Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Computer security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,531 records · Page 85
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

CI-MOR Final Report: Analysis and Validation of Critical Infrastructure Models using Model Order Reduction

This report summarizes the research and capabilities developed as part of the project “Analysis and Validation of Critical Infrastructure Models using Model Order Reduction” (CI-MOR) LDRD project. CI-MOR research enables the solution of large, complex optimization models that naturally arise in national security challenges involving critical infrastructures. Specifically, CI-MOR researchers developed methods to (1) rigorously approximate complex, nonlinear optimization formulations, (2) identify alternative near-optimal solutions, (3) accelerate optimization workflows used for complex applications, and (4) rigorously integrate domain knowledge in stochastic-process models. This report provides an overview of the research done in CI-MOR, and we describe application exemplars used to illustrate CI-MOR capabilities. Furthermore, we describe the software developed by CI-MOR that researchers can leverage to analyze new applications.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Systems Engineering Approach for Design and Implementation of a Gas Breech for Actinide Experiments at the JASPER Facility

The Joint Actinide Shock Physics Experimental Research (JASPER) Facility is located approximately 65 miles north of Las Vegas, Nevada at the Nevada National Security Site (NNSS). The primary mission is to conduct shock physics research on actinide materials in support of NNSA’s Stockpile Stewardship Program. JASPER experiment uses a two-stage light gas gun to accelerate projectiles into targets at velocities up to 8 km/s (17,000 mph). The first stage uses an ignited propellent to drive a piston to compress gas in the pump tube. At the second stage, the gas compression exceeds a specified pressure and a rupture valve at the end of the pump tube opens. This launches a projectile to impact the target. The target is housed inside the target assembly and the debris field is contained inside the primary target chamber (PTC). The PTC is placed inside the secondary confinement chamber (SCC) as an added protection against possible contamination. These major components are illustrated in Figure 1.JASPER is capable of generating and measuring data on the properties of radioactive chemical elements at high shock pressures, temperatures, and strain rates approximating the conditions in nuclear weapons by using a two-stage gas gun. The data is used to determine material equations-of-state and validate computer models of material response. The work advances predictive capability, thus ensuring confidence in the nuclear stockpile.

42 ENGINEERING↗
NASA NTRS2005

Internet-Based System for Voice Communication With the ISS

The Internet Voice Distribution System (IVoDS) is a voice-communication system that comprises mainly computer hardware and software. The IVoDS was developed to supplement and eventually replace the Enhanced Voice Distribution System (EVoDS), which, heretofore, has constituted the terrestrial subsystem of a system for voice communications among crewmembers of the International Space Station (ISS), workers at the Payloads Operations Center at Marshall Space Flight Center, principal investigators at diverse locations who are responsible for specific payloads, and others. The IVoDS utilizes a communication infrastructure of NASA and NASArelated intranets in addition to, as its name suggests, the Internet. Whereas the EVoDS utilizes traditional circuitswitched telephony, the IVoDS is a packet-data system that utilizes a voice over Internet protocol (VOIP). Relative to the EVoDS, the IVoDS offers advantages of greater flexibility and lower cost for expansion and reconfiguration. The IVoDS is an extended version of a commercial Internet-based voice conferencing system that enables each user to participate in only one conference at a time. In the IVoDS, a user can receive audio from as many as eight conferences simultaneously while sending audio to one of them. The IVoDS also incorporates administrative controls, beyond those of the commercial system, that provide greater security and control of the capabilities and authorizations for talking and listening afforded to each user.

