Results for “Cybersecurity” — Page 34

DOE OSTI2022

CyOTE ASSET OWNER ENGAGEMENT – SIDE CHANNEL POWER ANALYSIS PROTOTYPE

The U.S. Department of Energy’s (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER), through the Cybersecurity for the Operational Technology Environment (CyOTE) Program, worked with energy sector asset owners and operators (AOOs), partners, and Idaho National Laboratory (INL) to develop capabilities for AOOs to independently identify adversarial tactics, techniques, and procedures (TTPs) within their operational technology (OT) environments. The CyOTE methodology seeks to identify adversarial techniques within an AOO OT environment that could result in physical disruptions to energy flow or damage to equipment. CyOTE provides a general roadmap for AOOs, starting from a triggering event, or the point in time and space they perceive an anomalous event or condition meriting investigation, and culminating when the AOO has sufficient confidence to make a business risk decision on the appropriate resolution. This paper outlines the results of one such engagement with the New York Power Authority (NYPA), where the CyOTE program partnered with an AOO to develop a design specification for a power side channel detector to identify anomalous changes to device load. It describes the goal of developing this capability, the development process, the challenges the technical teams faced and the future steps an AOO will need to take to install and use this detector in its OT environment.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2024

Site Integration and Regulatory Considerations for a Nuclear Power Plant Colocated with Industrial Facilities: Colocation Studies for a Petroleum Refinery, Methanol Plant, and Wood Pulp Plant

This research explores the colocation of nuclear power plants (NPPs) with industrial applications. Three existing industrial sites were considered to demonstrate the siting process and illuminate technological gaps for future work. The three applications demonstrated for colocation here are a petroleum refinery, a methanol production plant, and a pulp and paper plant. This study uses a modified version of the EPRI siting criteria to explore the geological and demographic characteristics of the location of the current industrial site, as well as exploring external hazards from the industrial plant and its surrounding land use. Data was collected from public databases to estimate site characteristics. We then discuss how the site characteristics may impact the ability to colocate an NPP with an industrial application. The application site and 5 additional sites were explored for each application to give a general indication of the siting implications for an NPP in each area. The hazards for each industrial application was also explored to determine how colocation may impact reactor safety. The following gaps have been identified and should be explored in future research on colocation of NPPs with petroleum refineries, methanol plants, and pulp and paper plants: - There is a variety of industrial use, hazards, and pipelines in the surrounding area. A more thorough review of these hazards should be considered for colocation. - In general, the whole region around some applications seems to have softer soil, with implications for large site preparation costs. Further site investigations should prioritize looking into the geotechnical conditions. - Applications along coastlines are susceptible to flooding and hurricanes. The benefits of colocation should be weighed against the potential design implications. - The benefits of natural gas pipeline infrastructure in place should be explored further. If heat supply from the NPP is not required or not feasible due to the distance between the NPP and the application, there may be an opportunity to supply hydrogen to the plant through an existing pipeline. - Because there are several collocated industrial plants in the regions for the refinery and methanol plant, the benefits of sharing resources from the NPP should be explored further. This may open up additional sites for colocation. The following knowledge gaps were identified for the colocation of NPPs with these three industries, and industrial applications in general. These gaps are: - While the STAND tool contains many important characteristics for the reactor siting process, it is not calibrated for the colocation of NPPs with industrial facilities. - There are aspects of both the NPP and industrial application that need to be quantified for a siting analysis. Particularly, we need to understand the water intake requirements for NPPs and each application. - Further work may focus on adapting the STAND site comparison methodology to comparison of sites for co-location. This will involve using the data documented in this report as a starting point and performing a comprehensive and quantitative comparison. - Without spending significant resources, it would be impossible to gather data for each site to evaluate all aspects of siting. One approach to finding data and understanding its implications to siting is looking at FSARs for existing plants. For example, most sites considered in this study have small Vs30 values, indicating soft soil. However, there are NPPs located in the vicinity of most of the sites (e.g., Waterford Steam Electric Station near New Orleans) and reviewing available site characteristics and geotechnical data for these NPPs, might provide further information for siting. - The siting analysis in this study indicates that colocation of the NPP with the industrial site could be difficult based on external hazards, cooling requirements, weather, or population. We need to determine the impact of distance between the two facilities on cost and quality of energy transport. - This study did not touch on socioeconomic impacts for NPP colocation with industrial facilities. The input-output analysis methodology could be applied to the communities referenced in this study to determine the socioeconomic impact of these projects. - Similarly, the impacts of colocation on emergency planning was not explored in this study. The impacts on emergency planning infrastructure are somewhat related to the socioeconomic impacts, and could be explored using a similar methodology. - This study also did not address physical and cybersecurity, which will be important aspects of co-location [ref] . Cybersecurity will be important, regardless of the distance, but physical security will be important if the facilities are located very closely. Physical security might also be important for the steam lines between the plants, unless they are determined to be non-safety significant. - In many site l

