SEARCH · Engineering Papers

Results for “Cyber”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,297 records · Page 72

All sources NASA NTRS DOE OSTI

DOE OSTI2021

Evaluation of Hands-On Cybersecurity Skills Development

Cybersecurity is a relatively new and quickly advancing industry, though there is a deficit in industry professionals throughout the world. This deficit is a result of the inability of education to keep up with the continuously changing cyber-threat landscape. A lack of effective, accessible, hands-on training platforms is a barrier for students and professionals who seek to gain the skills and abilities necessary to enter the workforce. Additionally, the lack of adequate training makes it difficult for industry experts to upskill or stay up to date on new advancements within the field of cybersecurity. The goal of this cohort is to discover what makes an effective or ineffective training platform, what platforms are currently available, and to determine the next steps for hands-on learning. Hands-on experience is necessary to create workforce ready professionals, yet it is underutilized by students and professionals of cybersecurity due to costs, availability, and ease of use. This cohort has uncovered hands-on training solutions, identified many effective training solutions, and explored potential improvement to cybersecurity training. These findings resulted in the cohort moving beyond research to test the resources that currently exist or are in development, and to apply that knowledge to discovering and developing engaging hands-on training.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Cybersecurity Guide for Distributed Wind

Distributed wind sits at the intersection of grid-connected, off-grid and behind-the-meter cyber-physical electrical energy systems. The unique physical properties and communications requirements for distributed wind systems mean that there are unique cybersecurity considerations, but there is little to no existing guidance on best practices for cybersecurity. This document is intended to be a starting point for distributed wind stakeholders including manufacturers, installers and integrators, and operators (facility, aggregator, or utility). We discuss common distributed wind architectures and describe their role in the larger power system, pointing out some of the key connections to be aware of. Cybersecurity cannot exist in a vacuum, but rather must consider all the system and all its connections holistically. The role of distributed wind and the functions it can serve are described to gain understanding of the full range of capabilities. The purpose and application of relevant standards that may apply to certain distributed wind systems is presented. These standards may not apply to all installations, but even for systems that are not required to meet these standards they can be a good reference for best practices. A holistic threat perspective is used to describe the adversaries, threats, and potential impacts of cyberattacks, with special emphasis on what sets distributed wind systems apart from other distributed energy resources (DER). Finally, we present the recommendations for cybersecurity, both in terms of needs of the system and roles that specific stakeholders should fulfill. Distributed wind systems can come in a variety of architectures and applications, so there is no one-size-fits-all approach to cybersecurity. However, this document contains the relevant information for stakeholders to identify the cybersecurity needs of their system, refer to relevant standards, and apply best practices in a manner most consistent with their security and operational goals.

17 WIND ENERGY↗

DOE OSTI2021

Development of Integrated Safety and Security Models for Comprehensive Reliability and Resiliency Evaluation

The security of the electric grid and supporting energy systems is crucial to national security. One of the complexities in analyzing the security of energy systems is the safety consequences that may result from accidents. For energy systems, the goal is to ensure that they operate as intended and that any consequences are mitigated or prevented. The integration of safety and security is paramount to protecting these systems from attacks and ensuring that large consequences are prevented. This report describes an integrated safety and security methodology to evaluate cybersecurity events that can lead to large consequences. This novel approach first describes how Systems-Theoretic Process Analysis (STPA) provides a digital causal analysis for Bayesian Networks (BNs). The use of STPA causal analysis provides a systematic approach to constructing BNs that adequately model cyber scenarios that result in consequences. When combined with the technical principles described in Risk-Informed Management of Enterprise Systems (RIMES), a comprehensive risk-informed cybersecurity analysis results that allows decision-makers to prioritize systems that most impact risk.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Facility Cybersecurity Framework Best Practices Version 2.0

Federal facilities are increasingly adopting automation and connecting to the Internet creating an energy-internet-of-things environment that converges operational technology (OT) and information technology (IT). Today's buildings increasingly weave together networked sensors and cyber and physical systems that enable data to be collected, aggregated, exchanged, stored and monetized in new ways. Building technological advances have created new energy technology, services, markets and value creation opportunities (e.g. transactive energy, two-way grid communications, machine learning, and increased use of renewable and distributed energy resources). But as larger data sets are being exchanged at faster speeds between an increasing number of OT systems, it becomes more difficult to protect the security of the data lifecycle and the physical equipment it interacts with. These challenges are especially difficult to overcome because the economic and environmental gain (interoperability, big data, social networks and ubiquitous information sharing) are driving these prominent trends in the digital age. Often cybersecurity is an afterthought.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2021