Chamberlain, James↗
DOE OSTI2023

Modbus RTU for Embedded Cyber Secure Inverter Controller

The Modbus communication protocol is a widely adopted communication standard in industrial control systems. This communication protocol is known for being reliable and straightforward to implement while being versatile in terms of its operating parameters while supporting multiple formats over various hardware infrastructures and architectures. Many intelligent devices such as Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), Internet-of-Things (IoT), and various Operational Technologies (OT) utilize Modbus for their communication systems. These types of systems must communicate with each other through a standardized and central communication process. To support the integration of these modular systems, a Field-Programmable Gate Array (FPGA) can act as an embedded central routing fabric for this communication to take place. Embedded systems are versatile enough to interface with various devices and systems to accomplish various goals. Additionally, embedded systems require relatively small physical designs to minimize the required resources to facilitate the intended application by providing low-level system access. This minimization of system resources goes hand in hand with reducing the financial cost of a proposed solution or system. As remotely collaborating researchers often use FPGAs to prototype designs that are required to have a method for data transmission among systems, it is imperative to provide a baseline standard for communications among devices and systems. A typical method of implementing the Modbus RTU communication protocol in an embedded environment is using integrated logic architectures within the FPGA called “Intellectual Property (IP) cores.” IP cores can be designed using integrated logic or circuit designs to function as an embedded processor. These IP cores can then perform the required computational actions to support the Modbus RTU communication protocol by utilizing high-level programming languages such as the C programming language. The hardware description language of Very High-Speed Integrated Circuit Hardware Description Language (VHDL) allows for the control of real hardware at the logic gate and signal level. These logic gates and signals can be designed and controlled to perform desired actions based on the system design. Programming an FPGA using VHDL allows an individual to access the lowest abstraction level of the system during FPGA development. This level of abstraction is referred to as the register-transfer level (RTL), which gives access to manipulating values and variables at the register level. This register-level manipulation provides precision over creating the logical circuit within the FPGA, thus minimizing the required code to perform desired operations. The Modbus RTU communication protocol can be implemented within an FPGA using VHDL programming to establish a standardized and embedded serial communication pathway. This implementation provides a standardized communication protocol to streamline research efforts among researchers, thus increasing the efficiency of research efforts. Additionally, this Modbus RTU implementation requires fewer resources when compared to typical communication protocol implementations that utilize an IP core, reducing the hardware requirement for effective research efforts.

communication↗
DOE OSTI2023

Probabilistic Multi-Hazard Performance Assessment of Concrete Structures in Nuclear Installations

Concrete structures in nuclear installations are subject to time-dependent degradation mechanisms that can deteriorate their physical and mechanical properties, potentially exacerbating the risk of structural failure under external forces such as a seismic event. Previous research has extensively investigated the seismic response of nuclear concrete structures and the associated risk, as well as their effect on structural components safety margins. However, substantial work is still necessary to incorporate concrete aging effects into such evaluations. In fact, most models in the literature assume pristine concrete conditions and do not account for the impact of aging on the structural components’ fragility curves. This work identifies relevant time-dependent degradation mechanisms and provides simplified models to predict the the evolution of key material properties based on data from the literature. Namely, this work focuses on the aging effects of corrosion, alkali–silica reaction (ASR), and irradiation on reinforced concrete within US Department of Energy (DOE) nuclear facilities and nuclear power plants (NPP) structures. Furthermore, degradation models based on literature data are presented that define the relationship between probabilistic material properties and the concrete’s age. In this work, sampled material properties served as input for a simplified finite element model (FEM) of a critical nuclear structural system, with the output of the FEM being the seismic response for a given ground motion. The results of the FEM were then used within a probabilistic performance assessment with a statistically significant number of samples. The research presented herein addresses the detrimental effects of hazards caused by natural phenomena on deteriorated concrete elements of nuclear installations. This work directly benefits the safety analysis performed on US DOE/ National Nuclear Security Administration (NNSA) nuclear facilities located in areas prone to seismic activity. The results presented herein could aid in the improvement of DOE-STD-1020, the DOE Standard that addresses seismic risk analysis and capacity evaluation in DOE facilities. DOE-STD-1020 refers to the requirements in American Society of Civil Engineers (ASCE) 4-98, now superseded by ASCE 4-16, that shall be met in performing dynamic response analyses and generating in-structure response spectra, provided that such requirements are consistent with the requirements of ASCE/Structural Engineering Institute (SEI) 43-05. Moreover, the results presented herein could also aid in the updating of section C3.1.1. of ASCE 4-16 to account for the effects of aging on the stiffness of reinforced elements and American Concrete Institute (ACI) 349.3R-18, “Report on Evaluation and Repair of Existing Nuclear Safety-Related Concrete Structures.” Ultimately, this work can assist the risk assessment of potential lifetime extension of the existing US commercial nuclear fleet (light water reactors) and the safety analysis of the emerging advanced nuclear reactors. The proposed proof-of-concept methodology employs open-source DOE computational tools and is transferable to commercial software commonly used by engineering firms.

