Assessment and Coordination of DER Cybersecurity Standards
This slide deck summarizes NREL's accomplishments for last three years under the Securing Solar for the Grid (S2G) project.
29 ENERGY PLANNING, POLICY, AND ECONOMY↗
SEARCH · Engineering Papers
Results for “security assessment”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
A National Secure-by-Design Strategy
The US National Cybersecurity Strategy published March 2, 2023 uses plain language to communicate that the US is calling for a major change in how we prioritize the security of software systems used in critical infrastructure. It acknowledges that our current approach, which is essentially, “let the buyer beware,” leaves entities who are least able to assess or defend vulnerable software responsible for the impacts of designed-in weaknesses while the makers of the technology bear no liability. The strategy recommends a security-by-design approach, recommending that software vendors be held liable to uphold a “duty of care” to consumers and for systems to be designed to “fail safely and recover quickly” . For energy infrastructure, the strategy calls out the need to implement the National Cyber-Informed Engineering Strategy to achieve higher confidence security for energy infrastructures. The Idaho National Laboratory, a pioneer in cyber-informed engineering concepts, is at the forefront of organizations educating others in industry, academia, and government on how to apply these concepts to real-world challenges. In this brief, we'll outline some of the basic principles of security-by-design and offer examples of how, in a water sector context, they're being put into successful practice.
42 ENGINEERING↗
Sovereign Credit Rating Processes Adapted to Critical Infrastructure Cyber Risk Assessment
United States critical infrastructure entities are increasingly targeted by motivated and capable threat actors and must be prepared to assess and treat a diverse range of cyber risks. Consequently, this necessitates some form of analytical process to evaluate risks and inform cyber security investment decisions. A potential solution for structuring cyber risk evaluation exists within the field of sovereign credit ratings – where agencies employ mature approaches that integrate quantitative and qualitative data to produce a singular value of assessment. Adapting such approaches, we present a novel criterion and methodology for measuring and communicating the likelihood element of cyber risk. The methodology is composed of three sequential phases: a quantitative baseline organized by distinct capability frames, a bounded qualitative adjustment per frame, and a greater-bounded qualitative adjustment spanning the entire process. The process culminates in publication of a cyber capability rating that communicates a critical infrastructure entity’s ability and willingness to mitigate discontinuous function due to cyberattack.
45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
Technology Impact and Resource Assessment of Existing and Planned U.S. Biofuel Production: Life Cycle Water Consumption, Water Stress, Land Use, and Criteria Air Pollutants
Biofuels have the potential to strengthen the U.S. energy supply, enhance energy security, and promote economic development. As the United States continues to expand biofuel production, quantifying resource requirements and location-specific constraints is crucial for planning, siting, and technology development to support long-term viability. Accordingly, this work assesses the life cycle resource consumption (water consumption, and land use), water stress and criteria air pollutants associated with expanded U.S. biofuel production over the 2020–2035 period, based on producers’ plans. We perform a bottom-up technology impact assessment and resource assessment by integrating facility-level production statistics with Argonne’s Research and Development (R&D) GREET model and county-level water-stress characterization factors from Available Water Remaining for the United States (AWARE-US) model. Results suggest that by 2035, biofuels could meaningfully contribute to U.S. energy demand, driven primarily by first-generation and waste-based feedstocks with plans for substantial capacity expansion, although cellulosic and e-fuel technologies remain limited. However, growth must be managed to minimize impacts on water resources and land use. These impacts vary by fuel type and facility location, specifically, projected expansion increases water consumption and can elevate water-stress impacts in certain regions like Nebraska, Kansas, Colorado, Idaho, California and North Texas. Direct land use also increases overall, particularly for first-generation feedstocks such as corn and soybeans. These findings underscore the need for continued technological improvements and innovative strategies to manage resource demands as the industry scales and to support complementary deployment within the evolving U.S. energy system.
