Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “cybersecurity recommendations”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Facility Cybersecurity Framework Best Practices

Federal facilities are increasingly adopting automation and connecting to the Internet creating an energy-internet-of-things environment that converges operational technology (OT) and information technology (IT). Today's buildings increasingly weave together networked sensors and cyber and physical systems that enable data to be collected, aggregated, exchanged, stored and monetized in new ways. Building technological advances have created new energy technology, services, markets and value creation opportunities (e.g. transactive energy, two-way grid communications, machine learning, and increased use of renewable and distributed energy resources). But as larger data sets are being exchanged at faster speeds between an increasing number of OT systems, it becomes more difficult to protect the security of the data lifecycle and the physical equipment it interacts with. These challenges are especially difficult to overcome because the economic and environmental gain (interoperability, big data, social networks and ubiquitous information sharing) are driving these prominent trends in the digital age. Often cybersecurity is an afterthought. The U.S. Department of Energy’s (DOE) Federal Energy Management Program (FEMP) funded the Pacific Northwest National Laboratory (PNNL) to develop various cybersecurity tools, trainings, and reports to aid federal facility managers – and other building owners and operators – in better applying frameworks and lessons learned from the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), risk management framework (RMF), DOE’s cybersecurity capability maturity model (C2M2), and a wide variety of industry best practices and guidance documents (i.e., NIST 800 series, Department of Defense United Facilities Criteria). This set of tools, collectively known as the FEMP Facility-Related Control System Cyber Toolkit (FRCS Cyber Toolkit)2, is focused on cybersecurity concerns from facility-related control systems and other operational technology (OT), such as industrial control systems (ICS). The FRCS Cyber Toolkit can be applied across six of the sixteen critical infrastructure sectors designated by the Department of Homeland Security, including government facilities, healthcare and public health, commercial facilities (e.g., public assembly, offices, lodging), financial services (e.g., banking and insurance), emergency services (e.g., fire and police stations), and information technology. With increasingly converged IT and OT systems, it is crucial to address OT cybersecurity considerations and assess how the seam of these two systems could impact the overall cybersecurity posture of a facility. The objective of this report is to provide an overview of the best possible method to use FRCS Cyber Toolkit (section 2.0) and distilled cybersecurity best practices for the federal facilities to address growing non-linear cyber threats (section 3.0). Recommendations in this document are aggregated from several NIST and other documents (see Appendix A for additional details).

97 MATHEMATICS AND COMPUTING↗
NASA NTRSDate not supplied

NASA’s Secured Airspace for Urban Air Mobility (UAM)

The Urban Air Mobility (UAM) architecture is leveraged from the Unmanned Traffic Management (UTM) concept of operations. Within the UAM environment, UAM operators work collaboratively to manage aerial vehicles in the urban environment. Providers of Services for UAM (PSU), UAM operators, and Supplemental Data Service Providers (SDSP) provide services to support flight operations within that environment. As a recognized need, various views of UAM flight information are provided to the public and public safety entities. To accomplish this, among other goals, the Federal Aviation Administration (FAA) can coordinate flight information between the FAA controlled National Airspace System (NAS) and the UAM environments through the FAA-Industry Data Exchange Protocol (FIDXP). This concept of UAM proposes to develop short-range, point-to-point transportation systems in metropolitan areas using vertical take-off and landing (VTOL) or short take-off and landing (STOL) aircraft to overcome increasing surface congestion. To garner the support of UAM and to realize its potential, an assurance of cybersecurity is critical for public acceptance. Understanding the various components communicating with one-another cybersecurity, like in other industries, has come to the forefront highlighting the need to protect these networks and systems from cyberattacks. With the planned growth and reach of UAM systems, it’s clear that the associated data exchange and service interactions will be at risk due to numerous types of cybersecurity attacks. Consequently, as these threats evolve, the UAM cybersecurity capabilities must adapt to these changes as well. While learning is always the goal, the overall intent of this workshop is to make recommendations on the following: (1) how future UAM environments can be protected against cyber-attacks, and (2) what mechanisms should be put in place to detect attacks against UAM environments.

