from implementation of the proposed action, identifies alternatives to the Proposed Action, and allows for meaningful public comment.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2024

Enhancing Cloud Cybersecurity: Prescriptive Controls for Operational Technology

This whitepaper provides strategic insights and recommendations into security cloud-based solutions for electric utilities, encompassing operational technology (OT), virtual power plants (VPP), distributed energy resources (DERs), applications, networks, and data storage as they transition to and leverage cloud infrastructure through managed service providers (MSPs) and cloud service providers (CSPs). Principles derived from established frameworks serve as a foundation for best practices across cybersecurity projects and remove the constraints of settling on a single framework. For organizations that prefer not to integrate a specific framework altogether, elements of the proposed approach could be adopted or tailored to best fit defined requirements and expected functionalities. The Cirrus assessment, a utility cloud feasibility tool, and the roadmap it provides serve as a precursor to this paper, which seeks to be a valuable resource for defining next steps following cloud technology integration feasibility appraisal. With its comprehensive approach to adoption, the Cirrus framework offers strategic guidance on responsibly preparing for or deploying a utility cloud solution. The previously published whitepaper, “Use Case-Informed Framework for Utility Cloud Migration,” details the guiding strategy, research, and deployment of cloud solutions within electric and interconnected grid systems. Before implementing the controls suggested in this document, it is recommended that stakeholders complete Cirrus's cloud integration assessment and pair the results with their unique cybersecurity controls to form a comprehensive cloud-based utility cybersecurity plan. The Cirrus outcome will consider a series of future architectures for the grid before and after the energy transition and evaluate the arguments for and against cloud applications for each electric and interconnected grid layer. This document is a companion to the original whitepaper, "Use Case-Informed Framework for Utility Cloud Migration" to further identify and recommend security controls based on Cirrus’s cloud integration assessment output. The following whitepaper outlines the cybersecurity controls that secure cloud-service models pertinent to the electric sector using the predefined categories identify, protect, detect, and respond and recover. The objective is to outline prescriptive security controls based on the type of architecture and data stored in the cloud. The focus includes dissecting the shared responsibility model and elucidating what on-premises Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) entail. A pivotal consideration in this context is allocating responsibility for foundational cybersecurity aspects—having used Cirrus for the cloud integration assessment. The ensuing controls detailed herein also represent a checklist of controls necessary for a secure cloud transition, equipping utilities with the knowledge to navigate this digital transformation with confidence and strategic foresight in a safe and responsible manner.

42 ENGINEERING↗
DOE OSTI2023

Los Alamos National Laboratory Floodplain Assessment for the Technical Area 8 to Technical Area 22 Natural Gas Line Replacement Project

The National Nuclear Security Administration (NNSA), a semi-autonomous agency within the U.S. Department of Energy (DOE), is proposing new construction that crosses through upper Pajarito Canyon and upper Starmer Canyon from Technical Area (TA) 8 to TA-22 at Los Alamos National Laboratory (LANL). The project proposes to install a new 12 inch natural gas line to replace the existing 70+ year old natural gas line. Replacement will prevent loss of service to several LANL TAs and Bandelier National Monument. The project activities within the 100- year floodplains include 1) new natural gas line installation to replace and existing aging gas line, 2) relocating a section of fence and 3) three construction equipment and materials storage areas. NNSA has prepared this floodplain assessment in accordance with 10 Code of Federal Regulations (CFR) Part 1022 Compliance with Floodplain and Wetland Environmental Review Requirements (10 CFR Part 1022) (CFR 2003) which was promulgated to implement DOE requirements under Executive Order 11988 Floodplain Management (EO 1977). A floodplain is defined in 10 CFR 1022 as “the lowlands adjoining inland and coastal waters and relatively flat areas and flood prone areas of offshore islands,” and a base floodplain as “the 100-year floodplain, that is, a floodplain with a 1.0 percent chance of flooding in any given year (CFR 2003).” This floodplain assessment evaluates potential impacts to floodplain values and functions from implementation of the proposed action, identifies alternatives to the Proposed Action, and allows for meaningful public comment.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