Facility Cybersecurity Framework Best Practices Version 2.0

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2021

Identification and Testing of Electric Vehicle Fast Charger Cybersecurity Mitigations

Fast-charging infrastructure for electric vehicles (EVs) is needed to enable and achieve the national goals of transitioning the vehicle fleet toward more electrification. Idaho National Laboratory, Oak Ridge National Laboratory, and the National Renewable Energy Laboratory (NREL) have jointly worked to identify, evaluate, and mitigate potential cyber-related consequences associated with fast charger systems. NREL contributed by considering cyberattack scenarios and consequences associated with integrating distributed energy resources (DERs) at fast-charging stations. The dynamic nature of fast-charger load profiles would encourage site operators to incorporate solar for energy cost reduction and energy storage for peak demand cost management at future charging facilities with multiple fast chargers at a site. These energy resources would be monitored and coordinated via a site energy management controller with data exchange between devices and local power metering infrastructure; thus, networking between devices and the design of the system becomes important in the overall cybersecurity posture. In addition, component vendors and system operators might have remote interfaces to any of these systems. It is therefore important to understand the breadth of the cyberattack surface and potential strategies to mitigate impacts. This project has focused on components and protocols expected to be found within a local charging site that includes multiple chargers and DER resources. Our methods and results are summarized in this final report.

42 ENGINEERING↗

DOE OSTI2021

Safety and Security Defense-in-Depth for Nuclear Power Plants

This report describes the risk-informed technical elements that will contribute to a defense-in-depth assessment for cybersecurity. Risk-informed cybersecurity must leverage the technical elements of a risk-informed approach appropriately in order to evaluate cybersecurity risk insights. HAZCADS and HAZOP+ are suitable methodologies to model the connection between digital harm and process hazards. Risk assessment modeling needs to be expanded beyond HAZCADS and HAZOP+ to consider the sequence of events that lead to plant consequences. Leveraging current practices in PRA can lead to categorization of digital assets and prioritizing digital assets commensurate with the risk. Ultimately, the culmination of cyber hazard methodologies, event sequence modeling, and digital asset categorization will facilitate a defense-in-depth assessment of cybersecurity.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Employee Spotlight: Christopher Graham

Christopher Graham of Special Security IT and Cyber Operations (SSO-3) makes medieval armor using a combination of old-school techniques and tools with modern accouterments, such as a blacksmith’s gas-powered forge and a power hammer.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2021

Treatment of uncertainties for security-related design aspects of advanced reactors when using a risk-informed licensing approach

Sabotage of nuclear plants and theft of special nuclear material are different from many other issues potentially affecting public health and safety, and some of those differences drive the content of the present report. A high-level indication of these differences is provided in the US Nuclear Regulatory Commission’s Safety Goal Policy. Promulgated in the mid-1980’s, when it had become reasonably clear that risk analysis had improved to the point where it was possible to understand the risks associated with plant operation, the Safety Goal Policy articulates qualitative safety goals and quantitative health objectives that are meant to guide regulatory and risk management activities, with the following key exceptions noted in the original policy statement: The possible effects of sabotage or diversion of nuclear material are also not presently included in the safety goals. At present there is no basis on which to provide a measure of risk on these matters. It is the Commission’s intention that everything that is needed will be done to keep these types of risks at their present very low level; and it is the Commission’s expectation that efforts on this point will continue to be successful. With these exceptions, it is the Commission’s intent that the risks from all the various initiating mechanisms be considered to the best of the capability of current evaluation techniques. The present report discusses extensions of classical risk management to address some of the special issues that arise in the context of security. Although the present emphasis is on physical security, some attention will be paid to cyber security. A particular focus of the report is on quantitative framework to manage and address uncertainties. This framework is demonstrated via a couple of hypothetical examples.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

DOE OSTI2021

Universal Utility Data Exchange (UUDEX) Functional Design Requirements - Rev 1

This document provides a set of high-level functional design requirements for Universal Utility Data Exchange (UUDEX). These requirements include a set of use cases, data exchanges supported by UUDEX, both for grid operations and for cyber security data, functional requirements for data exchange, data models used by UUDEX, data exchange architectures, and security considerations. These functional design requirements are intended to be used in more detailed design documents.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Software-defined Networking for Energy Delivery Systems (SDN4EDS): An Architectural Blueprint (Final Report)