UAM↗
DOE OSTI2021

Implementing Cybersecurity for Distributed Wind: An Exercise in ICS Security Application

Distributed wind is unique and fast-growing component of the energy production mix, but cybersecurity for distributed wind is not well developed. In this presentation, we will introduce distributed wind as an example of difficult-to-secure critical infrastructure. We will first provide background on distributed wind architectures, applications, and stakeholder roles. We will explain the need and challenges for cybersecurity for distributed wind, pointing to both academic studies and real-world events. The key component of the presentation will discuss recommendations for different aspects of security, such as risk assessments, communications, and access control, that specifically call out considerations that apply uniquely to distributed wind. We will discuss what sets distributed wind apart from other ICS and energy applications, and how to account for these features in a comprehensive security plan. This process is demonstrative of the type of analysis needed to adapt traditional security guidelines and standards to narrow and focused applications.

17 WIND ENERGY↗
DOE OSTI2024

Cyber-Informed Engineering (CIE) Benefits Quantification: Recommendations for Consideration

Cyber-Informed Engineering (CIE) integrates engineering principles into the design, development, and operation of cyber-physical systems (CPS) to mitigate or eliminate the impact of cyber-enabled attacks. In July 2024, Idaho National Laboratory (INL) engaged MITRE researchers to investigate methods for systematically measuring the benefits of CIE implementation. This included evaluating the success and outcomes of CIE, identifying and quantifying the value of early adoption, and determining the business justification for its implementation, especially in existing infrastructure. MITRE reviewed existing methods in engineering and cybersecurity to understand how organizations prioritize security investments, considering their strengths, weaknesses, and relevance to CIE stakeholders. Based on this analysis, MITRE proposed potential approaches for quantifying CIE benefits and provided recommendations for INL's consideration.

42 ENGINEERING↗
NASA NTRS2015

Cyber-Attack Methods, Why They Work on Us, and What to Do

Basic cyber-attack methods are well documented, and even automated with user-friendly GUIs (Graphical User Interfaces). Entire suites of attack tools are legal, conveniently packaged, and freely downloadable to anyone; more polished versions are sold with vendor support. Our team ran some of these against a selected set of projects within our organization to understand what the attacks do so that we can design and validate defenses against them. Some existing defenses were effective against the attacks, some less so. On average, every machine had twelve easily identifiable vulnerabilities, two of them "critical". Roughly 5% of passwords in use were easily crack-able. We identified a clear set of recommendations for each project, and some common patterns that emerged among them all.

cybersecurity↗
DOE OSTI2021

Neighborhood Keeper Program Review

Dragos provided INL access to their Neighborhood Keeper platform, which contains simulated data, sample reports given to utilities, and access to anonymized program data that is sent from utilities to the cloud. Dragos has specifically asked INL to review the available data and respond to the following questions: 1) What detections or combinations of detections are most useful? 2) What additional analysis would benefit the electricity subsector? 3) How could Neighborhood Keeper reporting be modified to benefit the electricity subsector? 4) What lessons learned from the Cybersecurity for the Operational Technology Environment (CyOTE) program could be provided? 5) Based on INL’s experience with utilities, are there lessons learned about data sharing that could be provided? 6) Are there recommendations that could benefit the electricity subsector?

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

Advanced Reactor Control Systems Authentication Methods and Recommendations

In the dynamic landscape of Operational Technology (OT), and specifically the emerging landscape for Advanced Reactors, the establishment of trust between digital assets emerges as a challenge for cybersecurity modernization. This report reviews existing approaches to authentication in Enterprise environments, and proposed methods for authentication in OT, and analyzes each for its applicability to future Advanced Reactor digital networks. Principles of authentication ranging from underlying cryptographic mechanisms to trust authorities are evaluated through the lens of OT. These facets emphasize the importance of mutual authentication in real-time environments, enabling a paradigm shift from the current approach of strong boundaries to a more malleable network that allows for flexible operation. This work finds that there is a need for evaluation and decision making by industry stakeholders, but current technologies and approaches can be adapted to fit needs and risk tolerances.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2020