09 BIOMASS FUELS↗
Autonomous System Inference, Trojan, and Adversarial Reprogramming Attack and Defense (Final)
In the world of ever-advancing technology, Autonomous Systems (AS) find extensive application, bolstering functionalities of critical infrastructures such as nuclear power plants. These systems, however, are increasingly becoming a target for nefarious activities, namely through inference attacks, trojan attacks, and adversarial reprogramming. This paper delves into a comprehensive exploration of machine learning (ML)-driven autonomous control systems within advanced nuclear reactor designs, revealing the vulnerabilities and proposing strategies for defense against potential cyber-attacks. Advanced cyber-attacks against critical infrastructure and the energy sector are becoming more common. With the invention of autonomous control systems (ACS) within advanced nuclear reactor designs, system designers, reactor operators, and regulators must consider cybersecurity during the design and operational phases. This article provides a cyber threat assessment of machine learning (ML)- based digital twinning (DT) technologies in the context of advanced reactor ACS. A cyber-physical testbed was created to emulate nuclear reactor digital instrumentation and controls (I&C) and act as a basis for the ACS. The ACS was designed as two plant-level DTs predicting reactor malfunctions and determining control actions and two component-level DTs responsible for classifying component states and forecasting component inputs and outputs (I/O). Two duplicate ACS designs– one using a traditional ML framework and one using an automated ML (AutoML) framework– were created and tested against cyber-attacks on training data, real-time process data, and ML model architectures to determine their respective qualitative cyber-risk in terms of likelihood and impact. Both frameworks showed similar cyber-resilience against training, real-time, and ML architecture attacks, proving that neither is inherently more secure. Recommended safeguard and security measures are posed to system designers, reactor operators, and regulators to maintain the cybersecurity of ML-based DT technologies such as ACS, prompting a holistic view of shared responsibility for maintaining cyber-secure ML-based systems. As global reliance on generation III reactors begins to be critically assessed, the evolution towards advanced reactor systems utilizing digital instrumentation and controls (I&C) becomes not merely preferable, but essential. The integration of semi and fully autonomous control systems (ACS), powered by digital I&C and machine learning (ML)-based digital twinning (DT) technologies, emerges as a potent strategy to mitigate operations and maintenance costs, thereby enhancing the economic feasibility of novel reactor designs. However, with a staggering 500% and 380% increase in cyber-attacks reported against the energy sector by the United States Department of Energy (DoE) and the European Union respectively, a surge in cyber vulnerabilities specifically targeting the nuclear industry has been 2 markedly observed. Notable incidents, such as the W32.Ramnit spyware infiltration at the Gundremmingen nuclear power plant in Germany and the Dtrack spyware intrusion at the Kudankulam nuclear power plant in India, while not directly compromising core industrial control systems (ICS), underscore a compelling necessity to fortify cybersecurity protocols in safeguarding reactor systems against increasingly adept digital adversaries. In light of this, our investigation extends beyond conventional cybersecurity parameters, diving into the intricate web of potential vulnerabilities woven into ML-based DTs and ACS in advanced reactor systems. A crafted cyber-physical testbed and preliminary ACS were devised to act as a mirror, reflecting potential configurations of advanced reactor control designs. Moreover, this study is intertwined with a scrutinization of ML models, developed either through conventional, manually tuned methodologies or via automated means through AutoML, probing into their cyber-risk profiles within operational technology (OT) environments. Expanding on this, two distinct ACS blueprints were forged – one navigating through the corridors of traditional ML and the other traversing the path of AutoML – in an effort to holistically encapsulate the considerations pivotal to ML-based DT control system design. Employing the SANS Institute Industrial Control System (ICS) Kill Chain and the MITRE ATT&CK Tactics, Techniques, and Procedures (TTP) framework, a structured analysis was conducted, launching three targeted attacks against the training dataset, real-time dataset, and ML models, therein dissecting the potential cyber-attack implications against both ML frameworks within an ACS milieu. It is essential to note that three distinct categories of attacks were conducted against