Results for “Risk Informed Decision Making” — Page 9

NASA NTRS2020

Ellicott City Disasters III: Building a Real-Time Statistical Flood Model for Improving Early Warning Systems in Ellicott City, Maryland

As flood events in the United States grow in frequency and intensity, the uses of applied remote sensing analyses are increasingly necessary for effective flood monitoring and warning systems. The NASA DEVELOP Ellicott City Disasters III project investigated the use of machine learning for applications in flood risk detection to support the improvement of early warning systems in Ellicott City, Maryland. To strengthen the efforts of the Howard County Office of Emergency Management (OEM) in building a more robust flood monitoring system, this term built on the predictive capability of the long-short term memory (LSTM) model created by the second term of this DEVELOP project to create a Sequentially Trained Real-time EstimAted Model (STREAM). Enhancements to the model included the integration of both real-time and predicted weather products from the National Weather Service to increase predictive capacity. These weather products were supplemented by stream gauge data from the OEM as well as real-time radar products. The resultant flood risk model was trained to evaluate input variables and predict stage height in Ellicott City in real time. The model, upgraded to predict stage height up to 8 hours in advance, was incorporated into an online dashboard in a user-friendly interface. The project demonstrated the potential for integration of open data and NASA Earth observations into a flood risk forecasting tool capable of informing real-time decision-making.

Erika Munshi↗

NASA NTRSDate not supplied

Building a Real-Time Predictive Flood Model for Improving Early Warning Systems in Ellicott City, Maryland

As flood events in the United States grow in frequency and intensity, the use of applied remote sensing analyses is increasingly necessary for effective flood monitoring and warning systems. The NASA DEVELOP National Program partnered with the Howard County government in Maryland to investigate the use of machine learning for advanced flood risk detection, and to test the feasibility of integrating this approach into the county’s flood early warning system. To strengthen the efforts of the Howard County Office of Emergency Management (OEM), the project developed a prediction model capable of hindcasting the two severe flash flood events that devastated Ellicott City, and transitioned to an Long Short-Term Memory (LSTM) based sequence-to-sequence deep learning model with 8-hour forecast capability. The team combined data inputs from public sources including river and precipitation gauges, NASA and NOAA Earth observations, and numerical weather model products using scripts written in the Google Colaboratory Python scripting environment. In addition to designing the deep learning architecture, the team trained and tested the model, and evaluated its performance using the Nash-Sutcliffe Efficiency (NSE). The final product, called the Sequentially Trained Real-time EstimAted Model (STREAM), predicts stage height for the Hudson Branch gauge in Ellicott City using data products available in near real-time, including the High-Resolution Rapid Refresh (HRRR) model’s accumulated precipitation forecasts supplemented by stream gauge data from the OEM and the U.S. Geological Survey. STREAM was incorporated into an online dashboard in a user-friendly interface capable of triggering the alarms that initiate the OEM’s emergency response protocols up to 8 hours in advance of a predicted severe flood event. The project demonstrated the potential for the integration of open data and Earth observations into a flood risk forecasting tool capable of informing near real-time decision making.

Ryan Hammock↗

NASA NTRS2019

Gateway Modeling and Simulation Plan

This plan institutes direction across the Gateway Program and the Element Projects to ensure that Cross Program M&S are produced in a manner that (1) generate the artifacts required for NASA-STD-7009 compliance, (2) ensures interoperability of M&S exchanged and integrated across the program and, (3) drives integrated development efforts to provide cross-domain integrated simulation of the Gateway elements, space environment, and operational scenarios. This direction is flowed down via contractual enforcement to prime contractors and includes both the GMS requirements specified in this plan and the NASASTD- 7009 derived requirements necessary for compliance. Grounding principles for management of Gateway Models and Simulations (M&S) are derived from the Columbia Accident Investigation Board (CAIB) report and the Diaz team report, “A Renewed Commitment to Excellence.” As an outcome of these reports, and in response to Action 4 of the Diaz team report, the NASA Standard for Models and Simulations, NASA-STD-7009 was developed. The standard establishes M&S requirements for development and use activities to ensure proper capture and communication of M&S pedigree and credibility information to Gateway program decision makers. Through the course of the Gateway program life cycle M&S will be heavily relied upon to conduct analysis, test products, support operations activities, enable informed decision making and ultimately to certify the Gateway with an acceptable level of risk to crew and mission. To reduce risk associated with M&S influenced decisions, this plan applies the NASA-STD-7009 requirements to produce the artifacts that support credibility assessments and ensure the information is communicated to program management.

