Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “security assessment”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 109 records · Page 6
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

Standardization and Recommendations for EVSE Cybersecurity Standards

Currently, there is an absence of cybersecurity certification programs specifically for EVSE. Many existing standards focus primarily on safety, such as battery safety, while others provide cybersecu rity guidelines for different types of equipment, which could be adapted for EVSE. Among these, ISA/IEC 62443 has been identified as highly aligned with EVSE security needs. This report is a follow on to the previous research published (“Assessment and Coordination of EVSE Cybersecurity Standards,”). This report aims to find appropriate strategies for closing the gaps found in the aforementioned report and continue to work towards a comprehensive cybersecurity certification program for EVSE. Future testing will leverage this standard to assess EVSE security gaps and strengths, providing valuable insights to support certification development and harmonization of cybersecurity standards.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2024

The Meaning of Risk for Safety, Security, and Safeguards in the Design of Advanced Nuclear Reactors

What is the meaning of risk as it applies to the design of advanced reactors in the disciplines of safety, security, and safeguards? How can we find common terminology for the concept of risk and how can we find interfaces between these disciplines? These are important questions that should be explored in order that they may be applied in an integrated manner for the most effective and efficient design approaches. Eliminating or minimizing risks is a key design driver that motivates and informs the development of nuclear reactors. For safety, risk is well understood and applied in Probabilistic Risk Assessments. For security, the risk-based concepts of vulnerability assessments and vital areas are all considered in designing security systems. For safeguards, the concept of risk is not formally defined, as it relates to the design and operation of nuclear reactors. International nuclear safeguards seek to reduce the risk of proliferation in the nuclear fuel cycle and as such the concept of risk does exist. Therefore, the current understanding of the “3S’ approach, which seeks to find the interfaces and conflicts between safety, security, and safeguards requires a thorough understanding of the role that the reduction of risk plays in all three disciplines. The intersection of risk for safety and security is now being developed as there is a strong correlation between reactor design and operations and their vulnerability to sabotage. The intersection of risk for security and safeguards has to date chiefly been focused on the nuclear material control and accounting systems, which are relied on by both the operator (State) and the IAEA. This paper explores the concept of risk in each of the three disciplines, how they interact, potential conflicts and interfaces , how these might be addressed and leveraged, and a notional framework for how this could be achieved.

Kovacic, Donald N↗
DOE OSTI2023

User Guide to the Facility Cybersecurity Framework Internet of Things (IoT) Self-Assessment

The FEMP Facility Cybersecurity Framework (FCF) Internet of Things (IoT) Self-Assessment is a comprehensive tool aimed at illuminating the foggy domains of IoT and Industrial Internet of Things (IIoT) security. The assessment was developed using insights from recognized standards and guidelines to identify, address, and mitigate the challenges posed by the massive surge of interconnected devices. The FCF IoT Self-Assessment was created using the knowledge from established National Institute of Standards and Technology (NIST) publications such as NIST SP 800-53, NIST SP 800-213, and NIST Cybersecurity Framework (CSF). Additionally, integrating NIST SP 800-213A IoT Device Cybersecurity Guidance for the Federal Government ensures federal agencies are equipped with specific IoT security insights. This user guide has been developed to facilitate a thorough understanding of the tool. As users delve into the assessment, the guide offers a clear navigation walkthrough, report generation, and interpretation of the report.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

DEReliction: A Cybersecurity Vulnerability Assessment Methodology for Distributed Energy Resources

With the increasing integration of Distributed Energy Resources (DER) into the electric grid, maintaining grid reliability and resilience requires that these devices remain secure. This paper discusses a cybersecurity vulnerability assessment methodology that incorporates best practices from Sandia National Laboratories, SANS Institute, OWASP Foundation, and other web and Internet of Things (IoT) penetration testing (“pen testing”) programs, courses, and frameworks for assessing the security posture of devices. The methodology involves five sequential steps: (1) Collect Public Information, (2) Extract Hardware Details, (3) Inventory Software Components, (4) Identify Vulnerabilities, and (5) Test Vulnerabilities. Each step uncovers potential weaknesses in both hardware and software components of DER devices, considering adversary tactics, techniques, and procedures (TTPs), and potential attack vectors along the way. The results from the execution of this method on multiple residential- and small commercial-scale photovoltaic (PV) inverters reveled hardware and software vulnerabilities, which highlight the benefit of taking a methodical approach to discover vulnerabilities. While the specific vulnerability details are not shared here, a generalized overview of findings underscore the importance of robust security assessments for DER devices. Adoption of an assessment framework of this kind will identify and mitigate cybersecurity threats and bolster the resilience of DER-integrated electric grids.