both ACS configurations, each encompassing three distinct ML-based DTs, cumulating in a total of 18 varied attacks. This exploration extends into the realms of Autonomous System Inference, Trojan, and Adversarial Reprogramming Attack and Defense, unraveling vulnerabilities, and opportunities for fortified defenses against such intrusions, particularly where ML-driven technologies, and by extension, ACS, are deployed. Final recommendations, articulated through a lens of security, safeguard, and implementation considerations, are presented for both traditional and AutoML models, anchoring upon the existing knowledge landscape and ML-based DT modeling for ACS, and are offered as a beacon to guide the nuclear industry through the intricate cybersecurity challenges that lie ahead.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Eligibility Assessment of TA-52-1 and TA-52-11: The Ultra-High Temperature Reactor Experiment (UHTREX) Complex
The U.S. Department of Energy (DOE), National Nuclear Security Administration, Los Alamos Field Office (NA-LA) requests the State Historic Preservation Officer (SHPO) to concur with the eligibility determinations contained in this report for Buildings 1 and 11 in Technical Area 52 (TA-52) at Los Alamos National Laboratory (LANL or the Laboratory). Triad National Security LLC cultural resources staff have completed the evaluation of two buildings, called the UHTREX Complex, for inclusion in the National Register of Historic Places (Register). This complex includes the UHTREX Reactor Building (TA-52-1), and an associated Mechanical Assembly Building (TA-52-11). As part of LANL’s Footprint Reduction Program, both facilities of the UHTREX Complex are scheduled for characterization and demolition. In addition to evaluating their eligibility in the Register, the properties at TA-52 were assessed for potential adaptive reuse, long-term preservation, and public interpretation. Based on the findings in this assessment report, both TA-52-1 and TA-52-11 have been determined to not be eligible for inclusion in the Register. The history of the UHTREX Complex lacks association with exceptionally significant Cold War events of scientific developments. Both TA-52-1 and TA-52-11 lack the necessary internal historic integrity suitable for long-term preservation or public interpretation. And both facilities contain legacy radioactive contamination, which prohibits their reuse. In addition to its loss of integrity and context, TA-52- 11 has been determined ineligible due to its status as a support building of secondary or minor importance. In compliance with Section 106 and Section 110 of the National Historic Preservation Act of 1966, as amended, and with the Programmatic Agreement among the U.S. Department of Energy, National Nuclear Security Administration, Los Alamos Field Office, the New Mexico State Historic Preservation Office, and the Advisory Council on Historic Preservation Concerning Management of the Historic Properties at Los Alamos National Laboratory, Los Alamos, New Mexico, the SHPO is requested to concur with the eligibility determinations contained in this report for the UHTREX Complex in TA-52.
99 GENERAL AND MISCELLANEOUS↗
Integrated assessment of climate change impacts on crop productivity and income of commercial maize farms in northeast South Africa
Agriculture in South Africa sustains about 70% of the region’s population for food, income and employment, playing an important role for food security and the local economy. The focus of the study was the commercial maize farms of the Free State Province given their importance in the National economy. The Regional Integrated Assessment (phase I) was implemented to assess climate change and adaptation that links climate, crops, economic data and tools developed by the Agricultural Model Intercomparison and Improvement Project (AgMIP). In this context, the“system”is defined as a whole of agronomic and socio-economic factors. Within that framework three core questions were being evaluated: (i) Impacts of climate change under current system; (ii) Impacts of climate change under future system; (iii) The role of adaptation under climate change and the future system. Maize production will decrease between 10% to 16% as a result of projected climate impacts. Also, current agricultural production systems are negatively affected by climate change with an increase in poverty rates between 2% to 3%. The projected adoption of the adapted technology would result in positive increased net returns and a decrease in poverty rate of between 12%and 22%. The results of this study show that implementing adaptation measures and other strategies as indicated by the local stakeholders will have positive impacts on the agricultural production systems and can contribute to support and inform climate change policy decision making such as the development of National Adaptation Plans.
