Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Cybersecurity”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 577 records · Page 32
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

NNSA Minority Serving Institute Partnership Program (MSIPP)— Advanced Synergistic Program for Indigenous Research in Engineering (ASPIRE) (FY22 Q1 Progress Report)

In 2016, the National Nuclear Security Agency (NNSA) initiated the Minority Serving Institution Partnership Plan (MSIPP) targeting Tribal Colleges and Universities (TCUs) to offer programs that will prepare students for technical careers in NNSA’s laboratories and production plants. The MSIPP consortium’s approach is as follows: 1) align investments at the college and university level to develop a curriculum and workforce needed to support NNSA’s nuclear weapon enterprise mission, and 2) to enhance research and education at under-represented colleges and universities. The first TCU consortium that MSIPP launched was known as the Advanced Manufacturing Network Initiative (AMNI) whose purpose was to develop additive manufacturing (AM) learning opportunities. The AMNI consortium consisted of Bay Mills Community College, Cankdeska Cikana Community College, Navajo Tech University, Salish Kootenai Community College, Turtle Mountain Community College, and United Tribes Technical College. In 2016, the American Indian Higher Education Consortium (AIHEC), the AMNI consortium and the Southwestern Indian Polytechnic Institute (SIPI), in collaboration with Sandia National Labs, using a grant by NNSA hosted the first TCU Advanced Manufacturing Technology Summer Institute (TCU AMTSI). The AMNI consortium will officially end Sept. 2022. However, building on the successes of AMNI, in FY22 NNSA’s MSIPP launched three additional consortiums: (1) the Indigenous Mutual Partnership to Advanced Cybersecurity Technology (IMPACT), which focuses on STEM and cybersecurity, (2) the Advanced Synergistic Program for Indigenous Research in Engineering (ASPIRE), which focuses on STEM and the electrical and mechanical engineering skills set needed for renewable and distributed energy systems, and (3) the Partnership for Advanced Manufacturing Education and Research (PAMER), which focuses on developing and maintaining a sustainable pathway for a highly trained, next-generation additive manufacturing workforce and a corresponding community of subject matter experts for NNSA enterprises. The following report summarizes the status update during this quarter for the ASPIRE program.

42 ENGINEERING↗
DOE OSTI2021

Cyber-Physical Risks for Advanced Reactors

Cybersecurity for industrial control systems is an important consideration that advance reactor designers will need to consider. How cyber risk is managed is the subject of on-going research and debate in the nuclear industry. This report seeks to identify potential cyber risks for advance reactors. Identified risks are divided into absorbed risk and licensee managed risk to clearly show how cyber risks for advance reactors can potentially be transferred. Absorbed risks are risks that originate external to the licensee but may unknowingly propagate into the plant. Insights include (1) the need for unification of safety, physical security, and cybersecurity risk assessment frameworks to ensure optimal coordination of risk, (2) a quantitative risk assessment methodology in conjunction with qualitative assessments may be useful in efficiently and sufficiently managing cyber risks, and (3) cyber risk management techniques should align with a risked informed regulatory framework for advance reactors.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2022

Operational Technology Behavioral Analytics (OTBA) (Final Technical Report DE-FE0031640)

This final report provides a summary of the methodology, findings, lessons learned, and insights from an investigation into the feasibility of the Operational Technology Behavioral Analytics (OTBA) cybersecurity approach. The concept was evaluated with data from the National Carbon Capture Center (NCCC) – a U.S. Department of Energy (DOE) funded facility that is managed and operated by Southern Company Services, Inc. at Alabama Power Company’s E. C. Gaston generating power plant in Wilsonville, Alabama. Appropriate data sources for the post-combustion carbon capture system were identified. Infrastructure was deployed to monitor, capture and archive data for the system. Critical parameters for each subsystem were identified and analyzed. Machine-learning algorithms were used to establish and characterize normal operations and subsequently identify anomalies. This effort yielded valuable insights and formed the basis of a data-centric strategy for detecting cyber-attacks along with a coordinated response philosophy. A significant takeaway is that the OTBA cybersecurity approach is quite portable; it can be applied to other critical infrastructure beyond fossil power generation.