24 POWER TRANSMISSION AND DISTRIBUTION↗
NASA NTRS2011

C-Band Airport Surface Communications System Engineering-Initial High-Level Safety Risk Assessment and Mitigation

This document is being provided as part of ITT's NASA Glenn Research Center Aerospace Communication Systems Technical Support (ACSTS) contract: "New ATM Requirements--Future Communications, C-Band and L-Band Communications Standard Development." ITT has completed a safety hazard analysis providing a preliminary safety assessment for the proposed C-band (5091- to 5150-MHz) airport surface communication system. The assessment was performed following the guidelines outlined in the Federal Aviation Administration Safety Risk Management Guidance for System Acquisitions document. The safety analysis did not identify any hazards with an unacceptable risk, though a number of hazards with a medium risk were documented. This effort represents an initial high-level safety hazard analysis and notes the triggers for risk reassessment. A detailed safety hazards analysis is recommended as a follow-on activity to assess particular components of the C-band communication system after the profile is finalized and system rollout timing is determined. A security risk assessment has been performed by NASA as a parallel activity. While safety analysis is concerned with a prevention of accidental errors and failures, the security threat analysis focuses on deliberate attacks. Both processes identify the events that affect operation of the system; and from a safety perspective the security threats may present safety risks.

Zelkin, Natalie↗
DOE OSTI2024

Assessment of Potential Dose and Environmental Impacts from Proposed Testing at the INL National Security Test Range

This assessment uses screening level models to calculate potential environmental impacts from proposed tests at two locations at the Idaho National Laboratory (INL) National Security Test Range (NSTR) site. Proposed tests could be conducted using 11 different radioactive material types that include K 2 O, LaBr 3 , KBr, Cu, Zr, F, Ga, Ga 2 O 3 , NaNO 2 , Ga-68, and Tc-99m. The tests could potentially release radioactive material to the atmosphere and radionuclides and other contaminants to the soil, which could leach into the unsaturated zone and migrate to the aquifer. Atmospheric transport of radionuclides to potential human receptors and time-integrated air concentrations were calculated with a Gaussian plume model and three years of hourly meteorological data. Potential surface soil impacts were calculated with the computer program Mixing-Cell Model (MCM). Groundwater impacts were calculated with the computer programs MCM and GWSCREEN. Radiological doses from potential atmospheric releases were calculated for public receptors off the INL Site and for workers at nearby INL facilities. Results were compared to regulatory dose limits. Maximum potential groundwater concentrations were estimated in the aquifer below the NSTR site and compared to drinking water standards or risk-based screening levels for resident tap water. Soil concentrations were calculated and compared to risk-based screening levels for workers and potential future residents. All impacts were estimated based on the assumption that 12 tests are conducted annually using all 11 material types for 15 years. This document provides the resources to enable a subject matter expert in the field of environmental assessments to replicate the modeling and calculations. The methodology and parameters are presented in the text. All electronic files, including computer code input, output, executable files, batch files, scripts, and spreadsheet files, are contained in a zip file that can be accessed by selecting “Additional Information” (select Native File) in the INL Electronic Document Management System (EDMS).

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2023

Assessment of Potential Dose and Environmental Impacts from Proposed Testing at the INL National Security Test Range