Integrated assessment↗
Vulnerability Assessments for Power-Electronics-Based Smart Grids
Here, in this paper, a novel method is proposed to evaluate the cyber security of the power-electronics-based smart grids (PESG). The proposed method considers the performance and stability of both the individual inverter and the grid. To our knowledge, this is a first attempt to evaluate the performance and stability of PESG due to cyber attacks. We first develop impedance-based modeling and cyber-attack modeling for PESG. Then we propose innovative two security criteria to evaluate the security of PESG, including stability-based and metrics-based. For metrics-based criteria, we propose to use both total harmonic distortion (THD) and space phasor model (SPM) to evaluate the inverter performance. The simulation results with a two-inverter-based power grid verify the validity and accuracy of the proposed security evaluation method. Results have shown that the performance and stability of PESG are significantly affected by cyber attacks, and thus there is indeed a need to further study cyber security issues of PESG.
24 POWER TRANSMISSION AND DISTRIBUTION↗
The Role of Crop Production in the Forest Landscape Restoration Approach—Assessing the Potential Benefits of Meeting the Bonn Challenge
Existing approaches and methodologies that investigate effects of land degradation on food security vary greatly. Although a relatively rich body of literature that investigates localized experiences, geophysical, and socioeconomic drivers of land degradation, and the costs and benefits of avoiding land degradation already exists, less rigorously explored are the global effects of restoring degraded landscapes for the health of the land, the climate, and world food security. The current scale of land degradation is such that the problem can be meaningfully addressed only if local successes are upscaled and a large number of landowners and land managers implement restoration activities. Significant global efforts to address degradation exist, but studies that evaluate the global benefits of these efforts generally do not account for global market forces and the complex web of relationships that determine the effects of wide-scale restoration on production and food security. This paper provides important insights into how a full integration of crop production in restoration efforts could impact food production levels, food availability, forest carbon stocks, and Greenhouse gas emissions.
54 ENVIRONMENTAL SCIENCES↗
Power Sector Cybersecurity Building Blocks
The Power Sector Cybersecurity Building Blocks, developed through the USAID-NREL Partnership and the Resilient Energy Platform, are designed to help a variety of stakeholders improve security for the electrical grid. This effort grows out of USAID and NREL's discussions with utilities around the world, as well as past cybersecurity assessments performed by NREL on dozens of utilities and government agencies, with a focus on the cybersecurity challenges faced by small and under-resourced utilities. This document outlines eleven building blocks for power sector cyber security. It functions as a guide to help organizations develop a robust, balanced cybersecurity defense program. Individually, each building block represents a cluster of related activities within cybersecurity on which an organization should focus. Using the building blocks, organizations can effectively prioritize their cybersecurity efforts to best thwart a wide range of potential cyberattacks.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Resilient Energy Platform. Fact Sheet: Power Sector Cybersecurity Building Blocks
The Power Sector Cybersecurity Building Blocks, developed through the USAID-NREL Partnership and the Resilient Energy Platform, are designed to help a variety of stakeholders improve security for the electrical grid. This effort grows out of USAID and NREL's discussions with utilities around the world, as well as past cybersecurity assessments performed by NREL on dozens of utilities and government agencies, with a focus on the cybersecurity challenges faced by small and under-resourced utilities. This document outlines eleven building blocks for power sector cyber security. It functions as a guide to help organizations develop a robust, balanced cybersecurity defense program. Individually, each building block represents a cluster of related activities within cybersecurity on which an organization should focus. Using the building blocks, organizations can effectively prioritize their cybersecurity efforts to best thwart a wide range of potential cyberattacks.