42 ENGINEERING↗
NASA NTRS2002

A Virtual Mission Operations Center: Collaborative Environment

The Virtual Mission Operations Center - Collaborative Environment (VMOC-CE) intent is to have a central access point for all the resources used in a collaborative mission operations environment to assist mission operators in communicating on-site and off-site in the investigation and resolution of anomalies. It is a framework that as a minimum incorporates online chat, realtime file sharing and remote application sharing components in one central location. The use of a collaborative environment in mission operations opens up the possibilities for a central framework for other project members to access and interact with mission operations staff remotely. The goal of the Virtual Mission Operations Center (VMOC) Project is to identify, develop, and infuse technology to enable mission control by on-call personnel in geographically dispersed locations. In order to achieve this goal, the following capabilities are needed: Autonomous mission control systems Automated systems to contact on-call personnel Synthesis and presentation of mission control status and history information Desktop tools for data and situation analysis Secure mechanism for remote collaboration commanding Collaborative environment for remote cooperative work The VMOC-CE is a collaborative environment that facilitates remote cooperative work. It is an application instance of the Virtual System Design Environment (VSDE), developed by NASA Goddard Space Flight Center's (GSFC) Systems Engineering Services & Advanced Concepts (SESAC) Branch. The VSDE is a web-based portal that includes a knowledge repository and collaborative environment to serve science and engineering teams in product development. It is a "one stop shop" for product design, providing users real-time access to product development data, engineering and management tools, and relevant design specifications and resources through the Internet. The initial focus of the VSDE has been to serve teams working in the early portion of the system/product lifecycle - concept development, proposal preparation, and formulation. The VMOC-CE expands the application of the VSDE into the operations portion of the system lifecycle. It will enable meaningful and real-time collaboration regardless of the geographical distribution of project team members. Team members will be able to interact in satellite operations, specifically for resolving anomalies, through access to a desktop computer and the Internet. Mission Operations Management will be able to participate and monitor up to the minute status of anomalies or other mission operations issues. In this paper we present the VMOC-CE project, system capabilities, and technologies.

Medina, Barbara↗
DOE OSTI2021

America Resilient Climate Conference

On April 14, 2021, scientists, policymakers, and other interested parties from research institutes, academia, and other organizations gathered together virtually at the America Resilient Climate Conference to discuss one of the most pressing challenges of the 21st century: building resilience to climate change. Climate change affects the security and health of all Americans. Coastal areas are enduring more frequent and severe flooding due to sea level rise and storm surge; western states and Alaska have experienced increasingly devastating wildfires, driven in part by hotter, drier, and longer fire seasons; and communities across the nation have suffered through extreme precipitation events and heat waves. Even if emissions are reduced aggressively in the near future, the world—and the United States—will continue to feel the impacts of climate change for decades to come, due to the continued accumulation of greenhouse gasses in the atmosphere. Consequently, it is essential to act now to protect natural and human assets from the gradual—as well as extreme—impacts of a changing climate. To build resilient communities, leaders and community members need science-based information about the potential impacts climate change will have decades into the future and for specific regions. Therefore, it is essential to develop high-resolution climate models that can project both various climate impacts and the interactions between earth system variables and humans down to regional and local scales. Collecting and curating data for such models and their computational requirements poses large challenges. In the future, artificial intelligence will be needed to increase their accuracy and reduce associated uncertainties. The investments in Earth system science and artificial intelligence made by the U.S. Department of Energy and other federal entities will be essential in addressing these challenges.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

Distributed Energy Resource Cybersecurity Framework and Cyber Range Integration

Distributed energy resource (DER) systems feature complex, data-driven communications networks that require careful system coordination and constant vigilance to ensure that grid assets are secure. Because DERs are an important component of the decarbonization strategy, agencies need to secure energy data that could implicate issues of national security if compromised. To help federal energy managers assess, monitor, and manage cybersecurity while achieving decarbonization, the National Renewable Energy Laboratory's (NREL's) Distributed Energy Resource Cybersecurity Framework (DER-CF) offers a comprehensive, web-based assessment tool focusing on cyber governance or policies, technical management, and physical security. The DER-CF currently presents users with a series of pertinent cybersecurity questions that are used to generate a site-specific report and recommendations. This paper outlines a plan to integrate the DER-CF with another key asset-NREL's cyber range-to visualize cybersecurity resilience and compliance and to enhance the usability and accessibility of the DER-CF for federal facility energy managers and planners. This integration will result in a visualization environment to interpret and interact with compliance data. Its development will include regular conversations with stakeholders to assess the effectiveness of these efforts, refine the visualization capability, and ensure its value to our partners.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Real-time time-dependent density functional theory in Quantum Espresso and related codes