This assessment uses screening-level models to calculate potential environmental impacts from proposed tests at two locations at the Idaho National Laboratory (INL) National Security Test Range (NSTR) site. Proposed tests could be conducted using 11 different radioactive material types that include K 2 O, LaBr 3 , KBr, Cu, Zr, F, Ga, Ga 2 O 3 , NaNO 2 , Ga-68, and Tc-99m. The tests could potentially release radioactive material to the atmosphere and radionuclides and other contaminants to the soil, which could leach into the unsaturated zone and migrate to the aquifer. Atmospheric transport of radionuclides to potential human receptors and time-integrated air concentrations were calculated with a Gaussian plume model and three years of hourly meteorological data. Potential surface-soil impacts were calculated with the computer program mixing-cell model (MCM). Groundwater impacts were calculated with the computer programs MCM and GWSCREEN. Radiological doses from potential atmospheric releases were calculated for public receptors off the INL Site and for workers at nearby INL facilities. Results were compared to regulatory dose limits. Maximum potential groundwater concentrations were estimated in the aquifer below the NSTR site and compared to drinking water standards or risk-based screening levels for resident tap water. Soil concentrations were calculated and compared to risk-based screening levels for workers and potential future residents. All impacts were estimated based on the assumption that 12 tests are conducted annually using all 11 material types for 15 years. This document provides the resources to enable a subject matter expert in the field of environmental assessments to replicate the modeling and calculations. The methodology and parameters are presented in the text. All electronic files, including computer-code input, output, executable files, batch files, scripts, and spreadsheet files, are contained in a zip file that can be accessed by selecting “Additional Information” (select Native File) in the INL Electronic Document Management System (EDMS). It is highly unlikely the test scenarios evaluated in this ECAR will adversely impact human health based on comparisons of calculated dose and concentration against regulatory standards and risk-based screening levels. Conservative estimates of dose to workers and the public from atmospheric transport of possible radionuclide releases are far below federal radiation protection standards. Conservative estimates of potential contaminant concentrations in groundwater are less than federal drinking water standards or screening levels. Predicted radionuclide concentrations in surface soils are below risk-based screening levels, except for Ge-68 (material Ga-68) for the worker. The Ge-68 soil concentration can be made less than the worker PRG, if the number of annual tests using Ga-68 is reduced from 12 to 6. However, the sum of ratios still exceeds one because of the high K-40 ratio. If the EF of the worker (number of days the worker is in the contaminated testing area) is reduced from 225 days/yr (default value for full time worker) to 112 days/yr, the Ge-68 ratio is less than one and the sum of ratios is less than one. Actual radiation doses and groundwater and surface-soil concentrations are likely to be much less than those calculated because of the conservative assumptions and parameters employed in the modeling. For example, atmospheric-transport calculations assume the entire inventory of each material type is readily released to the atmosphere and no plume deposition, depletion, or radioactive decay occurs during transport. The calculations also assume the same meteorological conditions (e.g., wind velocity, wind direction, stability class) that produce the maximum 95th percentile concentration (i.e., concentration representing the 95th percentile of a distribution of concentrations derived from 3 years of hourly meteorological data) at each receptor location are the same for all 12 tests during the year, and each receptor is assumed to be present during all 12 tests. The surface-soil assessment assumes the entire inventory of each test is deposited in the top 5 cm of soil. No atmospheric dispersal is assumed, and the radionuclides are subject only to leaching and radioactive decay. The groundwater-pathway modeling is conservative in that it is one-dimensional in the unsaturated zone (no lateral spreading/dilution) and assumes the entire inventory of contaminants infiltrates into the ground at the same location for every test. This is especially conservative for particulate radionuclides because they would have to dissolve or corrode first and some would be dispersed into the atmosphere. The groundwater receptor is also assumed to consume water directly from a hypothetical well positioned in the location of maximum concentration. In addition, conservative degradation rates were used, and volatilization was not considered for the nonradradioactive chemicals modeled. And finally, the calculations assume all 12 tests will be performed at the same place at both locations, and all 11 radioactive material types will be used for each test. This is conservative because it is anticipated that no more than two material types will be used per test.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2023

AI-based Detection and Defense Against Cyberattacks in Distributed Energy Resources

This study will provide comprehensive artificial intelligence (AI)-based solution tools for network security, malware prevention, and sensor data anomaly detection for distributed energy resource (DER) research, development, and demonstration. DER technologies are energy systems (e.g., solar panels, wind turbines, and energy storage systems) that are often connected to the internet and thus vulnerable to cyberattacks. Cybersecurity should be of primary concern for DERs, which is why we propose an integrated multi-layer cyber-defense system for DERs. This system encompasses risk assessments, network security, malware prevention, and detection of anomalies in the sensor data. Implementation of a comprehensive risk assessment with an overview of the model architecture should be the primary step, and should include the potential impact of experiencing, at a given time, one or more cyberattacks on the system. The second step is to ensure that the network security includes firewalls, intrusion detection, and malware prevention. The third step is to provide solution tools that enable sensor data anomaly detection for DERs. By incorporating these considerations into DER research, development, and demonstration, organizations can help ensure the safety and security of their systems and protect against potential cyberattacks.

