Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Information Security Analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3
All sourcesNASA NTRSDOE OSTI
NASA NTRS2018

Supply Chain Research and Analysis for Space Systems

The implementation of NASA GSFC's portfolio of mission projects relies upon inter-connected, multi-tiered supply chains of organizations operating under direct and indirect contracts and other agreements throughout the U.S. and around the world. These supply chains are subject to an inter-related array of technical/production, business, market and security risks that are amplified by the ongoing globalization of industry and technology and which can disrupt or threaten the production and delivery of products and services when needed and in conformance with requirements. In recognition of such risks and associated challenges, GSFC's SMA directorate launched an innovative Supply Chain Research and Analysis capability three years ago to gain greater insight into the operating environment, performance, capabilities and viability of current and prospective suppliers for GSFC projects and proposals. The capability uses business intelligence techniques and primarily open source information resources as part of a cost-effective, non-intrusive methodology to produce several types of research and analysis reports. The reports are based on a holistic analytical framework encompassing key technical/production, business enterprise management, market and security factors, and feature in-depth information, summary information profiles, SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis, and candidate risk concerns in order to pro-actively support SMA and project management needs. The SRA capability, which is designed to complement and support ongoing SMA/project management activities and practices, has produced over 105 reports since its start-up in early 2015.This presentation addresses the approach, methodology and performance of the Supply Chain Research and Analysiscapability and its value in assuring the success of NASA mission projects. In doing so, the presentation provides lessons-learned, best practices, case examples and address how it fits into the development of an enterprise-level Supply Chain Risk Management capability.

supply chain risk management↗
DOE OSTI2011

An Analysis of Security and Privacy Issues in Smart Grid Software Architectures on Clouds

Power utilities globally are increasingly upgrading to Smart Grids that use bi-directional communication with the consumer to enable an information-driven approach to distributed energy management. Clouds offer features well suited for Smart Grid software platforms and applications, such as elastic resources and shared services. However, the security and privacy concerns inherent in an information rich Smart Grid environment are further exacerbated by their deployment on Clouds. Here, we present an analysis of security and privacy issues in a Smart Grids software architecture operating on different Cloud environments, in the form of a taxonomy. We use the Los Angeles Smart Grid Project that is underway in the largest U.S. municipal utility to drive this analysis that will benefit both Cloud practitioners targeting Smart Grid applications, and Cloud researchers investigating security and privacy.

Simmhan, Yogesh↗
DOE OSTI2016

Cyber-Physical Security Assessment (CyPSA) Toolset

CyPSA seeks to organize and gain insight into the diverse sets of data that a critical infrastructure provider must manage. Specifically CyPSA inventories, manages, and analyzes assets and relations among those assets. A variety of interfaces are provided. CyPSA inventories assets (both cyber and physical). This may include the cataloging of assets through a common interface. Data sources used to generate a catalogue of assets include PowerWorld, NPView, NMap Scans, and device configurations. Depending upon the role of the person using the tool the types of assets accessed as well as the data sources through which asset information is accessed may vary. CyPSA allows practitioners to catalogue relations among assets and these may either be manually or programmatically generated. For example, some common relations among assets include the following: Topological Network Data: Which devices and assets are connected and how? Data sources for this kind of information include NMap scans, NPView topologies (via Firewall rule analysis). Security Metrics Outputs: The output of various security metrics such as overall exposure. Configure Assets:CyPSA may eventually include the ability to configure assets including relays and switches. For example, a system administrator would be able to configure and alter the state of a relay via the CyPSA interface. Annotate Assets: CyPSA also allows practitioners to manually and programmatically annotate assets. Sources of information with which to annotate assets include provenance metadata regarding the data source from which the asset was loaded, vulnerability information from vulnerability databases, configuration information, and the output of an analysis in general.