20 FOSSIL-FUELED POWER PLANTS↗
DOE OSTI2022

Ambassador Project (Final Report)

SEL, in collaboration with its partners, performed research, development and demonstration of a trust, data, and resource management software layer enabling multiple software applications from different suppliers to operate in a Software Defined Infrastructure. The Energy sector has successfully deployed Software Defined Networking (SDN) technology and is rapidly scaling deployments. One major benefit of SDN is the abstracted centralized nature of the orchestration and management of the network. This architecture enables end users to deploy new technology and capabilities as quickly as they perform firmware upgrades to field devices. When an end user needs to roll trucks to install new equipment, they simply deploy new software to run on top of this SD-Infrastructure. This has attracted many software companies to develop value added features and introduce new capabilities, which is all good for the industry but has also introduced new challenges, including how to manage trust between these software applications, how to manage the data integrity and access, and how to manage access to the network resources each of these software applications are demanding. Completion of this project developed and demonstrated a safe and reliable resource scheduler and cybersecurity trust management communication platform allowing multiple software applications to operate in a SD-Infrastructure resulting in the commercialization of a software eco-system and architecture that maintains interoperability, cybersecurity, and reliability where the end user can safely scale out their software to leverage the powerful benefits of SDN.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

WPTO Navigator

Protecting hydroelectric plants from incidents that adversely impact their cyber-physical systems presents unique challenges due to the plants’ widely dispersed geographic locations and varied configurations as well as the relative nascent nature of the cyberattacks targeting these facilities. To help hydroelectric plants better respond to and mitigate cybersecurity incidents, this Department of Energy Water Power Technologies Office Navigator aligns the processes within the National Institute of Standards 800-61r2 Computer Security Incident Handling Guide with the emergency actions within the FEMA 64 Emergency Action Plan Framework. This work is to be used at a hydroelectric plant to quickly understand how the plant responds to a cyber incident in relationship to the actions involved in an emergency action plan involving a hydroelectric plant. In addition to this product, there are three other products meant to be distributed to a hydroelectric plant to assist in their cyber incident response and recovery. The first, a report on the processes of building a R&R flip book based on a large set of existing guidance. The second, a handy flip book meant to be distributed to hydroelectric plants to assist them during a cybersecurity incident occurring on a hydroelectic plant. And the third is a comprehensive set of resources to assist an operator in locating appropriate guidance during the recovery process.

13 HYDRO ENERGY↗
DOE OSTI2022

WPTO Comprehensive References [Poster]

Protecting hydroelectric plants from incidents that adversely impact their cyber-physical systems presents unique challenges due to the plants’ widely dispersed geographic locations and varied configurations as well as the relative nascent nature of the cyberattacks targeting these facilities. To help hydroelectric plants better respond to and mitigate cybersecurity incidents, this Department of Energy Water Power Technologies Office Cyber Comprehensive Reference list is to be used at a hydroelectric plant to quickly go to appropriate sources during the response and recovery of a cyber incident. In addition to this product, there are three other products meant to be distributed to a hydroelectric plant to assist in their cyber incident response and recovery. The first, a report on the processes of building a R&R flip book based on a large set of existing guidance. The second, a handy flip book meant to be distributed to hydroelectric plants to assist them during a cybersecurity incident occurring on a hydroelectic plant. And the third is a correlated alignment of the steps an hydroelectric plant operator would take for both a cyber incident as well as an emergency response process if the event rises to a cyber incident affecting the safe and reliable operations of a hydroelectric plant.