20 FOSSIL-FUELED POWER PLANTS↗
DOE OSTI2020

The Scientific Justification for a U.S. Domestic High-Performance Reactor-Based Research Facility

The Basic Energy Science Advisory Committee (BESAC) was charged with forming a subcommittee to assess the scientific justification for a U.S. domestic high-performance reactor-based research facility in order to continue providing the U.S scientific community with leading neutron capabilities in support of DOE's missions in science, energy, environment, and national security. The assessment included consideration of current international plans and existing domestic facility infrastructure. The subcommittee held a series of meetings from August 19, 2019 to April 24, 2020 that included DOE senior officials, leaders of national and international neutron facilities (SNS, HFIR, NIST, ILL, FRM-II), chairs of the NAS and POPA HEU-LEU committees, and outside experts on important areas of science, technology, and industry where high flux nuclear reactor facilities make important contributions. Also included were tours of neutron facilities (SNS, HFIR, NIST, BR2 reactor, and the planned Jules Horowitz Reactor). This July 2020 (revised 10-28-2020) report describes scientific use cases, brief summaries of existing and planned neutron facilities in the US and Europe, a comprehensive review of HFIR, a comprehensive discussion of the current state of progress on HEU-LEU conversion, user information from NIST and ORNL, and three recommendations to DOE for moving forward.

36 MATERIALS SCIENCE↗
DOE OSTI2021

Risk Management for Distributed Energy Resources

The National Institute of Standards and Technology will be hosting on Tuesday, February 2 and Wednesday, February 3, 2021, the second workshop in a new series focusing on the Open Security Controls Assessment Language. NREL extended the scope of the DERCF to include the NIST Risk Management Framework (RMF), addressing the challenges faced by federal energy managers when complying with the NIST RMF for DER systems. The NIST RMF is a cyclical process designed to incorporate principles of security and risk management into an organization’s system policies and procedures. The DER-RM will be downloadable application that runs locally and documents all the major requirements for achieving Authority to Operate the DER.

cybersecurity↗
DOE OSTI2021

Treatment of uncertainties for security-related design aspects of advanced reactors when using a risk-informed licensing approach

Sabotage of nuclear plants and theft of special nuclear material are different from many other issues potentially affecting public health and safety, and some of those differences drive the content of the present report. A high-level indication of these differences is provided in the US Nuclear Regulatory Commission’s Safety Goal Policy. Promulgated in the mid-1980’s, when it had become reasonably clear that risk analysis had improved to the point where it was possible to understand the risks associated with plant operation, the Safety Goal Policy articulates qualitative safety goals and quantitative health objectives that are meant to guide regulatory and risk management activities, with the following key exceptions noted in the original policy statement: The possible effects of sabotage or diversion of nuclear material are also not presently included in the safety goals. At present there is no basis on which to provide a measure of risk on these matters. It is the Commission’s intention that everything that is needed will be done to keep these types of risks at their present very low level; and it is the Commission’s expectation that efforts on this point will continue to be successful. With these exceptions, it is the Commission’s intent that the risks from all the various initiating mechanisms be considered to the best of the capability of current evaluation techniques. The present report discusses extensions of classical risk management to address some of the special issues that arise in the context of security. Although the present emphasis is on physical security, some attention will be paid to cyber security. A particular focus of the report is on quantitative framework to manage and address uncertainties. This framework is demonstrated via a couple of hypothetical examples.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2025

Wind Supply Chain Security: Hardware Enumeration and Analysis

This project, undertaken by Idaho National Laboratory (INL) for the Department of Energy (DOE) Wind Energy Technologies Office (WETO), focused on the enumeration and analysis of six key devices important to wind technologies. The devices analyzed included Beckhoff Bus Terminal Controllers (BK1120 and BC9000), a Beckhoff Economy Built-in Panel PC (CP6231), an N-Tron Managed Industrial Ethernet Switch (711FX3), a Bachmann M1 Gateway, and a Bachmann Smart Power Plant Controller. Device selection was driven by availability and budget constraints, with several components sourced from existing wind farms and others procured through a co-agreement with another WETO-funded project. The project's primary objective was to create a hardware bill of materials (HBOM) for each device, identifying and documenting all components to assess potential security and supply chain risks. A detailed analysis revealed over 750 unique components across the six devices, with 80% successfully identified and accompanied by datasheets. Notably, Texas Instruments emerged as the leading supplier, providing over 16% of the components, followed by ON Semiconductor at 11.3%, Analog Devices at 5.3%, and Renesas Electronics Corp at 4.1%. Other notable vendors included Toshiba Corporation, iC-Haus Corporation, Atmel, Vishay, and STMicroelectronics. The enumeration process involved thorough documentation of each component, including its designation, quantity, identifiers, pin package, description, vendor, model, and country of origin. This process provided valuable insights into the complexity and diversity of the electronic systems within these wind devices. It also highlighted the distinct separation of components between vendors, suggesting a trend of vendor-specific component usage. Key findings from the project emphasized the importance of broadening the scope of vendor analysis in future research to gain a comprehensive understanding of component distribution and commonality. The identification of vendor-specific component usage patterns offers new avenues for research and underscores the significance of continued investigation in this field. Overall, this project provides critical insights into the component composition of wind devices, aiding in the development of improved supply chain management and component sourcing strategies. The results contribute valuable knowledge to the wind technology sector, laying the groundwork for enhanced security and resilience in wind energy systems.