Garcia, Luis↗
NASA NTRS2008

Food Security, Decision Making and the Use of Remote Sensing in Famine Early Warning Systems

Famine early warning systems use remote sensing in combination with socio-economic and household food economy analysis to provide timely and rigorous information on emerging food security crises. The Famine Early Warning Systems Network (FEWS NET) is the US Agency for International Development's decision support system in 20 African countries, as well as in Guatemala, Haiti and Afghanistan. FEWS NET provides early and actionable policy guidance for the US Government and its humanitarian aid partners. As we move into an era of climate change where weather hazards will become more frequent and severe, understanding how to provide quantitative and actionable scientific information for policy makers using biophysical data is critical for an appropriate and effective response.

Brown, Molly E.↗
NASA NTRS1990

Applying the take-grant protection model

The Take-Grant Protection Model has in the past been used to model multilevel security hierarchies and simple protection systems. The models are extended to include theft of rights and sharing information, and additional security policies are examined. The analysis suggests that in some cases the basic rules of the Take-Grant Protection Model should be augmented to represent the policy properly; when appropriate, such modifications are made and their efforts with respect to the policy and its Take-Grant representation are discussed.

Bishop, Matt↗
NASA NTRS2002

A Virtual Mission Operations Center: Collaborative Environment

The Virtual Mission Operations Center - Collaborative Environment (VMOC-CE) intent is to have a central access point for all the resources used in a collaborative mission operations environment to assist mission operators in communicating on-site and off-site in the investigation and resolution of anomalies. It is a framework that as a minimum incorporates online chat, realtime file sharing and remote application sharing components in one central location. The use of a collaborative environment in mission operations opens up the possibilities for a central framework for other project members to access and interact with mission operations staff remotely. The goal of the Virtual Mission Operations Center (VMOC) Project is to identify, develop, and infuse technology to enable mission control by on-call personnel in geographically dispersed locations. In order to achieve this goal, the following capabilities are needed: Autonomous mission control systems Automated systems to contact on-call personnel Synthesis and presentation of mission control status and history information Desktop tools for data and situation analysis Secure mechanism for remote collaboration commanding Collaborative environment for remote cooperative work The VMOC-CE is a collaborative environment that facilitates remote cooperative work. It is an application instance of the Virtual System Design Environment (VSDE), developed by NASA Goddard Space Flight Center's (GSFC) Systems Engineering Services & Advanced Concepts (SESAC) Branch. The VSDE is a web-based portal that includes a knowledge repository and collaborative environment to serve science and engineering teams in product development. It is a "one stop shop" for product design, providing users real-time access to product development data, engineering and management tools, and relevant design specifications and resources through the Internet. The initial focus of the VSDE has been to serve teams working in the early portion of the system/product lifecycle - concept development, proposal preparation, and formulation. The VMOC-CE expands the application of the VSDE into the operations portion of the system lifecycle. It will enable meaningful and real-time collaboration regardless of the geographical distribution of project team members. Team members will be able to interact in satellite operations, specifically for resolving anomalies, through access to a desktop computer and the Internet. Mission Operations Management will be able to participate and monitor up to the minute status of anomalies or other mission operations issues. In this paper we present the VMOC-CE project, system capabilities, and technologies.

Medina, Barbara↗
DOE OSTI2024

Digital risk analysis in nuclear engineering projects: Designing for safety, performance, reliability, and security

Cyber-informed engineering and security-by-design frameworks are important in promoting the need to identify cybersecurity concerns early in the systems engineering lifecycle so risks from adversarial cyber-attacks can be eliminated or reduced through engineering design practices. In addition to adversarial risk, risk in operational technology systems also includes non-adversarial and unintentional risk from other factors such as human performance errors, environmental conditions, design flaws, and device degradation or failure. This paper introduces a new concept for characterizing digital risk, both adversarial and non-adversarial, and provides the basis for initial research into a novel digital risk analysis approach focused on incorporating attack difficulty into a multi-attribute analysis technique using robust decision-making. This digital risk characterization is also used to frame a discussion on the challenges of competing objectives and competing stakeholder requirements in an integrated energy system project that incorporates a small modular reactor and industrial facility.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2022