This is the initial version of a reference for suppliers and energy companies of all sizes to deploy networks based on software-defined networking technology (SDN) to improve reliability, reduce cyber security attack surface, and facilitate mitigation of adversarial behavior. It is a living document and will progress over the life cycle of the Software-Defined Networking for Energy Delivery Systems (SDN4EDS) project. Version 2 of this report provides information on the Red Team tabletop assessment performed against the initial reference architecture. Version 3 of this report updates the reference architecture with lessons learned from the Red Team tabletop assessment, as well as provides additional details for the use cases. It also provides information on the decision process that could be used by an organization when considering deploying SDN in their environment. The final version of this report consolidates all the interim reports generated by the project into a final report. It also draws from PNNL’s experience in deploying SDN to make recommendations on how SDN could be deployed in a utility environment, and provides rationale for those decisions allowing individual utilities to make risk-based and knowledge-based decisions on how to best deploy SDN in their own environment

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Software-defined Networking for Energy Delivery Systems (SDN4EDS): An Architectural Blueprint (Final Summary Report)

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Health Analysis and Research for Public Events (HARPE) Tool (Final CRADA Report)

Based on its experience in building assessment tools, Argonne National Laboratory (Argonne) has demonstrated expertise in developing comparative methodologies and question sets that provide both a physical and cyber-based risk assessment for the commercial facilities sector. A high-level risk assessment tool can be beneficial for venues and organizations that fall under a wide array of facility characterizations, ultimately accommodating the evolving landscape of threats specific to these facilities. The Health Analysis and Research for Public Events (HARPE) Tool is an assessment that seeks to help facility managers assess and mitigate aspects of safety, security, and emergency management within their venues. With the pandemic featuring prominently in today’s landscape, we have adapted and extended the scope of the HARPE tool so that it offers users the ability to integrate assessments of their preparation for, response to, and recovery from threats faced at the venue arising from the COVID-19 pandemic. Traditional threats and hazards remain prevalent in today’s landscape, and the best defense is a proactive approach to preventing and mitigating these threats. At the very core of prevention and mitigation is the first step of conducting a risk assessment—this is the gap that HARPE fills. While it is obvious that the response to COVID-19 is health and sanitation driven, leaders within the commercial facilities sector must also know where to best extend their efforts in mitigating future threats arising from the pandemic. Public events and mass gatherings are directly impacted by COVID-19; however, with the help of HARPE, leaders can focus their attention on core impact areas related to the safety and security of returning to a new normal, as they assess their risks using the Argonne-developed tool. HARPE provides an important solution to the COVID-19 situation by assisting venue managers and health officials in identifying their risks.

59 BASIC BIOLOGICAL SCIENCES↗

DOE OSTI2020

Artificial Intelligence for Digital Security and Protections

Proper functioning of nuclear power plants relies on a mix of well-regulated human and machine-driven workflows. This regulation supports nuclear safety through a series of processes and many of the tasks that support these processes have a repetitive nature that make artificial intelligence (AI) informed by machine learning (ML) a potential aid in a variety of tasks. AI is being evaluated for activities that include inspections, fuel processing, monitoring, and other activities. The introduction of any new technology presents a potential new attack vector. In the case of AI/ML, there are many attacks that have already been discovered and over time the attacks can be expected to follow the growth pattern observed in cyber security. While future planning is necessary, current efforts need to be established now to predict the threat emergence over the next year 10 years and mitigate potential threats. Based on these observations, AI/ML will need to become trustworthy, which corresponds to techniques and procedures that emphasize AI explainability along with resilience techniques to data, algorithms, models, and systems. This kind of system robustness is the foundation for defenses against AI/ML-specific attacks. Attempting to look forward and take a broad view of capabilities provides input to research roadmaps and the ability to distill vulnerabilities into specific use cases may provide greater assistance in understanding the technology benefits while introducing new risks. The impact of current and future AI in three areas—capabilities, challenges, and recovery strategies—represents an initial attempt at balancing both.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2022

Emerging Trends and Systemic Issues Influencing Today’s U.S. Electric Grid

With increasing shifts from vertically integrated to horizontally structured operations and from centralized to distributed electric power delivery, today’s electric power grid (the “grid”) operators and designers face the challenge of creating an architecture that accommodates a host of diverse requirements. The grid’s modes of operation must address concerns of reliability and stability, new deployments of renewable energy sources, threats from cyber-attacks and natural disasters, and increasingly distributed system operations. Grid modernization calls for a reliable, affordable, sustainable, agile, secure, and resilient grid. However, the modernization of the U.S. power grid is hampered by mounting complexity and diverging objectives from owners and operators and is consequently risky and fraught with potential missteps. Flawed architecture, design, and implementation will lead to stranded investments and lost opportunities. A principled approach to minimize risk and develop a robust grid of the future is to begin with a sound architecture for the grid to inform the design process. Architecture development starts with the context of influencing factors that provide constraints as well as driving goals. This report provides the context of emerging trends and cross-cutting systemic issues in the U.S. electric power grid and serves as a vital input for grid architecture development.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2022

