SEARCH · Engineering Papers

Results for “vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 739 records · Page 41

All sources NASA NTRS DOE OSTI

DOE OSTI2020

Fossil Power Plant Cyber Security Life-Cycle Risk Reduction, A Practical Framework for Implementation

Market conditions are forcing fossil electricity generation facility owners and operators to implement advanced digital technologies. These technologies enable efficiencies, operational flexibility, operations and maintenance efficiencies, and adapting to a transitioning workforce. These digital technologies, however, can increase the cybersecurity attack surface. The purpose of this research was to develop a holistic cybersecurity risk reduction framework for fossil generation facilities. The framework begins with assessing how cyber risk changes across facility life cycles, including plant, system, vendor, and business life cycles. The next phase performs consequence analysis to prioritize high consequence events. Focusing on high consequence events allows owners to use a graded, risk-informed approach to prioritize cybersecurity efforts. The final phase identifies the digital asset attack surface in sensors and instrumentation and control equipment. After the vulnerabilities are identified, the owner selects mitigating cybersecurity control measures (or countermeasures) based on the risk analysis from the previous phases. This report describes the current industry cybersecurity best practices in fossil generation that are based on the first principles for cybersecurity engineering. The report is divided into five sections that describe the implementation of the risk reduction framework and present identified research, methodological, and technology gaps that were identified through this course of research and development.

01 COAL, LIGNITE, AND PEAT↗

DOE OSTI2021

Cybersecurity Certification Recommendations for Interconnected Grid Edge Devices and Inverter Based Resources

Escalating deployment of PV and grid-edge devices on the distribution grid has increased the sustainability and efficiency of the electric grid. However, the increasing number of distributed energy resources (DERs) deployed creates a heightened cyber-physical interdependency on the distribution grid and thus creates more vectors for cyber-attacks to exploit through information and communication technology (ICT) systems and networks. For example, control signal packets can be modified, intercepted, or corrupted due to vulnerabilities in communication protocols used by microgrid controllers and grid edge devices for power control. Therefore, to mitigate and prevent cyber-attacks on grid edge devices and the inverter-based resources connected to the distribution grid, the U.S. Department of Solar Energy Technologies Office (SETO) awarded funding to the National Renewable Energy Laboratory and Sandia National Laboratory (SNL) to research, develop, and harmonize cybersecurity standards for Photovoltaic (PV) systems and for other kinds of DERs. To help develop a standard for DER cybersecurity, NREL established certification recommendations and test cases, in consensus with the solar industry and UL, for ensuring intrinsic design security for DERs. These recommendations were developed to bolster the cybersecure functionalities such as TLS, MAC, CRL, session resumption/renegotiation, and password, system, and service security management within the DER devices. The proposed test cases verify authentication, authorization, confidentiality, and data integrity for data and communications of DERs that use Transmission Control Protocol/Internet Protocol (TCP/IP). They were also developed to protect DER communications from eavesdropping, replay, man-in-the-middle, denial of service (DoS), spoofing through security certificates, least-privilege violation, and brute-force credentials. This report, which has been validated and reviewed by UL, expands upon those test cases to provide DER cybersecurity certification recommendations which increase DER resiliency and help to mitigate cyber-attacks. UL's collaboration with NREL and approval of this document will accelerate the adoption of a UL standard for DER cybersecurity.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2023

The Nuclear System-of-Systems Capabilities Analytic Process

This dissertation discusses the impetus for, development of, and initial demonstration of NuSCAPTM: the Nuclear System-of-Systems Capabilities Analytic Process TM . NuSCAP is an approach executed via a Python® application that enables capabilities-based vulnerability analyses of military systems of systems (SOS) exposed to prompt nuclear weapon effects. The NuSCAP application calls on industry-standard, fast-running nuclear weapon effects tools and the Monte Carlo N-Particle®1 (MCNP®) code to evaluate the impact of nuclear weapon environments on the military capabilities of a complex and networked SOS.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2025

