Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “vulnerability assessment”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 127 records · Page 7
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

CLEAP Project: OR-SAGE Analysis for MT, UT, and CO States

The OR-SAGE tool is designed to use industry-accepted practices in screening sites and then employ the proper array of data sources through the considerable computational capabilities of GIS technology available at ORNL. The tool was developed to screen the potential for NPP siting on a national and regional basis. However, because of the tool granularity, it is often focused specifically on the immediate area around user sites of interest. If data center siting parameters can be added to OR-SAGE, the ability to evaluate data center siting on a localized scale will be beneficial.1 More than 60 data sets have been collected and processed by ORNL to develop exclusionary, avoidance, and suitability criteria for screening sites for a variety of power generation types, including nuclear power plants. Available site evaluation parameters include population density, slope, seismic activity, proximity to cooling-water sources, proximity to hazard facilities, avoidance of protected lands and floodplains, susceptibility to landslide hazards, and many others. All siting parameters should be considered as flags to inform siting decisions and should not be used to rule in or rule out any NPP site. Once data center siting parameters are identified, appropriate data sets will be collected and processed. The OR-SAGE process is very versatile. Essentially, OR-SAGE is a visual, relational database. The database partitions the contiguous United States, a total of 720 million hectares (~1.8 billion acres), into 100-m by 100-m (1 hectare or ~2.5 acre) cells. The database is tracking just under 700 million individual land cells. Successive suitability criterion is applied to each cell in the database. User-specified thresholds can be applied to each siting parameter data layer. In this manner, a variety of scenarios can be quickly and thoroughly evaluated. Data can be added and/or revised within OR-SAGE to address user interests. Siting security assessment capability is currently being added to OR-SAGE. Security is expected to be of concern at data centers whether it is collocated with a nuclear power generating technology or not. If data center is collocated with a nuclear power generating source, the security threat attractiveness level of both will likely increase. It will be of additional benefit if a potential data center site is also assessed for security vulnerability.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Advanced Technology and a Resilient Electric Grid

Making the electric grid cleaner and more resilient will require investing in a variety of new and emerging technologies. Advanced technologies including hydrogen, small modular nuclear reactors, and energy storage will all have a role to play in modernizing the electric grid. A diverse energy supply helps to keep the lights on and protects critical infrastructure, however it will also be important to assess the potential vulnerabilities and risks that come with unfamiliar and new technologies. This webinar will feature experts on resilience planning around advanced technologies from multiple sectors and share resources for states as they seek to modernize and decarbonize their electric grid.

advanced technology↗
DOE OSTI2023

A National Secure-by-Design Strategy

The US National Cybersecurity Strategy published March 2, 2023 uses plain language to communicate that the US is calling for a major change in how we prioritize the security of software systems used in critical infrastructure. It acknowledges that our current approach, which is essentially, “let the buyer beware,” leaves entities who are least able to assess or defend vulnerable software responsible for the impacts of designed-in weaknesses while the makers of the technology bear no liability. The strategy recommends a security-by-design approach, recommending that software vendors be held liable to uphold a “duty of care” to consumers and for systems to be designed to “fail safely and recover quickly” . For energy infrastructure, the strategy calls out the need to implement the National Cyber-Informed Engineering Strategy to achieve higher confidence security for energy infrastructures. The Idaho National Laboratory, a pioneer in cyber-informed engineering concepts, is at the forefront of organizations educating others in industry, academia, and government on how to apply these concepts to real-world challenges. In this brief, we'll outline some of the basic principles of security-by-design and offer examples of how, in a water sector context, they're being put into successful practice.

42 ENGINEERING↗
DOE OSTI2023

Cyber and Physical Security Analysis of GSI and Noventum Application for IoT Communications

We present our findings of the red team exercise conducted on the device and application developed by Guardian Sensors, Inc. (GSI) and Noventum. The app is used for situational awareness and control of photovoltaics (PV) and microgrid energy systems. The assessments performed are practical case scenarios that assess the risks and vulnerabilities posed by the app through targeted activities that could be engaged by an adversary. The assessment team’s results and recommendations are provided to inform on and mitigate the identified weaknesses to improve secure user authentication, connections, and communications. The recommendations in this report are not intended to be a security panacea but will add the desired defense-in-depth layer to securing communication of such interconnected systems.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Warming Response of Deep Soil Carbon (LDRD Final Report)