NASA-STD-7009↗

DOE OSTI2022

1.3.3.402 - Cybersecurity Value-at-Risk Framework

The Cybersecurity Value-at-Risk Framework tool will guide users through an assessment and detailed analysis of a hydropower plant's operations. The tool will then provide results and data to inform effective cybersecurity investment decision-making and planning. The results will help managers understand the risk probability of cyberattacks on their facilities and how best to use resources to mitigate those risks.

cybersecurity↗

NASA NTRS2011

Empirical Tests of the Predicted Footprint for Uncontrolled Satellite Reentry Hazards

A number of statistical tools have been developed over the years for assessing the risk of reentering object to human populations. These tools make use of the characteristics (e.g., mass, material, shape, size) of debris that are predicted by aerothermal models to survive reentry. The statistical tools use this information to compute the probability that one or more of the surviving debris might hit a person on the ground and cause one or more casualties. The statistical portion of the analysis relies on a number of assumptions about how the debris footprint and the human population are distributed in latitude and longitude, and how to use that information to arrive at realistic risk numbers. Because this information is used in making policy and engineering decisions, it is important that these assumptions be tested using empirical data. This study uses the latest database of known uncontrolled reentry locations measured by the United States Department of Defense. The predicted ground footprint distributions of these objects are based on the theory that their orbits behave basically like simple Kepler orbits. However, there are a number of factors in the final stages of reentry - including the effects of gravitational harmonics, the effects of the Earth s equatorial bulge on the atmosphere, and the rotation of the Earth and atmosphere - that could cause them to diverge from simple Kepler orbit behavior and possibly change the probability of reentering over a given location. In this paper, the measured latitude and longitude distributions of these objects are directly compared with the predicted distributions, providing a fundamental empirical test of the model assumptions.

Matney, Mark↗

NASA NTRS2011

Statistical Issues for Uncontrolled Reentry Hazards Empirical Tests of the Predicted Footprint for Uncontrolled Satellite Reentry Hazards

A number of statistical tools have been developed over the years for assessing the risk of reentering objects to human populations. These tools make use of the characteristics (e.g., mass, material, shape, size) of debris that are predicted by aerothermal models to survive reentry. The statistical tools use this information to compute the probability that one or more of the surviving debris might hit a person on the ground and cause one or more casualties. The statistical portion of the analysis relies on a number of assumptions about how the debris footprint and the human population are distributed in latitude and longitude, and how to use that information to arrive at realistic risk numbers. Because this information is used in making policy and engineering decisions, it is important that these assumptions be tested using empirical data. This study uses the latest database of known uncontrolled reentry locations measured by the United States Department of Defense. The predicted ground footprint distributions of these objects are based on the theory that their orbits behave basically like simple Kepler orbits. However, there are a number of factors in the final stages of reentry - including the effects of gravitational harmonics, the effects of the Earth s equatorial bulge on the atmosphere, and the rotation of the Earth and atmosphere - that could cause them to diverge from simple Kepler orbit behavior and possibly change the probability of reentering over a given location. In this paper, the measured latitude and longitude distributions of these objects are directly compared with the predicted distributions, providing a fundamental empirical test of the model assumptions.