FIC Vulnerability Profile

The FIC team is engaged with Pacific Northwest National Laboratory’s (PNNL’s) Shamrock Cyber Team to provide cybersecurity analyses of the FIC software. Shamrock offers both Threat-Based Analysis services and Secure Software Development services. These services are ultimately used to understand and mitigate threats against software and to reduce vulnerabilities in software, thus improving overall cybersecurity and informing decision makers. Shamrock’s Secure Software Development services, specifically Static Analysis Security Testing (SAST) and Open-Source Analysis (OSA), produced this Vulnerability Profile.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2022

A Central Asia Hydrologic Monitoring Dataset for Food and Water Security Applications in Afghanistan

From the Hindu Kush mountains to the Registan Desert, Afghanistan is a diverse landscape where droughts, floods, conflict, and economic market accessibility pose challenges for agricultural livelihoods and food security. The ability to remotely monitor environmental conditions is critical to support decision making for humanitarian assistance. The Famine Early Warning Systems Network (FEWS NET) Land Data Assimilation System (FLDAS) global and Central Asia data streams provide information on hydrologic states for routine integrated food security analysis. While developed for a specific project, these data are publicly available and useful for other applications that require hydrologic estimates of the water and energy balance. These two data streams are unique because of their suitability for routine monitoring, as well as for being a historical record for computing relative indicators of water availability. The global stream is available at ∼ 1-month latency, and monthly average outputs are on a 10 km grid from 1982–present. The second data stream, Central Asia (21–56°N, 30–100°E), at ∼ 1 d latency, provides daily average outputs on a 1 km grid from 2000–present. This paper describes the configuration of the two FLDAS data streams, background on the software modeling framework, selected meteorological inputs and parameters, and results from previous evaluation studies. We also provide additional analysis of precipitation and snow cover over Afghanistan. We conclude with an example of how these data are used in integrated food security analysis. For use in new and innovative studies that will improve understanding of this region, these data are hosted by U.S. Geological Survey data portals and the National Aeronautics and Space Administration (NASA). The Central Asia data described in this paper can be accessed via the NASA repository at https://doi.org/10.5067/VQ4CD3Y9YC0R (Jacob and Slinski, 2021), and the global data described in this paper can be accessed via the NASA repository at https://doi.org/10.5067/5NHC22T9375G (McNally, 2018).

Amy McNally↗
DOE OSTI2016

Preliminary Cyber-Informed Dynamic Branch Conditions for Analysis with the Dynamic Simplified Cyber MELCOR Model

Instrumentation and control of nuclear power is transforming from analog to modern digital assets. These control systems perform key safety and security functions. This transformation is occurring in new plant designs as well as in the existing fleet of plants as the operation of those plants is extended to 60 years. This transformation introduces new and unknown exploits involving both digital asset induced safety issues and security exploits. Traditional the open literature of nuclear power risk assessment tools and cyber security assessment methods have not been modified or developed to address the unique nature of cyber failure modes and of cyber security threats. Starting in 2015, Sandia National Laboratories (SNL) embarked on a two year dynamic cyber-risk informed project to facilitate the analysis of unique cyber failure modes and the time sequencing of cyber faults, both malicious and non-malicious, and impose those cyber exploits and cyber faults onto a nuclear power plant accident sequence simulator code to assess how cyber exploits and cyber faults could interact with a plant's digital instrumentation and control (DI and C) system in the absence of digital controls. This will be achieved by coupling SNL's existing dynamic scheduler code (ADAPT), nuclear accident simulator code (MELCOR), and cyber Emulytics code (SCEPTRE) to demonstrate real-time simulation of cyber exploits and their impact on automatic DI and C responses. Studying such potential time-sequenced cyber-attacks and their risks (i.e., the associated impact and the associated degree of difficulty to achieve the attack vector) as they pertain to accident management will provide a risk informed basis for developing effective cyber security controls for nuclear power. This paper will discuss the rationale behind the proposed generic cyber exploits for an abstracted Pressurized Water Reactor that has adopted a unified DI and C System. Other papers related to this project submitted to this conference discuss: - The MELCOR model for this abstracted reactor, called the Dynamic Simplified Cyber (DSC) model, - Modifications to ADAPT to: Extend the framework for multiple simulators, Incorporation of importance measures into dynamic event tree analysis, Sort and reduce the dynamic event tree based upon inputs to or outputs from the tree, and - A feasibility study for using density based clustering methods with dynamic time wrapping to cluster and prune dynamic event trees. (authors)

