Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 469 records · Page 26

Recent Changes in High-Latitude Glaciers, Ice Caps, and Ice Sheets

The glaciers and ice sheets of the world contain enough ice to raise sea level by approximately 70 meters if they were to disappear entirely, and most of this ice is located in the climatically sensitive polar regions. Fortunately changes of this magnitude would probably take many thousands of years to occur, but recent discoveries indicate that these ice masses are responding to changes in today s climate more rapidly than previously thought. These responses are likely to be of great societal significance, primarily in terms of their implications for sea level, but also in terms of how their discharge of freshwater, through melting or calving, may impact ocean circulation. For millions of years, oceans have risen and fallen as the Earth has warmed and cooled, and ice on land has shrunk and grown. Today is no different in that respect, as sea levels have been rising at a rate of nearly 2 m per year during the last century (Miller and Douglas 2004), and 3 mm/yr in the last 12 years (Leuliette et al. 2004). What is different today, however, is that tens - perhaps hundreds - of millions of people live in coastal areas that are vulnerable to changes in sea level. Rising seas erode beaches, increase flood potential, and reduce the ability of barrier islands and coastal wetlands to mitigate the effects of major storms and hurricanes. The costs associated with a one-meter rise in sea level are estimated to be in the hundreds of billions of dollars in the United States alone. The worldwide costs in human terms would be far greater as some vulnerable low-lying coastal regions would become inundated, especially in poorer nations that do not have the resources to deal with such changes. Such considerations are particularly important in light of the fact that a one meter sea level rise is not significantly outside the 0.09 to 0.88 range of predictions for this century (IPCC 2001), and rises of this magnitude have occurred in the past in as little as 20 years (Fairbanks 1989). While the expansion of the warming oceans is estimated to be about a third of recent sea level rise, (Miller and Douglas 2004) the greatest potential for significantly increasing sea level lies in the Greenland and Antarctic ice sheets. For different reasons, each exhibits characteristics that suggest they are potentially unstable. In Antarctica, large portions of the ice cover rest on a soft bed that lies below sea level, making it vulnerable to runaway retreat. The Greenland ice sheet experiences considerable melt, which has the potential to rapidly accelerate the flow of ice toward the sea. While smaller ice masses, such as the Alaskan Glaciers and the Canadian ice caps, do not have anywhere near the same potential to impact sea level as the vast ice sheets do, many are melting rapidly, posing a significant near-term threat.

Abdalati, Waleed↗

Hybrid Wound Filaments for Greater Resistance to Impacts

A hybrid material containing wound filaments made of a hybrid of high-strength carbon fibers and poly(phenylene benzobisoxazole) [PBO] fibers is discussed. This hybrid material is chosen in an effort to increase the ability of the pressure vessel to resist damage by low-speed impacts (e.g., dropping of tools on the vessel or bumping of the vessel against hard objects during installation and use) without significantly increasing the weight of the vessel. While the basic concept of hybridizing fibers in filament-wound structures is not new, the use of hybridization to increase resistance to impacts is an innovation, and can be expected to be of interest in the composite-pressure-vessel industry. The precise types and the proportions of the high-strength carbon fibers and the PBO fibers in the hybrid are chosen, along with the filament-winding pattern, to maximize the advantageous effects and minimize the disadvantageous effects of each material. In particular, one seeks to (1) take advantage of the ability of the carbon fibers to resist stress rupture while minimizing their contribution to vulnerability of the vessel to impact damage and (2) take advantage of the toughness of the PBO fibers while minimizing their contribution to vulnerability of the vessel to stress rupture. Experiments on prototype vessels fabricated according to this concept have shown promising results. At the time of reporting the information for this article, research toward understanding and optimizing the performances of PBO fibers so as to minimize their contribution to vulnerability of the pressure vessel to stress rupture had yet to be performed.

