Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Cybersecurity”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,063 records · Page 59

Malcolm Deployment Guide for Solar Power Generation Plants

This guide provides detailed instructions for deploying Malcolm in Solar Power Generation systems. It covers the deployment process, from understanding the network architecture of these systems to configuring network switches and Switched Port Analyzer (SPAN) ports or mirror ports or TAPs. The guide also includes best practices for deploying Hedgehog sensors, another critical component in these systems. Following this guide, users can enhance network visibility, improve their system’s security, and effectively troubleshoot common issues.

14 SOLAR ENERGY↗

Cyber-Informed Engineering Adoption in University Engineering Programs: An Overview of CIE Integration Successes at Nine U.S. Educational Institutions

This report examines the adoption of Cyber-Informed Engineering (CIE) in university engineering programs, driven by the need to protect critical energy infrastructure from adversarial threats. CIE equips current and future engineers and technicians with the necessary mindset, skills, and competencies to enhance the resilience of engineered systems against cyber attacks. This report highlights nine academic partners who are incorporating CIE into their curricula through various approaches, including lectures, courses, and certificates.

42 ENGINEERING↗

Countering Weapons of Mass Destruction Office (CWMD) Data Categorization Study: Chemical, Biological, Radiological, and Nuclear (CBRN) Detection Device Data

Pacific Northwest National Laboratory (PNNL) seeks to address critical questions related to chemical, biological, radiological, and nuclear (CBRN) detection devices. This research aims to enhance the security and understanding of these devices by investigating various aspects of their identification, communication, and functionality. The primary focus is on network security, malware detection, device identification, and intelligence gathering. CBRN data can be categorized in various ways depending on the purpose of CBRN detection devices and the specific context of the applications for analysis. Criteria that can be used to assist in this effort include but are not limited to data type, data protocol, source/destination, application, time, security, and content. This study will inform additional paths for data classification, data profiling, data mapping, and data modeling. This will help the Countering Weapons of Mass Destruction Office (CWMD) better understand their data and make informed decisions based on the insights gained from this study and their application. The CBRN Data Categorization study will include the identification of 5–10 different CBRN detection devices with unique characteristics for assessing and analyzing the data that is being produced by and transmitted from these devices.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Cyber-Informed Engineering Validation Methods and Guidance

Validation is an important step in any systems engineering process to ensure the correct system was made to fulfill stakeholders’ needs, goals, and expectations. In the context of Cyber-Informed Engineering (CIE), validation ensures cyber impact is reduced through implemented design choices and CIE requirements. This document details a process in validating CIE-based design choices relative to their effectiveness at mitigating high consequence events. The document includes a case study to illustrate the CIE validation process. The case study explores the implementation of CIE validation within the engineering lifecycle of a chemical mixing plant.

42 ENGINEERING↗

Integrating Cyber-Informed Engineering into Enterprise Risk Management

This document supports the application of Cyber-Informed Engineering (CIE) within the context of Enterprise Risk Management (ERM) to enhance cyber-resilience. It highlights that many critical infrastructure organizations use ERM to manage business risks and emphasizes the importance of evaluating critical systems and assets. The proposed approach can be adopted independently of formal ERM processes and offers a starting point for integrating CIE alongside existing or new ERM practices. Both CIE and ERM are iterative, and their alignment fosters continuous improvement and supports the engineering and operations cultures of an organization.

42 ENGINEERING↗

Cyber-Informed Engineering (CIE) Guidance to Defeat Systematic OT Weaknesses

This research summary outlines the University of Illinois Information Trust Institute (ITI) team's evaluation of whether applying the 12 Cyber-Informed Engineering (CIE) Principles could reduce or eliminate weaknesses identified by the SEI-ETF in engineered systems. ITI's findings suggest that applying CIE principles to weaknesses in MITRE CWE View 1358 can potentially mitigate or eliminate those vulnerabilities.

42 ENGINEERING↗

Deep Cyber-Physical Situational Awareness for Energy Systems: A Secure Foundation for Next-Generation Energy Management