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2025

Defensive Cybersecurity Architecture Design Using Force-on-Force Cyber-Physical Modeling

Currently, nuclear power plant physical security systems are highly dependent on air-gaps as a protective measure against cyber-threats. Cyber-physical threats become more likely as advanced cyber-threat capabilities to jump air-gaps transition into common use. Defending against the emerging threat of cyber-enabled physical intrusions is poorly understood. The consequence of these cyber-physical attacks has no quantitative analysis method to inform risk-informed, performance-based cybersecurity approaches. By modifying the physical security simulation tool Dante, cyber-physical threat consequence was able to be analyzed on a notional facility. The results of this analysis are used to design a Defensive Cybersecurity Architecture (DCSA) for the physical security system to produce example resilience measures for this notional facility. A DCSA defines security levels to provide a graded approach for defending plant functions, and security zones for trusted communication between systems. This approach can be applied to real world systems to produce physical protection systems and response measures that are resilient to cyber-physical threats.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Approach and Model Used to Represent a Timeline Analysis for Security Design Enhancements

Next-generation reactors will be able to use risk to inform and performance base the licensing of many aspects of the reactor, facility, and site design, including attributes of physical security. There are several factors related to security, including site topography, reactor design, and physical protection system components, to consider when designing the physical protection system into the overall facility design and plan of operation. With the versatility of advanced reactors, especially micro reactors, methods are needed to simplify and quickly evaluate potential timelines for designing a site configuration. This report describes an approach to generate qualitative and quantitative insights using a risk-informed simulation. The modeling process is described in detail, focusing on three aspects: (1) the facility mission time (the time required to control the plant until safe), (2) the attacker timeline (the time to potential sabotage), and (3) the response timeline (the time to counter the facility attack). The modeling capabilities also are extended to include facility physical phenomena such as thermal-hydraulics and heat transfer to capture realistic representation of dynamic changes to a facility. While the plant models and examples are hypothetical and do not represent a real facility, these modeling approaches could be used for future security-by-design engineering in advanced reactors. The outputs and insights from the modeling approach may be used to modify and optimize the security posture of a facility by efficiently making modifications to the model and seeing the overall impact from the modification. Lastly, use of the approach described in this report can also provide the technical basis for a physical protection program, describing how the facility and security strategy will cope with off-normal events.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2019

Additive Manufacturing and Nuclear Security: Calibrating Rewards and Risks

In a security environment marked by a high degree of technological dynamism, additive manufacturing (AM) stands out for its special significance. The AM field has emerged from infancy, with many new and potential applications in the commercial and military sectors. Its potential impact on nuclear security is a matter of rising debate, with some emphasizing the disruptive consequences of AM competition for international stability and others emphasizing the disruptive benefits for the United States. This essay addresses both aspects and draws on a technical analysis to inform the further development of U.S. policy. From a nuclear-security perspective, additive manufacturing offers both rewards and risks for the United States and its allies. The rewards are primarily (1) reduced scale of effort and cost in maintaining weapons-production infrastructure and (2) greatly increased responsiveness and agility in production infrastructure. Both these benefits are long-standing U.S. policy goals. The risks derive from the potential impact of AM on foreign nuclear weapons programs and are of three kinds. Those impacts will likely be a function of the degree of technical sophistication of the foreign actor. Non-state actors and entry-level proliferants pose modest AM risks relative to more advanced states, including both existing nuclear-weapon- states and those developed countries with a high degree of nuclear latency. A critical factor in predicting the impact of AM is current uncertainty as to the utility of AM techniques in the fabrication of special nuclear materials. To meet the emerging challenges of AM, U.S. policy makers face a number of decisions regarding which benefits to seek, how much risk to accept, and how to reduce that risk. The basic strategic approach of the United States to the AM problem is sound, but some fine-tuning is necessary and appropriate at this time. The good news is that we have time to act; the bad news is that the time to act decisively may be shorter than we would wish.