DeLay, Thomas K.↗

Performance Data Errors in Air Carrier Operations: Causes and Countermeasures

Several airline accidents have occurred in recent years as the result of erroneous weight or performance data used to calculate V-speeds, flap/trim settings, required runway lengths, and/or required climb gradients. In this report we consider 4 recent studies of performance data error, report our own study of ASRS-reported incidents, and provide countermeasures that can reduce vulnerability to accidents caused by performance data errors. Performance data are generated through a lengthy process involving several employee groups and computer and/or paper-based systems. Although much of the airline indUStry 's concern has focused on errors pilots make in entering FMS data, we determined that errors occur at every stage of the process and that errors by ground personnel are probably at least as frequent and certainly as consequential as errors by pilots. Most of the errors we examined could in principle have been trapped by effective use of existing procedures or technology; however, the fact that they were not trapped anywhere indicates the need for better countermeasures. Existing procedures are often inadequately designed to mesh with the ways humans process information. Because procedures often do not take into account the ways in which information flows in actual flight ops and time pressures and interruptions experienced by pilots and ground personnel, vulnerability to error is greater. Some aspects of NextGen operations may exacerbate this vulnerability. We identify measures to reduce the number of errors and to help catch the errors that occur.

countermeasures↗

Experiences with Extra-Vehicular Activities in Response to Critical ISS Contingencies

The maturation of the International Space Station (ISS) design from the proposed Space Station Freedom to today's current implementation resulted in external hardware redundancy vulnerabilities in the final design. Failure to compensate for or respond to these vulnerabilities could put the ISS in a posture to where it could no longer function as a habitable space station. In the first years of ISS assembly, these responses were to largely be addressed by the continued resupply and Extra-Vehicular Activity (EVA) capabilities of the Space Shuttle. Even prior to the decision to retire the Space Shuttle, it was realized that ISS needed to have its own capability to be able to rapidly repair or replace external hardware without needing to wait for the next cargo resupply mission. As documented in a previous publicatoin5, in 2006 development was started to baseline Extra- Vehicular Activity (EVA, or spacewalk) procedures to replace hardware components whose failure would expose some of the ISS vulnerabilities should a second failure occur. This development work laid the groundwork for the onboard crews and the ground operations and engineering teams to be ready to replace any of this failed hardware. In 2010, this development work was put to the test when one of these pieces of hardware failed. This paper will provide a brief summary of the planning and processes established in the original Contingency EVA development phase. It will then review how those plans and processes were implemented in 2010, highlighting what went well as well as where there were deficiencies between theory and reality. This paper will show that the original approach and analyses, though sound, were not as thorough as they should have been in the realm of planning for next worse failures, for documenting Programmatic approval of key assumptions, and not pursuing sufficient engineering analysis prior to the failure of the hardware. The paper will further highlight the changes made to the Contingency EVA preparation team structure, approach, goals, and the resources allocated to its work after the 2010 events. Finally, the authors will overview the implementation of these updates in addressing failures onboard the ISS in 2012, 2013, and 2014. The successful use of the updated approaches, and the application of the approaches to other spacewalks, will demonstrate the effectiveness of this additional work and make a case for putting significant time and resources into pre-failure planning and analysis for critical hardware items on human-tended spacecraft.

Van Cise, E. A.↗

Experiences with Extra-Vehicular Activities in Response to Critical ISS Contingencies