This document provides the final report for the CYPRES project. The purpose is (1) to highlight and summarize its major accomplishments and (2) to provide guidance on how its outcomes have informed and can inform important additional research and technology transfer. The goal of CYPRES was the research, development, and demonstration of a security-oriented next generation cyber-physical EMS for electric power systems that detects malicious and abnormal events through the fusion of cyber and physical data. To achieve this, the CYPRES project team researched, developed, and built a prototype of the solution, referred to as the CYPRES EMS. The CYPRES EMS is a proof-of-concept cyber-physical platform that demonstrates the management of the energy system, communications, security, and cyber-physical grid modeling and analytics. As part of the capabilities of the CYPRES EMS, the team designed and developed a suite of power system applications for monitoring, risk analyses, detection, and control that are inherently cyberaware. At its core, the project aimed to research, develop, and demonstrate a security-oriented next-generation cyber-physical Energy Management System (EMS) capable of detecting malicious and abnormal events through the innovative fusion of cyber and physical data. This approach represents a fundamental shift from traditional EMS, reimagining how critical infrastructure can be protected through unified cyber-aware and physics-aware secure data flow pipelines. The project’s cornerstone deliverable, the CYPRES EMS, serves as a proof-of-concept cyber-physical platform that revolutionizes the management of energy systems, communications, security, and cyber-physical grid modeling and analytics. This prototype implements a comprehensive suite of power system applications for monitoring, risk analyses, detection, and control, all designed with inherent cyber awareness. The system’s architecture extends from end-devices in the field through to control center applications, establishing a secure and resilient control framework that addresses the challenges posed by diverse devices of unknown trustworthiness connecting to modern power systems. Through this innovative approach to deep cyber-physical situational awareness, the CYPRES project not only advances the state-of-the-art in energy infrastructure protection but also establishes a new paradigm for how EMS can be designed, deployed, and operated in an increasingly complex threat landscape. The findings and developments from this project provide crucial insights for stakeholders across the energy sector, offering a blueprint for enhancing the reliability and resilience of our nation’s critical energy infrastructure in the face of evolving cyber threats.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Application of Cyber-Informed Engineering for Protecting BESS

This white paper synthesizes an array of crucial grid services provided by BESS technology, assesses its architecture and communications, and presents a case study for analysis against the principles introduced by Cyber-Informed Engineering (CIE). Furthermore, in walking through the analysis, this paper presents a framework to evaluate risks and solutions when considering BESS components. Asset owners and buyers could perform this analysis to assess their BESS product implementations, alternative inverter-based resources (IBR), and energy management systems (EMS). Battery systems fulfill various roles contingent on the unique market demands and the specific challenges presented by regional grid infrastructures. These roles also vary due to the differing utility models for ownership and operation, which are adapted to meet regional and local capabilities and requirements. Concerns have been raised regarding the potential for adversaries to exploit knowledge of battery operational patterns to orchestrate decisive attacks. However, the security of operational data for these systems may not be the primary vulnerability, as much of this information is already well-understood within the community. Applying a modest degree of subject matter expertise can often yield valuable predictions regarding how a battery will respond under certain conditions, such as grid emergencies, high or low-temperature days, Public Safety Power Shutoff (PSPS) events, and outages. The operational characteristics of batteries are well-documented, and their capabilities, including the risks associated with misoperation and the resulting consequences, are published and understood within the industry. CIE practices represent the next step in gaining functional assurance and providing an acceptable level of risk, regardless of whether a battery vendor can support a trusted and validated supply chain. While this issue has exacerbated supply chain challenges, it is not an isolated condition. This foreign supply route is the primary source of BESS for the U.S. market. Significant efforts are underway through the Bipartisan Infrastructure Law (BIL) to change that. Still, strategic short-term operational mitigations are needed to ensure the security of our operational technology (OT) systems, which are enhanced by instilling trust and are separate from vendors implementing CIE principles.

25 ENERGY STORAGE↗

Analysis of Supply Chain Challenges in the U.S. Solar Industry: Focus on Build America, Buy America Act and Inverter Supply Issues

The United States (U.S.) solar industry has been undergoing significant transformation, driven largely by meeting U.S. climate goals while simultaneously maintaining national security. At the forefront of this movement is the Inflation Reduction Act (IRA) and the Build America, Buy America (BABA) Act. The IRA has driven investment in clean energy generation deployments while the BABA Act, enacted under Division G, Title IX of the Infrastructure Investment and Jobs Act (IIJA) establishes domestic content procurement preference for all federal financial assistance obligated for infrastructure projects. While these pieces of legislation aim to reduce reliance on foreign-made solar components and increase domestic production, the sector continues to face notable supply chain challenges. These are particularly pronounced with inverters, a critical component in solar photovoltaic (PV) systems. This report explores the current state of these supply chain challenges, with a specific focus on the impact of the BABA requirements and the associated complexities in inverter manufacturing and supply.

14 SOLAR ENERGY↗

Electric Vehicle Charging Data Falsification Attacks Utilizing Behavioral Models

A charging station (CS) and its associated electric vehicle supply equipment (EVSE) and charging electric vehicle (EV) interactions are potential targets for data falsification attacks since CSs are typically unmanned public facilities that are connected to the internet and EVs incorporate the vulnerable CAN bus network, which are both susceptible to remote attacks. The research question being addressed is how is the EV owner and CS negatively affected by CAN bus EV battery current sensor and battery temperature sensor data falsification attacks. Negative effects include economic losses from reduced life span of the battery, battery thermal runaway and fire (and potential loss of surrounding structure), and reduced utilization of the CS due to delayed departure time (longer charging times).