A set of subroutines that interact with an existing computer program, Quantum Espresso (QE), that takes a set of electronic orbitals from QE and propagates them forward in time in response to a number of perturbations. These perturbations include the motion of ions and a wide spectrum of applied electromagnetic fields (e.g., static magnetic fields, slowly-varying electric fields, x-rays, etc.). From the time evolution of the electronic orbitals comes time-varying values of physical observables like the electronic charge and current densities and atomic forces. These are further post-processed to yield properties of interest like stopping powers, conductivities, and the dynamic structure factor. The electronic orbitals are described in a plane wave basis and the equations of motion are carried out using a unitary or approximately unitary time propagation algorithm. Related work will include subroutines for interfacing this capability, as well as others that already exist within QE, with a fork of QE that is more extensible and modular.SAND2019-12611 M Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy's National Nuclear Security Administration under contract DE-NA0003525.

Baczewski, Andrew↗
DOE OSTI2020

Extreme Scale Infrasound Inversion and Prediction for Weather Characterization and Acute Event Detection

Accurate and timely weather predictions are critical to many aspects of society with a profound impact on our economy, general well-being, and national security. In particular, our ability to forecast severe weather systems is necessary to avoid injuries and fatalities, but also important to minimize infrastructure damage and maximize mitigation strategies. The weather community has developed a range of sophisticated numerical models that are executed at various spatial and temporal scales in an attempt to issue global, regional, and local forecasts in pseudo real time. The accuracy however depends on the time period of the forecast, the nonlinearities of the dynamics, and the target spatial resolution. Significant uncertainties plague these predictions including errors in initial conditions, material properties, data, and model approximations. To address these shortcomings, a continuous data collection occurs at an effort level that is even larger than the modeling process. It has been demonstrated that the accuracy of the predictions depends on the quality of the data and is independent to a certain extent on the sophistication of the numerical models. Data assimilation has become one of the more critical steps in the overall weather prediction business and consequently substantial improvements in the quality of the data would have transformational benefits. This paper describes the use of infrasound inversion technology, enabled through exascale computing, that could potentially achieve orders of magnitude improvement in data quality and therefore transform weather predictions with significant impact on many aspects of our society.

58 GEOSCIENCES↗
DOE OSTI2022

Distributed Energy Resource Cybersecurity Standards Development [Final Report]

Currently, the solar industry is operating with little application-specific guidance on how to protect and defend their systems from cyberattacks. This 3-year Department of Energy (DOE) Solar Energy Technologies Office-funded project helped advance the distributed energy resource (DER) cybersecurity state-of-the-art by (a) bolstering industry awareness of cybersecurity concepts, risks, and solutions through a webinar series and (b) developing recommendations for DER cybersecurity standards to improve the security performance of DER products and networks. Drafting DER standards is a lengthy, consensus-based process requiring effective leadership and stakeholder participation. This project was designed to reduce standard and guide writing times by creating well-researched recommendations that could act as a starting place for national and international standards development organizations. Working within the SunSpec/Sandia DER Cybersecurity Workgroup, the team produced guidance for DER cybersecurity certification, communication protocol standards, network architecture s, access control, and patching. The team also led subgroups within the IEEE P 1547.3 Guide for Cybersecurity of Distributed Energy Resources Interconnected with Electric Power Systems committee and pushed a draft to ballot in October 2021.

14 SOLAR ENERGY↗
NASA NTRS1983

Autonomy and the human element in space

NASA is contemplating the next logical step in the U.S. space program - the permanent presence of humans in space. As currently envisioned, the initial system, planned for the early 1990's, will consist of manned and unmanned platforms situated primarily in low Earth orbit. The manned component will most likely be inhabited by 6-8 crew members performing a variety of tasks such as materials processing, satellite servicing, and life science experiments. The station thus has utility in scientific and commercial enterprises, in national security, and in the development of advanced space technology. The technical foundations for this next step have been firmly established as a result of unmanned spacecraft missions to other planets, the Apollo program, and Skylab. With the shuttle, NASA inaugurates a new era of frequent flights and more routine space operations supporting a larger variety of missions. A permanently manned space system will enable NASA to expand the scope of its activities still further. Since NASA' s inception there has been an intense debate over the relative merits of manned and unmanned space systems. Despite the generally higher costs associated with manned components, astronauts have accomplished numerous essential, complex tasks in space. The unique human talent to evaluate and respond inventively to unanticipated events has been crucial in many missions, and the presence of crews has helped arouse and sustain public interest in the space program. On the other hand, the hostile orbital environment affects astronaut physiology and productivity, is dangerous, and mandates extensive support systems. Safety and cost factors require the entire station complex, both space and ground components, to be highly automated to free people from mundane operational chores. Recent advances in computer technology, artificial intelligence (AI), and robotics have the potential to greatly extend space station operations, offering lower costs and superior productivity. Extended operations can in turn enhance critical technologies and contribute to the competitive economic abilities of the United States. A high degree of automation and autonomy may be required to reduce dependence on ground systems, reduce mission costs, diminish complexity as perceived by the crew, increase mission lifetime and expand mission versatility. However, technologies dealing with heavily automated, long duration habitable spacecraft have not yet been thoroughly investigated by NASA. A highly automated station must amalgamate the diverse capabilities of people, machines, and computers to yield an efficient system which capitalizes on unique human characteristics. The station also must have an initial design which allows evolution to a larger and more sophisticated space presence. In the early years it is likely that AI-based subsystems will be used primarily in an advisory or planning capacity. As human confidence in automated systems grows and as technology advances, machines will take on more critical and interdependent roles. The question is whether, and how much, system autonomy will lead to improved station effectiveness.