The maturation of the International Space Station (ISS) design from the proposed Space Station Freedom to today's current implementation resulted in external hardware redundancy vulnerabilities in the final design. Failure to compensate for or respond to these vulnerabilities could put the ISS in a posture where it could no longer function as a habitable space station. In the first years of ISS assembly, these responses were to largely be addressed by the continued resupply and Extra-Vehicular Activity (EVA) capabilities of the Space Shuttle. Even prior to the decision to retire the Space Shuttle, it was realized that ISS needed to have its own capability to be able to rapidly repair or replace external hardware without needing to wait for the next cargo resupply mission. As documented in a previous publication, in 2006 development was started to baseline Extra-Vehicular Activity (EVA, or spacewalk) procedures to replace hardware components whose failure would expose some of the ISS vulnerabilities should a second failure occur. This development work laid the groundwork for the onboard crews and the ground operations and engineering teams to be ready to replace any of this failed hardware. In 2010, this development work was put to the test when one of these pieces of hardware failed. This paper will provide a brief summary of the planning and processes established in the original Contingency EVA development phase. It will then review how those plans and processes were implemented in 2010, highlighting what went well as well as where there were deficiencies between theory and reality. This paper will show that the original approach and analyses, though sound, were not as thorough as they should have been in the realm of planning for next worse failures, for documenting Programmatic approval of key assumptions, and not pursuing sufficient engineering analysis prior to the failure of the hardware. The paper will further highlight the changes made to the Contingency EVA preparation team structure, approach, goals, and the resources allocated to its work after the 2010 events. Finally, the authors will overview the implementation of these updates in addressing failures onboard the ISS in 2012, 2013, and 2014. The successful use of the updated approaches, and the application of the approaches to other spacewalks, will demonstrate the effectiveness of this additional work and make a case for putting significant time and resources into pre-failure planning and analysis for critical hardware items on human-tended spacecraft.

Van Cise, E. A.↗

Understanding Risk Tolerance and Building an Effective Safety Culture

Estimates range from 65-90 percent of catastrophic mishaps are due to human error. NASA's human factors-related mishaps causes are estimated at approximately 75 percent. As much as we'd like to error-proof our work environment, even the most automated and complex technical endeavors require human interaction... and are vulnerable to human frailty. Industry and government are focusing not only on human factors integration into hazardous work environments, but also looking for practical approaches to cultivating a strong Safety Culture that diminishes risk. Industry and government organizations have recognized the value of monitoring leading indicators to identify potential risk vulnerabilities. NASA has adapted this approach to assess risk controls associated with hazardous, critical, and complex facilities. NASA's facility risk assessments integrate commercial loss control, OSHA (Occupational Safety and Health Administration) Process Safety, API (American Petroleum Institute) Performance Indicator Standard, and NASA Operational Readiness Inspection concepts to identify risk control vulnerabilities.

Loyd, David↗

Ground Software Technologies – Embracing Change: Mission Drivers and Technology Opportunities to Enable Long Lived Missions

Mission lifecycles have proven to extend well beyond their original design. The benefits to this are countless but introduce challenges in today’s rapidly changing ground infrastructure and software technologies used to enable mission success. What remains constant is the risk posture missions maintain when accepting change and the use of new technologies. Larger missions are ready for change in early lifecycle development but near launch and especially in operations, few continue to evolve beyond what is set in place in phase C. This paper will discuss how the Advance Multi-Mission Operations System (AMMOS) intends to address, three driving missions concerns: Maintaining functionality (hardware/software) for decades, rapidly responding to security vulnerabilities in software, and finally the ability to quickly evolve infrastructure and software changes. These driving concerns are briefly described below: 1. Maintaining functionality (hardware/software) for decades. Hardware updates considerably faster than 10 years ago. Expectations that a system can remain in place for more than 10 years is no longer valid. Expecting to find hardware replacements for a system older than 5 years will increasingly become more and more challenging. How than do missions plan for hardware changes for long lived missions? Principle Objective: Provide abstraction by virtualizing and containerizing software abstract away any hardware dependencies and package up the application lightweight units. 2. Rapidly responding to security vulnerabilities in software. Cost is often the main impediment and largely driven by the revalidation and testing of system that undergo change. In todays, environment security updates are a major diver demanding systems remain up to date. How then do missions accept these changes and avoid large testing efforts? Principle Objective: Help reduce the cost of re-testing by automation of testing, deployment, and compartmentalizing change. 3. Ability to quickly evolve infrastructure and software changes. Responding quickly to change is similar to the second concern in this paper regarding security vulnerabilities. In this case, it address broader concerns of updating software and infrastructure on a more realistic timeline. How do missions stay up to date with the most recent versions of software and allowing for improved functionality? Principle Objective: Use continuous integration techniques at the system level to ensure rapid turnaround. This paper explores each of these concerns in more detail. It focuses the AMMOS’s current plans, challenges and current roadmap.

