“Development of Fiber Optic Dry Cask Monitoring System to Enhance Safety and Security of Spent Fuel Transportation and Storage
Explore the source record for details and available documents.
02 PETROLEUM↗
SEARCH · Engineering Papers
Results for “systems security”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Addressing Consequence within Operational Risk (O.T. Gagnon III) 9-18-2024
Addressing Consequence within Operational Risk: Why threats and security are just not that important! When dealing with cyber or physical risk within any critical infrastructure (CI) environment, don’t concern yourself with vulnerabilities and threats, at least not at first! Also, don’t be overly fixated on “securing the systems” within the organization. The endeavor of tackling operational risk focused on consequences in any critical infrastructure environment to include the complex Aviation ecosystem is challenging even for the most resourced entity but can be advanced though a simplified approach: identifying, binning, and prioritizing the infrastructure environment. While no two entities within a single element of the 16 critical infrastructure sectors are exactly alike when it comes to risk, there is a basic process to move toward a greater understanding of operational risk through becoming more informed about the infrastructure environment in which the entity exists. The process starts with bringing internal and external stakeholders and subject matter experts together to analyze key areas such as Information Technology (IT) and Operational Technology (OT) components and points of convergence, analyzing internal and external cyber and physical dependencies, accounting for explosive growth in devices and wireless technology, and leveraging the contributions of people inside and outside the operational environment. Attaining a common understanding of the infrastructure environment as part of addressing consequences within operational risk is not easy to do or resource light, but the process outlined provides the framework to further any entity’s efforts in this space. When it comes to cyber risks, before an organization can consider vulnerabilities within and threats to its operations, it must first have a solid understanding of the consequences existing inside its infrastructure environment. Idaho National Lab’s Consequence-Driven, Cyber-Informed Engineering is offered as an example of this approach to effective and efficient cyber risk mitigation.
99 GENERAL AND MISCELLANEOUS↗
Covert Cognizance: A Novel Predictive Modeling Paradigm for Securing Unattended High-Valued Systems
Explore the source record for details and available documents.
42 ENGINEERING↗
Opdefender Network Monitoring And Control System
OpDefender is a new system designed to enhance the cyber security of control system networks. It accomplishes this by inspecting each network packet using a novel, patent-pending method that extends software defined networking into the application/ICS protocol layer. OpDefender consists of two key components: 1. Smart, “ICS-aware” network switches that analyze and filter network traffic in real time. 2. A network management human machine interface (HMI) that allows an operator to monitor and control network traffic in real time. The “ICS-aware” switches can serve as a drop-in replacement for typical network switches, or they can be used in conjunction with existing network switches. OpDefender is configured and controlled in real time via a custom-built, web-based HMI designed with the operator in mind.
Johnson, BriamE.↗
E Tunnel Wastewater Disposal System Quarterly Monitoring Report Nevada National Security Site, Nevada Water Pollution Control Permit NEV 96021, Third Quarter 2018
This report includes the results of the E Tunnel Wastewater Disposal System (ETDS) inspections and monitoring for July, August, and September 2018. Monitoring and sampling activities were performed in accordance with the requirements of Water Pollution Control Permit NEV 96021, Revision 1, effective October 1, 2013. Monthly monitoring was conducted on July 16, August 13, and September 13, 2018. Operating personnel measured the instantaneous flow rate (see Table 1), log hydrogen ion activity (pH), temperature, and specific conductance of the discharge water (see Table 2). Monthly inspections also included an assessment of the general condition of the berms, including ponding (the water levels relative to the overflow pipes); any tunneling or burrowing into the berms; soil conditions on and around the berms, including erosion or sloughing of the interior or exterior slopes of the berms; seeps at the toe of the berms; the presence of any deep-rooting botanicals on the berms; and the physical condition of fencing (see Tables 3 through 7). Monthly rainfall quantities are presented in Table 8.
54 ENVIRONMENTAL SCIENCES↗
Secure information transmission in filter bank multi-carrier spread spectrum systems
This report discusses the issue of secure information transmission for a spread-spectrum system, which in our case is Filter-Bank Multi-Carrier spread spectrum (FB-MC SS). We develop a novel method for generating a secret key to augment the security of the spread spectrum system. The proposed key generation takes advantage of the channel reciprocity exhibited between two communicating parties.We validate the key generation aspect of our system by using real-world measurements. It is found that our augmentation of strongest path cancellation (SPC) is shown to be highly effective in our measurement scenarios where the adversary’s key would otherwise be significantly correlated with the legitimate nodes. Our approach in using the proposed key generation method as a part of FB-MC SS allows for it to be fault tolerant and it is not necessarily limited to FB-MC SS or spread-spectrum system in general. However, the advantage that our approach has in the domain of spread-spectrum security is that it significantly decorrelates the adversary’s key from the authentic parties. This aspect is crucial because if the adversary’s key is similar to the legitamate parties, then the adversary obtains a sizable advantage due to the fault tolerance nature of the developed spread spectrum key.
