Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Cyberattack”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 145 records · Page 8
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Strengthening the Security of Operational Technology: Understanding Contemporary Bill of Materials

The evolution of cyber-physical infrastructure has made its security more challenging. The last few years have witnessed a convergence of hardware and software segments in various domains, including operational technology (OT) which is responsible for carrying out critical tasks such as monitoring and controlling power grids, nuclear plants, transportation, and emergency services. Both hardware and software encapsulate numerous open source and proprietary subcomponents, making it crucial for end-users to understand the composition of the products they are using. For example, wind turbines incorporate thousands of lines of code (software) used for the turbine's design, planning, operation, and analytics in addition to the numerous hardware subcomponents that construct it. Due to the highly complex nature of software and hardware, knowledge of the components and subcomponents is required to mitigate cyber vulnerabilities and defend against cyberattacks. There has also been a transformation from a traditional linear supply chain into a global, dynamic, diverse, and interconnected system. The digitization of the supply chain makes it easier to find and exploit vulnerabilities. Critical infrastructures (e.g., power grids, oil, natural gas, water, and wastewater) rely on OT to function, and if the OT is compromised, equipment damage and potential interruption of services could result. A significant security measure to protect OT systems from disruption is to develop a supply chain bill of materials (BoM) corresponding to the software and hardware used in OT, along with attestations amongst vendors and asset owners. A supply chain BoM is a proactive way to understand the inherent vulnerabilities in the system and mitigate them in advance of being exploited. BoMs bolster the trust placed in the digital infrastructure and enhance software supply chain security by sustaining the management of component obsolescence and compliance, along with the seclusion of unsafe segments of a specific product. Adopting BoM tools is becoming increasingly important across various government sectors, as evidenced by the recent U.S. executive order on cybersecurity (NIST 2021). This paper aims to classify BoMs based on structure, functionality, component type, and architecture. The work also discusses case studies to further highlight the benefits of BoMs. In addition, it identifies missing pieces in existing BoM implementations so that future research may identify bounds on where it could expect to make improvements and directly enable researchers to identify promising areas for exploration. Further, the authors provide valuable recommendations to tool developers, researchers, and standardizing organizations (policymakers), additionally benefitting critical infrastructure owners and government executives. This aids in paving a path for future work, thereby, providing suggestions to determine a tool for consumers that best suit their needs.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Securing Vehicle Charging Infrastructure

As the US electrifies the transportation sector, cyber attacks targeting vehicle charging could bring consequences to electrical system infrastructure. This is a growing area of concern as charging stations increase power delivery and must communicate to a range of entities to authorize charging, sequence the charging process, and manage load (grid operators, vehicles, OEM vendors, charging network operators, etc.). The research challenges are numerous and are complicated because there are many end users, stakeholders, and software and equipment vendors interests involved. Poorly implemented electric vehicle supply equipment (EVSE), electric vehicle (EV), or grid communication system cybersecurity could be a significant risk to EV adoption because the political, social, and financial impact of cyberattacks - or public perception of such - ripples across the industry and has lasting and devastating effects. Unfortunately, there is no comprehensive EVSE cybersecurity approach and limited best practices have been adopted by the EV/EVSE industry. There is an incomplete industry understanding of the attack surface, interconnected assets, and unsecured interfaces. Thus, comprehensive cybersecurity recommendations founded on sound research are necessary to secure EV charging infrastructure. This project is providing the power, security, and automotive industry with a strong technical basis for securing this infrastructure by developing threat models, determining technology gaps, and identifying or developing effective countermeasures. Specifically, the team is creating a cybersecurity threat model and performing a technical risk assessment of EVSE assets, so that automotive, charging, and utility stakeholders can better protect customers, vehicles, and power systems in the face of new cyber threats.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2021

Power Sector Cybersecurity Building Blocks

The Power Sector Cybersecurity Building Blocks, developed through the USAID-NREL Partnership and the Resilient Energy Platform, are designed to help a variety of stakeholders improve security for the electrical grid. This effort grows out of USAID and NREL's discussions with utilities around the world, as well as past cybersecurity assessments performed by NREL on dozens of utilities and government agencies, with a focus on the cybersecurity challenges faced by small and under-resourced utilities. This document outlines eleven building blocks for power sector cyber security. It functions as a guide to help organizations develop a robust, balanced cybersecurity defense program. Individually, each building block represents a cluster of related activities within cybersecurity on which an organization should focus. Using the building blocks, organizations can effectively prioritize their cybersecurity efforts to best thwart a wide range of potential cyberattacks.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Idaho Cyber Heroes: Helping Individuals Navigate Career Pathways in Cybersecurity