Public – Private Partnership to Promote Efficient Manufacturing and Workforce Development (IAC Final Technical Report)

Through delivering ninety (90) energy assessments to small- and medium-sized manufacturing facilities in and around Tennessee, significant understandings were gained through providing detailed energy assessment reports to manufacturers and training seventy-seven (77) engineering students in which thirty-five (35) certified IAC students were recognized by DOE. The robust involvement of Tennessee Valley Authority (TVA), local utility and Tennessee Tech’s Cybersecurity Education, Research, and Outreach Center (CEROC) in majority of assessments made the technical operation very effective where leaded to 40.5% implementation rate of energy recommendations. Other benefits of the award to the public are a dynamic modeling tool capable of analyzing existing cooling towers for energy use optimization was developed and presented to DOE IAC, providing technical assistance to non-participating manufacturers in the form of workshop and training, publishing fifteen (15) peer-reviewed conference and journal papers as well as a book chapter in the area of industrial energy efficiency field, assisting the TVA Magnolia Combined Cycle Power Plant to become the First 50001 Ready Certified Power Plant in the U.S. through briefing them on ISO 50001 and 50001 Ready as well as providing an energy assessment to the plant, assisted the new IAC center at Clemson University with on-site and remote support, and provided assessment and training in unique areas of water, waste water, cyber security and smart manufacturing to our clients, students and community.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2021

A Method for Assessing Effectiveness and Technical Capabilities Required for Integrated Deterrence (NSLP-Final Report-Draft2022)

The United States faces an ever-increasingly multi-polar security environment dominated by great power competition with China and a lingering Russian threat as well as from would-be regional hegemons led by ambitions from Iran and North Korea. Our adversaries are pursuing and expanding the strategic means by-which they have an asymmetric offset (e.g., cyber, space, and other modes below the level of armed conflict). To combat and deter against the widening range of hostile actions, the U.S. must have additional capabilities with-which to deter. All of which drives us towards a more thoughtful integrated approach to deterrence, attempting to best align deterrent tools with the adversary actions in order to maximize the credibility of our deterrent. Such an approach complicates our deterrence strategy and demands a methodology to assess whether the U.S. has the deterrent tools necessary to deter the adversarial actions most costly to the U.S. To address this complexity, we create a framework to comprehensively and systematically assess our deterrent tools as qualitatively measured against the adversarial actions we wish to deter. Deterrence is ultimately an operation in the cognitive domain and at the heart of the framework presented here is the fundamental deterrence calculus which we use as the defining measure of whether a tool will credibly deter a given action. We describe the eight levers of the deterrence calculus and distill these levers to four products that are used to qualitatively assess the overall effectiveness of deterrence tools against adversarial actions. Credibility is determined by two principal variables: the technical credibility of the deterrent tool, and the principle of proportionality. Technical credibility of realized deterrence products is assessed through development of key mission requirements and hardware (e.g., components) that will impose costs, deny benefits, or encourage restraint. The principle of proportionality qualitatively asserts that for a deterrent tool to be cognitively credible, the costs imposed against, or benefits denied by, an action are commensurate to the magnitude of costs received from the adversarial action. By basing this framework on these two fundamentals, it is possible to compare deterrent tools in a systematic approach across the broad spectrum of hostile actions.

42 ENGINEERING↗

DOE OSTI2022

A Review of Technologies that can Provide a 'Root of Trust' for Operational Technologies

The supply chain attack pathway is being increasingly used by adversaries to bypass security controls and gain unauthorized access to sensitive networks and equipment (e.g., Critical Digital Assets). Cyber-attacks targeting supply chain generally aim to compromise the environments, products, or services of vendors and suppliers to inject, add, or substitute authentic software and hardware with malicious elements. These malicious elements are deemed to be authentic as they arise from the vendor or supplier (i.e., the supply chain). This research aims at providing a survey of technologies that have the potential to reduce exposure of sensitive networks and equipment to these attacks, thereby improving tamper resistance. The recent advances in the performance and capabilities of these technologies in recent years has increased their potential applications to reduce or mitigate exposure of the supply chain attack pathway. The focus being on providing an analysis of the benefits and disadvantages of smart cards, secure tokens, and elements to provide root of trust. This analysis provides evidence that these roots of trust can increase the technical capability of equipment and networks to authenticate changes to software and configuration thereby increasing resilience to some supply chain attacks, such as those related to logistics and ICT channels, but not development environment attacks.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