08 HYDROGEN↗

DOE OSTI2024

Reverse Engineering of Medical Devices for Innovation and Advancement in Healthcare

Medical cybersecurity research addresses the critical intersection of healthcare and digital security. As medical devices expand and become increasingly interconnected, the healthcare sector is poised to become a primary target for cyber warfare. This project aims to mitigate the risks associated with a field that often underestimates the importance of cybersecurity.

Baldwin, David↗

DOE OSTI2025

Employing a Hardware-in-the-Loop Approach to Realize a Fully Homomorphic Controller for a Small Modular Advanced High Temperature Reactor

This paper addresses the cybersecurity challenges of advanced nuclear reactors by integrating fully homomorphic encryption (FHE) into their control systems, enabling encrypted processing of control signals without compromising functionality. Advanced nuclear reactors, including Small Modular Reactors (SMRs) and microreactors, aim to achieve autonomous and remote operations, reducing costs and enhancing competitiveness. However, these advancements expand the attack surface for cyberattacks, particularly in autonomous and remote operation scenarios. Cyberattacks can exploit vulnerabilities to manipulate physical processes, causing shutdowns, asset damage, or public harm. Such attacks begin with passive reconnaissance, where adversaries intercept communications or observe behaviors to gather information, which is then leveraged to execute cyber-physical attacks by injecting malicious commands. Nuclear power must adopt cybersecurity protection measures to secure the integrity and availability of their digital control systems. This paper demonstrates the application of FHE to secure operations by enabling encrypted processing of sensitive signals and parameters -- ensuring privacy without exposing data. FHE supports secure mathematical operations on encrypted data without requiring decryption. Using a hardware-in-the-loop (HIL) approach, this paper implements an FHE-integrated controller on a BeagleBone Black (BBB) controlling a simulation of the Small Modular Advanced High Temperature Reactor (SmAHTR). By doing so, the encrypted controller protects the integrity of critical set points and control signals during transmission and processing. Thus, FHE-integrated controllers enhance secure operations of advanced nuclear reactors while maintaining functionality.

control systems↗

DOE OSTI2025

Site Integration and Regulatory Considerations for an NPP Colocated with a Petroleum Refinery, Methanol Plant, and Wood Pulp Plant

