Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Cyber security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,315 records · Page 73

EPA and Idaho National Laboratory create first of its scale

Advancing the science and engineering of decontaminating water distribution systems and safely disposing of high-volumes of contaminated water are high priorities for the EPA. To help address these science gaps, EPA homeland security researchers have developed the first-of-its-scale Water Security Test Bed (WSTB). Water is an important component of everyday life. We rely on safe, clean water for our health and the health of the environment. Protecting this vital resource is critical to living safely and securely. The U.S. Environmental Protection Agency is responsible for working with water utilities to protect water systems from contamination and to clean up systems that become contaminated. Purposeful or inadvertent distribution system contamination can result in large amounts of infrastructure and water that must be cleaned. Water distribution systems contamination can be caused by, for example, natural disasters such as Superstorm Sandy or by individuals hoping to cause harm. The WSTB, constructed at the Department of Energy’s (DOE) Idaho National Laboratory, replicates a section of a typical municipal drinking water system including a piping system with roughly 445 feet of pipe and two fire hydrants laid out in an “L” shape using 40-year-old, eight-inch cement mortar lined, ductile iron pipes, excavated after twenty years of use for water conveyance. Researchers built the WSTB above ground for easy access during experiments, and to facilitate fast leak detection. Over the next several years, EPA and partner researchers will conduct experiments using simulants of various biological, chemical, and radioactive materials that simulate high toxic versions of these agents. At this “full” sized system, researchers will demonstrate approaches to contamination detection, sensor and model testing, infrastructure decontamination, water treatment and cyber testing developed at lab and pilot scale. Researchers are also able to verify if laboratory results that were effective in controlled conditions are as effective in full-scale testing. Having the ability to conduct bench scale studies in a real world setting can help address specific research gaps, and help water researchers understand conditions in which real world drinking water systems operate.

54 ENVIRONMENTAL SCIENCES↗

Testing SOAR tools in use

Investigations within Security Operation Centers (SOCs) are tedious as they rely on manual efforts to query diverse data sources, overlay related logs, correlate the data into information, and then document results in a ticketing system. Security Orchestration, Automation, and Response (SOAR) tools are a relatively new technology that promise, with appropriate configuration, to collect, filter, and display needed diverse information; automate many of the common tasks that unnecessarily require SOC analysts’ time; facilitate SOC collaboration; and, in doing so, improve both efficiency and consistency of SOCs. There has been no prior research to test SOAR tools in practice; hence, understanding and evaluation of their effect is nascent and needed. Here, in this paper, we design and administer the first hands-on user study of SOAR tools, involving 24 participants and six commercial SOAR tools. Our contributions include the experimental design, itemizing six characteristics of SOAR tools, and a methodology for testing them. We describe configuration of a cyber range test environment, including network, user, and threat emulation; a full SOC tool suite; and creation of artifacts allowing multiple representative investigation scenarios to permit testing. We present the first research results on SOAR tools. Concisely, our findings are that: per-SOC SOAR configuration is extremely important; SOAR tools increase efficiency and reduce context switching, although with potentially decreased ticketing accuracy/completeness; user preference is slightly negatively correlated with their performance with the tool; internet dependence varies widely among SOAR tools; and balance of automation with assisting decision making is preferred by senior participants. We deliver a public user- and tool-anonymized and -obfuscated version of the data.