Giovannoni, Brian J.↗

Cincinnati & Covington Urban Development II: Assessing Flooding and Landslide Susceptibility Along the Ohio-Kentucky Border

Landslides and flooding are reoccurring environmental hazards that lead to health risks and economic burdens in the urban areas of Cincinnati, Ohio and Covington, Kentucky. These communities share underlying natural and artificial conditions that make them vulnerable to these hazards, including excessive precipitation, weak lithology, high impervious surface levels, and steep slopes. Despite the human and economic risks associated with these environmental hazards, the areas of highest vulnerability within the region remain unknown. NASA DEVELOP partnered with Groundwork USA and Groundwork Ohio River Valley (ORV) to assess the region’s susceptibility to landslides and flooding. The team utilized NASA Earth observations, including the Landsat 8 Operational Land Imager (OLI), Landsat 8 Thermal Infrared Sensor (TIRS), and Global Precipitation Measurement (GPM) Integrated Multi-satellitE Retrieval for GPM (IMERG), alongside ancillary datasets to map landslide susceptibility and exposure throughout the study area. The team also used ancillary data to map surface runoff and runoff retention using the Natural Capital Project’s Integrated Valuation of Ecosystem Services and Tradeoffs (InVEST) Urban Flood Risk Mitigation Model. The resulting landslide susceptibility and exposure maps highlight the neighborhoods around Avondale and Fairmount as areas of particularly high landslide exposure. Meanwhile, the InVEST outputs demonstrate that Downtown Cincinnati and the Queensgate neighborhood retain the least amount of rainfall. This research provides partners with a more complete hazard analysis of the greater Cincinnati area while also producing refined methodologies to enhance future flood and landslide vulnerability mapping throughout Groundwork USA’s nationwide network of communities.

Paxton LaJoie↗

Integrating Earth Observations and Socioeconomic Data to Address Health, Equity, and Environmental Justice

Access to reliable data about the characteristics of populations is a crucial component of decision making, policy development, and the assessment of progress towards strategic goals. Social determinants of health provide insight into the status of social and economic conditions within populations that have profound effects on public health, equity, and vulnerability. International frameworks such as the Sustainable Development Goals (SDGs) fundamentally focus on equality, but to efficiently address targets and indicators, socioeconomic data and Earth observations must be integrated to help identify populations most vulnerable to the impacts of climate change, natural disasters, health disparities, and poor policy planning. The ability to identify vulnerable populations with data analysis has the potential to empower community stakeholders with spatial awareness needed to inform decision-making that addresses equity and environmental justice issues within their communities. The EPA defines environmental justice (EJ) as “the fair treatment and meaningful involvement of all people regardless of race, color, national origin, or income with respect to the development, implementation and enforcement of environmental laws, regulations and policies.” NASA’s Earth Science Division (ESD) recognizes the benefits that Earth observations with NASA satellites create by equipping individuals with the knowledge to address community challenges. NASA’s Socioeconomic Data and Applications Center (SEDAC) supports the integration of socioeconomic and Earth science data as an “informational gateway.” This integration of data is advancing health, equity, and environmental justice initiatives.