45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
An Automated, Disruption-Tolerant Device Authentication and Key Management Framework for Critical Systems
Key management is critical to secure operation. Distributed control systems, such as Supervisory Control and Data Acquisition (SCADA) systems, have unique operational requirements that make conventional key management solutions less effective and burdensome. In this paper a novel Kerberos based framework for automated, disruption-tolerant key management for control system environments is presented. Experimental tests and their results are presented to quantify expected performance overhead of this approach. In addition, Zeek sensor analytics are presented to monitor the health and security of the key management framework operation.
Edgar, Thomas W.↗
An Automated Disruption-Tolerant Key Management Framework for Critical Systems
Key management is critical to secure operation. Distributed control systems, such as Supervisory Control and Data Acquisition (SCADA) systems, have unique operational requirements that make conventional key management solutions less effective and burdensome. This paper presents a novel Kerberos-based framework for automated, disruption-tolerant key management for control system environments. Here, experimental tests and their results are presented to quantify the expected performance overhead of this approach. Additionally, Zeek sensor analytics are presented to aid in monitoring the health and security of the key management framework operation.
96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗
Forming IDEAS: Interactive Data Exploration & Analysis System
Modern cyber security operations collect an enormous amount of logging and alerting data. While analysts have the ability to query and compute simple statistics and plots from their data, current analytical tools are too simple to admit deep understanding. To detect advanced and novel attacks, analysts turn to manual investigations. While commonplace, current investigations are time-consuming, intuition-based, and proving insufficient. Our hypothesis is that arming the analyst with easy-to-use data science tools will increase their work efficiency, provide them with the ability to resolve hypotheses with scientific inquiry of their data, and support their decisions with evidence over intuition. To this end, we present our work to build IDEAS (Interactive Data Exploration and Analysis System). We present three real-world use-cases that drive the system design from the algorithmic capabilities to the user interface. Finally, a modular and scalable software architecture is discussed along with plans for our pilot deployment with a security operation command.
Bridges, Robert↗
Edge Deployed Cyber Security Hardware Architecture for Energy Delivery Systems
At a time of accelerated cyber conflict, an “edge deployed” system will supply sensor based cyber ground truth to live grid models, and under secure command, take complete control of suspected rogue programmable logic controllers (PLCs) to maintain bulk power delivery to chosen critical sites. This hardware solution is purpose built to be agnostic to PLC vendor or protocol with the realization that a widely deployed solution must function with existing devices for rapid adoption by industry. An overview of the situation and how this developed system functions is provided.
42 ENGINEERING↗
Electronic Derivative Classifier/Reviewing Official
The electronic Derivative Classifier, Reviewing Official (eDC/RO) is a web based document management and routing system that reduces security risks and increases workflow efficiencies. The system automates the upload, notification review request, and document status tracking of documents for classification review on a secure server. It supports a variety of document formats (i.e., pdf, doc, docx, xls, xlsx, xlsm, ppt, pptx, vsd, vsdx and txt), and allows for the dynamic placement of classification markings such as the classification level, category and caveats on the document, in addition to a document footer and digital signature.
Harris, Joshua C↗
A Multidimensional Holistic Framework for the Security of Distributed Energy and Control Systems
The digitization of smart grid distributed generation and industrial control systems has prompted utilities to deploy tools with ubiquitous communications that potentially widen the attack surface. The utilities still continue to rely on the traditional cybersecurity technologies, such as firewalls, anti-malware tools, and passwords that do not ensure security across all dimensions of the information assurance model required for a strong cybersecurity business process. This paper proposes a multidimensional holistic framework that addresses this gap through advanced technologies, intelligent algorithms, and continued assessments. To show proof, the layered defense model, a solution dimension of the framework, is integrated into the National Renewable Energy Laboratory's Security and Resilience Testbed to replicate a utility's enterprise and substation networks. The model is used to evaluate the security and resilience of microgrid control systems, and, based on the insights gathered, recommend best practices for utility cybersecurity analysts for a strong business process. Here, with this baseline, the paper conceptually introduces intelligence-driven solutions comprising contextual data analysis and machine learning to respond to advanced persistent threats sponsored by campaign efforts.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Blueprint: Stakeholder-Specific Vulnerability Categorization Guidance
Vulnerability management is a process of discovering, analyzing, and handling new or reported security vulnerabilities in systems to prevent the systems from being exploited, to reduce risk, and to protect assets. For vulnerability analysis, handling, and response, the prioritization of organizational and analyst resources must precede. The Common Vulnerability Scoring System (CVSS) is a standard prioritization method that is used to rate the severity of security vulnerabilities in systems by assigning numerical severity scores, but it does not provide clear guidelines of how the numerical severity scores might inform decisions. The Stakeholder-Specific Vulnerability Categorization (SSVC) provides a method for prioritizing vulnerabilities based on the needs of the stakeholders involved in the vulnerability management process. Instead of the numerical scoring used in the CVSS, the SSVC focuses on contextual decision-making to determine how quickly and effectively an organization should respond to vulnerabilities. The main functionality of the SSVC accommodates the diversity of the stakeholders in the vulnerability management process, including finders, vendors, coordinators, deployers, and others. So, the SSVC should be designed to be used by any of these stakeholders, and it should be customizable to enable specific stakeholder decision models and risk appetites.
