Theory Framework and Method for Software Design Studies in Security and Intelligence Analysis Work Environments.
Abstract not provided.
Stevens-Adams, Susan Marie↗
SEARCH · Engineering Papers
Results for “software security”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Containerized Application Security for Real Time Software Upgrade & Patching (CAPSEC).
Abstract not provided.
Jungwirth, Jessica Lynn↗
A National Secure-by-Design Strategy
The US National Cybersecurity Strategy published March 2, 2023 uses plain language to communicate that the US is calling for a major change in how we prioritize the security of software systems used in critical infrastructure. It acknowledges that our current approach, which is essentially, “let the buyer beware,” leaves entities who are least able to assess or defend vulnerable software responsible for the impacts of designed-in weaknesses while the makers of the technology bear no liability. The strategy recommends a security-by-design approach, recommending that software vendors be held liable to uphold a “duty of care” to consumers and for systems to be designed to “fail safely and recover quickly” . For energy infrastructure, the strategy calls out the need to implement the National Cyber-Informed Engineering Strategy to achieve higher confidence security for energy infrastructures. The Idaho National Laboratory, a pioneer in cyber-informed engineering concepts, is at the forefront of organizations educating others in industry, academia, and government on how to apply these concepts to real-world challenges. In this brief, we'll outline some of the basic principles of security-by-design and offer examples of how, in a water sector context, they're being put into successful practice.
42 ENGINEERING↗
Operationally-Relevant Cyber Situational Awareness Tool Development.
Research was undertaken to gain an understanding of the interplay between cyber security professionals and the software tools utilized in performing their jobs. Substantial investments are devoted to purchasing and developing software tools targeting cyber security operations. However, development is largely based on anecdotal knowledge concerning the work processes, cognitive demands, and the needs and requirements of cyber security analysts. The current study first characterized the workflow of a Cyber Security Incidence Response (CSIRT) team, including their use of software tools, and instantiated this workflow within a simulation model. Next, data was collected during cyber security training exercises reflecting the use of software tools. It was discovered that while cyber security professionals rely heavily on specialized software tools, their jobs require that they effectively integrate the use of specialized software tools with the use of general- purpose software tools.
97 MATHEMATICS AND COMPUTING↗
Information Security and Integrity Systems
Viewgraphs from the Information Security and Integrity Systems seminar held at the University of Houston-Clear Lake on May 15-16, 1990 are presented. A tutorial on computer security is presented. The goals of this tutorial are the following: to review security requirements imposed by government and by common sense; to examine risk analysis methods to help keep sight of forest while in trees; to discuss the current hot topic of viruses (which will stay hot); to examine network security, now and in the next year to 30 years; to give a brief overview of encryption; to review protection methods in operating systems; to review database security problems; to review the Trusted Computer System Evaluation Criteria (Orange Book); to comment on formal verification methods; to consider new approaches (like intrusion detection and biometrics); to review the old, low tech, and still good solutions; and to give pointers to the literature and to where to get help. Other topics covered include security in software applications and development; risk management; trust: formal methods and associated techniques; secure distributed operating system and verification; trusted Ada; a conceptual model for supporting a B3+ dynamic multilevel security and integrity in the Ada runtime environment; and information intelligence sciences.
Source record↗
Managing information technology security risk
Information Technology (IT) Security Risk Management is a critical task for the organization to protect against the loss of confidentiality, integrity and availability of IT resources. As systems bgecome more complex and diverse and and attacks from intrusions and malicious content increase, it is becoming increasingly difficult to manage IT security risk. This paper describes a two-pronged approach in addressing IT security risk and risk management in the organization: 1) an institutional enterprise appraoch, and 2) a project life cycle approach.
security toolset↗
Experimental Setup for Grid Control Device Software Updates in Supply Chain Cyber-Security
Supply chain cyberattacks that exploit insecure third-party software are a growing concern for the security of the electric power grid. These attacks seek to deploy malicious software in grid control devices during the fabrication, shipment, installation, and maintenance stages, or as part of routine software updates. Malicious software on grid control devices may inject bad data or execute bad commands, which can cause blackouts and damage power equipment. This paper describes an experimental setup to simulate the software update process of a commercial power relay as part of a hardware-in-the-loop simulation for grid supply chain cyber-security assessment. The laboratory setup was successfully utilized to study three supply chain cyber-security use cases.
