Results for “Cybersecurity Resilience” — Page 4

DOE OSTI2023

Resilient Electric Grid: Defining, Measuring, and Integrating Resilience into Electricity Sector Policy and Planning

Traditionally, electric grid planning seeks to maintain safe, reliable, efficient, and affordable service for current and future customers. As policies, expectations of the energy system, and the threat landscape evolve, additional objectives for power system planners are emerging, including decarbonization, resilience, and equity. Renewable and clean energy goals, especially in the context of deep decarbonization strategies, are changing the mix of resources on the electric grid and prompting new considerations for grid architecture. The increased frequency and severity of extreme weather events over the last two decades, coupled with cybersecurity concerns, have elevated resilience as a key system need. More recently, there has been greater focus on equity and energy justice in grid planning to ensure that disadvantaged communities are not adversely affected by grid modernization and have equal access to its benefits. In response, new thinking around multi-objective decision planning is exploring improvements in grid planning processes to better integrate approaches to meet decarbonization, resilience, and equity objectives. To provide a foundation for this work, a series of white papers was produced to summarize these emerging objectives.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2023

Equitable Electric Grid: Defining, Measuring, and Integrating Equity into Electricity Sector Policy and Planning

Traditionally, electric grid planning seeks to maintain safe, reliable, efficient, and affordable service for current and future customers. As policies, expectations of the energy system, and the threat landscape evolve, additional objectives for power system planners are emerging, including decarbonization, resilience, and equity. Renewable and clean energy goals, especially in the context of deep decarbonization strategies, are changing the mix of resources on the electric grid and prompting new considerations for grid architecture. The increased frequency and severity of extreme weather events over the last two decades, coupled with cybersecurity concerns, have elevated resilience as a key system need. More recently, there has been greater focus on equity and energy justice in grid planning to ensure that disadvantaged communities are not adversely affected by grid modernization and have equal access to its benefits. In response, new thinking around multi-objective decision planning is exploring improvements in grid planning processes to better integrate approaches to meet decarbonization, resilience, and equity objectives. To provide a foundation for this work, a series of white papers was produced to summarize these emerging objectives.

24 POWER TRANSMISSION AND DISTRIBUTION↗

NASA NTRSDate not supplied

The State of Cryptolib – The Open-Source Satellite Cryptography Library

What state would the world be in if all internet traffic was unencrypted? Imagine an alternate universe where you can plug a packet sniffing device into your home internet and capture the web traffic of the entire world. It seems obvious that this scenario is less than desirable. If we would not allow this for the internet, why would we allow this in the space domain? With the advent of open-source ground stations, commercial off the shelf hardware, and ground stations as a service, the barrier to entry for space communications is rapidly lowering. New players enter the space realm everydayevery day, and the presence of tools to allow apprentice evildoers the ability to exploit satellite communications is on the horizon. Not only are legacy missions at risk, but future missions are as well - particularly lower budget science missions with more stringent sciencesize, weight, and power constraints. that may find it difficult to utilize hardware-based encryption solutions. In terms of Civilian Aerospace, NASA Standard 1006 generally directs that missions "shall protect the command stack with encryption that meets or exceeds Federal Information Processing Standards (FIPS) 140". Fortunately, the Consultative Committee for Space Data Systems (CCSDS) has published an international standard on Space Data Link Security. The combination of these two forces has resulted in CryptoLib - an open-source, C-based, encryption library that aims to be CCSDS SDLS compliant. CryptoLib is designed to support smaller missions on a tight budget that may be subject to the more stringent command link encryption requirements. Additionally, CryptoLib serves as an underpinning in JPL's Key Management & Cryptography (KMC) suite and is also designed to function as a 'drop-in' for smaller missions. CryptoLib is in active development and currently provides Telecommand (TC), Telemetry (TM), and Advanced Orbiting Systems (AOS) encryption and decryption capabilities with a variety of encryption and authentication schemes. This presentation will report the latest features, current status, and future plans for CryptoLib.