33 ADVANCED PROPULSION SYSTEMS↗
E Tunnel Wastewater Disposal System Quarterly Monitoring Report Nevada National Security Site, Nevada Water Pollution Control Permit NEV 96021, Second Quarter 2018
This report includes the results of the E Tunnel Wastewater Disposal System (ETDS) inspections and monitoring for April, May and June 2018. Monitoring and sampling activities were performed in accordance with the requirements of Water Pollution Control Permit NEV 96021, Revision 1, effective October 1, 2013.
12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
Efficient Modeling of HIL Multi-Grid System for Scalability & Concurrency in CPS Security Testbed
Cyber-event-triggered power grid blackout compels utility operators to intensify cyber-aware and physics-constrained recovery and restoration process. Recently, coordinated cyber attacks on the Ukrainian grid witnessed such a cyber-event-triggered power system blackout. Various cyber-physical system (CPS) testbeds have attempted with multitude designs to analyze such interdependent events and evaluate remedy measures. However, resource constraints and modular integration designs have been significant barriers while modeling large-scale grid models (scalability) and multi-grid isolated models (concurrency) under a single real-time execution environment for the hardware-in-the-loop (HIL) CPS security testbeds. This paper proposes a meticulous design and effective modeling for simulating large-scale grid models and multi-grid isolated models in a HIL realtime digital simulator environment integrated with industry-grade hardware and software systems. We have used our existing HIL CPS security testbed to demonstrate scalability by the realtime performance of a Texas-2000 bus US synthetic grid model and concurrency by the real-time performance of simultaneous ten IEEE-39 bus grid models and an IEEE-118 bus grid model. The experiments demonstrated significant results by 100% realtime performance with zero overruns, low latency while receiving and executing control signals from SEL Relays via IEC-61850 protocol and low latency while computing and transmitting grid data streams including stability measures via IEEE C37.118 synchrophasor data protocol to SEL Phasor Data Concentrators.
24 POWER TRANSMISSION AND DISTRIBUTION↗
2017 Grid Modernization Peer Review Report; Foundational Projects and Technical Area Portfolio Review
In April 2017, the U.S. Department of Energy’s (DOE’s) Grid Modernization Initiative (GMI) conducted its first external peer review of the projects awarded to the Grid Modernization Laboratory Consortium (GMLC) to execute a diverse portfolio of technologies to modernize the nation’s grid. The six technology areas reviewed during the 2017 Project Peer Review were: Design and Planning Tools; Devices and Integrated Systems; Institutional Support, Security and Resilience; Sensing and Measurement; and System Operations, Power Flow, and Control. Results of the 2017 Peer Review have been, and will be, used to help inform programmatic decision making, modify or discontinue existing projects, guide future funding opportunities, and support other budget and strategic planning objectives.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Security-informed safety: integrating security within the safety demonstration of a smart device - 157
Safety and security engineering have, over the years, developed their own regulations, standards, cultures, and practices. However, there's a growing realisation that security is closely connected to safety. Safety must be security-informed: if a safety-critical system isn't secure, it isn't safe. A safety demonstration is incomplete and unconvincing unless it considers security. In our work for government and industry, we have used the Claims, Arguments, Evidence (CAE) framework to analyse the impact of security on a safety justification or safety case and identified the significant changes needed to address security explicitly. This will impact the design and implementation process as well as the assurance and V and V approach. In this paper we discuss the impact of integrating security when developing a safety demonstration of a smart device. A smart device is an instrument, device or component that contains a microprocessor (and therefore contains both hardware and software) and is programmed to provide specialised capabilities, often measuring or controlling a process variable. Examples of smart devices include radiation monitors, relays, turbine governors, uninterruptible power supplies and heating ventilation, and air conditioning controllers. (authors)
42 ENGINEERING↗
Design and Implementation of Full-Scale Industrial Control System Test Bed for Assessing Cyber-Security Defenses
In response to the increasing awareness of the Ethernet-based threat surface of industrial control systems (ICS), both the research and commercial communities are responding with ICS-specific security solutions. Unfortunately, many of the properties of ICS environments that contribute to the extent of this threat surface (e.g. age of devices, inability or unwillingness to patch, criticality of the system) similarly prevent the proper testing and evaluation of these security solutions. Production environments are often too fragile to introduce unvetted technology and most organizations lack test environments that are sufficiently consistent with production to yield actionable results. Cost and space requirements prevent the creation of mirrored physical environments leading many to look towards simulation or virtualization. Examples in literature provide various approaches to building ICS test beds, though most of these suffer from a lack of realism due to contrived scenarios, synthetic data and other compromises. In this paper, we provide a design methodology for building highly realistic ICS test beds for validating cybersecurity defenses. We then apply that methodology to the design and building of a specific test bed and describe the results and experimental use cases.
Gillen, Rob↗