13 HYDRO ENERGY↗
DOE OSTI2021

Hydropower Cyber-Physical Configurations

The U.S. Department of Energy’s Water Power Technologies Office funded Pacific Northwest National Laboratory, Argonne National Laboratory, and the National Renewable Energy Laboratory to develop a typology to characterize the variety and pervasiveness of cyber-physical configurations across the nation’s hydropower fleet. Outreach to owners and operators returned configurations for 275 hydropower plants or approximately 12% of the fleet. Components (OT and IT), systems, and connections among systems differed among plants according to function, age, position in the river cascade, and many other factors. Seven cyber-physical configuration types labeled A through I, included from 2 to dozens of plants. They were differentiated by how pervasive data and control connections were among cyber-physical components and how frequently control signals paired with data signals in a feedback loop. The flow of data and control within each type implies what cybersecurity vulnerabilities may exist, and what mitigation actions may be most effective. A self-assessment approach allows plant operators to identify the configuration type similar to their plant and link to the lessons learned and best practices information. The cyber-physical typology reinforces the idea that hydropower facilities vary widely, but it also identifies groups that highlight similarities in how their cyber-physical components interact. This helps address fleetwide cybersecurity needs by identifying a reasonable number of configuration types that share risks, vulnerabilities, and potential mitigations.

13 HYDRO ENERGY↗
DOE OSTI2022

FIC Vulnerability Profile

The FIC team is engaged with Pacific Northwest National Laboratory’s (PNNL’s) Shamrock Cyber Team to provide cybersecurity analyses of the FIC software. Shamrock offers both Threat-Based Analysis services and Secure Software Development services. These services are ultimately used to understand and mitigate threats against software and to reduce vulnerabilities in software, thus improving overall cybersecurity and informing decision makers. Shamrock’s Secure Software Development services, specifically Static Analysis Security Testing (SAST) and Open-Source Analysis (OSA), produced this Vulnerability Profile.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Using Structured Intelligence Graph (STIG) to protect our critical infrastructure against cyber attacks [Poster]

STIG is a revolutionary cybersecurity tool developed by researchers at the U. S. Department of Energy's Idaho National Laboratory and it is a software that allows utility owners and operators to easily visualize, create, and edit cyberthreat intelligence information. STIG uses Structured Threat Information eXpression (STIX) and converts complex data on cybersecurity vulnerabilities into a visualization that is easy to understand and act on. With STIG, utility owners and operators have a common system for sharing threat intelligence information, thus increasing the chances of detecting and mitigating cyber exploits before they lead to a cyberattack.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

Cyberguardians and STEM Warriors (Final Technical Report (FTR))

In the past decade, solar power, with and without energy storage has become the fastest growing source of energy generation in the world. In the U.S., solar employment more than doubled from 105,145 jobs in 2011 to 255,037 jobs in 2021, four times faster than the U.S. job growth rate overall. These factors, combined with technology advancements, creates a skills gap that puts tremendous stress on society to deliver the workers to fill the open job requisitions. The Cyberguardians and STEM Warriors project (Cyberguardians) was designed to address the trained-worker shortage in the energy industry in three ways: 1) by developing educational curriculum that addresses DER technology changes; 2) by delivering curriculum to prospective workers, including military veterans and their families, via universities, community colleges, and vocational training outlets; and 3) introducing individuals who have completed training to employers that can hire them. Cyberguardians exceeded its curriculum goals by producing 27 academic units of university-accredited material (12 total courses) covering energy fundamentals, smart inverters, Distributed Energy Resource (DER) data communication, cybersecurity, standardization, certification, data analytics, and IEEE 1547 standard topics. The North American Board of Certified Energy Practitioners (NABCEP) also accredited the material for use in their credential program. Seven instructors were recruited and trained, and six academic institutions (University of California San Diego, State University of New York, North Carolina State University, Harper Community College, Green Village Academy, and the SunSpec Alliance) were enlisted, meeting program goals. All course material was published under the Creative Commons license and made available royalty free, thus providing a long-lasting public benefit. The program’s outreach program vastly exceeded program goals and incorporated the efforts of 13 outreach partners (11 of which are veteran focused), an advisory board representing 15 companies, webinars and 10’s of thousands of email messages sent to prospective students and hiring managers. Despite these efforts, the global pandemic depressed anticipated program participation by about a third. Still, a total of 396 students enrolled and 289 completed the courses and were accredited. The job applicant task achieved similar results (111 realized vs a 174 goal) but reported job placement was weaker at (9 realized vs. a 51 goal). The Cyberguardians program fills a critical void for cost-effective, royalty-free curriculum and training pertaining to DER technologies and cybersecurity that prospective energy workers must possess to be effective in the 21 st century. On this basis alone, the investment of taxpayer funds will pay dividends for years to come.