This research explores the colocation of nuclear power plants (NPPs) with industrial applications. Three existing industrial sites were considered to demonstrate the siting process and illuminate technological gaps for future work. The three applications demonstrated for colocation here are a petroleum refinery, a methanol production plant, and a pulp and paper plant. This study uses a modified version of the EPRI siting criteria to explore the geological and demographic characteristics of the location of the current industrial site, as well as exploring external hazards from the industrial plant and its surrounding land use. Data was collected from public databases to estimate site characteristics. We then discuss how the site characteristics may impact the ability to colocate an NPP with an industrial application. The application site and 5 additional sites were explored for each application to give a general indication of the siting implications for an NPP in each area. The hazards for each industrial application was also explored to determine how colocation may impact reactor safety. The following gaps have been identified and should be explored in future research on colocation of NPPs with petroleum refineries, methanol plants, and pulp and paper plants: - There is a variety of industrial use, hazards, and pipelines in the surrounding area. A more thorough review of these hazards should be considered for colocation. - In general, the whole region around some applications seems to have softer soil, with implications for large site preparation costs. Further site investigations should prioritize looking into the geotechnical conditions. - Applications along coastlines are susceptible to flooding and hurricanes. The benefits of colocation should be weighed against the potential design implications. - The benefits of natural gas pipeline infrastructure in place should be explored further. If heat supply from the NPP is not required or not feasible due to the distance between the NPP and the application, there may be an opportunity to supply hydrogen to the plant through an existing pipeline. - Because there are several collocated industrial plants in the regions for the refinery and methanol plant, the benefits of sharing resources from the NPP should be explored further. This may open up additional sites for colocation. The following knowledge gaps were identified for the colocation of NPPs with these three industries, and industrial applications in general. These gaps are: - While the STAND tool contains many important characteristics for the reactor siting process, it is not calibrated for the colocation of NPPs with industrial facilities. - There are aspects of both the NPP and industrial application that need to be quantified for a siting analysis. Particularly, we need to understand the water intake requirements for NPPs and each application. - Further work may focus on adapting the STAND site comparison methodology to comparison of sites for co-location. This will involve using the data documented in this report as a starting point and performing a comprehensive and quantitative comparison. - Without spending significant resources, it would be impossible to gather data for each site to evaluate all aspects of siting. One approach to finding data and understanding its implications to siting is looking at FSARs for existing plants. For example, most sites considered in this study have small Vs30 values, indicating soft soil. However, there are NPPs located in the vicinity of most of the sites (e.g., Waterford Steam Electric Station near New Orleans) and reviewing available site characteristics and geotechnical data for these NPPs, might provide further information for siting. - The siting analysis in this study indicates that colocation of the NPP with the industrial site could be difficult based on external hazards, cooling requirements, weather, or population. We need to determine the impact of distance between the two facilities on cost and quality of energy transport. - This study did not touch on socioeconomic impacts for NPP colocation with industrial facilities. The input-output analysis methodology could be applied to the communities referenced in this study to determine the socioeconomic impact of these projects. - Similarly, the impacts of colocation on emergency planning was not explored in this study. The impacts on emergency planning infrastructure are somewhat related to the socioeconomic impacts, and could be explored using a similar methodology. - This study also did not address physical and cybersecurity, which will be important aspects of co-location [ref] . Cybersecurity will be important, regardless of the distance, but physical security will be important if the facilities are located very closely. Physical security might also be important for the steam lines between the plants, unless they are determined to be non-safety significant. - In many site l

08 - HYDROGEN↗

DOE OSTI2025

Hands-On, Heads-Up: Blending Cyber T&E with Data Science-Driven Training in Jupyter Notebooks

In an era of increasingly sophisticated threats to critical infrastructure, cybersecurity professionals must be more than just aware; they must be immersed, agile, and equipped to operate in environments where failure is not an option. Nowhere is this truer than in the nuclear sector, where cyber-physical systems, regulatory scrutiny, and insider threat potential demand a new generation of hands-on, technically fluent defenders. This paper presents a unified training approach that integrates Cybersecurity Test and Evaluation (T&E) with data science techniques using Jupyter Notebooks as the interactive lab environment. The program centers on a modular, scenario-driven curriculum designed to build not just knowledge but practical capability in the assessment and defense of radiation detection systems, firmware interfaces, and operational security postures.

98 - NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL↗

DOE OSTI2023

Proactive Intrusion Detection and Mitigation System

SAND2023-05661O The proactive intrusion detection and mitigation system (PIDMS) provides grid-edge situational awareness for cybersecurity defense by capturing real-time distributed energy resource (DER) network traffic and performance data with a novel approach that improves the detection and prevention of cyber-physical attacks. The PIDMS addresses the grid-edge security gap with real-time analysis of both network traffic and photovoltaic performance data to deliver a novel, cyber-physical intrusion detection system (IDS) approach that increases the accuracy and effectiveness of detection and mitigation. This hybrid IDS analysis enables dual monitoring that increases the workload of the adversary; both cyber and physical data would have to be simultaneously spoofed to evade detection. Furthermore, monitoring and analyzing cyber data are insufficient in some cases. For example, in an insider threat aimed at disrupting inverter grid-support functions where proper credentials and authentication are achieved, only the altered PV performance would indicate abnormal behavior. All in all, the PIDMS provides novel capabilities for: • Distributed, real-time cyber-physical detection and mitigation analysis • Cybersecurity defense for grid-edge systems • Analysis framework that can provide situational awareness across the transmission, distribution, and DER systems The PIDMS sensor is designed to collect cyber-physical data, process the data using machine-learning algorithms, detect abnormal events, and deploy mitigations. With these goals, the main functional PIDMS objectives are: • Capability to collect cyber-physical data • Onboard storage of cyber-physical data • Peer-to-peer communication • Computationally efficient machine-learning algorithms • Online cyber-physical data analysis • Alerting/visualization capabilities • Mitigation deployment capability with bump-in-the-wire (BITW) implementation Each of these functional objectives enable PIDMS to perform effective cyber-physical intrusion detection and mitigation. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Jones, Christian↗