In 2019, there was a shortage of 3.5 million qualified cybersecurity professionals. Cyberattacks are ever on the rise, making it increasingly important these positions be filled quickly. The purpose of this research, as part of the Idaho Cyber Research Project, was to use information collected from open-source materials to depict the career path issues in cybersecurity for individuals. Interviews with professionals from various industry sectors in Idaho also influenced the course of our research. Early research revealed that one of the main problems is an unclear career path for individuals wanting to enter the cybersecurity workforce. Unclear pathways are defined by of a lack of awareness about a career field, uncertainty surrounding the knowledge and skills taught in college due to a lack of standardization between institutions, high qualification standards in hiring, and a lack of diverse representation in the cybersecurity workforce. Additionally, a platform called CyberKnights was assessed as it applies to the individual and their pathway. However, CyberKnights is not the only solution to this problem, and further research is needed to identify additional solutions.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Cybersecurity Guide for Distributed Wind

Distributed wind sits at the intersection of grid-connected, off-grid and behind-the-meter cyber-physical electrical energy systems. The unique physical properties and communications requirements for distributed wind systems mean that there are unique cybersecurity considerations, but there is little to no existing guidance on best practices for cybersecurity. This document is intended to be a starting point for distributed wind stakeholders including manufacturers, installers and integrators, and operators (facility, aggregator, or utility). We discuss common distributed wind architectures and describe their role in the larger power system, pointing out some of the key connections to be aware of. Cybersecurity cannot exist in a vacuum, but rather must consider all the system and all its connections holistically. The role of distributed wind and the functions it can serve are described to gain understanding of the full range of capabilities. The purpose and application of relevant standards that may apply to certain distributed wind systems is presented. These standards may not apply to all installations, but even for systems that are not required to meet these standards they can be a good reference for best practices. A holistic threat perspective is used to describe the adversaries, threats, and potential impacts of cyberattacks, with special emphasis on what sets distributed wind systems apart from other distributed energy resources (DER). Finally, we present the recommendations for cybersecurity, both in terms of needs of the system and roles that specific stakeholders should fulfill. Distributed wind systems can come in a variety of architectures and applications, so there is no one-size-fits-all approach to cybersecurity. However, this document contains the relevant information for stakeholders to identify the cybersecurity needs of their system, refer to relevant standards, and apply best practices in a manner most consistent with their security and operational goals.

17 WIND ENERGY↗
DOE OSTI2022

Distributed Energy Resource Cybersecurity Standards Development [Final Report]

Currently, the solar industry is operating with little application-specific guidance on how to protect and defend their systems from cyberattacks. This 3-year Department of Energy (DOE) Solar Energy Technologies Office-funded project helped advance the distributed energy resource (DER) cybersecurity state-of-the-art by (a) bolstering industry awareness of cybersecurity concepts, risks, and solutions through a webinar series and (b) developing recommendations for DER cybersecurity standards to improve the security performance of DER products and networks. Drafting DER standards is a lengthy, consensus-based process requiring effective leadership and stakeholder participation. This project was designed to reduce standard and guide writing times by creating well-researched recommendations that could act as a starting place for national and international standards development organizations. Working within the SunSpec/Sandia DER Cybersecurity Workgroup, the team produced guidance for DER cybersecurity certification, communication protocol standards, network architecture s, access control, and patching. The team also led subgroups within the IEEE P 1547.3 Guide for Cybersecurity of Distributed Energy Resources Interconnected with Electric Power Systems committee and pushed a draft to ballot in October 2021.

14 SOLAR ENERGY↗
DOE OSTI2022

Cyber Resilient Flexible Alternating Current Transmission Systems (XFACTS)

This report summarizes the activities conducted under the DOE-OE funded project DEOE0000897, Cyber Attack Resilient Flexible AC Systems – XFACTS. Hitachi Energy (HE), in collaboration with ABB Inc. (ABB), Bonneville Power Administration (BPA), University of Illinois at Urbana-Champaign (UIUC), Iowa State University (ISU), and University of Idaho (UI) pursued the development of a system of defense for Flexible Alternating current Transmission Systems against cyber-attacks (XFACTS). A FACTS substation enhanced with XFACTS defense mechanisms will be capable of mitigating cyberattacks especially those that seek to control electrical parameters like voltage or current and interrupt the power flow in AC lines. It empowers existing FACTS controllers and associated intelligent electronic devices to detect and mitigate malicious intents to depress system voltages, destabilize power flows, trip AC circuit breakers, corrupt currents, and voltages, even if the malicious commands and the measurements have correct syntax. The XFACTS functions utilize the physics of active power electronic systems, control and protection, electric power engineering principles, and state estimation to bring more in-depth cyber defense closer to the protected FACTS substation devices.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Department of Energy Water Power Technologies Office Cyber Response & Recovery Flipbook [Slides]