14 SOLAR ENERGY↗
DOE OSTI2023

An Integrated Framework for Risk Assessment of Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology Refinement and Exploration

This report documents activities performed by Idaho National Laboratory (INL) during Fiscal Year (FY) 2023 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a technical basis to support effective, and secure DI&C technologies for digital upgrades/designs. A risk assessment-informed framework was proposed for this strategy, which aims to (1) provide a best-estimate, risk informed capability to quantitatively estimate the safety margin obtained from plant modernization, especially for safety-related DI&C systems, (2) support and supplement existing risk informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems, (4) assure the long-term safety and reliability of safety-related DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals, the LWRS-developed framework provides a means to address relevant technical issues by: (1) defining a risk informed analysis process for DI&C upgrade that integrates hazard analysis, reliability analysis, and consequence analysis, (2) applying risk informed tools to address common cause failures (CCFs) and quantify corresponding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the component level, system level, and plant level, and (4) providing insights and suggestions on designs to manage the risks, thus to support the development and deployment of advanced DI&C technologies in nuclear power plants (NPPs). Adding diversity within a system or components is the primary means to eliminate and mitigate CCFs, but diversity also increases system complexity and may not address all sources of systematic failures. Optimization of diversity and redundancy applications for the safety-critical DI&C systems remains a challenge. To deal with the technical issues in addressing potential software CCFs in safety-related DI&C systems of NPPs and supporting relevant design optimization, the proposed framework provides: (a) A best-estimate, risk informed capability to address new technical digital issues quantitatively, focusing on software CCFs in safety-related DI&C systems of NPPs; (b) A common and a modularized platform for DI&C designers, software developers, cybersecurity analysts, and plant engineers to predict and prevent risk in the early design stage of DI&C systems; (c) Technical bases and risk informed insights to assist users address the risk informed alternatives for evaluation of CCFs in safety-related DI&C systems of NPPs; and (d) A risk informed tool that offers a capability of design architecture evaluation of various DI&C systems to support system design decisions in diversity and redundancy applications. The research and development efforts of this project in FY 2023 are focused on refining current methods on software CCF modeling and estimation and exploring additional innovative approaches to risk assessment of DI&C systems to enable a more comprehensive and complete assessment of various safety-related DI&C design architectures. The primary audience of this report are DI&C designers, engineers, and probabilistic risk assessment (PRA) practitioners. This includes stakeholders, such as the nuclear utilities and regulators who consider the deployment and upgrade of DI&C systems, DI&C software developers and reviewers, and cybersecurity specialists. It should be noted that all the analyses are performed for the demonstration of the methodology, not for the evaluation of an actual digital control system. Results are obtained based on limited design information and testing data.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2023