building blocks↗
In-Time Non-Participant Casualty Risk Assessment to Support Onboard Decision Making for Autonomous Unmanned Aircraft
Numerous operational paradigms, technologies, and missions are emerging as newcomers to the National Airspace System (NAS) develop small Unmanned Aircraft Systems (sUAS), personal air vehicles and other Urban Air Mobility (UAM) concepts. As the list of applications expands, maintaining the safety of the current airspace system remains one of the core concerns preventing widespread commercial implementation of these concepts. Further, the risks associated with unmanned aircraft operations themselves have to be recognized and mitigated in a timely manner. Safety-critical risks include, but are not limited to, flight outside of approved airspace, unsafe proximity to people or property, critical system failures, loss-of control, and cyber-security related risks. Instead of reacting to accidents, a set of predictive and data-driven risk monitoring, assessment, and mitigation capabilities are envisioned to help capture and eliminate hazards as these systems become operational. NASA’s System-wide Safety project is performing R&D on such a safety assurance concept. As part of this concept, this paper describes an architecture that continuously monitors a diverse set of onboard and ground-based sources to estimate and predict non-participant casualty risk during flight. Timely identification of the changing nature of this risk can inform decision making processes to mitigate current and impending situations.
Ancel, Ersin↗
Space Strategy at a Crossroads: Opportunities and Challenges for 21st Century Competition
In its November 2018 report to Congress, the bipartisan National Defense Strategy Commission applauded the main themes of the Trump administration’s 2017 National Defense Strategy. But it was also deeply critical of the strategic thought so far done by the U.S. defense community about the requirements, operational and otherwise, of securing U.S. and allied interests in the types of conflicts we now face. Indeed, it assessed these shortfalls as crippling to the exercise of American power and as dangerous in crisis and war. Is the U.S. military space community exempt from such criticism? Should it be?
29 ENERGY PLANNING, POLICY, AND ECONOMY↗
Cybersecurity at the Grid Edge: Protecting LA's Energy Systems in a Connected World
Join SoCalGas and the National Laboratory of the Rockies (NLR) for an insightful webinar on securing operational technology and energy systems. Los Angeles has the second-largest metro by population in the nation, making it vital to protect the energy infrastructure that powers day-to-day life. However, cybersecurity for energy systems is an immense challenge due to an increasing number of interconnected devices and stakeholders. While there was traditionally a limited need to secure energy infrastructure, the grid is only becoming smarter and more software-defined. Amid aging infrastructure and evolving cyber threats, the need to ensure the security of energy is at an all-time high. Together, SoCalGas and NLR are assessing the current state-of-the-art of the energy ecosystem to understand gaps in current best practices and technologies relevant to powering the city of Los Angeles.
97 MATHEMATICS AND COMPUTING↗
Reliability modeling of fault-tolerant computer based systems
Digital fault-tolerant computer-based systems have become commonplace in military and commercial avionics. These systems hold the promise of increased availability, reliability, and maintainability over conventional analog-based systems through the application of replicated digital computers arranged in fault-tolerant configurations. Three tightly coupled factors of paramount importance, ultimately determining the viability of these systems, are reliability, safety, and profitability. Reliability, the major driver affects virtually every aspect of design, packaging, and field operations, and eventually produces profit for commercial applications or increased national security. However, the utilization of digital computer systems makes the task of producing credible reliability assessment a formidable one for the reliability engineer. The root of the problem lies in the digital computer's unique adaptability to changing requirements, computational power, and ability to test itself efficiently. Addressed here are the nuances of modeling the reliability of systems with large state sizes, in the Markov sense, which result from systems based on replicated redundant hardware and to discuss the modeling of factors which can reduce reliability without concomitant depletion of hardware. Advanced fault-handling models are described and methods of acquiring and measuring parameters for these models are delineated.
Bavuso, Salvatore J.↗
National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook
The NASA Automated Information Security Handbook provides NASA's overall approach to automated information systems security including discussions of such aspects as: program goals and objectives, assignment of responsibilities, risk assessment, foreign national access, contingency planning and disaster recovery, awareness training, procurement, certification, planning, and special considerations for microcomputers.