Adapting Traditional Hazards Analysis Methods to Address Cyber Risks

Traditional hazards analysis (HA) methods, originally developed to address physical and operational risks, often fall short when it comes to identifying and mitigating cyber threats. These cyber threats pose unique and evolving risks to critical infrastructure and industrial control systems (ICS). This report explores the integration of Cyber-Informed Engineering (CIE) principles into existing HA methods to enhance their ability to address cyber-induced risks. CIE provides organizations with a practical, cost-effective approach to closing the gap between traditional HA methods and the need for cyber risk mitigation. By leveraging existing safety processes and controls, CIE allows users to examine and mitigate cyber vulnerabilities without overhauling existing HA methods. This report identifies areas where HA and CIE naturally align and where their approaches diverge. It emphasizes how CIE principles can be used to adapt HA methods, broadening their scope to include cyber risks and enabling the mitigation of cyber- induced impacts alongside traditional hazards and failure scenarios. This report examines how CIE can be applied across various HA methods—such as Hazard and Operability Studies (HAZOP), Probabilistic Risk Assessment (PRA), Failure Modes and Effects Analysis (FMEA), Systems-Theoretic Process Analysis (STPA), Hazard and Consequence Analysis for Digital Systems (HAZCADS), and Layers of Protection Analysis (LOPA). It provides strategies for integrating CIE to strengthen the identification, assessment, and mitigation of cyber-induced risks. The findings offer a structured entry point for organizations to embed CIE concepts into hazards and safety analyses, as well as broader engineering processes, ultimately supporting the design and operation of a more resilient infrastructure.

42 ENGINEERING↗

DOE OSTI2025

Adapting Traditional Hazards Analysis Methods to Address Cyber Risks

42 - ENGINEERING↗

NASA NTRS2021

Climate Change Impacts and Adaptation for Dryland Farming Systems in Zimbabwe: A Stakeholder-Driven Integrated Multi-Model Assessment

Decision makers need accurate information to address climate variability and change and accelerate transformation to sustainability. A stakeholder-driven, science-based multi-model approach has been developed and used by the Agricultural Model Intercomparison and Improvement Project (AgMIP) to generate actionable information for adaptation planning processes. For a range of mid-century climate projections—likely to be hotter, drier, and more variable—contrasting future socio-economic scenarios (Representative Agricultural Pathways, RAPs) were co-developed with stakeholders to portray a sustainable development scenario and a rapid economic growth pathway. The unique characteristic of this application is the integration of a multi-modeling approach with stakeholder engagement to co-develop scenarios and adaptation strategies. Distribution of outcomes were simulated with climate, crop, livestock, and economic impact assessment models for smallholder crop livestock farmers in a typical dryland agro-ecological zone in Zimbabwe, characterized by low and erratic rainfall and nutrient depleted soils. Results showed that in Nkayi District, Western Zimbabwe, climate change would threaten most of the farms, and, in particular, those with large cattle herds due to feed shortages. Adaptation strategies that showed the most promise included diversification using legume production, soil fertility improvement, and investment in conducive market environments. The switch to more legumes in the farming systems reduced the vulnerability of the very poor as well as the more resourced farmers. Overall, the sustainable development scenario consistently addressed institutional failures and motivated productivity-enhancing, environmentally sound technologies and inclusive development approaches. This yielded more favorable outcomes than investment in quick economic wins from commercializing agriculture.

Climate change adaptation↗

NASA NTRS2023

Los Angeles Urban Development: Utilizing NASA Earth Observations to Evaluate the Impact of Tree Coverage on Urban Heat Mitigation