DOE OSTI2022

Towards Software Bill of Materials in the Nuclear Industry

Large, modern industrial facilities often incorporate thousands of digital assets in their operational technology. Regulated facilities, such as nuclear power plants (NPPs), maintain robust cybersecurity and configuration management programs that often use bills of materials (BOMs) for these assets, including make, model, and version of hardware, firmware, and software. However, these BOMs typically capture only first- or second-tier information provided by the original equipment manufacturer (OEM). Unfortunately, as indicated by the increasing number and sophistication of software supply chain attacks, this level of detail is insufficient for identifying all the potential vulnerabilities and risks in software applications. Software BOMs (SBOMs) provide detailed enumeration of components and dependencies within the product or devices, including firmware. SBOMs can be combined with vulnerability data sources and vendor vulnerability attestations to improve vulnerability management and enable rapid identification of affected components when new software vulnerabilities are discovered. Ideally, SBOMs are created by the OEM prior to installation. However, since this practice is not yet commonplace and since NPPs are typically slow to adopt new technology, most NPPs do not incorporate SBOMs into their asset or configuration management programs. Fortunately, SBOMs can be generated by NPPs on existing digital assets to provide further insight into risk management decisions. This report provides an overview of the current SBOM ecosystem and recommends guidance on how to get started in a “crawl, walk, run” manner to develop and implement a sustainable SBOM program for digital assets in an NPP.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2022

Washington State Cyber Incident Response Summit Event Report

On September 7 and 8, 2022, Pacific Northwest National Laboratory and Washington State Adjutant General Major General Bret Daugherty, with support from the Department of Homeland Security Cybersecurity and Infrastructure Security Agency, hosted the Washington State Cyber Incident Response Summit at Camp Murray in Washington State. The invite-only summit convened 40 key decision makers and stakeholders from across the state to discuss strategies and pilot a collaborative approach to improve cyber incident response readiness within Washington. In small working groups, participants shared incident response lessons learned, best practices, and opportunities for improvement within the water and transportation sectors. This report highlights the details of the workshop presentations and discussions.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

The Distributed Energy Resource Risk Manager

Organizations need a comprehensive approach to managing security and privacy risks, especially for energy resources that are becoming increasingly distributed. A tool by the National Renewable Energy Laboratory (NREL) makes it possible to manage these risks and maintain the highest standards of cybersecurity. To simplify risk management for facilities and distributed energy resources, NREL has created the Distributed Energy Resource Risk Manager, an automated, user-friendly tool that helps navigate and implement one of the most widely trusted frameworks for information security, the National Institute of Standards and Technology Risk Management Framework.

compliance↗

DOE OSTI2023

A National Secure-by-Design Strategy

The US National Cybersecurity Strategy published March 2, 2023 uses plain language to communicate that the US is calling for a major change in how we prioritize the security of software systems used in critical infrastructure. It acknowledges that our current approach, which is essentially, “let the buyer beware,” leaves entities who are least able to assess or defend vulnerable software responsible for the impacts of designed-in weaknesses while the makers of the technology bear no liability. The strategy recommends a security-by-design approach, recommending that software vendors be held liable to uphold a “duty of care” to consumers and for systems to be designed to “fail safely and recover quickly” . For energy infrastructure, the strategy calls out the need to implement the National Cyber-Informed Engineering Strategy to achieve higher confidence security for energy infrastructures. The Idaho National Laboratory, a pioneer in cyber-informed engineering concepts, is at the forefront of organizations educating others in industry, academia, and government on how to apply these concepts to real-world challenges. In this brief, we'll outline some of the basic principles of security-by-design and offer examples of how, in a water sector context, they're being put into successful practice.

42 ENGINEERING↗

DOE OSTI2024

Operational Process for Trigger Identification and Comprehension (OPTIC)

The Operational Process for Trigger Identification and Comprehension (OPTIC) is a standalone, downloadable application designed to enhance the CyOTE (Cybersecurity for the Operational Technology Environment) methodology and will be made available for free download to industry. OPTIC brings key CyOTE functionalities into focus. OPTIC aids OT professionals in analyzing and determining whether an observed anomaly may indicate possible malicious activity or merely a maintenance related irregularity.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2024

Bayesian Attack Model (BAM)

The Bayesian Attack Model (BAM) is an analytical tool designed to enhance the comprehension of adversarial activity in OT environments. BAM leverages both expert cybersecurity insights and historical data to characterize the likelihood of adversarial behavior given anomalous observable events.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2024