97 MATHEMATICS AND COMPUTING↗

Enhancing Cloud Cybersecurity: Prescriptive Controls for Operational Technology

This whitepaper provides strategic insights and recommendations into security cloud-based solutions for electric utilities, encompassing operational technology (OT), virtual power plants (VPP), distributed energy resources (DERs), applications, networks, and data storage as they transition to and leverage cloud infrastructure through managed service providers (MSPs) and cloud service providers (CSPs). Principles derived from established frameworks serve as a foundation for best practices across cybersecurity projects and remove the constraints of settling on a single framework. For organizations that prefer not to integrate a specific framework altogether, elements of the proposed approach could be adopted or tailored to best fit defined requirements and expected functionalities. The Cirrus assessment, a utility cloud feasibility tool, and the roadmap it provides serve as a precursor to this paper, which seeks to be a valuable resource for defining next steps following cloud technology integration feasibility appraisal. With its comprehensive approach to adoption, the Cirrus framework offers strategic guidance on responsibly preparing for or deploying a utility cloud solution. The previously published whitepaper, “Use Case-Informed Framework for Utility Cloud Migration,” details the guiding strategy, research, and deployment of cloud solutions within electric and interconnected grid systems. Before implementing the controls suggested in this document, it is recommended that stakeholders complete Cirrus's cloud integration assessment and pair the results with their unique cybersecurity controls to form a comprehensive cloud-based utility cybersecurity plan. The Cirrus outcome will consider a series of future architectures for the grid before and after the energy transition and evaluate the arguments for and against cloud applications for each electric and interconnected grid layer. This document is a companion to the original whitepaper, "Use Case-Informed Framework for Utility Cloud Migration" to further identify and recommend security controls based on Cirrus’s cloud integration assessment output. The following whitepaper outlines the cybersecurity controls that secure cloud-service models pertinent to the electric sector using the predefined categories identify, protect, detect, and respond and recover. The objective is to outline prescriptive security controls based on the type of architecture and data stored in the cloud. The focus includes dissecting the shared responsibility model and elucidating what on-premises Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) entail. A pivotal consideration in this context is allocating responsibility for foundational cybersecurity aspects—having used Cirrus for the cloud integration assessment. The ensuing controls detailed herein also represent a checklist of controls necessary for a secure cloud transition, equipping utilities with the knowledge to navigate this digital transformation with confidence and strategic foresight in a safe and responsible manner.

42 ENGINEERING↗

Autonomous Inverter Controls for Resilient and Secure Grid Operation: Vector Control Design for Grid Forming

The project addresses both fundamental and practical challenges of GFM/GFL inverter control for the power grids with high inverter based resources (IBRs) penetration. A data- driven modeling technique is applied to accurately model dynamics of PWM inverters, including electromagnetic-transient (EMT). Systematic and integrative designs of grid- forming (GFM) and grid-following (GFL) primary controls are developed to guarantee system performance under either normal or abnormal operating conditions without violating constraints. This modeling and control framework provides black-start capability in case of an outage without relying on rotating generators, and its secondary control is also shown to enhance resilience against cyber-physical attacks.

14 SOLAR ENERGY↗

Safety and Security Defense-in-Depth for Nuclear Power Plants

This report describes the risk-informed technical elements that will contribute to a defense-in-depth assessment for cybersecurity. Risk-informed cybersecurity must leverage the technical elements of a risk-informed approach appropriately in order to evaluate cybersecurity risk insights. HAZCADS and HAZOP+ are suitable methodologies to model the connection between digital harm and process hazards. Risk assessment modeling needs to be expanded beyond HAZCADS and HAZOP+ to consider the sequence of events that lead to plant consequences. Leveraging current practices in PRA can lead to categorization of digital assets and prioritizing digital assets commensurate with the risk. Ultimately, the culmination of cyber hazard methodologies, event sequence modeling, and digital asset categorization will facilitate a defense-in-depth assessment of cybersecurity.

97 MATHEMATICS AND COMPUTING↗

Gary Laughlin IHNS Intro to 2015 HPC Annual Report

The International, Homeland, and Nuclear Security (IHNS) Program Management Unit (PMU) oversees a broad portfolio of Sandia’s programs in areas ranging from global nuclear security to critical asset protection. We use science and technology, innovative research, and global engagement to counter threats, reduce dangers, and respond to disasters. The PMU draws on the skills of scientists and engineers from across Sandia. Our programs focus on protecting US government installations, safeguarding nuclear weapons and materials, facilitating nonproliferation activities, securing infrastructures, countering chemical and biological dangers, and reducing the risk of terrorist threats. We conduct research in risk and threat analysis, monitoring and detection, decontamination and recovery, and situational awareness. We develop technologies for verifying arms control agreements, neutralizing dangerous materials, detecting intruders, and strengthening resiliency. Our programs use Sandia’s High-Performance Computing resources for predictive modeling and simulation of interdependent systems, for modeling dynamic threats and forecasting adaptive behavior, and for enabling decision support and processing large cyber data streams. In this report, we highlight four advanced computation projects that illustrate the breadth of the IHNS mission space.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

Analyzing Resiliency of the Smart Grid Communication Architectures

Smart grids are susceptible to cyber-attack as a result of new communication, control and computation techniques employed in the grid. In this paper, we characterize and analyze the resiliency of smart grid communication architecture, specifically an RF mesh based architecture, under cyber attacks. We analyze the resiliency of the communication architecture by studying the performance of high-level smart grid functions such as metering, and demand response which depend on communication. Disrupting the operation of these functions impacts the operational resiliency of the smart grid. Our analysis shows that it takes an attacker only a small fraction of meters to compromise the communication resiliency of the smart grid. We discuss the implications of our result to critical smart grid functions and to the overall security of the smart grid.