Over the last several decades the city of Los Angeles, California, has been experiencing increased temperatures resulting from the urban heat island effect. This is largely due to the expansion of developed areas which allow for the trapping of heat, posing dangerous health risks. As a solution, many organizations have turned to urban greening and tree planting initiatives to help cool vulnerable communities. NASA DEVELOP has partnered with City Plants and the City of Los Angeles, Office of Forest Management to study the role of trees in urban environments and their relation to the mitigation of local urban heat islands. This team used NASA Earth observation data spanning from 2016 to 2022, including land surface temperature and Normalized Difference Vegetation Index (NDVI) data collected from Landsat 8 Thermal Infrared Sensor (TIRS) and International Space Station (ISS) ECOsystem Spaceborne Thermal Radiometer Experiment on Space Station (ECOSTRESS), respectively. Data from the National Agriculture Imagery Program (NAIP) were also used to obtain a supervised classification of tree canopy cover. Our analysis reveals a spatial and temporal connection between temperature and vegetation, suggesting that areas with more vegetation are less likely to suffer high summertime temperatures. Results also highlight the impacts of tree planting programs, such as the Vermont Corridor planting project, which increased tree canopy cover by up to 5% in the community between 2016 and 2022. These findings support the implementation of urban greening practices and inform residents and officials about how investing in trees will help mitigate increasing heat within Los Angeles.

Urban heat island↗

NASA NTRS2023

Great Salt Lake Health and Air Quality: Monitoring Lakebed Exposure and its Impact on Air Quality and Environmental Hazards in the Great Salt Lake Watershed

Water flow into the Great Salt Lake has declined rapidly over the last forty years due to human withdrawals and climate change. As a result of declining lake levels, over 50% of the lakebed is now exposed. Dust storms may grow in frequency and intensity across Northern Utah as lakebed dust becomes airborne under specific meteorological conditions. In our research project, we utilized satellite imagery from Terra and Aqua, Sentinel-5P, CALIPSO, Landsat 5 TM, Landsat 7 ETM+, Landsat 8 OLI-2, Suomi NPP, ground sensor environmental data, and demographic data to understand the relationship between lake desiccation and dust, and the impact of pollution upon the communities surrounding the Great Salt Lake. By plotting changes in Lake Surface Area against Aerosol Optical Depth (AOD) over our study period (2010-2022), we found an inverse relationship (R2=0.3423) between lake surface area and dust levels within our study area. We conducted a Vertical Feature Mask (VFM) and Extinction Coefficient Plot, from which we identified that during dust events, the aerosol type is mainly polluted dust and the aerosol height is 200 meters from the surface. Lastly, we created bivariate choropleth maps, which demonstrate which census tracts within our study area are most vulnerable to AOD (a proxy for PM2.5 from dust), NO2 and HCHO (precursors to ozone). In summary, our findings revealed that declining lake levels are associated with an increase in intensity of dust events, and these dust events will particularly impact residents of Tooele County and the west side of Salt Lake City. Project resources support partner needs by informing targeted air monitoring efforts, lakebed management practices, and advocacy efforts for GSL stewardship.

Terminal Saline Lake↗

DOE OSTI2019

A Context-Centered Research Approach to Phishing and Operational Technology in Industrial Control Systems

Advanced persistent threats (APT’s) that leverage phishing against operational technology (OT) are cyber-attacks that endanger critical infrastructure assets nationwide. Today phishing, a human focused exploit, constitutes 91% of successful attack vectors against Federal assets. This means Human Introduced Vulnerabilities (HICV’s) are the weakest cyber defense link. The success of these attacks also suggests HICV’s are not well understood nor mitigated. To characterize HICV’s and provide the necessary context in which they exist, this paper introduces a research approach derived from the mature science of Social Ecology. The desired end result of this research is an HICV focused risk assessment framework.

Advanced Persistent Threats↗

DOE OSTI2020

Identification of Worst Impact Zones for Power Grids During Extreme Weather Events Using Q-Learning: Preprint

Both the frequency and intensity of extreme weather events have been trending higher in recent years, leading to significant infrastructure loss in the electric grid. The impact of these extreme weather events is desired to be analyzed and quantified in order to help transmission and distribution system operators to prepare and prevent significant losses. In this paper, we developed an approach that models the impact of extreme weather on the power grid and identifies the worst impact zone using Q-learning (a reinforcement learning approach). The identification results reveal grid vulnerability to weather events and provide insights for system operators to help achieve optimal resource allocation and crew dispatch in order to minimize the adverse impact of extreme weather. Simulation studies are conducted on the IEEE 123-node system to demonstrate the performance of the proposed approach.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Q-Learning Based Impact Assessment of Propagating Extreme Weather on Distribution Grids: Preprint

