SEARCH · Engineering Papers

Results for “security assessment”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 613 records · Page 34

All sources NASA NTRS DOE OSTI

DOE OSTI2020

Fossil Power Plant Cyber Security Life-Cycle Risk Reduction: A Practical Framework for Implementation

Market conditions are forcing fossil electricity generation facility owners and operators to implement advanced digital technologies. These technologies enable efficiencies, operational flexibility, operations and maintenance efficiencies, and adapting to a transitioning workforce. These digital technologies, however, can increase the cybersecurity attack surface. The purpose of this research was to develop a holistic cybersecurity risk reduction framework for fossil generation facilities. The framework begins with assessing how cyber risk changes across facility life cycles, including plant, system, vendor, and business life cycles. The next phase performs consequence analysis to prioritize high consequence events. Focusing on high consequence events allows owners to use a graded, risk-informed approach to prioritize cybersecurity efforts. The final phase identifies the digital asset attack surface in sensors and instrumentation and control equipment. After the vulnerabilities are identified, the owner selects mitigating cybersecurity control measures (or countermeasures) based on the risk analysis from the previous phases. This report describes the current industry cybersecurity best practices in fossil generation that are based on the first principles for cybersecurity engineering. The report is divided into five sections that describe the implementation of the risk reduction framework and present identified research, methodological, and technology gaps that were identified through this course of research and development.

20 FOSSIL-FUELED POWER PLANTS↗

DOE OSTI2019

Demonstration of the Cybersecurity Framework through Real-world Cyber Attack

The Cybersecurity Framework (CSF) developed by the National Institute of Standards and Technology Cybersecurity, provides five concurrent and continuous functions to Identify, Protect, Detect, Respond, and Recover from cyber threats and vulnerabilities to buildings. Based on the core architecture and security best practices defined in the CSF guidelines, we developed the CSF webtools. The CSF webtools provide actionable functions that can be easily adopted by a facility operator to enhance their critical infrastructure security. The essence is captured in a set of “how-to” instructions for the facility operators to adopt, adapt, and apply to their critical infrastructure facilities. When considered together, these functions provide a high-level, strategic view of the lifecycle of an organization’s cybersecurity risk management. The CSF webtools provide an easy to follow set of cybersecurity best practices, policies, and procedures to improve the cybersecurity posture of our nation’s buildings and other critical infrastructures. The CSF webtools are also designed to facilitate communication of cybersecurity activities and outcomes across the organization from the executive to operations levels. Finally, the CSF webtools allow the critical infrastructure operators to assess the overall cybersecurity maturity and posture. The goal of this paper is to demonstrate the capabilities of the CSF webtools through an illustrative cyber-attack based on a real-world scenario.

cybersecurity framework, maturity model, critical ↗

DOE OSTI2021

Evaluating Probability of Containment Effectiveness at a GCS Sites using integrated assessment modeling approach with Bayesian decision Networks

Improved scientific and engineering understanding of the behavior of geologic CO2 storage together with established regulatory framework and incentive structures raise the prospects for accelerated, large-scale deployment of this greenhouse gas emissions reduction approach. Incentive structures call for the establishment of appropriate verification and accounting approaches to support claims of the integrity of a geologic storage complex and to justify taking credit for long-term storage. In this study, we present a framework for assessing the probability of containment effectiveness over the lifetime of a geologic carbon storage site (e.g., after 70 years of injection and post-injection site performance) using forward stochastic model realizations based on site characterization data and using a monitoring-informed Bayesian network based on hypothetical detectability from surface seismic surveys over the site injection and post-injection phases. The National Risk Assessment Partnership’s open-source Integrated Assessment Model (NRAP-Open-IAM) was utilized to develop an ensemble of 10,000 a priori stochastic forecasts of CO2 containment. Those simulations were used to train the Bayesian network model to estimate the prior probabilities of the CO2 leakage mass into overlying, monitorable aquifers considering the uncertainties in the reservoir properties, permeability of potentially leaky wells and the overlying aquifers. The conditional probabilities in the Bayesian network were either learned from the NRAP-Open-IAM simulations or derived from the predefined detection thresholds for the monitoring method. Observations obtained from monitoring, over time during the site operation phases were then used to generate updated posterior probabilities of containment (and any loss from containment) in the Bayesian network by propagating the prior probabilities through the conditional probabilities. We demonstrate how to construct and use the Bayesian network for verifying the long-term storage complex effectiveness informed by monitoring based on the NRAP-Open-IAM simulations previously developed for the FutureGen 2.0 site. This approach may have relevance for stake holders to demonstrate secure geologic storage, provide a defensible, probabilistic approach to claim credit for geologic storage, and to estimate the likelihood that any fraction of the claimed credit may need to be refunded to the creditor based on available monitoring information.