42 ENGINEERING↗
DOE OSTI2013

Fuel Cell Technology Status Analysis Project: Partnership Opportunities (Fact Sheet)

This fact sheet describes National Renewable Energy Laboratory's (NREL's) Fuel Cell Technology Status Analysis Project. NREL is seeking fuel cell industry partners from the United States and abroad to participate in an objective and credible analysis of commercially available fuel cell products to benchmark the current state of the technology and support industry growth. Participating fuel cell developers share price information about their fuel cell products and/or raw fuel cell test data related to operations, maintenance, and safety with NREL via the Hydrogen Secure Data Center (HSDC). The limited-access, off-network HSDC houses the data and analysis tools to protect proprietary information. NREL shares individualized data analysis results as detailed data products (DDPs) with the partners who supplied the data. Aggregated results are published as composite data products (CDPs), which show the technology status without identifying individual companies. The CDPs are a primary benchmarking tool for the U.S. Department of Energy and other stakeholders interested in tracking the status of fuel cell technologies. They highlight durability advancements, identify areas for continued development, and help set realistic price expectations at small-volume production.

08 HYDROGEN↗
DOE OSTI2011

Secure VM for Monitoring Industrial Process Controllers

In this paper, we examine the biological immune system as an autonomic system for self-protection, which has evolved over millions of years probably through extensive redesigning, testing, tuning and optimization process. The powerful information processing capabilities of the immune system, such as feature extraction, pattern recognition, learning, memory, and its distributive nature provide rich metaphors for its artificial counterpart. Our study focuses on building an autonomic defense system, using some immunological metaphors for information gathering, analyzing, decision making and launching threat and attack responses. In order to detection Stuxnet like malware, we propose to include a secure VM (or dedicated host) to the SCADA Network to monitor behavior and all software updates. This on-going research effort is not to mimic the nature but to explore and learn valuable lessons useful for self-adaptive cyber defense systems.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2021

UKy-CAER Heat Integrated Transformative CO 2 Capture Process in Pulverized Coal Power Plants

The goal of this Phase II Topical Report is to summarize the work for public domain conducted on project DE-FE0031583. Building upon the Design Basis completed during Phase I and in accordance with the Statement of Project Objectives (SOPO), the University of Kentucky (UK) Center for Applied Energy Research (CAER) (Recipient) along with team members has completed the Front End Engineering Design (FEED) for its advanced, versatile post-combustion CO 2 capture system (CCS) at the 10 MWe large pilot scale to be installed at the Wyoming (WY) Integrated Test Center (ITC), using a heat integrated process with split-rich fed, two-stage stripping and any advanced solvent to enhance the CO 2 absorber performance and lower the cost of CO 2 capture. The proposed project (Phases I-III) involves the design, fabrication, installation, testing and evaluation of a large pilot scale facility that will demonstrate the UK CAER transformative CCS integrated with an operating power plant. The work performed in Phase I, detailed in the Phase I Topical Report that was submitted in March 2019, included formation of a project team, securing the host site, and completing pre-FEED design basis, a cost estimation, a preliminary techno-economic analysis (TEA) and an environmental information volume (EIV). The work performed in Phase II, detailed in this Phase II Topical Report, includes completion of FEEDs, completion of a process risk analysis (PRA), obtaining necessary permits, updating the EIV and TEA, updating the cost and schedule estimate for the Phase III scope of work (SOW) and securing the necessary cost share. Updated information is provided on the current status of the UK CAER CCS technology and the project is ready to begin immediately detailed design, construction and operation of the proposed pilot.