Increasing number of power outage events due to extreme weather condition is hampering us socioeconomically. Preparing in advance for the extreme weather event is critical and can help utility operators to reduce grid damages, restore grid service quickly, allocate energy resources and repair crews strategically, and hence dramatically increase grid resilience. In this paper, we propose a method to identify the sequence of worst impact zones in the power grid caused by extreme weather events based on Q-learning (a reinforcement learning algorithm). To quantify weather severity and it’s effect on the grid, we model the impact of extreme weather on the grid as a function of intensity, vulnerability and exposure. A modified IEEE 123-node distribution feeder is presented in a mesh grid and experimented for sequences of zones identification. Finally, simulation results present the identified sequences and their associated impacts on the grid caused by the extreme weather events.

distribution system↗

DOE OSTI2021

Personal Resiliency Index

A plethora of information exists in literature focusing on different aspects of personal resilience. There are a number of questionnaires available to measure resilience in different aspects of an individual’s life, such as mental health. However, there is a lack of comprehensive information on the subject of personal resilience to natural and man-made disasters. A Personal Resiliency Index identifying four key areas of resilience related to natural and man-made disasters will help fill this gap by providing individuals an idea of where the stand comparatively to their peers on this topics. As an increasing amount of man-made disasters, natural disasters and pandemics occur, we realize that preparation is key.?“Crisis can be experienced at individual, group and mass levels and at local, regional, national or supra-national levels.” 1? Dr. Ron Fisher, the principal investigator has over 20 years’ critical infrastructure protection including developing vulnerability assessment methodology, risk and resiliency analyses and infrastructure interdependencies. Dr. Fisher and his team will research and develop a voluntary survey which evaluates the user’s personal resilience level to natural and man-made disasters. The research team is focusing on 4 main categories:? financial resilience, cyber security, physical and mental health, and emergency preparedness.?The web based application will?provide a resilience score for each of the categories and also a comprehensive personal resiliency score based on the voluntary survey. The application will also provide feedback to the user on actions to take to become more resilient to natural and man-made disasters. Through this effort, we will also be able to identify the areas where participants are excelling as well as opportunities for improvement in terms of resilience. This information will provide insight into areas of further investigation and identify potential areas of support needed for the general public to adopt strategies to become more resilient. 1 Lynott, William. “Surviving a Natural (or Man-Made) Disaster: How to Prepare for and Bounce Back? from a Crisis in Your Business | 2018-02-01 | NOLN.” Home Page, NOLN, 1 Feb. 2018, https://www.noln.net/articles/2683-surviving-a-natural-or-man-made-disaster-how-to-prepare-for-and-bounce-back-from-a-crisis-in-your-business.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2022

Achieving American Leadership in Cybersecurity and Digital Components Factsheet

The Biden Administration’s efforts to meet 100% clean electricity by 2035 and net-zero greenhouse gas emissions by 2050 has created opportunities to rebuild American supply chains create new jobs, strengthen community engagement, and spur U.S. economic growth. DOE’s strategy for success in the transition to a clean energy economy hinges on building and maintaining technology supply chains that are advanced, secure, and resilient to cyber threats. As the energy sector grows increasingly globalized, complex, and digitized, the supply chain for digital components of energy systems – including software, virtual platforms and services, and data – is facing greater threats. Nearly all digital components of U.S. energy sector systems are vulnerable to cyber supply chain instability, stemming from a variety of causes and shared among a broad set of interdependent stakeholders. Overall, supply chain risks for digital components in energy sector systems will continue to evolve and likely increase as these systems are increasingly interconnected, digitized, and remotely operated.