Keller, Joseph↗
Characterization of Morphology using MAMA Software
The MAMA (Morphological Analysis for Material Attribution) software was developed at the Los Alamos National Laboratory funded through the National Technical Nuclear Forensics Center in the Department of Homeland Security. The software allows images to be analysed and quantified. The largest project I worked on was to quantify images of plutonium oxides and ammonium diuranates prepared by the group with the software and provide analyses on the particles of each sample. Images were quantified through MAMA, with a color analysis, a lexicon description and powder x-ray diffraction. Through this we were able to visually see a difference between some of the syntheses. An additional project was to revise the manual for MAMA to help streamline training and provide useful tips to users to more quickly become acclimated to using the software. The third project investigated expanding the scope of MAMA and finding a statistically relevant baseline for the particulates through the analysis of maps in the software and using known measurements to compare the error associated with the software. During this internship, I worked on several different projects dealing with the MAMA software. The revision of the usermanual for the MAMA software was the first project I was able to work and collaborate on. I first learned how to use the software by getting instruction from a skilled user at the laboratory, Dan Schwartz, and by using the existing user manual and examples. After becoming accustomed to the program, I started to go over the manual to correct and change items that were not as useful or descriptive as they could have been. I also added in tips that I learned as I explored the software. The updated manual was also worked on by several others who have been developing the program. The goal of these revisions was to ensure the most concise and simple directions to the software were available to future users. By incorporating tricks and shortcuts that I discovered and picked up from watching other users into the user guide, I believe that anyone who utilizes the software will be able to quickly understand the best way to analyze their image and use the tools the program offers to achieve useful results.
97 MATHEMATICS AND COMPUTING↗
Final Report- HOST: HPC Obfuscation and Security Toolkit
Explore the source record for details and available documents.
97 MATHEMATICS AND COMPUTING↗
Data Diode
The Data Diode is a data security technology that can be deployed within an organization's defense-in-depth computer network strategy for information assurance. For internal security, the software creates an environment within the network where an organization's approved users can work freely inside an enclave of protected data, but file transfers out of the enclave is restricted. For external security, once a network intruder has penetrated the network, the intruder is able to "see" the protected data, but is unable to download the actual data. During the time it takes for the intruder to search for a way around the obstacle created by the Data Diode, the network's intrusion detection technologies can locate and thwart the malicious intent of the intruder. Development of the Data Diode technology was made possible by funding from the Intelligence Advanced Research Projects Activity (IARPA).
Source record↗
Advanced Transmission Technologies – GETs and HPCs Session 2: Advanced Power Flow Control and Transmission Topology Optimization
The INL TADA GETs Cohort Session 2, held on November 7, 2025, conducted in collaboration with ScottMadden, focused on two core Advanced Transmission Technologies (ATTs): Advanced Power Flow Control (APFC) and Transmission Topology Optimization (TTO). These technologies are pivotal in enhancing grid flexibility, reliability, and cybersecurity resilience. APFC, particularly through modular FACTS devices like Modular Static Synchronous Series Compensators (M-SSSCs), enables dynamic voltage injection to reroute power flows. The session highlighted the deployment benefits of APFC, such as rapid installation, minimal civil works, and re-deployability. Regulatory drivers like FERC Order 2023 mandate the inclusion of Grid-Enhancing Technologies (GETs) in interconnection studies. Case studies from Central Hudson, CAISO, and National Grid (UK) demonstrated APFC’s effectiveness in congestion relief and cost savings. The session also addressed cybersecurity concerns, including firmware vulnerabilities, SCADA integration risks, and supply chain dependencies. Participants engaged in interactive exercises to rank cybersecurity and supply chain risks, emphasizing the need for robust digital assurance strategies. TTO involves software-based reconfiguration of transmission networks to optimize power flow without new infrastructure. The session showcased its operational value, with examples from SPP, PJM, and MISO showing significant congestion cost reductions. Cybersecurity vulnerabilities were discussed, particularly in API security and software supply chains, referencing incidents like SolarWinds and attacks on Danish utilities. Digital assurance exercises explored worst-case scenarios, attack paths, and mitigation responsibilities between vendors and utilities. Reliability challenges such as algorithm stability, vendor dependency, and operator trust were also examined. Cross-cutting themes emphasized the importance of digital assurance tools, including Software Bills of Materials (SBOMs) and hardware-in-loop testing. Human performance, training, and operational confidence were identified as critical enablers of technology adoption. The session concluded with a preview of Session 3, which will focus on High Performance Conductors (HPCs) and risk-based cybersecurity tools. Session 2 of 3.
24 - POWER TRANSMISSION AND DISTRIBUTION↗
The Elastic Analysis Facility's (EAF's) Contribution to the Future of Analysis at Multi-Experiment Institutions and Future Colliders
The Elastic Analysis Facility (EAF) hosted at Fermi National Accelerator Laboratory (Fermilab) is a platform being developed with the goal of providing a fast and efficient facility for physics analysis. As high-energy physics moves towards collecting larger datasets, such as those from the High-Luminosity LHC, the EAF strives to provide a powerful and adaptable framework for future colliders and multi-experiment institutions. Currently, the EAF supports several experiments including CMS, NOvA, and DUNE as well as serving accelerator physicists and beam line operations through integrated software and secure connections to Fermilab's computing resources. In addition, the EAF was designed with a user-friendly interface, intended to be more intuitive for emerging generations of physicists, that is still accessible for established styles of analysis. The EAF can also achieve better analysis efficiency due to the modernization of software and tools that can better utilize Fermilab's computing power. Furthermore, its design incorporates industry standards whenever possible, enhancing its sustainability and making it a possible template for other national or international laboratories and research facilities. Overall, the EAF is a forward-looking solution that will meet the evolving needs of particle physics, ensuring readiness for future colliders and multi-experiment research institutions.