Matney, Mark↗

NASA NTRS2013

Geospatial Modeling of Asthma Population in Relation to Air Pollution

Current observations indicate that asthma is growing every year in the United States, specific reasons for this are not well understood. This study stems from an ongoing research effort to investigate the spatio-temporal behavior of asthma and its relatedness to air pollution. The association between environmental variables such as air quality and asthma related health issues over Mississippi State are investigated using Geographic Information Systems (GIS) tools and applications. Health data concerning asthma obtained from Mississippi State Department of Health (MSDH) for 9-year period of 2003-2011, and data of air pollutant concentrations (PM2.5) collected from USEPA web resources, and are analyzed geospatially to establish the impacts of air quality on human health specifically related to asthma. Disease mapping using geospatial techniques provides valuable insights into the spatial nature, variability, and association of asthma to air pollution. Asthma patient hospitalization data of Mississippi has been analyzed and mapped using quantitative Choropleth techniques in ArcGIS. Patients have been geocoded to their respective zip codes. Potential air pollutant sources of Interstate highways, Industries, and other land use data have been integrated in common geospatial platform to understand their adverse contribution on human health. Existing hospitals and emergency clinics are being injected into analysis to further understand their proximity and easy access to patient locations. At the current level of analysis and understanding, spatial distribution of Asthma is observed in the populations of Zip code regions in gulf coast, along the interstates of south, and in counties of Northeast Mississippi. It is also found that asthma is prevalent in most of the urban population. This GIS based project would be useful to make health risk assessment and provide information support to the administrators and decision makers for establishing satellite clinics in future.

Kethireddy, Swatantra R.↗

DOE OSTI2025

INTEGRATION OF DATA ANALYTICS WITH SYSTEM HEALTH PROGRAMS

Industry equipment reliability and asset management programs are essential elements that help ensure the safe and economical operation of nuclear power plants. The effectiveness of these programs is addressed in several industry developed and regulatory programs. However, these programs have proven to be labor intensive and expensive. There is an opportunity to significantly enhance the collection, analysis, and use of this information to provide more cost-effective plant operation. Additionally, there is an acute industry need to leverage advanced technology to reduce costs and improve operational effectiveness. The goal of this paper is to provide effective and efficient analytical methods and tools to support risk-informed decisions for the equipment reliability and asset management programs at nuclear power plants. This is accomplished by creating a direct bridge between component health/lifecycle data and decision making (e.g., maintenance scheduling and project prioritization). Here we are supporting typical system engineer decisions regarding maintenance activity scheduling and component ageing management. This is performed in a risk-informed context where herein the term “risk” is broadly constructed to include both plant reliability and economics. This framework combines data analytics tools to analyze equipment reliability data with risk-informed methods designed to support system engineer decisions (e.g., maintenance and replacement schedules, optimal maintenance posture) in a customizable workflow. A challenge is that the structure of this workflow strongly depends on the decision that needs to be made, the type of data available, and the constraints that need to be considered. Current methods are designed to provide specific answers to specific problems; however, these methods might prove to be inadequate even when problem settings slightly change (e.g., different types of requirements, additional dependencies between system reliability and economics). We tackled this challenge by designing framework in a flexible and modular fashion such that the user can assemble and customize his/her own workflow that integrates SSC economic lifecycle models (e.g., maintenance and replacement costs), system reliability models, and optimization methods.

97 - MATHEMATICS AND COMPUTING↗

NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek A Whitman↗

NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek Whitman↗

NASA NTRS2012

Bayesian Analysis for Risk Assessment of Selected Medical Events in Support of the Integrated Medical Model Effort

The Exploration Medical Capability project is creating a catalog of risk assessments using the Integrated Medical Model (IMM). The IMM is a software-based system intended to assist mission planners in preparing for spaceflight missions by helping them to make informed decisions about medical preparations and supplies needed for combating and treating various medical events using Probabilistic Risk Assessment. The objective is to use statistical analyses to inform the IMM decision tool with estimated probabilities of medical events occurring during an exploration mission. Because data regarding astronaut health are limited, Bayesian statistical analysis is used. Bayesian inference combines prior knowledge, such as data from the general U.S. population, the U.S. Submarine Force, or the analog astronaut population located at the NASA Johnson Space Center, with observed data for the medical condition of interest. The posterior results reflect the best evidence for specific medical events occurring in flight. Bayes theorem provides a formal mechanism for combining available observed data with data from similar studies to support the quantification process. The IMM team performed Bayesian updates on the following medical events: angina, appendicitis, atrial fibrillation, atrial flutter, dental abscess, dental caries, dental periodontal disease, gallstone disease, herpes zoster, renal stones, seizure, and stroke.