Source record↗
DOE OSTI2021

Inventory Management Improvement Project

The Lawrence Livermore National Laboratory (LLNL) conducts research and development for the National Nuclear Security Agency (NNSA) and its affiliates. The Polymer AM team at LLNL conducts research and development in 3D printing, specifically direct-ink-write, in accordance with LLNL and NNSA missions. The team is composed of machine operators, chemists, testing engineers, and project engineers across multiple lab spaces with one shared storage area at LLNL. The operations use a variety of different consumables and hardware to conduct research applications for LLNL and NNSA. These items are critical to performing operation tasks; if an item is out of stock, operations associated with the respective item could be suspended for weeks. As such, the Polymer AM team manages an inventory of spare consumables and hardware to ensure these items are always available. However, the current management system, an excel sheet managed by the project engineer group, is not intuitive in providing inventory information despite the high labor utilization needed to maintain the system. As such, the team is looking to improve their inventory management that can send notifications regarding inventory needs, accessible to other team members, provide all relevant information to a specific item, and store historical information for budget and operation planning. The proposed solution is a Computer Maintenance Management System (CMMS): a web-based management software that stores inventory information and provides automated notifications. The system will store information on each item including quantity in stock, technical information, supplier information, costs, lead times, and expiration date. The system has a notifications function that can send notifications to the respective team member’s when an item needs to be counted, item inventory is low, or an item is approaching their expiration date. Information for each item can be tracked over time creating data to be used for budget planning and process improvement purposes. Due to its web-based source, the system can be accessed by the respective team member viewing technical information, quantity, and purchasing information.

42 ENGINEERING↗
DOE OSTI2020

Quantifying Graph Uncertainty from Communication Data

Graphs are a widely used abstraction for representing a variety of important real-world problems including emulating cyber networks for situational awareness, or studying social networks to understand human interactions or pandemic spread. Communication data is often converted into graphs to help understand social and technical patterns in the underlying communication data. However, prior to this project, little work had been performed analyzing how best to develop graphs from such data. Thus, many critical, national security problems were being performed against graph representations of questionable quality. Herein, we describe our analyses that were precursors to our final statistically grounded technique for creating static graph snapshots from a stream of communication events. The first analyzes the statistical distribution properties of a variety of real-world communication datasets generally fit best by Pareto, log normal, and extreme value distributions. The second derives graph properties that can be estimated given the expected statistical distribution for communication events and the communication interval to be viewed node observability, edge observability, and expected accuracy of node degree. Unfortunately, as that final process is under review for publication, we can't publish it here at this time.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Securing against malicious control of circuit breakers in electrical substations

An example method for detecting and mitigating attacks on electric power substations comprises detecting a command to open or close a circuit breaker in the electric power substation. A modified extended substation model for the electric power substation is generated, based on the detected command and based on measurements in substation, where the modified extended substation model is a power flow model for the substation and for one or more directly connected neighboring substations. A power flow analysis is performed, using the modified extended substation model, to generate a predicted voltage for each of a plurality of nodes in the substation and in the one or more directly connected neighboring substations. Each predicted voltage is compared to a corresponding allowable voltage range, and execution of the command is blocked in response to determining that one or more of the voltages is outside the corresponding allowable voltage range.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Arctic Critical Infrastructure: Assessing and Predicting the Risk to Critical Permafrost Infrastructure from Climate Change: A New Thermomechanical Approach