Natasha Johnson-Griffin↗

The Compound Risk of Heat and COVID-19 in New York City: Riskscapes, Physical and Social Factors, and Interventions

Climate change is disrupting the fundamental conditions of human life and exacerbating existing inequity by placing further burdens on communities that are already vulnerable. Risk exposure varies by where people live and work. In this article, we examine the spatial overlap of the compound risks of COVID-19 and extreme heat in New York City. We assess the relationship between socio-demographic and natural, built and social environmental characteristics, and the spatial correspondence of COVID-19 daily case rates across three pandemic waves. We use these data to create a compound risk index combining heat, COVID-19, density and social vulnerability. Our findings demonstrate that the compound risk of COVID-19 and heat are public health and equity challenges. Heat and COVID-19 exposure are influenced by natural, built, and social environmental factors, including access to mitigation infrastructure. Socio-demographic characteristics are significant indicators of COVID-19 and heat exposure and of where compound vulnerability exists. Using GIS mapping, we illustrate how COVID-19 risk geographies change across the three waves of the pandemic and the particular impact of vaccinations before the onset of the third wave. We, then, use our compound risk index to assess heat interventions undertaken by the City, identify neighborhoods of both adequate and inadequate coverage and provide recommendations for future interventions.

COVID-19↗

New York Ecological Conservation: Evaluating Agricultural Conservation Easement Impact Using Earth Observations to Examine Avoided Soil Carbon Loss to Development

Farmland provides ecosystems and communities with services ranging from habitat conservation to food security. As total U.S. farmland continues to decline, agricultural lands near urban areas are especially vulnerable. Our project partners—Finger Lakes Land Trust, Genesee Land Trust, and Saratoga Preserving Land and Nature (PLAN)—can use study results to better profile farmland vulnerability, issuing conservation easements to protect maximum acreage in Saratoga County and the Finger Lakes Region of New York. Multiple existing studies effectively use remote sensing imagery to analyze historical land cover and forecast future change. This study examined soil carbon stocks and land cover change to estimate avoided soil carbon loss. We also predicted farmland vulnerability. We completed these analyses using European Space Agency (ESA) and NASA Earth observations that include Landsat 5 Thematic Mapper (TM), Landsat 8 Operational Land Imager (OLI), Landsat 9 OLI-2, Sentinel-2 Multispectral Instrument (MSI), and Suomi National Polar-Orbiting Partnership (NPP) Visible Infrared Imaging Radiometer Suite (VIIRS) for nighttime lights data that aided in the land change model analysis. We determined that the conversion of agriculture to development from 1990 to 2022 occurred at rates of 0.91% (Finger Lakes) and 7% (Saratoga). Urban development is predicted to increase surrounding urban centers through 2030 and 2050. We also estimate that between 26.5 and 348,101 kilotons (Finger Lakes) and 3.7 and 58,006 kilotons (Saratoga) of soil carbon losses have been avoided through agricultural easements. Findings from this study will support our partners in determining agricultural conservation easement benefits and prioritizing the acquisition of future easement sites.

Agriculture↗

Downscaled and Bias-Adjusted Climate Projections for Afghanistan

Climate change is already having devastating impacts on human communities and natural landscapes, from increasing severity and frequency of natural disasters to drought and desertification that degrade both natural ecosystems and human livelihoods. However, the impacts of climate change are not evenly distributed across the world—some places are at far greater risk than others. These highly vulnerable places should be a higher priority for investments and interventions to help people and nature adapt to changing climatic conditions. Afghanistan is one of the most at-risk countries from climate change. Within the country, the river basins are particularly sensitive as climate change will dramatically alter their water regimes upon which ecosystems and a vast proportion of the Afghan population and millions of people in neighbouring countries rely. As part of an EU-funded project implemented by the Wildlife Conservation Society (WCS), WCS conducted a vulnerability assessment for the Amu Darya River Basin that drains c. 14% of Afghanistan’s land area and is critically important for supporting both people and sensitive biodiversity (Elsen et al., 2023). Central to the vulnerability assessment was the development of downscaled and bias-adjusted climate projections, produced by the Center for Climate Systems Research (CCSR)1. The climate projections were produced at a much higher resolution (1 km2) than were otherwise available and were tailored to the local environment.

climate projections↗

Models of Human-Automation Systems: Initial Analysis of the Boeing 737MAX Design

We describe a formal approach to identifying human factors design vulnerabilities and usability concerns in the context of automated control systems. We present an initial analysis of the design of the B737MAX that has suffered two fatal accidents. We highlight two main design vulnerabilities and one usability concern. Key formal generic properties used to identify these vulnerabilities and usability concerns are defined. These generic properties, and others referenced in the paper, can be applied to the analysis of any human-automation system.