Cyber Risk Considerations for Nuclear Digital I&C Systems

Many engineers and scientists researching modeling and analysis methods for nuclear energy advancement are focused on proof-of-concept and early-stage development for new reactor designs. Since instrumentation and control (I&C) systems are traditionally developed later in the systems engineering lifecycle, researchers may be unfamiliar with modern digital technology used in these I&C systems. It is even more likely that they are unfamiliar with the cyber risks associated with them. This paper provides a brief overview of nuclear digital I&C systems before examining the importance of cyber risk management at nuclear reactors and the benefits of including Cyber-Informed Engineering throughout the systems engineering lifecycle. The primary goal is for engineers and scientists to develop a mindset that incorporates cybersecurity as another discipline alongside safety when designing and developing new technologies, regardless of technology readiness level.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2022

Advanced Reactor Control and Operations (ARCO): A University Research Facility for Developing Optimized Digital Control Rooms

The Advanced Reactor Control and Operations (ARCO) facility was constructed in January 2018 to serve as a test bed for advanced reactor control rooms and operator support systems. Since then, it has supported human-machine interface user experience research, fault detection and mitigation technology development, control room concept of operations development, and remote operations research. ARCO serves as the control room for the Compact Integral Effects Test (CIET) facility, which replicates the primary-side flow paths and thermal-hydraulic behavior of a fluoride-salt-cooled high-temperature reactor (FHR) using simulant fluids and scaling principles. New reactor designs feature different operating conditions and scenarios than those in existing reactors. ARCO supports the research and development of digital tools for operator communications, intuitive real-time data analysis, online health monitoring and prognostics, and control room cybersecurity. By integrating these different technologies, ARCO acts as a prototypical control system to iteratively develop methods and tools of operation in advanced small modular nuclear reactors. This paper describes the features of and challenges to operating advanced small modular reactors underlying the design basis for ARCO and its operator support systems.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

DOE OSTI2020

Secure and Cost-Effective Micro Phasor Measurement Unit (PMU)-Like Metering for Behind-the-Meter (BTM) Solar Systems using Blockchain-Assisted Smart Inverters

Recently, there is increasing interest in using behind-the-meter (BTM) solar systems for grid services. However, providing visibility and operational situational awareness of BTM solar systems mainly operated by small-scale solar inverters is challenging due to the requirement of relatively expansive networked observation tools (e.g., micro phasor measurement units (µPMUs)) and consequent cybersecurity threats through networks. This paper presents a secure, cost-effective, µPMUs-like metering method using a blockchain-assisted smart (BAS) inverters for a BTM solar system. The proposed BAS inverter consisting of an internet of things device as a node of a local blockchain network enables the secure provision of inverter measurement data for grid services. The BAS inverter sends the encrypted local measurement data with a timestamp to a local blockchain miner. Once the blockchain miner generates a tamper-resistant metering ledger including the measurements, it is used to assess the situational awareness of the BTM solar system. The concept of the proposed metering using the BAS inverters is validated by experimental studies.

behind the meter↗

DOE OSTI2021

Blockchain-Based Man-in-the-Middle (MITM) Attack Detection for Photovoltaic Systems

Cybersecurity of photovoltaic (PV) systems entails a much larger scope than just encryption and firewall of communications. For instance, integrity of data in transit between inverters and a cloud server can be compromised by authorized third-party, devices, and internal network within security perimeter (i.e., man-in-the-middle (MITM) attack). To address this challenge, this paper proposes a blockchain-based MITM attack detection method for a PV system. A breakthrough method includes screening network data, network intrusion detection, and hash comparison of in-transit data using distributed ledgers. Furthermore, the proposed method is implemented in Internet-of-Thing (IoT) security modules as clients of a blockchain network and validated by experiments.

blockchain↗

DOE OSTI2022

Secure Firmware Update and Device Authentication for Smart Inverters using Blockchain and Physically Uncloable Function (PUF)-Embedded Security Module

Cybersecurity of inverters has been significantly important as inverters become smarter in cyber-physical environments. However, firmware security of smart inverters against firmware attacks from various attack vectors has been less studied. Furthermore, this paper proposes a secure firmware update and device authentication method using a blockchain-based public key infrastructure (PKI) management system and a physically unclonable function (PUF)-embedded security module in a smart inverter. The proposed method is validated by experiments.

blockchain↗