open-source encryption↗

NASA NTRSDate not supplied

The State of CryptoLib – The Open-Source Satellite Cryptography Library

What state would the world be in if all internet traffic was unencrypted? Imagine an alternate universe where you can plug a packet sniffing device into your home internet and capture the web traffic of the entire world. It seems obvious that this scenario is less than desirable. If we would not allow this for the internet, why would we allow this in the space domain? With the advent of open-source ground stations, commercial off the shelf hardware, and ground stations as a service, the barrier to entry for space communications is rapidly lowering. New players enter the space realm everydayevery day, and the presence of tools to allow apprentice evildoers the ability to exploit satellite communications is on the horizon. Not only are legacy missions at risk, but future missions are as well - particularly lower budget science missions with more stringent sciencesize, weight, and power constraints. that may find it difficult to utilize hardware-based encryption solutions. In terms of Civilian Aerospace, NASA Standard 1006 generally directs that missions "shall protect the command stack with encryption that meets or exceeds Federal Information Processing Standards (FIPS) 140". Fortunately, the Consultative Committee for Space Data Systems (CCSDS) has published an international standard on Space Data Link Security. The combination of these two forces has resulted in CryptoLib - an open-source, C-based, encryption library that aims to be CCSDS SDLS compliant. CryptoLib is designed to support smaller missions on a tight budget that may be subject to the more stringent command link encryption requirements. Additionally, CryptoLib serves as an underpinning in JPL's Key Management & Cryptography (KMC) suite and is also designed to function as a 'drop-in' for smaller missions. CryptoLib is in active development and currently provides Telecommand (TC), Telemetry (TM), and Advanced Orbiting Systems (AOS) encryption and decryption capabilities with a variety of encryption and authentication schemes. This presentation will report the latest features, current status, and future plans for CryptoLib.

open-source encryption↗

DOE OSTI2024

Resilient Energy Delivery and Control Systems (REDCS) (Final Technical Report)

US critical infrastructure is increasingly the target of cyberattacks, where disturbances could cause considerable damage and disruption. To help provide a new layer of cyber-physical protection for one key energy delivery system, natural gas pipelines, GE Vernova Advanced Research along with partners Florida State University and Intel Corporation created an innovative technology called "Resilient Energy Delivery and Control Systems" (REDCS). This cybersecurity package helps detect anomalies caused by cyberattacks, isolate the subsystem being impacted by the attack, and provide functions that can allow for resiliency – giving better situational awareness to the operators and cybersecurity specialists or in the future perform closed loop control for continued operation while compromised.

03 NATURAL GAS↗

DOE OSTI2023

Disrupting EV Charging Sessions and Gaining Remote Code Execution with DoS, MITM, and Code Injection Exploits using OCPP 1.6

Open Charge Point Protocol (OCPP) 1.6 is widely used in the electric vehicle (EV) charging industry to communicate between Charging System Management Services (CSMSs) and Electric Vehicle Supply Equipment (EVSE). Unlike OCPP 2.0.1, OCPP 1.6 uses unencrypted websocket communications to exchange information between EVSE devices and an onpremise or cloud-based CSMS. In this work, we demonstrate two machine-in-the-middle (MITM) attacks on OCPP sessions to terminate charging sessions and gain root access to the EVSE equipment via remote code execution (RCE). Second, we demonstrate a malicious firmware update with a code injection payload to compromise an EVSE. Lastly, we demonstrate two methods to prevent availability of the EVSE or CSMS. One of these, originally reported by SaiFlow, prevents traffic to legitimate EVSE equipment using a DoS-like attack on CSMSs by repeatedly connecting and authenticating several CPs with the same identities as the legitimate CP. These vulnerabilities were demonstrated with proof-of-concept exploits in a virtualized Cyber Range at Wright State University and/or with a 350 kW Direct Current Fast Charger (DCFC) at Idaho National Laboratory. The team found that OCPP 1.6 could be protected from these attacks by adding secure shell (SSH) tunnels to the protocol, if upgrading to OCPP 2.0.1 was not an option. Index Terms—Electric vehicle charging, cybersecurity, OCPP, cyberattack, cyber-resilience. INSPEC Accession Number: 23981565

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2025

Hawaii Threat Brief

The Digital Energy Transformation is redefining how power systems operate, integrating physical infrastructure with digital technologies to enhance efficiency, visibility, and resilience. For islanded and digitally modernizing systems like Hawai‘i’s, this shift presents both new opportunities and evolving challenges in cybersecurity, supply chain assurance, and environmental resilience. This brief provides an overview of critical infrastructure dependencies and systemic risks associated with increasing digital integration. It summarizes recent energy-sector threat activity and case studies that illustrate adversary tactics and supply chain vulnerabilities, and identifies pathways to strengthen resilience.