The Third Assessment of the Effects of Climate Change on Federal Hydropower

Understanding the future changes in projected water supplies is a vital objective for federal hydropower facilities tasked with providing low-cost, reliable electricity across a large regional footprint that encompasses a growing customer base, alternative market structures for marketing the electricity, and a more diverse generation asset mix than was historically present when a majority of federal hydropower facilities were built. This study, The Third Assessment of the Effects of Climate Change on Federal Hydropower, directed by Section 9505 of the SECURE Water Act of 2009 (SWA), is the third quinquennial report on evaluating the effects of climate change on hydroelectric energy generated from 132 US federal hydropower plants marketed by four US Department of Energy (DOE) Power Marketing Administrations (PMAs). The technical assessment is conducted by DOE’s Oak Ridge National Laboratory, Pacific Northwest National Laboratory, and Texas A&M University under the guidance of DOE’s Water Power Technologies Office. This study is the result of extensive consultation with the four federal PMAs (Bonneville Power Administration [BPA], Western Area Power Administration [WAPA], Southwestern Power Administration [SWPA], and Southeastern Power Administration [SEPA]), as well as other agencies, including federal hydropower owners/operators (the US Army Corps of Engineers, US Bureau of Reclamation [Reclamation]), US Geological Survey, and National Oceanic and Atmospheric Administration). The main findings of this assessment, along with the PMA administrators’ recommendations, will be included in a subsequent DOE report to Congress. The assessment method and the technical findings are described in this report.

13 HYDRO ENERGY↗
DOE OSTI2024

Quantitative risk assessment examples for underground hydrogen storage facilities

Hydrogen energy storage can be used to achieve goals of national energy security, renewable energy integration, and grid resilience. Adapting underground natural gas storage facility (UNGSF) infrastructure for underground hydrogen storage (UHS) is one method of storing large quantities of hydrogen that has already largely been proven to work for natural gas. There are currently some underground salt caverns in the United States that are being used for hydrogen storage by commercial entities, but it is still a fairly new concept in that it has not been widely deployed nor has it been done with other geologic formations like depleted hydrocarbon reservoirs. Assessments of UHS systems can help identify and evaluate risks to people both working within the facility and residing nearby. This report provides example risk assessment methodologies and analyses for generic wellhead and processing facility configurations, specifically in the context of the risks of unintentional hydrogen releases into the air. Assessment of the hydrogen containment in the subsurface is also critically important for a safety assessment for a UHS facility, but those geomechanical assessments are not included in this report.

08 HYDROGEN↗
DOE OSTI2023

Cybersecurity Assessment for a Behind-the-Meter Solar PV System: A Use Case for the DER-CF

The world's energy production is shifting toward lower-cost, cleaner, more efficient, and sustainable sources. The increasing numbers of distributed energy resources (DERs) are allowing for the rapid transformation of electric grids toward achieving the goal of energy decarbonization. Along with cleaner and more efficient energy, however, we must also aim for a secure energy future. Solar photovoltaic (PV) systems are an important part of this transition. This paper discusses a cybersecurity risk assessment for behind-the-meter DERs using a solar PV system as a use case of the Distributed Energy Resource Cybersecurity Framework (DER-CF) developed by the National Renewable Energy Laboratory. This poster presents a conference paper on the risk assessment processes and summarizes the DER-CF's use case recommendations to strengthen the cybersecurity posture of the electric grid.

cybersecurity↗
DOE OSTI2026

Equipment Self-Assessment Guide Checklist

This Equipment Self-Assessment Checklist is designed for asset owners and operators (AOOs) responsible for the deployment, operation, maintenance, or cybersecurity oversight of grid systems and digital energy technologies. It provides a structured inspection checklist for evaluating the security, integrity, and operational trustworthiness of equipment across substations, generation sites, distributed energy resources (DERs), and control environments.

32 - ENERGY CONSERVATION, CONSUMPTION, AND UTILIZA↗
NASA NTRS2013

Earth Observations for Global Water Security

The combined effects of population growth, increasing demands for water to support agriculture, energy security, and industrial expansion, and the challenges of climate change give rise to an urgent need to carefully monitor and assess trends and variations in water resources. Doing so will ensure that sustainable access to adequate quantities of safe and useable water will serve as a foundation for water security. Both satellite and in situ observations combined with data assimilation and models are needed for effective, integrated monitoring of the water cycle's trends and variability in terms of both quantity and quality. On the basis of a review of existing observational systems, we argue that a new integrated monitoring capability for water security purposes is urgently needed. Furthermore, the components for this capability exist and could be integrated through the cooperation of national observational programmes. The Group on Earth Observations should play a central role in the design, implementation, management and analysis of this system and its products.