The overarching objective of this LDRD project was to determine the vulnerability of deep soil organic carbon (SOC) to warming in the Sierra Nevada region. Deep soils (>30 cm) store more than 70% of global SOC, and increased SOC decomposition and CO 2 emissions caused by warming are potentially large climate change feedbacks. According to the Intergovernmental Panel on Climate Change, temperatures are expected to increase by 4°C by the year 2100, warming the land and underlying soil, and making understanding of how warming will influence deep SOC storage and persistence critical to projecting the land carbon sink. However, uncertainty remains in our process-level understanding and ability to quantify how projected warming will impact the stability of carbon in deep soils. We investigated warming effects on deep (up to 16 m) SOC stability across climate, vegetation, and soil mineralogy gradients in California. We sampled soils from the surface to bedrock (down to 16 meters) at four sites representing vastly different ecosystems across the Northern and Southern Sierra Nevada mountains. This study quantified the response of SOC concentration, distribution, and vulnerability to warming using a soil incubation experiment to warm the whole soil profile and radiocarbon and stable isotopes to assess which pools are vulnerable to loss under warming. Our results refine our understanding of the terrestrial carbon cycle by revealing the vulnerability of deep SOC to future changes in climate and how minerology may influence that vulnerability.

58 GEOSCIENCES↗
DOE OSTI2024

Assessing Historical Extreme Weather Event Impacts

Resilience planning, particularly energy and water resilience planning, has been a key priority for the federal government for many years, leading federal agencies to develop processes for identifying and addressing critical resilience gaps at their facilities and sites. Furthermore, recent federal policy is driving agencies to prioritize climate change impacts as a more central component of their resilience planning efforts. To achieve this, federal sites must understand their vulnerability to climate change, which involves identifying climate hazards projected to impact the site (known as exposure), as well as understanding the sensitivity (the degree to which a site, including its people and the things they value, could be harmed by that exposure), and adaptive capacity of the site (the degree to which the site could lessen bathe potential for harm by taking action to reduce exposure and sensitivity). To assess and understand sensitivity and adaptive capacity, it is important to first obtain a baseline and understand how a site has been impacted by past events, in addition to considering the potential for unprecedented impacts based on climate projections. This information paper highlights current limitations for developing event history assessments and suggests a framework for more consistently capturing key data points. The purpose of this paper is to help inform how organizations could begin structuring a comprehensive process for recording the impacts of extreme weather events in order to facilitate climate vulnerability assessments, and thus, resilience planning.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2025

Development of the Contamination Distribution Centered Toxics Mobility Vulnerability Index in the Beaumont–Port Arthur Region of Texas

This study advances the Toxics Mobility Inventory (TMI) and the Toxics Mobility Vulnerability Index (TMVI) to develop a new tool to assess the movement of hazardous substances and their implications for vulnerable communities. It emphasizes the need to include contamination distribution variables in such indices to address disproportionate impacts and more accurately reflect vulnerability. The study uses the TMI framework and TMVI methodology in the Beaumont–Port Arthur region of Texas, also integrating contamination distribution considerations into the analysis to develop a new framework and process. The new Contamination Distribution Centered Toxics Mobility Vulnerability Index (CDC-TMVI) consolidates climate change and topography variables into a broader built environment vulnerability category while introducing a contamination sources category. Using ArcGIS Pro and ToxPi tools, the study evaluates 27 geospatial variables across four categories: built environment vulnerability, social vulnerability, health outcomes, and contamination sources. The results indicate significant contributions from contamination and social vulnerability variables, highlighting areas with higher risks of flooding and air pollution. This article advocates for future research and policy efforts to enhance the integration of contamination sources and their spatial distributions into toxics mobility assessments to better protect vulnerable populations. Furthermore, the unique methodology and findings serve as a basis for developing targeted measures and strategic planning to improve environmental health.

contamination↗
DOE OSTI2026

Validating a Dynamic PWR Safety and Security Model?