Chavez, Elise [Wisconsin U., Madison]↗
Optimizing the Performance of Radionuclide Identification Software in the Hunt for Nuclear Security Threats
The Radionuclide Analysis Kit (RNAK), my team’s most recent nuclide identification software, is entering the testing phase. A question arises: will removing rare nuclides from the software’s library improve its overall performance? An affirmative response indicates fundamental errors in the software’s framework, while a negative response confirms the effectiveness of the software’s key machine learning algorithms. After thorough testing, I found that the performance of RNAK cannot be improved with the library choice effect, thus verifying the effectiveness of RNAK’s algorithms—multiple linear regression, Bayesian network using the Viterbi algorithm, and branch and bound search.
97 MATHEMATICS AND COMPUTING↗
Network Security Challenges and Countermeasures for Software-Defined Smart Grids: A Survey
The rise of grid modernization has been prompted by the escalating demand for power, the deteriorating state of infrastructure, and the growing concern regarding the reliability of electric utilities. The smart grid encompasses recent advancements in electronics, technology, telecommunications, and computer capabilities. Smart grid telecommunication frameworks provide bidirectional communication to facilitate grid operations. Software-defined networking (SDN) is a proposed approach for monitoring and regulating telecommunication networks, which allows for enhanced visibility, control, and security in smart grid systems. Nevertheless, the integration of telecommunications infrastructure exposes smart grid networks to potential cyberattacks. Unauthorized individuals may exploit unauthorized access to intercept communications, introduce fabricated data into system measurements, overwhelm communication channels with false data packets, or attack centralized controllers to disable network control. An ongoing, thorough examination of cyber attacks and protection strategies for smart grid networks is essential due to the ever-changing nature of these threats. Previous surveys on smart grid security lack modern methodologies and, to the best of our knowledge, most, if not all, focus on only one sort of attack or protection. This survey examines the most recent security techniques, simultaneous multi-pronged cyber attacks, and defense utilities in order to address the challenges of future SDN smart grid research. The objective is to identify future research requirements, describe the existing security challenges, and highlight emerging threats and their potential impact on the deployment of software-defined smart grid (SD-SG).
24 POWER TRANSMISSION AND DISTRIBUTION↗
Converged Computing: A Best of Both Worlds of High-Performance Computing and Cloud
Collaboration between Cloud and High Performance Computing (HPC) communities has accelerated in the last half decade. A common goal to run batch workloads combined with a desire for reproducibility, automation, and optimization has led to successful projects that range from container technologies to workload management and security. This span of current and future work defines a novel “Converged Computing” paradigm that aims to combine the best of both worlds, both from a technological and cultural standpoint. Furthermore, in this Special Issue, we review common themes in the space, showcasing current work and encouraging a continued effort toward innovative ideas that will enable the next generations of scientific discovery.
97 MATHEMATICS AND COMPUTING↗
The Open Science Cyber Risk Profile: The Rosetta Stone for Open Science and Cybersecurity
The Open Science Cyber Risk Profile (OSCRP) working group has created a document that motivates scientists by demonstrating how improving their security posture reduces the risks to their science. This effort aims to both bridge the communication gap between scientists and IT security professionals and allows for the effective management of risks to open science caused by IT security threats.
97 MATHEMATICS AND COMPUTING↗
Poster — Thur Eve — 52: A Web-based Platform for Collaborative Document Management in Radiotherapy
We describe DepDocs, a web-based platform that we have developed to manage the committee meetings, policies, procedures and other documents within our otherwise paperless radiotherapy clinic. DepDocs is essentially a document management system based on the popular Drupal content management software. For security and confidentiality, it is hosted on a linux server internal to our hospital network such that documents are never sent to the cloud or outside of the hospital firewall. We used Drupal's in-built role-based user rights management system to assign a role, and associated document editing rights, to each user. Documents are accessed for viewing using either a simple Google-like search or by generating a list of related documents from a taxonomy of categorization terms. Our system provides document revision tracking and an document review and approval mechanism for all official policies and procedures. Committee meeting schedules, agendas and minutes are maintained by committee chairs and are restricted to committee members. DepDocs has been operational within our department for over six months and has already 45 unique users and an archive of over 1000 documents, mostly policies and procedures. Documents are easily retrievable from the system using any web browser within our hospital's network.
07 ISOTOPE AND RADIATION SOURCES↗
X-Ray Toolkit (XTK) v. 3.1.x
Radiographic Image Acquisition & Processing Software for Security Markets
Eldridge, Bryce↗