Roback, E.↗
Personal Resiliency Index
A plethora of information exists in literature focusing on different aspects of personal resilience. There are a number of questionnaires available to measure resilience in different aspects of an individual’s life, such as mental health. However, there is a lack of comprehensive information on the subject of personal resilience to natural and man-made disasters. A Personal Resiliency Index identifying four key areas of resilience related to natural and man-made disasters will help fill this gap by providing individuals an idea of where the stand comparatively to their peers on this topics. As an increasing amount of man-made disasters, natural disasters and pandemics occur, we realize that preparation is key.?“Crisis can be experienced at individual, group and mass levels and at local, regional, national or supra-national levels.” 1? Dr. Ron Fisher, the principal investigator has over 20 years’ critical infrastructure protection including developing vulnerability assessment methodology, risk and resiliency analyses and infrastructure interdependencies. Dr. Fisher and his team will research and develop a voluntary survey which evaluates the user’s personal resilience level to natural and man-made disasters. The research team is focusing on 4 main categories:? financial resilience, cyber security, physical and mental health, and emergency preparedness.?The web based application will?provide a resilience score for each of the categories and also a comprehensive personal resiliency score based on the voluntary survey. The application will also provide feedback to the user on actions to take to become more resilient to natural and man-made disasters. Through this effort, we will also be able to identify the areas where participants are excelling as well as opportunities for improvement in terms of resilience. This information will provide insight into areas of further investigation and identify potential areas of support needed for the general public to adopt strategies to become more resilient. 1 Lynott, William. “Surviving a Natural (or Man-Made) Disaster: How to Prepare for and Bounce Back? from a Crisis in Your Business | 2018-02-01 | NOLN.” Home Page, NOLN, 1 Feb. 2018, https://www.noln.net/articles/2683-surviving-a-natural-or-man-made-disaster-how-to-prepare-for-and-bounce-back-from-a-crisis-in-your-business.
99 GENERAL AND MISCELLANEOUS↗
A critical review of cyber-physical security for building automation systems
Modern Building Automation Systems (BASs), as the brain that enable the smartness of a smart building, often require increased connectivity both among system components as well as with outside entities, such as the cloud, to enable low-cost remote management, optimized automation via outsourced cloud analytics, and increased building-grid integrations. As smart buildings move towards open communication technologies, providing access to BASs through the building's intranet, or even remotely through the Internet, has become a common practice. However, increased connectivity and accessibility come with increased cyber security threats. BASs were historically developed as closed environments with limited cyber-security considerations. As a result, BASs in many buildings are vulnerable to cyber-attacks that may cause adverse consequences, such as occupant discomfort, excessive energy usage, and unexpected equipment downtime. Therefore, there is a strong need to advance the state-of-the-art in cyber-physical security for BASs and provide practical solutions for attack mitigation in buildings. However, an inclusive and systematic review of BAS vulnerabilities, potential cyber-attacks with impact assessment, detection & defense approaches, and cyber resilient control strategies is currently lacking in the literature. This review paper fills the gap by providing a comprehensive up-to-date review of cyber-physical security for BASs at three levels in commercial buildings: management level, automation level, and field level. The general BASs vulnerabilities and protocol-specific vulnerabilities for the four dominant BAS protocols (i.e., BACnet, KNX, LonWorks, and Modbus) are reviewed, followed by a discussion on four attack targets and seven potential attack scenarios. Furthermore, the impact of cyber-attacks on BASs is summarized as signal corruption, signal delaying, and signal blocking. The typical cyber-attack detection and defense approaches are identified at the three levels. Cyber resilient control strategies for BASs under attack are categorized into passive and active resilient control schemes. Open challenges and future opportunities are finally discussed.
97 MATHEMATICS AND COMPUTING↗