25 - ENERGY STORAGE↗

DOE OSTI2026

Aggregation and Grid Security Workshop Report

The Aggregation and Grid Security Workshop - held on June 17-18, 2025, National Laboratory of the Rockies (NLR) in Golden, Colorado - brought together approximately 40 external stakeholders from the energy sector, including VPP owner/operators, aggregators, OEMs, utilities, testing & certification labs, trade associations, and cybersecurity vendors. Led by key facilitators, the workshop focused on addressing cybersecurity challenges and enhancing grid resilience for aggregated Distributed Energy Resources (DERs) and Virtual Power Plants (VPPs). The workshop was catalyzed by recognition that traditional, rearward-looking regulatory frameworks are insufficient to keep pace with technological change. There is a "missing understanding" of risk, an "absent security basis" for managing it, and an "untenable responsibility" due to unclear ownership and requirements. The workshop aimed to shift the mindset from reacting to past crises to proactively preparing for emerging threats, fostering forward resilience through risk simulation and collaborative action. This report summarizes the outcomes of the workshop, marking it a significant step toward a secure, reliable and affordable energy future.

14 SOLAR ENERGY↗

DOE OSTI2024

Cybersecurity for Energy Delivery Systems

The Cyber Resilient Energy Delivery Consortium (CREDC) started operations on October 1, 2015. The original period of performance ended September 30, 2020. During this span, CREDC developed projects with significant and measurable sector impact, achieved by involving industry partners (asset owners, equipment vendors, and technology providers) early and often, from helping us to identify critical sector needs, to performing pilot deployment and technology adoption. The central project goal was to create a research and development ecosystem where research results lead directly to development of applications and methodologies which are then validated in realistic contexts.

24 POWER TRANSMISSION AND DISTRIBUTION↗

NASA NTRSDate not supplied

Cyber Resiliency and the Implementation of a Host-Based Intrusion Detection System in an Urban Air Mobility Environment

With the growth in Urban Air Mobility systems and the increasing reliance on interconnected technologies, ensuring the security of these complex components has become critical. As cities evolve into smart urban centers, the vulnerability to cyber threats escalates, possibly endangering citizens safety and the efficiency of transportation networks.In response to these challenges, this paper presents a study on the need for cyber resilient techniques within future air traffic environments. It will pay specific attention to the implementation of a Host-Based Intrusion Detection System (HIDS) utilizing Atomic OSSEC software, tailored specifically to a NASA simulation of an UrbanAirMobility environments’ unique demands. Further, this study seeks to outline the rational for NASA’s recommendation for a HIDS in such environments. It explores the design, development, and deployment of the proposed HIDS, focusing on its adaptability to monitor the hybrid nature of the Urban Air Mobility environment. Leveraging machine learning algorithms and anomaly detection techniques, the HIDS is equipped to continuously monitor and analyze the behavior of individual host systems, vehicles, and devices, thereby providing a proactive approach to threat detection. Implementing a HIDS is a pivotal strategy for enhancing cyber resiliency, as it gives an organization granular visibility into internal system activities, enables rapid detection and response to anomalous behavior and cyber threats, and fortifies the organizations overall cybersecurity posture. Finally, this study aims to provide recommendations and include learned takeaways that the Urban Air Mobility industry should consider. In brief, this paper highlights the significance of host-based intrusion detection in UrbanAirMobility environments and underscores the necessity of tailored security solutions to safeguard against emerging cyber threats.

UAM↗

DOE OSTI2024

DEReliction: A Cybersecurity Vulnerability Assessment Methodology for Distributed Energy Resources