Earth↗
DOE OSTI2023

Cyber and Physical Security Analysis of GSI and Noventum Application for IoT Communications

We present our findings of the red team exercise conducted on the device and application developed by Guardian Sensors, Inc. (GSI) and Noventum. The app is used for situational awareness and control of photovoltaics (PV) and microgrid energy systems. The assessments performed are practical case scenarios that assess the risks and vulnerabilities posed by the app through targeted activities that could be engaged by an adversary. The assessment team’s results and recommendations are provided to inform on and mitigate the identified weaknesses to improve secure user authentication, connections, and communications. The recommendations in this report are not intended to be a security panacea but will add the desired defense-in-depth layer to securing communication of such interconnected systems.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

CARILEC Resilient Energy Community CoP for Cybersecurity Workshop Series: Cybersecurity Assessment Tools [Slides]

For the last several years and in collaboration with CARILEC, USAID and NREL have been working to support cyber resilience at power sector utilities in Latin America and the Caribbean. Direct technical assistance with regional utilities has been a key component of USAID-NREL Partnership activities, and technical assistance has typically included a foundational cybersecurity assessment using NREL's Distributed Energy Resource Cybersecurity Framework (DER-CF) tool. The DER-CF allows organizations to benchmark and evaluate their cybersecurity posture across the areas of Governance, Technical Management, and Physical Security. To complement the activities of the newly created CAREC IT/OT and Cybersecurity Team, this webinar on cybersecurity assessment tools includes an overview of the DER-CF tool and a discussion with regional stakeholders and NREL experts on the DER-CF assessment process and other resources for cybersecurity assessments.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Los Alamos National Laboratory Floodplain Assessment for the Technical Area 72 Outdoor Live Fire Range Storage Units Installation Project

The National Nuclear Security Administration (NNSA), a semi-autonomous agency within the U.S. Department of Energy (DOE), is proposing new construction in lower Sandia Canyon at Technical Area (TA) 72 at the Outdoor Live Fire Range facility at Los Alamos National Laboratory (LANL). The proposed project is intended to provide storage for firing range supplies and consumables. The project activities within the 100-year floodplain include installation of at least seven prefabricated metal transportainer type storage units located at one of four locations (Figure 1).

54 ENVIRONMENTAL SCIENCES↗
NASA NTRSDate not supplied

Gateway Implementation of Cybersecurity Requirements

Cyber threats are a constant present-day reality for any type of business -- Space exploration is not excluded from these threats either. The Gateway Program is one of NASA’s latest initiatives that extend space exploration beyond low earth orbit. Gateway allows for NASA to prove technologies and mature systems necessary to live and work on another celestial body before embarking on multi-year missions to Mars. The Gateway is a small, human-tended space station in orbit around the Moon. With the increased autonomy, distance and criticality of systems, cybersecurity is one of the critical subsystems that touches and integrates with most if not all subsystems of the Gateway. Building a gateway to the lunar orbit is no simple task. In this presentation, we outline an approach that the Gateway team adopted in creating a cyber safe and robust vehicle to support operations and assure protection of the critical functions. Gateway Program is required to implement National Institute of Standards and Technology (NIST) guidelines to adhere to the Federal Information Security Modernization Act (FISMA). NIST provides a framework for managing and controlling cybersecurity risks by defining cybersecurity controls and methodologies for implementation. The NIST framework is based upon the system, data within the system, integrations with external systems, and risk assessments to determine impacts for each of those systems. The goals and objectives are to identify appropriate security controls that fulfill and map to the NIST 800-53 framework. The implementation process involves developing an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. NIST Security controls are interpreted and defined within the Gateway vehicle requirements subsystems specifications. This paper details the approach, implementation, and challenges faced during the development and design phases to address cyber threats during the Gateway vehicle operations.

Svetlana Hanson↗
NASA NTRSDate not supplied

Gateway Implementation of Cybersecurity Requirements

Cybersecurity threats are a constant present-day reality for any type of business -- Space exploration is not excluded from these threats either. The Gateway Program is one of NASA’s latest initiatives that extend space exploration beyond low earth orbit. Gateway allows for NASA to prove technologies and mature systems necessary to live and work on another celestial body before embarking on multi-year missions to Mars. The Gateway is a small, human-tended space station in orbit around the Moon. With the increased autonomy, distance and criticality of systems, cybersecurity is a critical discipline that touches and integrates with most if not all subsystems of the Gateway. Building a gateway to the lunar orbit is no simple task. In this presentation, we outline an approach that the Gateway team adopted in creating a cyber safe and robust vehicle to support operations and assure protection of the critical functions. Gateway Program is required to implement National Institute of Standards and Technology (NIST) guidelines to adhere to the Federal Information Security Modernization Act (FISMA). NIST provides a framework for managing and controlling cybersecurity risks by defining cybersecurity controls and methodologies for implementation. The NIST framework is based upon the system, data within the system, integrations with external systems, and risk assessments to determine impacts for each of those systems. The goals and objectives are to identify appropriate security controls that fulfil and map to the NIST 800-53 framework. The implementation process involves developing an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. NIST Security controls are interpreted and defined within the Gateway vehicle requirements subsystems specifications. This paper details the approach, implementation, and challenges faced during the development and design phases to address cyber threats during the Gateway vehicle operations.

Cybersecurity↗