25 ENERGY STORAGE↗

Essence2.0 Development and Deployment (Final Report)

The objective of the project was to take two core technologies that have been developed under the Recipient’s solid laboratory products and integrate them into a single CyberPhysical awareness platform and complete development on current field-tested prototypes that will extend the integrated capability of the platform. During the final development phase, the Recipient development team and its selected industry partners tested and hardened the platform to ensure resilient and secure operation of the integrated platform. The team also executed substantial field testing and established the framework for defining the organization and/or commercial infrastructure needed to sustain operations and provide readiness for a national scale deployment. The focus of the project was (1) the improvement, refinement, and deployment of technology for the detection of cyber-attacks on utility operational technology (OT) and information technology (IT) networks and assets, including Supervisory Control and Data Acquisition Systems (SCADA) systems; and (2) support for containment and remediation of adversarial threats and actions against those systems and environments.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

Reference Architecture Discussion [Slides]

NREL is developing reference architectures - industry-validated and verified models - to provide a common operational view and emulation environment for analyzing risk to the energy sector. In this presentation, we overview our work in developing these architectures.

97 MATHEMATICS AND COMPUTING↗

SolarSTARTS: Solar-Assisted State-Aware and ResilienT infrastructure System

This final technical report provides a description and results of the design, development, testing, and validation of the Automated Resilience Management System (ARMS) solution, which integrates different systems to collect, store and process relevant information from the power distribution system to automatically manage the operation of multiple energy assets to enhance the resilience of the power grid against high-impact physical incidents (e.g., hurricanes) and cyber threats. The developed solution comprises a suite of novel AI-based algorithms designed to first detect, locate, and classify anomalies by collecting and analyzing data from multiple monitoring and control devices

14 SOLAR ENERGY↗

Electricity Subsector Transmission Resilience Maturity Model (TRMM) User Guide

The electric transmission sector is facing a range of threats to its functionality that are either new, more severe than experienced in earlier years, or more well understood. Such threats include more frequent and more severe extreme weather events, wildfires, droughts, and human-caused physical and cyberattacks. They also include geological, electromagnetic, and biological events. The novelty or increasing severity of these threats creates a significant need for transmission owners to implement programs to prevent, prepare for, respond to, and recover from such incidents. The national and economic security of the United States depends on the reliable functioning of the Nation’s critical infrastructure in the face of such threats, and the transmission networks are essential components of that infrastructure. The Electricity Subsector Transmission Resilience Maturity Model (TRMM) is a tool that a transmission organization can use to objectively evaluate and benchmark its currently established transmission resilience strategies, programs, policies, and investments, in order to target and prioritize enhancements where needed. The TRMM was developed to address the unique characteristics of the transmission system. The model can enable users to: • evaluate and benchmark their organization’s resilience capabilities, effectively and consistently • prioritize actions and investments to improve the resilience of their systems • share transmission-related knowledge, best practices, and relevant references within their organization and with business partners as a means to improve resilience capabilities • contribute to increasing the overall resilience of the Nation’s transmission systems. The TRMM provides descriptive rather than prescriptive industry-focused guidance. The model content is presented at a high level of abstraction so that it can be interpreted by transmission organizations of various types, structures, and sizes. The model is designed to an be easy-to-use, self-assessment tool.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Vulnerability Management for Electric Vehicle Supply Equipment

Vulnerability management for EVSE is a challenging undertaking with all the necessary stakeholders and devices that are interconnected, this presentation reviews the challenges and opportunities for conducting CVD for EVSE.

97 MATHEMATICS AND COMPUTING↗

Addressing Rising Energy Demand Through Innovation

The U.S. is facing a significant increase in energy demand, driven by AI advancements, the rapid expansion of data centers, manufacturing and industrial growth, and the electrification of transportation and buildings. Buildings alone account for approximately 75% of U.S. electricity consumption and 40% of total energy use. To address these challenges, NLR leverages its state-of-the-art research facilities, advanced energy modeling, hardware-in-the-loop emulation, and real-world demonstrations to provide data-driven insights that de-risk emerging energy solutions, increase efficiency and demand flexibility, optimize grid controls, and identify vulnerabilities to enhance energy security. This presentation will highlight our research ecosystem and its role in supporting a more reliable, affordable, and adaptive energy infrastructure in the face of accelerating demand.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

Blueprint: Open Worldwide Application Security Project Top 10 Common Weakness Enumerations for Electric Vehicle Supply Equipment

This report categorizes the top 10 security weaknesses in electric vehicle supply equipment (EVSE) using a similar approach by the Open Worldwide Application Security Project (OWASP) Top 10, and it describes example exploitations, methods for prevention, and related common weakness enumerations (CWEs) for each category. The weaknesses listed in this report could lead to security issues or vulnerabilities in EVSE if they are exploited by an attacker to compromise the confidentiality, integrity, or availability of a system. This report also recommends EVSE industry best practices and remediations for the identified weaknesses to use as guidelines for their secure products and systems.

33 ADVANCED PROPULSION SYSTEMS↗