With the increasing integration of Distributed Energy Resources (DER) into the electric grid, maintaining grid reliability and resilience requires that these devices remain secure. This paper discusses a cybersecurity vulnerability assessment methodology that incorporates best practices from Sandia National Laboratories, SANS Institute, OWASP Foundation, and other web and Internet of Things (IoT) penetration testing (“pen testing”) programs, courses, and frameworks for assessing the security posture of devices. The methodology involves five sequential steps: (1) Collect Public Information, (2) Extract Hardware Details, (3) Inventory Software Components, (4) Identify Vulnerabilities, and (5) Test Vulnerabilities. Each step uncovers potential weaknesses in both hardware and software components of DER devices, considering adversary tactics, techniques, and procedures (TTPs), and potential attack vectors along the way. The results from the execution of this method on multiple residential- and small commercial-scale photovoltaic (PV) inverters reveled hardware and software vulnerabilities, which highlight the benefit of taking a methodical approach to discover vulnerabilities. While the specific vulnerability details are not shared here, a generalized overview of findings underscore the importance of robust security assessments for DER devices. Adoption of an assessment framework of this kind will identify and mitigate cybersecurity threats and bolster the resilience of DER-integrated electric grids.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

Cybersecurity Baselines for Electric Distribution Systems and DER

The National Association of Regulatory Utility Commissioners (NARUC) has partnered with the Department of Energy (DOE) to develop a set of cybersecurity baselines for electric distribution systems and the distributed energy resources (DERs) that connect to them. Cybersecurity is an integral underpinning of power system resilience, and this initiative builds on work that states have undertaken over the last decade to mitigate cybersecurity risk across their critical infrastructures.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

Countering Weapons of Mass Destruction (CWMD) Device Cybersecurity Characterization Process and Profile

Countering Weapons of Mass Destruction (CWMD) recognizes that threats in the cyberspace domain continue to grow, which requires CWMD devices and supporting systems to be both cybersecure (ability to protect or defend from cyber-attacks) and resilient (ability to maintain required capability in the face of adversity) to cyber threats. The CWMD cybersecurity characterization approach in this document supports existing cyber resilience activities within the Acquisition Lifecycle Framework. Similarly, this process supports existing Department of Homeland Security Cyber Resilience Test and Evaluation activities, which consist of iterative processes, starting at the initiation of system acquisition and continuing throughout the entire device and system life cycle. Cyber resilience is the ability of an information system to continue to operate while under attack, even if in a degraded or debilitated state,1 and to rapidly recover operational capabilities for essential functions after a successful attack.2 The goal of the security characterization task for CWMD is to support the development of a CBRN device-dependent profile that aligns with device network capabilities and maps to recommended security controls to create a characterization security profile impact levels. The impact levels for CWMD devices should be characterized as Low (L), Moderate (M), High (H) to align with the low, moderate, high control baselines. To estimate the impact levels, the device’s security-related attributes are translated into the security objectives: Confidentiality (C), Integrity (I), and Availability (A), known as the CIA triad. The potential impact for each device can be L, M, H, for devices that connect and transmit different types of data and may have different impact levels. National Institute of Standards and Technology Federal Information Processing Standards Publication 199 states, “the potential impact values assigned to the respective security objectives shall be the highest value from among those security categories that have been determined for each type of information resident on the information system.”3 As CWMD is determining the cybersecurity impact levels of CBRN devices based on network connections and data transfers, the impact levels are aligned with the associated attributes of network connections and communications. For example, if the device system is connected to a wireless network and transmits different data types based on the confidentiality of the data, the highest impact value for each security objective should represent the device’s CIA impact level. This document is intended to be used by test managers, test team, and program managers.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2026

EVs-at-RISC: A Secure and Resilient Interoperable SCM Control System Architecture for Electric Vehicle’s-at-Scale (Final Technical Report)

The EVs-at-RISC project was a five-year research, development, and demonstration initiative to create foundational tools for utility-scale fleet aggregation and Smart Charge Management (SCM) of Electric Vehicles (EV), Electric Vehicle Charging Infrastructure (EVCI), and related Distributed Energy Resources (DER). Rather than seeking to develop and demonstrate highly perfected SCM algorithms and control strategies, this project instead focused on creating foundational software solutions that enable unprecedented digital interoperability across the communications technologies and vendor platforms used to manage EV , EVCI, and DER, as well as existing energy management infrastructure operated by utilities, grid operators, and aggregators. This project then extends these novel interoperability capabilities to develop and deploy powerful middleware abstractions across grid edge networks and EVCI/DER fleet aggregations incorporating modern software tools and best practices, such as CI/CD, to bring the immense capabilities of infrastructure-as-code and policy-as-code to modern grid edge network environments. This addresses the foremost systemic issues preventing realization of any net operational benefits from scaled deployment of behind-the-meter EV, EVCI, and DER assets in electric power grids and markets today. The results of this approach and project unlock massive potential for new SCM capabilities to be easily prototyped, evaluated, and deployed at-scale within the existing grid edge network infrastructure and EVCI/DER technology ecosystem. The EVs-at-RISC project achieves this by extending Open Field Message Bus (OpenFMB), a conceptual model for digital interoperability and distributed intelligence in traditional front-of-meter utility SCADA networks, validating our hypothesis that OpenFMB could be similarly used to solve systemic digital interoperability issues in behind-the-meter environments and unlock real-world utility-scale SCM capabilities without requiring any new proprietary vendor solutions or significant infrastructure reconfiguration.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