Dragonstone Strategy – State of Cybersecurity in the Oil & Natural Gas Sector

The oil & natural gas (ONG) system touches every corner of the nation and increased communications & control capabilities have not only allowed for greater efficiency of system operation, but have also created a massive target for adversaries to launch cyber-attacks. Like any other heavy industrial process, the ONG system relies on a complex system of information technology (IT) and operational technology (OT) devices. The current state of cyber-preparedness across the ONG industry varies from organization to organization. Among the most common challenges that ONG companies face are remote locations, longlived field assets, and lacking capabilities to find and track malware on their systems. ONG companies tend to be concerned with lack of cyber-awareness from employees, risk stemming from remote access for operations & maintenance, and software vulnerabilities within third-party equipment. Various industry and government organizations are performing research and development activities to address some of these challenges, but in many cases industry stakeholders are not aware of solutions that already exist. It is clear that a need exists for a coherent, comprehensive, multi-layered strategy for assuring the security and resilience of the nation's pipeline infrastructure against cyber threats. For a variety of reasons, the general consensus from stakeholders interviewed by LLNL is that the state of cyber-security within the electric grid is currently outpacing its ONG cousin. Existing strategies for the resilience and cyber-security of the electric grid can and should be leveraged to provide immediate benefits to the ONG system. In LLNL’s view, there are two key factors currently limiting the development of necessary cyber-practices within the ONG industry: The sheer number of differing regulatory bodies and trade groups offering both standards and best-practice recommendations for ONG cyber-security makes it difficult to create a comprehensive, directed, and coherent strategy that is applicable to all players within the ONG industry. The ONG industry is unaware of potentially useful technologies that have been developed for ensuring cyber-security of other infrastructure systems, such as the electric grid. Leveraging these technologies—and the science and engineering behind them—can provide some low-hanging fruit that can greatly improve cyber-security in the ONG industry without significant investments in terms of time and money. In the months following this report, LLNL will continue to perform outreach to key oil & gas industry stakeholders in a continual effort to identify the most pressing cyber-resilience issues in the industry. This outreach will be supplemented with LLNL’s threat intelligence capabilities to begin painting a clearer picture of the overall threat landscape faced by this sector. This assessment will be threat-informed and while the strategy itself will not be classified we will leverage intelligence analysis and adversary capabilities to identify gaps in current cybersecurity practices for oil & gas pipeline systems. Recommended efforts will be compiled into a cyber-resilience roadmap for the oil & gas pipeline sector, in which LLNL will highlight priority activities to immediately improve the state of cyber-resilience in the industry.

02 PETROLEUM↗
DOE OSTI2022

Public – Private Partnership to Promote Efficient Manufacturing and Workforce Development (IAC Final Technical Report)

Through delivering ninety (90) energy assessments to small- and medium-sized manufacturing facilities in and around Tennessee, significant understandings were gained through providing detailed energy assessment reports to manufacturers and training seventy-seven (77) engineering students in which thirty-five (35) certified IAC students were recognized by DOE. The robust involvement of Tennessee Valley Authority (TVA), local utility and Tennessee Tech’s Cybersecurity Education, Research, and Outreach Center (CEROC) in majority of assessments made the technical operation very effective where leaded to 40.5% implementation rate of energy recommendations. Other benefits of the award to the public are a dynamic modeling tool capable of analyzing existing cooling towers for energy use optimization was developed and presented to DOE IAC, providing technical assistance to non-participating manufacturers in the form of workshop and training, publishing fifteen (15) peer-reviewed conference and journal papers as well as a book chapter in the area of industrial energy efficiency field, assisting the TVA Magnolia Combined Cycle Power Plant to become the First 50001 Ready Certified Power Plant in the U.S. through briefing them on ISO 50001 and 50001 Ready as well as providing an energy assessment to the plant, assisted the new IAC center at Clemson University with on-site and remote support, and provided assessment and training in unique areas of water, waste water, cyber security and smart manufacturing to our clients, students and community.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2022

California Energy Systems for the 21st Century (CES-21) Program, CRADA TC02200 (Final Report)

The following report representsthe culmination of a five-year Cybersecurity Research and Development (R&D) program performed by California’s Investor-Owned Utilities (IOUs) and Lawrence Livermore National Laboratory (LLNL) and funded by the IOUs’ electricity ratepayers as authorized by California Legislation and the California Public Utilities Commission (CPUC). The cybersecurity R&D, which was intensely technical in nature, was broken into three major workstreams: 1. The development of a modeling & simulation platform, to explore the potential effects of various threat and response scenarios at grid scale; 2. The establishment of a physical testbed with separate substation instances from each of the IOUs, to evaluate threats and responses on actual substation equipment; 3. The development of a research package consisting of several capabilities to support the industry’s evolution towards automated threat response and other next-generation cybersecurity techniques Throughout the program, there was extensive collaboration between the program team and national laboratories, federal departments, academic institutions and industry organizations. Several of the tools developed through the program have been made available to the open source community, to enable faster adoption and continued development of important cybersecurity capabilities. While this program began to develop much of the foundation for automated threat response, much work remains to be done, and this report recommends a series of next steps. While the Executive Summary below has been simplified as much as possible, the very technical nature of the subject matter would make further reduction difficult without causing meaning to be lost. Due to the sensitive nature of the research, some topics are intentionally covered at a high level to protect the research and therefore the electric grid and customers of California and the Nation. For further detail, clarification or questions we suggest discussion with the program team.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2026