Bat Smart Curtailment: Efficacy and Operational Testing

Curtailment, or blanket curtailment, is a leading method to mitigate the impacts to bats from operating wind turbines. Although this strategy results in considerable decreases in bat fatalities, it also results in decreased energy production. In 2019, Natural Power was awarded funding by the Department of Energy to assess the readiness of the informed smart curtailment technology, EchoSense (formerly referred to as Detection and Active Response Curtailment, [DARC]). The research undertaken by this project expands the understanding of alternative methods, known as smart curtailment, to maintain a reduction in bat fatalities while simultaneously recovering lost energy associated with blanket curtailment. The overall project was composed of three major tasks; Task 1 was focused on cybersecurity compliance of the EchoSense system in accordance with the North American Electric Reliability Corporation Critical Infrastructure Protection (“NERC CIP”) standards, Task 2 assessed the mechanical loads exerted on turbines when operating under a smart curtailment regime, and Task 3 assessed the efficacy of the EchoSense system at an operational wind farm. Regarding Task 1, an external review by the National Renewable Energy Laboratory determined that the EchoSense system did not create any new cybersecurity weaknesses and was compliant with the NERC CIP standards. As a result of this process, Natural Power developed some best practices (10.1) for wind- wildlife technology developers. In conjunction with the National Renewable Energy Laboratory, the results (10.2) of the loads testing demonstrated that the periodic curtailment and release of turbines by the EchoSense system did not have any detrimental impact on the mechanical components of a wind turbine (Task 2). During the late summer to fall of 2020 and 2021, Natural Power demonstrated that the use of the EchoSense smart curtailment system resulted in no significant difference in bat fatalities compared to blanket curtailment with cut-in speeds at 6.9 m/s (2020) and 5.0 m/s (2021) while resulting in a significant difference in decreased lost energy (Task 3). This translates to an average of 41% (2020) and 56% (2021) reduction in per turbine energy loss compared to blanket curtailment. The reduction in energy loss that would have been achieved by EchoSense curtailment compared to blanket curtailment, if applied across all 69 turbines, is roughly equivalent to having an additional turbine on site. These results are notable for finding a balance between the environmental impact of wind energy and the economic feasibility in energy production associated with mitigating that impact. https://www.naturalpower.com/us/expertise/service/engineering-operations/echosense

17 WIND ENERGY↗
DOE OSTI2024

Application Guide for the Cyber-Resilient Design Framework for Hybrid Systems

As the energy landscape evolves, hybrid power plants—integrating multiple renewable energy sources (e.g., solar, wind, and battery storage) with the bulk power electric system—play a crucial role in meeting growing energy demands. However, with a hybrid power plant’s increased number of components, complex network connectivity and digitization of controls, these systems face growing cybersecurity risks. To help mitigate these risks, Idaho National Laboratory (INL) presents this application guide specifically designed for operators and systems engineers to evaluate the cybersecurity resilience of their hybrid power plant’s design.

14 SOLAR ENERGY↗
DOE OSTI2024

Advanced Reactor Safeguards & Security 2024 Program Roadmap

The Advanced Reactor Safeguards and Security (ARSS) program was established to provide research support addressing near term challenges that advanced nuclear reactor vendors face in meeting domestic Material Control and Accounting (MC&A), Physical Protection System (PPS), and Cybersecurity requirements for U.S. construction. The technical work in the program is meant to (1) support nuclear reactor vendors with advanced MC&A, PPS, and Cybersecurity designs for next generation reactors, (2) provide technical bases for the regulator, and (3) promote the integration of Safeguards and Security by Design early in the design process. Existing domestic regulations for safeguards and security, as outlined in the Code of Federal Regulations, were written for large light water reactors, and rule-making efforts are underway to develop regulations more suited to different reactor designs. The ARSS program seeks to remove roadblocks in the deployment of new and advanced reactors by solving regulatory challenges, reducing safeguards and security costs, and utilizing the latest technologies and approaches for robust plant monitoring and protection. This roadmap discusses the goals of the ARSS program, current research, and program plan for the next five years.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

Large-Scale Hydrogen Storage Cyber Risk Assessment

Hydrogen storage systems are becoming more widely deployed throughout the country, and as their presence continues to grow, it is possible that individual and interconnected systems will be exposed to cyber-attacks. These events can cause physical and financial harm to employees, people in the vicinity, and to the company that owns the facility. The two main mechanisms malicious actors may access information or control from a hydrogen storage facility are through information technology and operations technology devices, the former of which refers to data and information from networked devices and the latter of which refers to onsite controls for the physical system. Both types of entryways into the system should be considered when facility managers conduct cyber risk assessments and when regulators develop or revise relevant codes and standards. This report analyzes cybersecurity risks applicable to a wide variety of hydrogen storage systems by outlining the system's purpose and the importance of its cybersecurity. The hydrogen storage system architecture and communication protocols are provided to understand potential cyber vulnerabilities. Later, an event tree analysis is performed on hydrogen operation to identify system weaknesses by outlining potential attack scenarios. This report also identifies critical cyber assets related to different hydrogen operations followed by an examination of potential threats, and the impact of cyber assets on those operational assets.