Bayesian network, Risk assessment, Monitoring, car↗

DOE OSTI2020

Assessing DER Network Cybersecurity Defences in a Power-Communication Co-Simulation Environment

Increasing penetrations of interoperable distributed energy resources (DER) in the electric power system are expanding the power system attack surface. Maloperation or malicious control of DER equipment can now cause substantial disturbances to grid operations. Fortunately, many options exist to defend and limit adversary impact on these newly-created DER communication networks, which typically traverse the public internet. However, implementing these security features will increase communication latency, thereby adversely impacting real-time DER grid support service effectiveness. In this work, a collection of software tools called SCEPTRE were used to create a co-simulation environment where SunSpec-compliant PV inverters were deployed as virtual machines and interconnected to simulated communication network equipment. Network segmentation, encryption, and moving target defence security features were deployed on the control network to evaluate their influence on cybersecurity metrics and power system performance. The results indicated that adding these security features did not impact DER-based grid control systems but improved the cybersecurity posture of the network when implemented appropriately.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2023

Secure Storage: Historical Documentation of TA-08-0032, TA-11-0036, TA-22-0016, TA-22-0023, TA-22-0025, TA-22-0035, TA-37-0006, TA-37-0009, and TA-37-0020

The U.S. Department of Energy, National Nuclear Security Administration, Los Alamos Field Office (NA-LA), is pursuing the decommissioning and demolition (D&D) of facilities contaminated with high-explosives residues at the Los Alamos National Laboratory (Laboratory or LANL). This effort affects nine facilities associated with high-explosives and detonator research, development, and storage: Technical Area (TA) 8 Facility 32 (TA-08-0032), TA-11-0036, TA-22-0016, TA-22-0023, TA-22-0025, TA-22-0035, TA-37-0006, TA-37-0009, and TA-37-0020. All nine facilities proposed for D&D have been evaluated for listing in the National Register of Historic Places (NRHP) and determined eligible. NA-LA previously requested the State Historic Preservation Officer (SHPO) to concur with the NRHP-eligibility determinations of these nine properties presented in four reports: (1) TA-08-0032 was determined eligible for listing in the NRHP in the report, From Ranching to Radiography: An Assessment of Historic Buildings at Anchor West Site (TA-8), Vol. 1 (McGehee et al. 2008a). The SHPO concurred with this eligibility determination on November 26, 2008. (2) TA-11-0036 was determined eligible for listing in the NRHP in the report, ESA Division’s Five-Year Plan: Consolidation and Revitalization at Technical Areas 3, 8, 11, and 16, Vol. 1) (McGehee et al. 2003). The SHPO concurred with this eligibility assessment on June 22, 2003. (3) TA-22-0016, TA-22-0023, TA-22-0025, and TA-22-0035 were determined eligible for listing in the NRHP in the report, DX Division’s Facility Strategic Plan: Consolidation and Revitalization at Technical Areas 6, 8, 9, 14, 15, 22, 36, 39, 40, 60, and 69, Vol. 1 (McGehee et al. 2005a). The SHPO concurred with these eligibility determinations on April 18, 2006. (4) TA-37-0006, TA-37-0009, and TA-37-0020 were determined eligible for listing in the NRHP in the report, High Explosives and the Nuclear Stockpile: An Assessment of Historic Buildings at Magazine Area C (TA-37), Vol. 1 (McGehee et al. 2008b). The SHPO concurred with these eligibility determinations on April 17, 2008. In a letter dated January 24, 2020, NA-LA acknowledged that the D&D of these nine NRHP-eligible facilities was an adverse effect that requires resolution through mitigation. NA-LA proposed the use of standard mitigation practices as defined in the Programmatic Agreement (PA) among the U.S. Department of Energy, National Nuclear Security Administration, Los Alamos Field Office, the New Mexico State Historic Preservation Office, and the Advisory Council on Historic Preservation Concerning Management of the Historic Properties at Los Alamos National Laboratory, Los Alamos, New Mexico. The PA states that adverse effects to NRHP-eligible buildings and structures will be resolved according to the standard practices defined in Part II, Section 10, of the Laboratory’s Cultural Resources Management Plan, A Plan for the Management of the Cultural Heritage at Los Alamos National Laboratory, New Mexico (Purtzer et al. 2019), and Section 2.B of Appendix D of the PA itself. The standard practice documentation package includes the following components: (1) Interior and exterior photography and production of archival-quality digital photographs; (2) Documentation and curation of historically significant equipment and artifacts; (3) A list of all known drawings for the property; (4) Reduced-scale reproductions of selected drawings for the property; (5) A location map that shows the location of the property relative to the entire Laboratory property; (6) Reproduction of historical TA maps; (7) A TA map that depicts the footprint of each eligible and non-eligible facility; and (8) An expanded historic context that uses oral-history interviews, if available. On March 3, 2020, the SHPO concurred with the adverse effect determination and the mitigation plan. The documentation package, as previously described, is provided in Volumes 1 and 2 of this report.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2020

Digital Biosecurity Pilot Project

Security models for the bioeconomy have largely been developed on risk profiles borrowed from the financial industry and, in some cases, industrial control systems. The bioeconomy, however, has unique characteristics that require domain-specific knowledge of the risks to environmental, health and economic impact from directly targeted attacks. Key questions need to be assessed and answered for any facility engaged in bioproduction. These include: how much technical information must the attacker possess in order to target a specific process or facility? Which processes cause the largest economic impact if disrupted? Can an attacker lead companies down the wrong path of research, leading to irrecoverable losses of time, resources and capital? Can attackers disrupt venture capital strategies and affect financial returns? What are the resources required to attack key workflows, and subsequently what is the cost of defense? What strategies are effective against such attackers, and what are their cost? Can government provide an active role in assurance of material, process and results for critical bioeconomic infrastructure?

59 BASIC BIOLOGICAL SCIENCES↗

DOE OSTI2025