Navigating United States Standards and Regulation for Digital Energy Systems

This report provides an analysis of the U.S. standards and regulatory landscape for digital energy systems, focusing on cybersecurity, safety, and reliability requirements. It examines the interplay between federal mandates, state regulations, voluntary industry standards, and utility-specific policies, highlighting critical gaps between compliance and real-world risk mitigation. While NERC CIP standards enforce cybersecurity for Bulk Electric System assets, distribution-level infrastructure and emerging technologies often fall outside mandatory oversight, creating vulnerabilities. The report identifies systemic challenges such as reliance on self-attestation, uneven state adoption of safety codes, and lagging standards for advanced technologies like battery energy storage and inverter-based resources. Through a detailed gap analysis, it underscores the urgency of proactive risk-based approaches, independent verification, and strategic engagement with state and federal entities. Recommendations include adopting tiered security frameworks, strengthening procurement practices, and addressing emerging technology risks to ensure resilient and secure digital energy infrastructure. This guidance is intended for utilities, regulators, and stakeholders navigating compliance obligations and seeking to enhance cybersecurity and safety beyond minimum standards.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Industrial Assessment Center – integration of education and practice. Final progress report

The goal of the DOE’s Industrial Assessment Center (IAC) program is twofold: first, to help US manufacturing competitiveness by providing assessments and recommendations for small and medium-sized enterprises (SMEs) on energy efficiency, productivity, sustainability and competitiveness – including measuring the impacts of these recommendations on reducing greenhouse gas emissions; and second, to address a growing shortage of engineering professionals with applied energy and manufacturing-related skills by training a diverse cross-section of engineering students through hands-on involvement in these assessments. IUPUI has an IAC, which was established in 2011, in the Department of Mechanical and Energy Engineering, Purdue School of Engineering and Technology, IUPUI. The IAC has won the awards twice. We have built the center that has the expertise and infrastructure for quality energy assessments to manufactures and commercial building owners and aligned our current research and teaching activities to the DOE’ training mission with programs to train the next generation of industrial energy efficiency experts, with theory and hands-on experience in conducting energy assessment for small and median manufacturing enterprises. We have made recommendations that have the potential to save about $20M annually. We also initiated research projects to meet DOE priorities, specifically in the areas of smart manufacturing and cybersecurity. On the energy assessment side, the Center has provided energy assessments to 144 qualified companies, primarily located in Indiana. On the training side, the center has trained students in various programs, such as the department’s Bachelor of Science (BS) programs in Mechanical Engineering (ME) and BS in Energy Engineering (EEN), both are ABET accredited engineering programs, as well as a graduate level Energy Management and Assessment certificate program. At the present, the center has trained 95 students, 43 or them received the DOE issued certificates. Research projects were developed within the center to advance energy efficiency related technologies, which provided excellent opportunities for our trainees. The center has also been building a professional network with utilities, Manufacturing Extension Partnership (MEP), government agencies, and manufacturing companies, to increase our client base and promote collaborations. The center received the 2019 Center of Excellence of the Year Award and three students received the “Outstanding Achievement in Energy Engineering by an IAC Student” awards in the past five years.

42 ENGINEERING↗
DOE OSTI2019

Potential Cybersecurity Issues of Fast Charging Stations with Quantitative Severity Analysis

Potential issues of front-end converters of wireless power transfer system modules for extreme fast charging are discussed and analyzed in this study in order to provide some recommendations to defend against attacks on electric vehicles and charging systems. Compared to conventional low-power charging systems, the impact of a cyber-attack might be more detrimental in high-power / fast charging systems since the fault energy levels would be inherently higher both on the grid- and vehicle- side converters. In order to analyze the potential issues that might be a result of cyber-attacks, the negative scenarios are reviewed in this study which include interfering with the grid-side controllers, establishing fake communications between the vehicles and the charging stations, and interfering with the battery management system functionalities. A 100-kW stationary wireless power transfer system with a series-series resonant compensation network is used as a representative system in the analysis. Potential damages and the fault energy levels for selected fault scenarios are investigated. The system is simulated to verify the analysis results. On the basis of the discussed worst-case study, a set of hardware design-level solutions are recommended in this study to provide cyber protection.