HSI↗

Analyzing Insider Risk Threat to the Internet of Things (IoT)

Recent technological advancement has created a growing convergence of innovation. From machine learning to ubiquitous computing to wireless networks and automation, the world is seeing new technology increasingly capable of connecting with each other. Devices and systems use open communications networks to interact, process information, and react. This is called the Internet of Things (IoT) and is comprised of physical devices that exchange data over networks, creating revolutionary possibilities. The most common way most people interact with an IoT is through ‘smart home’ products like Amazon’s Alexa, which use microphones, speakers, and phones to control a variety of devices, from lights and thermostats, to cameras, to appliances and vacuum cleaners. But the open nature of IoT networks—necessary for their ability to communicate and operate—also introduces privacy and security concerns. At a personal level, this might mean a hack into a home to steal private information, but when applied in broader industries like healthcare, transportation, manufacturing, or the military, this vulnerability can have serious consequences. As IoT usage and interconnectivity increases, so too does the susceptibility to malicious actors. And the entire system is only as secure as its least secure member. This creates particular risk and vulnerability to radiological material industries, as a competent insider adversary could utilize the IoT to potentially steal or access classified or sensitive information about employees, sites, or systems; or simply sabotage security or maintenance from a more remote—and less secure—device. The IoT relies on a secure network across the entire system, especially in transport which may lack the security of more permanent locations; if one device fails, it can create a ripple effect and an insider threat may seek to exploit that connectivity. While IoT benefits drive increased innovation and usage, there are also vulnerabilities an insider threat could exploit; this risk of an IoT to radiological material must be addressed in any mitigation effort.

Kinney, Justin↗

Software Bill of Materials in the Nuclear Industry

Nuclear power plants (NPP) have thousands of digital assets throughout their facility. Typically, NPPs have asset and configuration management programs that capture the make, model, and version of a component. This information, however, usually only includes first- or second-tier components and does not capture the complete enumeration of software components and their dependencies within operational technology (OT) equipment. As seen with recent cyberattacks, this level of detail is insufficient for identifying if and where an exploitable vulnerability exists within a facility. A software bill of materials (SBOM) provides this detailed enumeration. Further, integrating SBOMs with vulnerability data sources and vulnerability attestation reports can provide improved awareness leading to better cyber risk management and incident response. Preferably, SBOMs are provided by the supplier; however, when an NPP already owns a device, it is less likely they will have a supplier provided-SBOM. Fortunately, SBOMs can be generated on installed digital assets. This paper provides an introduction to the U.S. Department of Energy Office of Nuclear Energy paper titled “Towards Software Bill of Materials in the Nuclear Industry,” which describes the SBOM ecosystem and provides a suggested approach to methodically and seamlessly integrate an SBOM program in an NPP.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