17 - WIND ENERGY↗
NASA NTRS2004

Common Operating Picture: UAV Security Study

This initial communication security study is a top-level assessment of basic security issues related to the operation of Unmanned Aerial Vehicles (UAVs) in the National Airspace System (NAS). Security considerations will include information relating to the use of International Civil Aviation Organization (ICAO) Aeronautical Telecommunications Network (ATN) protocols and applications identifying their maturity, as well as the use of IPV4 and a version of mobile IPV6. The purpose of this assessment is to provide an initial analysis of the security implications of introducing UAVs into the NAS.

Source record↗
NASA NTRS2011

L-Band System Engineering - Concepts of Use, Systems Performance Requirements, and Architecture

This document is being provided as part of ITT s NASA Glenn Research Center Aerospace Communication Systems Technical Support (ACSTS) contract NNC05CA85C, Task 7: New ATM Requirements-Future Communications, C-band and L-band Communications Standard Development. Task 7 was motivated by the five year technology assessment performed for the Federal Aviation Administration (FAA) under the joint FAA-EUROCONTROL cooperative research Action Plan (AP-17), also known as the Future Communications Study (FCS). It was based on direction provided by the FAA project-level agreement (PLA FY09_G1M.02-02v1) for "New ATM Requirements-Future Communications." Task 7 was separated into two distinct subtasks, each aligned with specific work elements and deliverable items. Subtask 7-1 addressed C-band airport surface data communications standards development, systems engineering, test bed development, and tests/demonstrations to establish operational capability for what is now referred to as the Aeronautical Mobile Airport Communications System (AeroMACS). Subtask 7-2, which is the subject of this report, focused on preliminary systems engineering and support of joint FAA/EUROCONTROL development and evaluation of a future L-band (960 to 1164 MHz) air/ground (A/G) communication system known as the L-band digital aeronautical communications system (L-DACS), which was defined during the FCS. The proposed L-DACS will be capable of providing ATM services in continental airspace in the 2020+ timeframe. Subtask 7-2 was performed in two phases. Phase I featured development of Concepts of Use, high level functional analyses, performance of initial L-band system safety and security risk assessments, and development of high level requirements and architectures. It also included the aforementioned support of joint L-DACS development and evaluation, including inputs to L-DACS design specifications. Phase II provided a refinement of the systems engineering activities performed during Phase I, along with continued joint FAA/EUROCONTROL L-DACS development and evaluation support.

Henriksen, Stephen↗
DOE OSTI2025

Remotely Sensed High‐Resolution Soil Moisture and Evapotranspiration: Bridging the Gap Between Science and Society

This paper reviews the current state of high‐resolution remotely sensed soil moisture (SM) and evapotranspiration (ET) products and modeling, and the coupling relationship between SM and ET. SM downscaling approaches for satellite passive microwave products leverage advances in artificial intelligence and high‐resolution remote sensing using visible, near‐infrared, thermal‐infrared, and synthetic aperture radar sensors. Remotely sensed ET continues to advance in spatiotemporal resolutions from MODIS to ECOSTRESS to Hydrosat and beyond. These advances enable a new understanding of bio‐geo‐physical controls and coupled feedback mechanisms between SM and ET reflecting the land cover and land use at field scale (3–30 m, daily). Still, the state‐of‐the‐science products have their challenges and limitations, which we detail across data, retrieval algorithms, and applications. We describe the roles of these data in advancing 10 application areas: drought assessment, food security, precision agriculture, soil salinization, wildfire modeling, dust monitoring, flood forecasting, urban water, energy, and ecosystem management, ecohydrology, and biodiversity conservation. We discuss that future scientific advancement should focus on developing open‐access, high‐resolution (3–30 m), sub‐daily SM and ET products, enabling the evaluation of hydrological processes at finer scales and revolutionizing the societal applications in data‐limited regions of the world, especially the Global South for socio‐economic development.

54 ENVIRONMENTAL SCIENCES↗