Nuclear power plants (NPPs) are assessed for safety and security using separate models that cannot capture how an attacker's decisions and a plant's response unfold together in real time, leaving regulators and operators without a complete picture of true plant vulnerability. Traditional probabilistic risk assessment (PRA) methods treat adversarial events as fixed initiators with predetermined outcomes, and are structurally incapable of representing the time-dependent interplay between physical security events, safety system response, and operator mitigative actions. At Idaho National Laboratory (INL), I contributed to the development and validation of Modeling and Analysis for Safety and Security using the Dynamic EMRALD Framework (MASS-DEF). Where static PRA relies on event-tree logic that cannot evolve mid-scenario, MASS-DEF couples a time-dependent dynamic PRA tool EMRALD (Event Modeling Risk Assessment using Linked Diagrams) with attack simulation software, allowing attacker behavior, plant system states, and operator actions to interact across time. My work focused on validating a general Pressurized Water Reactor (PWR) model. I traced model logic against PWR plant to identified errors in logic and confirm accuracy. I then built and tested attack scenarios against a general PWR model to verify that the model produced expected outcomes across all logical pathways. I also contributed a section to a related technical paper applying the same EMRALD platform to radiation dose modeling. Results show that MASS-DEF can quantitatively demonstrate that many plants exceed their regulatory security thresholds. This demonstrated margin provides a technically defensible basis for reducing the number of guards without compromising regulatory compliance. Physical security costs represent roughly 10% of annual operating budgets, making such reductions directly meaningful to INL's mission of sustaining existing commercial NPPs. This internship strengthened my understanding of nuclear systems, probabilistic modeling, and technical writing, and has solidified my pursuit of a career at a national laboratory.

98 - NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL↗
DOE OSTI2021

A Methodology for Assessing Risk to Inform Technology Integration

When new technology, such as artificial intelligence (AI), is introduced into an existing workflow it may impact risk by mitigating some vulnerabilities and threats in the workflow while introducing others. We present a versatile methodology for assessing the vulnerabilities and threats that impact overall risk in a workflow to inform technology integration. Our method involves both qualitative and quantitative assessment of risk and includes a formula for generating a risk score to guide technology integration. We describe our methodology and demonstrate its application to a specific workflow (the Derivative Classification review process). This work was funded by the Department of Energy (DOE) Automated Classification Tools for the Identification of Classified Information (ACTICI) program.

risk, technology integration↗
DOE OSTI2025

Cool rooms for indoor heat resilience: Evaluating affordable cooling strategies in heat-stressed California homes

Extreme heat conditions pose significant indoor survivability challenges for resource-constrained communities, which often lack access to cooling, have poorly insulated homes, and face compounding socioeconomic vulnerabilities. Moreover, concurrent power outages worsen health risks and heat-related illnesses. It is therefore crucial to develop innovative and affordable cooling approaches to protect vulnerable populations. This study assesses the efficacy of “cool rooms”– a designated space within a home equipped with passive and low-power active cooling measures to maintain safe indoor temperatures during extreme heat events and power disruptions. Using a physics-based building energy modeling approach, we evaluate the efficacy of various retrofit packages in maintaining thermal safety within the cool room under recent extreme heat conditions. The results indicate that passive measures can reduce 64% of hours with unmet standard effective temperatures, while the combination of passive and low-power active measures with built-in batteries further cuts this to 86%. Nevertheless, these strategies remain insufficient to maintain indoor thermal safety during extended outages. In contrast, integrating a solar-powered mini-split heat pump, whose technical potential was evaluated in this study, reduces indoor air temperatures below the 28 °C overheating threshold and significantly improves indoor habitability. The localized cool room strategy also offers potential for grid resilience by reducing peak electricity demand by up to 70% compared to whole house cooling during heat waves. The findings can inform the development of actionable heat mitigation plans and retrofit policies for residential communities with relatively low adoption of air conditioning such as warm marine climates.

Cool room↗
DOE OSTI2022

Ransomware and Today's Electric Grid

Cyberattacks come in many forms, including one of the newest and most threatening of attacks: ransomware. The rise in ransomware impacts businesses small and large -- and have the potential to significantly disrupt the operations of critical infrastructure. This presentation will explain what utilities can expect from a ransomware attack, sharing examples from specific events, provide guidance on how to prepare for the unknown, and offer possible ways to respond when an attack occurs. The presentation will also discuss cybersecurity governance as an effective method in taking preventative action to ransomware by identifying and addressing vulnerabilities through monitoring and assessment.

assessment↗
DOE OSTI2023

Vulnerabilities in Satellite Communications Underscore Threat to Critical Infrastructure

INL analysts assess critical infrastructure sectors leveraging satellite communications (SATCOM) are likely inadvertently increasing the attack surface caused by inherent vulnerabilities in equipment and communications pathways. A lack of ownership regarding security in SATCOM ecosystems creates pervasive information security risk, and the obfuscation of patching responsibility means the mitigation of publicly and privately disclosed vulnerabilities is difficult to track. With these factors in consideration, INL analysts assess the number of attacks against SATCOM is likely to increase in the next decade as threat actors exploit these vulnerabilities.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2022