Protecting hydroelectric plants from incidents that adversely impact their cyber-physical systems presents unique challenges due to the plants’ widely dispersed geographic locations and varied configurations as well as the relative nascent nature of the cyberattacks targeting these facilities. To help hydroelectric plants better respond to and mitigate cybersecurity incidents, this Department of Energy Water Power Technologies Office Cyber Response & Recovery Flipbook is to be used at a hydroelectric plant to quickly respond to an anomalous event. In addition to this product, there are three other products meant to be distributed to a hydroelectric plant to assist in their cyber incident response and recovery. The first, a report on the processes of building this flip book based on a large set of existing guidance. The second, a handy guide of hydroelectric and cyber guidance in responding to the cyber and physical systems within a hydroelectric plant. And the third is a correlated alignment of the steps an hydroelectric plant operator would take for both a cyber incident as well as an emergency response process if the event rises to a cyber incident affecting the safe and reliable operations of a hydroelectric plant.

13 HYDRO ENERGY↗
DOE OSTI2020

Hydroelectric Cybersecurity Response and Recovery Overview

Protecting hydroelectric plants from incidents that adversely impact their cyber-physical systems presents unique challenges due to the plants’ widely dispersed geographic locations and varied configurations as well as the relative nascent nature of the cyberattacks targeting these facilities. To help hydroelectric plants better respond to and mitigate cybersecurity incidents, this Department of Energy Water Power Technologies Office Cyber Response & Recovery Overview document discusses the process of defining how a hydroelectric plant might respond to and recover from an anomalous event. In addition to this product, there are three other products meant to be distributed to a hydroelectric plant to assist in their cyber incident response and recovery. The first, a handy flip book that guides an operator in the midst of a cyber event through the R&R process of the incident and if the event warrants, through an emergency action plan to recover the plant itself. The second, a handy guide of hydroelectric and cyber guidance in responding to the cyber and physical systems within a hydroelectric plant. And the third is a correlated alignment of the steps an hydroelectric plant operator would take for both a cyber incident as well as an emergency response process if the event rises to a cyber incident affecting the safe and reliable operations of a hydroelectric plant.

13 HYDRO ENERGY↗
DOE OSTI2022

WPTO Navigator

Protecting hydroelectric plants from incidents that adversely impact their cyber-physical systems presents unique challenges due to the plants’ widely dispersed geographic locations and varied configurations as well as the relative nascent nature of the cyberattacks targeting these facilities. To help hydroelectric plants better respond to and mitigate cybersecurity incidents, this Department of Energy Water Power Technologies Office Navigator aligns the processes within the National Institute of Standards 800-61r2 Computer Security Incident Handling Guide with the emergency actions within the FEMA 64 Emergency Action Plan Framework. This work is to be used at a hydroelectric plant to quickly understand how the plant responds to a cyber incident in relationship to the actions involved in an emergency action plan involving a hydroelectric plant. In addition to this product, there are three other products meant to be distributed to a hydroelectric plant to assist in their cyber incident response and recovery. The first, a report on the processes of building a R&R flip book based on a large set of existing guidance. The second, a handy flip book meant to be distributed to hydroelectric plants to assist them during a cybersecurity incident occurring on a hydroelectic plant. And the third is a comprehensive set of resources to assist an operator in locating appropriate guidance during the recovery process.

13 HYDRO ENERGY↗
DOE OSTI2022

WPTO Comprehensive References [Poster]

Protecting hydroelectric plants from incidents that adversely impact their cyber-physical systems presents unique challenges due to the plants’ widely dispersed geographic locations and varied configurations as well as the relative nascent nature of the cyberattacks targeting these facilities. To help hydroelectric plants better respond to and mitigate cybersecurity incidents, this Department of Energy Water Power Technologies Office Cyber Comprehensive Reference list is to be used at a hydroelectric plant to quickly go to appropriate sources during the response and recovery of a cyber incident. In addition to this product, there are three other products meant to be distributed to a hydroelectric plant to assist in their cyber incident response and recovery. The first, a report on the processes of building a R&R flip book based on a large set of existing guidance. The second, a handy flip book meant to be distributed to hydroelectric plants to assist them during a cybersecurity incident occurring on a hydroelectic plant. And the third is a correlated alignment of the steps an hydroelectric plant operator would take for both a cyber incident as well as an emergency response process if the event rises to a cyber incident affecting the safe and reliable operations of a hydroelectric plant.