Park, Yongwan↗
DOE OSTI2020

The CYBER security – Competency Health and Maturity Progression (CYBER-CHAMP) model: Extending the National Initiative for Cybersecurity Education (NICE) Framework Across Organizational Security

Problem Statement: There is a pervasive talent deficit in the cybersecurity industry that prevents employers from being able to fill their open positions efficiently. A holistic approach to security is required to ensure organizations have adequate prevention and response capabilities in case of a cyberattack. Specifically, industrial control systems (ICS’s) and their operational technology (OT) components have become a constant target for cyberattacks. Research Questions: It is proposed that the NICE Framework should be extended in the following areas: 1) Include guidance regarding the job roles and competencies for both IT and OT professionals. 2) Offer step-by-step solutions, based on the work role mappings from the NICE Framework, to increase cybersecurity through employee training and education. 3) Provide a streamlined, lifecycle approach to building a cybersecurity program. Contribution: The CYBER security – Competency Health and Maturity Progression (CYBER-CHAMP©) model provides a customized solution for businesses to understand their education gaps in organizational security and target areas for improvement. Rationale: The Framework for Improving Critical Infrastructure Cybersecurity v1.1 addresses ICS but does not offer a measurement of cybersecurity maturity or clear methods to ascertain an organization’s current risk profile. In Phases 1 and 5 of the model, measurements are provided to help an organization build their current and target risk profiles. The NICE framework provides a structure for planning an IT cybersecurity workforce, but the OT aspects of cybersecurity are only briefly discussed. The model uses Phases 2-3 to examine the competencies of an organization’s workforce, which includes both IT and OT roles. Current frameworks do not offer next steps to increase an organization’s cybersecurity. During Phase 4, employees’ roles are mapped to training, education, and/or certifications from common vendors. Investigative Approach: The model provides measurements and metrics for both an organization’s status and continual improvement. This improvement methodology includes guidance for creating an overall strategic plan for security improvement via products designed to increase an organization’s operational readiness through workforce competency health. Lessons Learned: Depending on who was participating, there were contradicting answers given in Phase 1 due to different security cultures in the organization. This revelation has influenced the steps listed in the User’s Guide, where Phase 1’s first recommended step is to assemble a team that champions the facilitation and implementation of the model in the organization. During Phase 2, the discovery was made that organizations may be missing roles that are necessary to perform critical cybersecurity functions. By understanding the functional roles and competencies needed, they can contract or hire cybersecurity help to fill these gaps. Implications: Using the model, organizations can discuss quantitative measures for improvement as a business case for advancing their security program. Future research can validate and extend the present theory and model to a variety of environments. It is of interest to investigate additional security roles and knowledge domains that are used to build standardized cybersecurity curriculum.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

A Cybersecurity Threat Profile for a Connected Lighting System

In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement.

97 MATHEMATICS AND COMPUTING↗
NASA NTRSDate not supplied

Developing a Cybersecurity Architecture for Extensible Traffic Management (xTM)

This paper explores the development of a cybersecurity architecture tailored for Extensible Traffic Management (xTM) to address emerging challenges in managing diverse aerial vehicles within the National Airspace System (NAS). Driven by technological advances and the rise of uncrewed aerial systems (UAS), urban air mobility (UAM), and high-altitude traffic (ETM), the NAS is undergoing a paradigm shift. Traditional air traffic management, reliant on traditional Federal Aviation Administration (FAA) control, will give way to decentralized coordination among autonomous and semi-autonomous systems. The proposed xTM Security Architecture, designed as a high-level framework, focuses on ensuring the confidentiality, integrity, and availability of data and operations in this evolving ecosystem. Utilizing threat modeling, the research identifies potential risks across key flight phases, operations and use cases to offer security control recommendations. Key objectives include analyzing interactions between novel airspace entrants and existing NAS traffic, cataloging vulnerabilities, and developing mitigative strategies to ensure safety, operational stability, and secure data exchanges. This research lays the groundwork for regulatory and industry adaptation, providing critical insights into managing cybersecurity risks in this complex, multi-domain environment.

UAM↗
DOE OSTI2023

Blockchain applicability framework

Technology related to blockchain cybersecurity solutions and a blockchain applicability framework is disclosed. In one example of the disclosed technology, a system is configured to receive parameters for a blockchain candidate application and evaluate the parameters to determine a recommendation for types of blockchain to apply to the candidate application. The recommendation may be based on an evaluation of the parameters to determine a level of applicability of blockchain usage, a level of applicability of one or more blockchain privacy types, and a level of applicability of one or more blockchain consensus types. The system may be configured to calculate an overall percentage distribution of the levels of applicability and to output an indication of the overall percentage distribution.

Gourisetti, Sri Nikhil Gupta↗