A Real-Time ANPC Inverter Digital Twin with Integrated Design-For-Trust

The demand for renewable energy has increased over the last few years, and so has the demand for greater expectations within the energy market. This increasing trend has been accompanied by more significant usage of internet-connected devices (IoT), leading to critical electrical infrastructure being connected to the internet. Implementing internet connectivity with such devices and systems provides benefits such as improving the system's performance, facilitating irregularity and anomaly mitigation, and providing additional situational awareness for enhanced decision-making. However, enhancing the connected system with IoT introduces a drawback – a greater vulnerability to cyber-attacks. Cyber-attacks targeting critical infrastructure in the electrical sector have occurred in the United States and Ukraine. These cyber-attacks highlight and expose vulnerabilities that a system inherits when connecting to the internet. These attacks left thousands of customers without electricity for hours until operators could regain control of the electric utility grid. Therefore, to address the vulnerabilities of an internet-connected power electronic device, this work focused on the hardware layer of the system. Implementing a cyber-control system inside the hardware layer can significantly reduce the possibility of an attacker patching malicious controller firmware into a photovoltaic grid-connected inverter, thus mitigating the likelihood that the inverter becomes inactive a cyber-attack scenario. With this mitigation technique, if a cyberattack is successful and an attacker gains control of the network, a cyber-defense technique is in place to mitigate the impact of the cyber-attack. This additional protection layer was developed based on an innovative concept known as Digital Twin (DT). A DT, in this case, replicates an Active-Neutral Point Clamped (ANPC) inverter and was designed using a hardware language known as VHDL (Very High-Speed Integrated Circuit Hardware Description Language) and applied to Field-Programmable-GateArray (FPGA). The DT is embedded within the FPGA and contained in a controller board, the UCB (Unified Controller Board), developed by the University of Arkansas electrical engineering team. This UCB also contains two Digital Signal Processors (DSPs) responsible for generating associated signals to control an authentic physical inverter. These DSP signals are received and processed by the FPGA that implements the DT of an ANPC; in other words, it simulates in realtime the expected output of an actual ANPC inverter using the signals from the DSP. When a new firmware is ready to be patched, the DT provides output signals simulating behavior that a real ANPC inverter would generate with the new firmware. The new firmware is tested to check if it meets all the operational requirements established using a Design-For-Trust technique (DFTr). If the new firmware fails in at least one of the DFT tests, it is considered malicious and must be rejected. This work is divided into sections, such as Background, which explains the pieces that were used and the strategy behind this work; Process and Procedure, which explains the methodology that was adopted to prove the reliability and effectiveness of this work; Results and Discussion, where the simulations and results are described and explained; followed by Conclusion and Future work section, which concludes this work and adds possible future projects to continue this work further.

do Amaral Custodio, Paulo Vitor↗

Trends in Cybersecurity Threats to Clean Energy

As deployments of clean energy generation and storage assets continue to grow, the increased attack surface creates a greater risk for cyber threats, but is clean energy truly a target for cyber adversaries? This poster will present research on the trends in cyber incidents that have affected clean energy companies and assets as well as the trends in disclosed and exploited vulnerabilities. From a series of ransomware attacks on European wind manufacturers, to vulnerabilities exploited in solar assets to turn controllers into botnets, to attacks on communication infrastructure that have resulted in extended outages of remote control and monitoring, we explore the techniques used and the impacts to the clean energy sector. Key takeaways include understanding of how OT-focused malware is becoming more flexible and more destructive, how known vulnerabilities are being exploited, the growing number of IT and OT attacks that use built in tools and functionalities. Additionally, we highlight the presumed motivations and targeted sectors for various identified cyber adversaries. Viewers will leave with an understanding of how recent headlines fit into the development of cyberattack trends and what preventions they may need to take to protect against increasingly popular tactics.

14 SOLAR ENERGY↗

Forensic Analysis of SOHO Router Binaries

Small Office/Home Office (SOHO) routers are used by millions of consumers across the United States, and are commensurately vulnerable. Forensic analysis of SOHO router firmware helps to understand and mitigate those vulnerabilities. This poster focused particularly on analysis of BusyBox executables, a software suite that provides several Unix utilities in a single file. Three main tools were used to analyze the binaries. BinWalk was used to extract the files, but also to build entropy graphs, extract Linux kernel images, and identify CPU architectures; WiiBin processed the binaries to find endianness, architecture, the percent compressed/encrypted, and compiler data; and @DisCo, a machine learning tool used to determine function similarity in disassembled binaries, analyzed similarities and determined versions of extracted BusyBox files from each router. These tools found that venders from all five routers utilized the same version of the BusyBox software across different firmware updates, demonstrating the importance of constant firmware scrutiny to protect against security vulnerabilities.

24 POWER TRANSMISSION AND DISTRIBUTION↗