CCE↗

DOE OSTI2023

A National Secure-by-Design Strategy

The US National Cybersecurity Strategy published March 2, 2023 uses plain language to communicate that the US is calling for a major change in how we prioritize the security of software systems used in critical infrastructure. It acknowledges that our current approach, which is essentially, “let the buyer beware,” leaves entities who are least able to assess or defend vulnerable software responsible for the impacts of designed-in weaknesses while the makers of the technology bear no liability. The strategy recommends a security-by-design approach, recommending that software vendors be held liable to uphold a “duty of care” to consumers and for systems to be designed to “fail safely and recover quickly” . For energy infrastructure, the strategy calls out the need to implement the National Cyber-Informed Engineering Strategy to achieve higher confidence security for energy infrastructures. The Idaho National Laboratory, a pioneer in cyber-informed engineering concepts, is at the forefront of organizations educating others in industry, academia, and government on how to apply these concepts to real-world challenges. In this brief, we'll outline some of the basic principles of security-by-design and offer examples of how, in a water sector context, they're being put into successful practice.

42 ENGINEERING↗

DOE OSTI2020

Accelerating Hanford Site Cleanup through Operations Research Modeling - 20238

The Hanford Site cleanup effort will require the integration of dozens of unique facilities and processes, many of which will be first-of-a-kind in implementation and design. Each facility will be governed by its own set of operating logic, configured with a unique array of unit operations, and subject to a set of constraints that will affect its behavior. The collection of facilities have multiple points of interface, making the operations of any one facility potentially significant to the operations of other up- or downstream processes. It is therefore highly desirable to accurately predict these operations, as it allows for Site officials to identify and preempt bottlenecks and vulnerabilities before they unexpectedly inhibit the cleanup mission. With the quantity and complexity of the processes that will be on Site, building a pen-and-paper or even a spreadsheet-assisted model of the cleanup mission quickly becomes overwhelming in scope and inaccurate in execution. The Engineering organization for the Site's Tank Operations Contract (TOC) has therefore implemented the use of operations research (OR) modeling to simulate and predict future operations of Site facilities. These models are created using a discrete event simulation tool that allows for the development of detailed, versatile, and robust models. Not only can these models account for complex logical behaviors, but they can also simulate process details down to the level of vessel sizing, labor utilization, equipment reliability, and resource availability. To date, the TOC has developed OR models for several facilities on Site, including for single-shell tank (SST) farms, double-shell tank (DST) farms, the Effluent Treatment Facility (ETF), and the waste transfer system. These models have focused on identifying bottlenecks and operational constraints, and have been used to quantify the effects of implementing process changes. This latter point is particularly valuable, as it allows for several alternatives to be studied in a virtual setting before committing resources to making a change in the field. The decision to develop OR models has gained tremendous support from the Site's stakeholders and the U.S. Department of Energy (DOE) management, and has prompted the use of the tool to support additional internal and external initiatives. Recently, an initiative was proposed to use the models to help identify and provide quantitative backing for risks and opportunities for the TOC. This application of OR could not only help inform how the TOC manages its risks (e.g. quantities and types of spare parts), but could also help drive process improvements whose benefits might otherwise be hard to quantify. The models have also been used to drive the TOC's cloud computing, artificial intelligence (AI), and machine learning (ML) initiatives. These initiatives will not only improve the ability of the TOC to more rapidly respond to the needs of its customers, but it will also aid in the ability of the TOC to analyze and improve the processes it studies. Partnership with two external software development and consulting companies (Lanner and Ynformed) has furthered not only the application of AI and ML within the TOC, but has also spurred the development of new/improved software tools and platforms used by the companies. These partnerships have proven to be mutually beneficial and productive, and have set a precedent for the types of gains that can be made by exploring such options. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2020