Cyber-informed Engineering Microgrid Analysis Tool

The Cyber-Informed Engineering Microgrid Analysis Tool (CIEMAT) leverages the Department of Energy’s Cyber-Informed Engineering to prompt engineering designers and operators through an analysis of the critical functions to be supported by a microgrid installations, the criticality of those functions, the impacts of denial, disruption or misuse of those functions on the microgrid and dependent functions, and the mitigations which could best prevent impacts to those functions resulting from cyber attack. Through use of this tool, microgrid designers and operators can quickly identify appropriate engineering mitigations to limit impacts from cyber attack and functions where engineering and operational staff can prioritize and guide the application of cybersecurity protections to best support the resiliency of the system.

Wright, VirginiaL [Idaho National Laboratory (INL)↗

DOE OSTI2025

Cyber-informed Engineering Battery Analysis Tool

The Cyber-Informed Engineering Battery Analysis Tool (CIEBAT) leverages the Department of Energy’s Cyber-Informed Engineering to prompt engineering designers and operators through an analysis of the critical functions to be supported by a BESS installation, the criticality of those functions, the impacts of denial, disruption or misuse of those functions within the BESS system, and the mitigations which could best prevent impacts to those functions resulting from cyber attack. Through use of this tool, BESS designers and operators can quickly identify appropriate engineering mitigation opportunities to limit impacts from cyber attack and functions where engineering and operational staff can prioritize and guide the application of cybersecurity protections to best support the resiliency of the system.

Lampe, BenjaminR [Idaho National Laboratory (INL),↗

DOE OSTI2025

Master Services Agreement - Flexible Feeder/Distribution System Support: Cooperative Research and Development (Final Report)

PGE will engage NREL on a broad range of projects related to the integration of distributed energy resources (DERs) into the utility's operations. This portfolio of work could include projects focused on DER adoption models, advanced distribution management system (ADMS) and distributed energy management system (DERMS) design, DER dispatch strategy development, and DER valuation framework development. Additional topics could include long-term energy planning, renewable energy, energy efficiency and demand-side management. As well as technology evaluations and design guidance for building retrofits and new construction projects, energy and energy infrastructure planning, policies, and markets (and their analysis), energy storage, energy security and resilience (including energy system-related cybersecurity), transportation and mobility, technology integration analysis. Additionally, other assistance as requested by PGE consistent with NREL’s expertise.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

ByzSec — A Multi-layered Byzantine Resilient Architecture for Bulk Power System Protective Relays

Reliability, selectivity, and sensitivity are the fundamental attributes of any protection system, acting as the main drivers in the selection of schemes, and equipment. In high-voltage systems, microprocessor-based relays represent the industry’s preferred solution, providing engineers with a vast array of benefits. However, they remain vulnerable to cybersecurity events that may compromise their functionality. To help mitigate against potential cybersecurity risks, this paper presents a fault-tolerant, Byzantine Resilient (BR) architecture that significantly increases the cybersecurity attributes of a protection system while minimizing the amount of performance impacts and integration overheads introduced. The solution relies on an array of independent relays that utilize robust consensus methods (based on Spire [1], [2]) to ensure correct system behavior is achieved even when a relay has been compromised. Furthermore, the solution has been complemented with a custom-built Situational Awareness engine that can be used to detect and identify potential threats. The implemented solution has been developed in consultation with three hardware vendors and has been tested to comply with the performance requirements of a 345kV differential protection scheme (87T). The results indicate that the proposed architecture is a comprehensive solution that: supports the strict correctness and performance requirements of the bulk power grid while providing a cost-effective alternative that offers a seamless, long-term solution.

byzantine security, Fault Tolerant Application Sof↗