None, None↗

Analyzing Resiliency of the Smart Grid Communication Architectures

Smart grids are susceptible to cyber-attack as a result of new communication, control and computation techniques employed in the grid. In this paper, we characterize and analyze the resiliency of smart grid communication architecture, specifically an RF mesh based architecture, under cyber attacks. We analyze the resiliency of the communication architecture by studying the performance of high-level smart grid functions such as metering, and demand response which depend on communication. Disrupting the operation of these functions impacts the operational resiliency of the smart grid. Our analysis shows that it takes an attacker only a small fraction of meters to compromise the communication resiliency of the smart grid. We discuss the implications of our result to critical smart grid functions and to the overall security of the smart grid.

Anas AlMajali, Anas↗

Parameter Estimation for Decoding Sensor Signals

This paper introduces a parameter estimation approach for decoding digital sensor signals in a cyber-physical system. For unknown or not fully characterized digital sensor data, it can be difficult to decipher a desired signal from background or noise. In a cyber-physical system with networked sensors, we can leverage knowledge of the physical system to inform the decoding of the digital signals. This work in progress is a case study on deciphering commercial vehicle on-board sensor networks that communicate through the Controller Area Network (CAN). By understanding the stock vehicle sensor network, a vehicle can be extended into a scalable research platform with minimal instrumentation. Our challenge was to localize desired sensor signals encoded in network traffic that included other sensor data, control messages, as well as encoding and security overhead. Due to the vehicle’s unknown sensor network, our approach developed methods to efficiently analyze and identify key signals despite the large state-space for potential signal embeddings.

Nice, Matthew↗

Dynamic Analysis of Mobile Device Applications

The On-Device Dynamic Analysis of Mobile Applications (ODAMA) project was started in an effort to protect mobile devices used in Industrial Control Systems (ICS) from cyber-attack. Because mobile devices hide as much of the “computer” as possible, the user’s ability to assess the software running on their system is limited. The research team chose Google’s Android platform for this initial research because it is open source and it would give us freedom in our approach, including the ability to modify the mobile device’s operating system itself. The research team concluded that a Privileged Application was the right approach, and the result was ODAMA. This project is an important piece of the work to secure the expanding use of mobile devices with our nation’s critical infrastructure.

24 POWER TRANSMISSION AND DISTRIBUTION↗

FIC Consequence Profile - Hypothetical Cybercrime Syndicate Adversary Dossier

The FIC team has engaged PNNL’s Shamrock Cyber team to produce this Consequence Profile. This Consequence Profile is an Adversary Dossier, which provides the foundation for a thorough understanding of unacceptable mission outcomes, and the threats and vulnerabilities that make these outcomes plausible. The dossier helps stakeholders and development teams understand each other’s viewpoints. It also provides a means for reducing overall risk by prioritizing threats and vulnerabilities based on unacceptable outcomes. The Consequence Profile can be used as is, or as content to inform other reports tailored to a specific audience. It is intended to enable decision makers at all levels to improve the security posture of the system.

Beaman, Jacob E.↗

Cyber-Resilient Frequency Control of Power Grids with Energy Storage Systems

The integration of synchronous generators and energy storage systems operated through communication networks introduces new challenges and vulnerabilities to the electric grid, where cyber attacks can corrupt sensor measurements or control inputs and interrupt functions such as frequency regulation. This paper proposes a defense methodology for the design of resilient operating constraints imposed on each generation and storage unit in order to prevent any attack sequence from driving the system's frequency to unsafe conditions. The resilient operating constraints are found by using ellipsoidal approximations of the reachable set of the power system, leading to a convex optimization problem with linear matrix inequalities. Numerical results in a single-area power system with synchronous generation and energy storage demonstrate how the resilient constraints provide security guarantees against any type of attack affecting frequency measurements or controller setpoints.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Intelligent Buildings of the Future: Cyberaware, Deep Learning Powered, and Human Interacting