20 FOSSIL-FUELED POWER PLANTS↗
DOE OSTI2011

DOE SciDAC's Earth System Grid Center for Enabling Technologies Final Report

The mission of the Earth System Grid Federation (ESGF) is to provide the worldwide climate-research community with access to the data, information, model codes, analysis tools, and intercomparison capabilities required to make sense of enormous climate data sets. Its specific goals are to (1) provide an easy-to-use and secure web-based data access environment for data sets; (2) add value to individual data sets by presenting them in the context of other data sets and tools for comparative analysis; (3) address the specific requirements of participating organizations with respect to bandwidth, access restrictions, and replication; (4) ensure that the data are readily accessible through the analysis and visualization tools used by the climate research community; and (5) transfer infrastructure advances to other domain areas. For the ESGF, the U.S. Department of Energy's (DOE's) Earth System Grid Center for Enabling Technologies (ESG-CET) team has led international development and delivered a production environment for managing and accessing ultra-scale climate data. This production environment includes multiple national and international climate projects (such as the Community Earth System Model and the Coupled Model Intercomparison Project), ocean model data (such as the Parallel Ocean Program), observation data (Atmospheric Radiation Measurement Best Estimate, Carbon Dioxide Information and Analysis Center, Atmospheric Infrared Sounder, etc.), and analysis and visualization tools, all serving a diverse user community. These data holdings and services are distributed across multiple ESG-CET sites (such as ANL, LANL, LBNL/NERSC, LLNL/PCMDI, NCAR, and ORNL) and at unfunded partner sites, such as the Australian National University National Computational Infrastructure, the British Atmospheric Data Centre, the National Oceanic and Atmospheric Administration Geophysical Fluid Dynamics Laboratory, the Max Planck Institute for Meteorology, the German Climate Computing Centre, the National Aeronautics and Space Administration Jet Propulsion Laboratory, and the National Oceanic and Atmospheric Administration. The ESGF software is distinguished from other collaborative knowledge systems in the climate community by its widespread adoption, federation capabilities, and broad developer base. It is the leading source for present climate data holdings, including the most important and largest data sets in the global-climate community, and - assuming its development continues - we expect it to be the leading source for future climate data holdings as well. Recently, ESG-CET extended its services beyond data-file access and delivery to include more detailed information products (scientific graphics, animations, etc.), secure binary data-access services (based upon the OPeNDAP protocol), and server-side analysis. The latter capabilities allow users to request data subsets transformed through commonly used analysis and intercomparison procedures. As we transition from development activities to production and operations, the ESG-CET team is tasked with making data available to all users seeking to understand, process, extract value from, visualize, and/or communicate it to others. This ongoing effort, though daunting in scope and complexity, will greatly magnify the value of numerical climate model outputs and climate observations for future national and international climate-assessment reports. The ESG-CET team also faces substantial technical challenges due to the rapidly increasing scale of climate simulation and observational data, which will grow, for example, from less than 50 terabytes for the last Intergovernmental Panel on Climate Change (IPCC) assessment to multiple Petabytes for the next IPCC assessment. In a world of exponential technological change and rapidly growing sophistication in climate data analysis, an infrastructure such as ESGF must constantly evolve if it is to remain relevant and useful. Regretfully, we submit our final report at the end of project funding. To continue to serve the climate-science community, we are currently seeking additional funding. Such funding would allow us to maintain and enhance ESGF production and operation of this vital endeavor of cataloging, serving, and analyzing ultra-scale climate science data. At this time, the entire ESG-CET team would like to take this opportunity to sincerely thank our funding agencies in the DOE Scientific Discovery through Advanced Computing (SciDAC) program and the Office of Biological and Environmental Research (OBER) - as well as our national and international collaborators, stakeholders, and partners - for allowing us to work with you and serve the community these past several years.

54 ENVIRONMENTAL SCIENCES↗