08 HYDROGEN↗
DOE OSTI2025

ARCADE Technical Pathway and Industry Impact

The Advanced Reactor Cyber Analysis and Development Environment (ARCADE) simplifies the evaluation and assessment of robustness factor and cyber resilience that support secure-by-design for advanced reactor nuclear power plants. In this manner, ARCADE supports risk-informed performance based (RIPB) evaluations of cybersecurity through its integration of plant physics with high-fidelity emulations of control systems. This cross domain approach enables comprehensive analysis of control system sensitivities, cyber-attack scenarios, and their consequences. ARCADE has been custom developed to meet the demands identified in Tier 1 of the Tiered Cyber Analysis (TCA) as outlined in NRC Draft Regulation Guide (RG) 5.96, which provides a RIPB cybersecurity approach for new reactors.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Center of Excellence for Operational Technology

The Center of Excellence for Operational Technology Traditional Presentation Abstract 2025 National Laboratories Information Technology Summit | Denver, CO Traditional Presentation Session Managing cybersecurity risk in Operational Technology (OT) presents a significant challenge across the Department, and critically, at many of the national laboratories. This includes IT-OT convergence, aging OT systems, cost of updating OT systems, and increased Advanced Persistent Threat efforts against OT including the 16 critical infrastructure sectors as listed in Presidential Policy Directive 21. DoE’s Office of Science and NNSA’s Office of the Chief Information Officer are taking the lead in addressing this challenge to include critical systems, by establishing the Center of Excellence (CoE) for Operational Technology. Championed by NNSA Deputy Chief Information Officer Steven McAndrews and the Office of Science Chief Information Officer Shila Cooch, the CoE for OT was chartered in February 2025 to address the challenges of OT cybersecurity and compliance. The CoE for OT will create partnerships and leverage expertise from across the NNSA National Security Enterprise and DOE Labs, Plants and Sites. The CoE will also collaborate with colleagues in other government agencies, industry partners and academia. The CoE for OT discussion at the National Laboratories Information Technology Summit ’25 will include the genesis of the CoE, stated goals, organizational structure, and the effort to attract OT subject matter experts to join the CoE effort to share knowledge and expertise. The discussion will include opportunities to get involved and contribute to this important effort. This session will be led by CoE for OT Co-Chairs Matt Kwiatkowski, Fermi National Laboratory Chief Information Security Officer, and Steven Weldon, Savannah River National Laboratory Cyber Program Director at the Georgia Cyber Center. The session will be of particular interest to CIOs, CTOs, CISOs, as well as IT and OT practitioners.

Kwiatkowski, Matt [Fermilab]↗
DOE OSTI2025

Enabling Secure and Resilient XFC: A Software/Hardware-Security Co-Design Approach

Extremely fast charging (XFC) has the potential to reduce the charging time of battery electric vehicles (BEV) to be equivalent to the filling time of internal combustion engine vehicles (ICEV), thus eliminating one of the few advantages ICEV still poses for light- and heavy-duty vehicles. Enabling XFC will, however, require coordination and cooperation between the grid, charging stations, and the vehicles themselves, which leads to an inevitable increase in the attack surface for all systems combined. In securing the overall system, we must not only embrace traditional cybersecurity, which is chiefly concerned with communications and the operation of digital systems, but also cyber-physical systems security as the proper operation of XFC is critically dependent on systems’ abilities to know about (sense) and interact with (actuate) the physical world. The project team consists of academic and industry researchers with backgrounds in cybersecurity, cyber-physical systems security, learning in adversarial environments, transportation security, grid security and resilience, wireless power transfer, converter design, and battery management systems.

33 ADVANCED PROPULSION SYSTEMS↗