13 HYDRO ENERGY↗
DOE OSTI2022

ADROC: An Emulation Experimentation Platform for Advancing Resilience of Control Systems

Cyberattacks against industrial control systems have increased over the last decade, making it more critical than ever for system owners to have the tools necessary to understand the cyber resilience of their systems. However, existing tools are often qualitative, subject matter expertise-driven, or highly generic, making thorough, data-driven cyber resilience analysis challenging. The ADROC project proposed to develop a platform to enable efficient, repeatable, data-driven cyber resilience analysis for cyber-physical systems. The approach consists of two phases of modeling: computationally efficient math modeling and high-fidelity emulations. The first phase allows for scenarios of low concern to be quickly filtered out, conserving resources available for analysis. The second phase supports more detailed scenario analysis, which is more predictive of real-world systems. Data extracted from experiments is used to calculate cyber resilience metrics. ADROC then ranks scenarios based on these metrics, enabling prioritization of system resources to improve cyber resilience.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Cyber-Physical Resiliency for Wind Power Generation

During the next three years, wind power generation is expected to add more generation capacity to the national electrical grid than any other energy sector. With new wind turbine designs rated power over 10 MW and wind farms reaching over 1 GW capacities, the consequences of cyber-attacks on wind power generation are becoming increasingly more critical. Moreover, the known vulnerabilities of wind turbine control systems and the potential damaging effects of intrusions, motivate an urgent protection improvement for the wind power generation sector. This program has developed a variety of new adaptive defense technologies that enable wind power generation systems to survive sophisticated cyberattacks by enhancing the control systems capabilities of detection, localization, and accommodation. The introduction of these technologies in the on-shore and the emerging off-shore market will result in a significantly more reliable and secure wind power infrastructure.

17 WIND ENERGY↗
DOE OSTI2022

Networked Microgrid Cybersecurity Architecture Design Guide: A New Jersey TRANSITGRID Use Case

Microgrids require reliable communication systems for equipment control, power delivery optimization, and operational visibility. To maintain secure communications, Microgrid Operational Technology (OT) networks must be defensible and cyber-resilient. The communication network must be carefully architected with appropriate cyber-hardening technologies to provide security defenders the data, analytics, and response capabilities to quickly mitigate malicious and accidental cyberattacks. In this work, we outline several best practices and technologies that can support microgrid operations (e.g., intrusion detection and monitoring systems, response tools, etc.). Then we apply these recommendations to the New Jersey TRANSITGRID use case to demonstrate how they would be deployed in practice.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

Situational Awareness of Grid Anomalies (SAGA) for Visual Analytics—Near-Real-Time Cyber-Physical Resiliency Through Machine Learning

The Situational Awareness of Grid Anomalies (SAGA) project built upon foundational power system tools developed at the National Renewable Energy Laboratory (NREL) integrated with an ever-increasing set of Gridmetrics data extracted from the cable television (CATV) broadband network infrastructure while assimilating other time-series geospatial data and information, such as weather and cyber-physical phenomena, to demonstrate a disruptive technology for power system data analytics relying on existing infrastructure. Three research thrusts supported (1) visual analytics, (2) cyber-physical power system simulation, and (3) anomaly detection. SAGA created technology that leverages, couples, and fortifies two vastly different realms - power and broadband - to increase the resiliency of the power grid in the face of increasing cyberattacks and operational challenges related to integrating DERs. The exploration of potential synergies of broadband-enabled grids resulted in identifying a mutually beneficial symbiosis that can increase the resiliency of both power and broadband services. Broadband networks perform better with reliable power and are good at providing real-time measurements that identify where the grid is under attack, is failing, or is weak. Likewise, sensor-starved distribution grids perform better and can be more reliable when their operation is buttressed with observations of broadband-detected anomalies. Future research can explore broadband's contribution to continuing to improve grid resiliency, reliability, and cost-effective operation.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