Towards Automatic Mapping of Vulnerabilities to Attack Patterns using Large Language Models

With the advent of new devices and applications, cyber attack surface is continuously evolving due to the emergence of new attack techniques and vulnerabilities. Hence, security management tool must assess the cyber risk of an enterprise at regular interval basis through comprehensively identifying associations among attack techniques, weakness, and vulnerabilities. However, existing repositories providing such associations are incomplete (i.e., missing associations), inducing the likelihood of undermining the risk of particular set of attack techniques. Moreover, such associations still rely on manual interpretation, which is slow compared to attack speed and ineffective for the increasing list of vulnerabilities and attack actions. Therefore, there is an urge to develop methodologies for automatically associating vulnerabilities to all relevant attack techniques. In this paper, we present a framework, named VWC-MAP, that can automatically identify all relevant attack techniques of a vulnerability via weakness based on their text descriptions, applying natural language process (NLP) techniques. To achieve that, we present a novel two-tiered classification approach, where the first tier classifies vulnerabilities to weakness, and the second tier classifies weakness to attack techniques. This research has improved the scalability of the current state-of-the-art tool to make vulnerability to weakness mapping significantly faster. Moreover, this paper presents two novel approaches for weakness to attack technique mapping applying Text-to-Text and link prediction techniques. Our experiment results cross-validated through cyber-security experts show that VWC-MAP can associate vulnerabilities to weakness types with 87% accuracy and to new attack patterns with 80% accuracy.

Das, Siddhartha Shankar↗
DOE OSTI2020

Cybersecurity Resiliency of Marine Renewable Energy Systems-Part 1: Identifying Cybersecurity Vulnerabilities and Determining Risk

Technology innovation, market demand, and the potential impacts of a changing climate are driving the marine renewable energy (MRE) industry to develop market-ready systems to provide low-carbon electricity for emerging, off-grid markets. The advanced operational and information technology devices used in MRE systems create a pathway for a cyber threat actor to gain unauthorized access to data or disrupt operation. To improve the resiliency of MRE systems as a predictable, affordable, and reliable source of energy from oceans and rivers, guidance was developed for an end users' organization that describes a framework for identifying and managing cybersecurity risk. The development of the cybersecurity guidance is based on standards described in the Risk Management Framework and Cybersecurity Framework developed by the National Institute of Standards and Technology (NIST). This paper is the first of a two-part series that describes an approach to determine the cybersecurity risk for MRE systems based on assessing potential cyber threats, identifying vulnerabilities (people, processes, and technology, including physical and operational environment), and evaluating the consequences a cyberattack would have on operation of the MRE system and impact on end users' mission and business objectives. MRE developers and stakeholders can use this approach to assess their current cybersecurity risk posture to incorporate appropriate cybersecurity controls to reduce the consequences and impacts from a cyberattack on MRE systems. This approach can be refined further as MRE systems are deployed and operational configurations are available.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Cybersecurity for Digital Energy Infrastructure : Trends, Threats, and Cyber-Informed Engineering

This presentation discusses the rise in digital energy infrastructure and associated threats. It covers an in-depth risk assessment of digital energy equipment and provides real world examples of threats, vulnerabilities, and known incidents. Research conducted by INL assessing and addressing these risks follows, concluding with a dive into Cyber-Informed Engineering (CIE) and it's application to digital energy infrastructure, using battery energy storage systems (BESS) as an example.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Interdisciplinary Approaches to Cybervulnerability Impact Assessment for Energy Critical Infrastructure

As energy infrastructure becomes more interconnected, understanding cybersecurity risks to production systems requires integrating operational and computer security knowledge. We interviewed 18 experts working in the field of energy critical infrastructure to compare what information they find necessary to assess the impact of computer vulnerabilities on energy operational technology. These experts came from two groups: 1) computer security experts and 2) energy sector operations experts. We find that both groups responded similarly for general categories of information and displayed knowledge about both domains, perhaps due to their interdisciplinary work at the same organization. Yet, their discussion of each group’s domain-specific training, motivations, and limitations, as well as their suggestions for collaboration across domains, highlighted how these two groups can work together to help each other secure the energy grid. Our findings inform the development of interdisciplinary security approaches in critical-infrastructure contexts.

97 MATHEMATICS AND COMPUTING↗