This study presents the development of a computational framework designed to predict the interaction between permafrost and infrastructure, addressing potential failure modes and mitigation strategies in the context of climate change. The framework, rooted in advanced modeling and simulation (mod/sim) techniques, integrates thermomechanical coupling to account for the complex interplay between heat flow, ice content, and mechanical behavior in permafrost. Existing models fail to fully capture these dynamics, particularly as they relate to the effects of ice saturation on structural integrity. Our innovative Arctic Coastal Erosion (ACE) framework fills this gap by coupling thermal and mechanical models to accurately simulate subsidence and deformation in permafrost environments. We applied the ACE framework to a representative runway, demonstrating its capability to predict settlement due to rising temperatures and subsequent permafrost thaw. This proof-of-concept showcases the potential of the framework to evaluate risks to Arctic infrastructure, which supports over four million people and 70% of existing permafrost-based structures. By simulating various infrastructure types and environmental conditions, our research offers insights into failure mechanisms and evaluates structural solutions to mitigate risk. The anticipated deliverables, including a prototype runway exemplar, position this project as a critical advancement in permafrost infrastructure modeling, with applications in national security and resilience planning.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2023

Requirements and Recommendations for a Physical Attack Characterization Framework

This study seeks to identify existing frameworks or develop requirements and recommendations for a new framework that can consistently characterize physical attacks, analogous to MITRE ATT&CK®. MITRE ATT&CK is widely used across government, research organizations, and the cyber security community to characterize cyber attack tactics, techniques, and procedures (TTPs) in a consistent and commonly understood manner. While physical attack taxonomies, methodologies, and other tools for evaluating physical security do exist, many are sector and/or facility-type specific—and therefore not able to provide comparable scenarios across sectors—or are more focused on security assessment instead of the characterization of attacks themselves. A MITRE ATT&CK analog for physical attacks on critical infrastructure would provide a common language and structure for analysis of physical attacks. Existing attack characterization methodologies do not robustly address cyber-physical security risks. To fully understand a facility’s security needs, it is important to understand the entire vulnerability landscape from both a physical and a cyber perspective. To underscore this need, organizations such as the Cybersecurity and Infrastructure Security Agency (CISA) are calling for a coordinated approach to cyber and physical security, which they refer to as cyber and physical security convergence. A physical attack characterization framework that could be used jointly with MITRE ATT&CK would help support a more robust analysis in support of convergence, enabling the consistent characterization of attacks that utilize both cyber and physical tactics and techniques. This could provide analysts and stakeholders with a clearer understanding of how security mitigations deployed in the physical realm impact security risks in the cyber realm, and vice versa. In this study, the project team evaluates existing physical security taxonomies and methodologies to assess whether an existing method can be used to create a “physical half” of MITRE ATT&CK. This study then provides requirements and recommendations for a framework that can leverage aspects of existing methodologies. The goal of the final framework is for it to be widely adopted and referenced, regardless of critical infrastructure sector, facility type, or facility components. This study also identifies applicable use cases for when and how a framework could be applied across the various critical infrastructure sectors for a variety of attack types or motivations. Through a literature review of existing security-focused methodologies and taxonomies, engagement with relative stakeholders, evaluation of potential physical attack framework use cases, and subsequent identification of requirements, this study identified the following key findings and recommendations: There is a need for a new physical attack characterization framework; A physical attack framework should be interoperable with the MITRE ATT&CK framework; A physical attack framework should be broadly applicable, but with detailed tactics, techniques, and procedures that encompass the entire attack path; A physical attack framework should be based on observed or feasible events; A physical attack framework should adapt features from existing methodologies, frameworks, and taxonomies; A physical attack framework should be owned, overseen, and maintained by one organization.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2024

Integrity Enhancing Protocols: Performance and Recommendations for Nuclear Systems

In today’s communication landscape there are multiple technologies and protocols used for communication between end devices. Within security paradigms for these protocols, integrity management is a common goal of system designers. Communication protocols focused on maintaining message integrity can provide assurance that some received data has not been altered or tampered with. While integrity is often coupled with confidentiality in protocol design, this analysis focuses on an evaluation of only integrity protocols. This report outlines various ways message integrity may be preserved with respect to high performance operational technology (OT) systems. It describes a series of experiments and an evaluation framework used to evaluate the performance of the identified integrity approaches regarding common system design goals. Finally, it addresses the testing environment utilized and closes the report with a summary of experimental results.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