Emerging Contaminants: Identification, Life Cycle, and Key Challenges - 20415

The term 'emerging contaminants' and its multiple variants has come to refer to previously overlooked compounds discovered in the environment which represent a potential threat to human and ecological receptors. These compounds may be discovered in the environment as new analytical techniques are developed and/or as new monitoring programs for drinking water and groundwater are implemented, while the threat to receptors may be realized through advances in understanding of toxicology and pathways to receptors. Emerging contaminants present unique and considerable challenges as demands to address them can outpace the understanding of their toxicity, their need for regulation, their occurrence, and techniques for treating the environmental media they affect. With these challenges in mind, this paper serves as a primer for understanding emerging contaminants. The paper will lay a foundation for understanding emerging contaminants through three key topics: 1. Who identifies emerging contaminants? An overview of the various stakeholder groups around the world working on identifying potential emerging contaminants and developing systems for screening potential candidates, prioritizing, and ultimately generating regulations will be provided. 2. How Chemicals Rise into Awareness as Emerging Contaminants. The process by which contaminants emerge through a cycle of awareness, characterization, management and regulation will be discussed. Current emerging contaminants will be discussed in the context of the life cycle: emerging contaminants where impacts to drinking water supplies are driving public awareness (e.g. per and polyfuoroalkyl substances (PFASs) and 1,4-dioxane), emerging contaminants impacted by changing regulatory standards or development and debate on toxicity (e.g., hexavalent chromium, 1,2,3-trichloropropane, trichloroethylene in vapor intrusion), and those with evolving understanding of impacts and usage (e.g., microplastics). 3. Key Challenges. Unique challenges associated with emerging contaminants, including visibility and public sensitivity, uncertainty and vulnerability, will be discussed. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2020

System Health and Status Reporting is Used to Improve Infrastructure Systems at the Hanford Site - 20449

Reliable physical infrastructure systems are vital to completing the clean-up mission and the start-up and commissioning of new nuclear waste processing facilities at the Hanford Site. Key infrastructure systems at Hanford include water, sewer, and electrical utilities, roads, telecommunications/network systems, and fire systems. All of the infrastructure systems are non-nuclear, General Service systems that are being maintained under formal engineering configuration control and none are specifically credited in any documented safety analysis (DSA). Starting in calendar year 2017, the Hanford Site's infrastructure and services contractor started producing system health and status reports for a total of 15 critical infrastructure systems as means to get a better understanding of each system's health and how it could be improved to ensure better and more reliable service delivery. As the reporting, tracking, and use of the metrics has matured, the number of systems for which reports are being developed has been expanded to a total of 23. Each of the critical infrastructure systems are assigned primary and alternate design authorities that complete qualifications on each assigned system. The design authorities actively manage and maintain configuration control on each of their systems and track metrics associated with availability, maintenance (corrective and preventive), and configuration of the technical baseline. The metrics are based on the principles established in Chapter V of DOE O 420.1C, Facility Safety, [1] and have been tailored as appropriate to each of the key infrastructure systems. An overall assessment of system health is performed and documented on a routine basis (e.g., quarterly). Included in this documentation is a quantitative score for each of the metrics (i.e., availability, maintenance, configuration management) along with results of system walk-downs, description of any permanent design modifications, identification of new or emerging issues and vulnerabilities affecting the system, and an assessment by the design authority of actions necessary to improve the system health score. The overall status scores are calculated using a formula and based on a pre-determined grading scale, a color is assigned for simple presentation. The information gained from developing the reports is being used to (1) assist with making timely and better informed decisions through the use of solid technical bases that are increasing the overall reliability and capabilities of the Site's infrastructure systems as new expense and capital projects in the Reliability Projects Investment Portfolio (RPIP) are prioritized and executed; (2) feed the risk management program, and (3) integrate the technical content of Master Plans that describe the Site's needs for the system and the system's capabilities to meet those future needs. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2026

Supporting U.S. National Security Through Cybersecurity Partnerships

At NLR, we're studying energy evolutions and threats to understand the challenges they pose and uncover ways to leverage grid advancements to achieve more secure, defensible, and reliable systems. Our integrated research approach bridges the gap between cyber threats and real-world consequences to deliver actionable solutions that reduce vulnerabilities and help strengthen U.S. national security.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