Cyber-CHAMP White Paper

Cyber-CHAMP white paper intern school assignment. Worldwide there is a tremendous shortfall in the cybersecurity workforce. By 2021, researchers have forecasted a deficit of 3.5 million cyber professionals. As workforce capabilities diminished, the world's cybersecurity threats have continued to multiply. Industrial control systems (ICSs) and their operational technology (OT) components became more vulnerable to attack and compromise. When an ICS is compromised, attackers can cause widespread impacts on national security, public health, and safety. This capacity makes ICSs attractive targets, with 90% of surveyed OT organizations reporting a damaging cyberattack in the last two years. To address the risk to ICSs, personnel must be competent in operational best practices and the latest threats. While frameworks for information technology (IT) cybersecurity education have been developed, educational standards for OT cybersecurity are nonexistent.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Autonomous Tools for Attack Surface Reduction (Final Report)

The electric power grid is a complex critical infrastructure that forms the lifeline of modern society, and its secure and reliable operation is of paramount importance to national security and economic wellbeing. However, recent findings documented in authoritative sources indicate the threat of cyber-based attacks growing in numbers and sophistication. However, securing the grid against stealthy cyberattacks is a challenging task due to legacy nature of the infrastructure coupled with dynamic nature of threat landscape and ever-growing sophistication of the adversaries. Additionally, the grid’s attack surface continues to grow with the increased dependence on digital communications and control that now extends to each consumer through smart meters and distributed energy resources. Unfortunately, this expansive surface increases the grid’s vulnerability and further exposes critical control systems in both substations and control centers. To respond to this emerging need, we had successfully assembled an interdisciplinary team with academic- industry partnership to successfully conduct research, development, evaluation, demonstration, and commercialization of attack surface reduction tools, whose goal was to significantly reduce the cyber attack surface in the North American power grid. Our proposed project was a synergistic collaborative effort leveraging the synergistic expertise of the team members across power systems, cyber security and CPS security, testbeds, field deployments and demonstration, and successful commercialization. The following are the specific tasks that have been successfully completed two phases (2016-2020). Phase I: Task 1: Developed and implemented a robust Project Management and Data Management Plan, coupled with a well thought out Risk Mitigation Plan. Task 2.1: Developed a comprehensive framework that continually assesses and autonomously reduces the attack surface for the power grid control environment spanning across substations, control center and the SCADA network to significantly reduce the risks of cyber attacks. Task 2.2: Developed attack surface analysis techniques, metrics, and tools that assess the attack surface at multiple levels including the control center, substations, and the SCADA network. Task 2.3: Developed attack surface reduction techniques and tools that dynamically reduce attack surface and hence increase attacker’s cost without interfering in the critical functions of the system. Task 2.4: Prototyped, implemented, and quantitatively evaluated/validated the techniques and tools on a realistic industrial CPS security testbed environment by leveraging the unique resources of the team. Task 3: Developed Commercialization plan to transition the developed tools into power system industry stakeholders for a broader adoption by leveraging the expertise of our industrial members. Phase II: Task 4: Successfully completed field demonstration, verification, and evaluation of the effectiveness of the attack surface analysis and reduction techniques on a realistic utility testbed environment. This also involved the development of realistic scenarios, sound metrics, data sets, evaluation criteria, and documentation. Technology integration & Field demonstration: The project had significantly advanced the state-of-the-art research and practice in improving the cybersecurity of our nation’s power grid infrastructure against cyber threats. In particular, the proposed, designed, and deployed attack surface analysis and reduction algorithms and tools have contributed to significantly reducing the exposure and risk of the devices, substations, and the integrated SCADA/EMS/ DMS grid environment to cyber threat. Strong demonstration and evaluation techniques have verified the feasibility of the developed techniques on realistic cyber-physical testbeds and utility partner's real grid environment, and collaborative research and evaluation of attack surface reduction techniques (for wide-are monitoring and control) within a vendor (GE) EMS platform. The Attack Host Analyzer (AHA) tool that was developed through this project was made available through GitHub.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Using Structured Intelligence Graph (STIG) to protect our critical infrastructure against cyber attacks [Poster]

STIG is a revolutionary cybersecurity tool developed by researchers at the U. S. Department of Energy's Idaho National Laboratory and it is a software that allows utility owners and operators to easily visualize, create, and edit cyberthreat intelligence information. STIG uses Structured Threat Information eXpression (STIX) and converts complex data on cybersecurity vulnerabilities into a visualization that is easy to understand and act on. With STIG, utility owners and operators have a common system for sharing threat intelligence information, thus increasing the chances of detecting and mitigating cyber exploits before they lead to a cyberattack.

24 POWER TRANSMISSION AND DISTRIBUTION↗