This study discuss, intelligent buildings are quickly becoming cohesive and integral entities of cyber-physical ecosystems. Modern buildings adapt to internal and external elements and thrive on ever increasing data sources such as ubiquitous smart devices and sensors while mimicking various approaches previously known in software, hardware, and bio inspired systems. This article provides an overview of intelligent buildings of the future from a range of perspectives. First, a brief overview of prospects of U.S. and world energy consumption, concepts of smart buildings as integral entities of smart grids is presented. This is followed by a discussion of the role of connectivity and interoperability as well as current issues and solutions in the areas of security, resilience, and humans in realm of intelligent buildings. The article dives into detail about the intelligence aspect of intelligent buildings of the future. The learning and predictive Artificial Intelligence (AI) techniques behind many of the concepts of intelligent buildings are reviewed, including the latest techniques such as deep learning. As a concrete application of AI in the realm of intelligent buildings, prediction of energy consumption/load/demand, which is a much researched application of AI in the realm of intelligent buildings, is elaborated. The discussion is focused on most recent advancements of AI based demand prediction and the overview consists of existing research and a case study conducted by the authors for deep learning based demand prediction. Then, the article discusses the role of humans in intelligent buildings. Different types of human-building interactions are identified. Further, the article presents how each type of human-building interaction can benefit the overall control of intelligent buildings. The section is concluded by elaborating a case study conducted by the authors to achieve effective and efficient human-building interaction. The article is concluded with compilation of future insights based on latest technological advancements in U.S. industry and government.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

INL FY 2021 Laboratory Overview

The INL FY 2021 Laboratory Overview is an opportunity for INL to share its achievements and plans for the future with the entire Laboratory, stakeholders, and the public. This document outlines how INL will advance its clean energy and national security objectives in the future and highlights FY 2020 accomplishments across the Laboratory in science and technology, community outreach, and operations.

07 ISOTOPE AND RADIATION SOURCES↗

Network Randomization and Dynamic Defense for Critical Infrastructure Systems

Critical Infrastructure control systems continue to foster predictable communication paths, static configurations, and unpatched systems that allow easy access to our nation's most critical assets. This makes them attractive targets for cyber intrusion. We seek to address these attack vectors by automatically randomizing network settings, randomizing applications on the end devices themselves, and dynamically defending these systems against active attacks. Applying these protective measures will convert control systems into moving targets that proactively defend themselves against attack. Sandia National Laboratories has led this effort by gathering operational and technical requirements from Tennessee Valley Authority (TVA) and performing research and development to create a proof-of-concept solution. Our proof-of-concept has been tested in a laboratory environment with over 300 nodes. The vision of this project is to enhance control system security by converting existing control systems into moving targets and building these security measures into future systems while meeting the unique constraints that control systems face.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

Automation, Autonomy & Megacities 2025: A Dark Preview

This paper extrapolates from present trends to describe very plausible – and actually quite likely – future crises playing out in multiple global cities. While predicting the future is fraught with uncertainty, much of what occurs in the scenarios that follow is fully possible today and absent a significant course change, probable in the timeframe discussed. The authors want to caveat that we are not commenting on a specific organization or technology deployment. It is not hard to find tech evangelists touting that ubiquitous and highly interconnected digital technology will bring great advances in productivity and efficiency, as well as new capabilities we cannot foresee. This paper attempts to reveal what is possible when these technologies are applied to critical infrastructure applications en masse without adequate security in densely populated cities that by their nature are less resilient than other environments. Megacities need and will deploy these new technologies to keep up with insatiable demand for energy, communications, transportation and other services, but it is important to recognize that they are also made more vulnerable by following this path .

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

Cybersecurity Incident Response Guide for Wind

As wind energy systems become increasingly digitized and interconnected, they face a growing array of cyber threats that can disrupt operations, compromise safety, and trigger cascading impacts across the energy ecosystem. The Wind Incident Response Guide provides a structured, wind-specific framework for preparing for, detecting, responding to, and recovering from cyber incidents. Drawing on lessons from field demonstrations, cyber-physical testbeds, and stakeholder engagement across the wind sector, this guide integrates technical, operational, and regulatory considerations to support asset owners, operators, and responders. It outlines key roles and responsibilities, maps incident response phases to wind-specific scenarios, and highlights applicable laws, regulations, standards, and best practices. By tailoring general cybersecurity principles to the unique architectures and operational constraints of wind systems—including remote access, legacy components, and environmental interfaces—this guide aims to enhance resilience, reduce response time, and support coordinated action across public and private stakeholders. It is intended as a practical resource for utilities, developers, regulators, and emergency managers working to secure the future of wind energy.

17 - WIND ENERGY↗