Gilkey, Kelly M.↗

NASA NTRS2018

An Integrated Platform for Mission Performance: Goddard Space Flight Center's Meta Information System

Successful management of NASA Goddard Space Flight Centers portfolio of mission projects (i.e. spacecraft, spacecraft instruments / subsystems, and ground systems) depends upon numerous processes, data and information resources coming together throughout the life-cycle of the projects to enable sound decision-making, risk reduction, conformance with requirements and continual improvement. In the summer of 2012, GSFC SMA management recognized that the set of legacy data systems used to support the SMA mission and responsibilities at GSFC were not effective, integrated nor on par with best practices. Accordingly, GSFC SMA management launched a project to transform the GSFC electronic management system to create and deploy an integrated, state-of-the-market information system for process performance, data management and analytics that is currently operating in support of GSFC overall mission performance. The information system, known as Meta, provides controlled, process-based applications, integrated data management, and analytics for a robust set of integrated applications. Since the inception of the project, a lean, award-winning SMA project team has thus far designed, configured and managed the system to serve as an integrated platform for 18 applications that support key processes for GSFC and the Science Mission Directorate at NASA headquarters, such as internal Management System assessments, Supplier Assessments, Supplier Research & Analysis, Problem Reporting for in-house mission projects, On-orbit Anomaly Reporting for GSFC-operated spacecraft, GSFC Project Life-Cycle Reviews, Risk Management and Reporting, and SMA Project Team Reporting. The system has experienced steady growth in utilization with 1,917 users (NASA employees and support contractor personnel) and 44 gigabytes of data and related files managed by the system as of the end of April 2018. Overall, Meta has achieved increasing levels of process management and real-time data / information integration to enable improved process performance, richer analytics and informed decision-making. This paper will present and examine the need, goals, approach and design driving the management and operation of the Meta information system and its ongoing growth as an integrated platform for advancing NASA mission performance.

Integration↗

NASA NTRSDate not supplied

Spaceflight Medical Evacuation Risk Assessment Principles - A Qualitative Investigation

BACKGROUND Future human space exploration beyond Low Earth Orbit (LEO) will require innovative solutions in many areas, primarily those that provide direct medical support to crew on long-duration missions and optimize their health and performance. The associated challenges therein will be numerous, including but not necessarily limited to extended one-way or "asynchronous" communication delays, minimal to non-existent resupply, and a prolonged transit time to "definitive care" ranging from 3-days to 9-months. At the same time, long-duration exploration spacecraft and crew will face restrictions on mass, power, volume, and data far more significant than that seen in current LEO settings. Given these limitations, medical risk assessment is of primary importance, especially evaluating the implications of a medical evacuation of an ill or injured crewmember. Such evacuations are complicated, potentially dangerous, and well may be impossible in certain phases of the mission. Regardless, such issues must be weighed against the risks of the injured crew remaining aboard a spacecraft with limited medical resources. OBJECTIVE This qualitative study drew from the experiences of subject matter experts (SMEs) in spaceflight and appropriate analog environments (i.e., military, disaster, and extreme environment fields) to identify unique principles common amongst medical evacuation considerations helpful in informing future risk assessment tools. Appropriate analog environments included austere operational settings where multiple factors (weather, logistics/limited resupply, denied/extreme environments, and patient condition) resulted in a limited ability to provide definitive local medical care. The fundamental principles in question revolved around scenarios where evacuation became a complicating yet necessary consideration and where life-threatening medical concerns had to be weighed against critical mission objective(s). The primary authors collected semi-structured data gathered through in-depth interviews with 16 subject matter experts (SMEs). Interview questions investigated how these SMEs consider and weigh the attendant risks present in medical evacuation scenarios. Among the critical questions posed were those that sought to understand how the SME balanced the challenges and requirements of medical evacuation (or keeping an injured patient "on-site" aka: "prolonged field care") against the evacuation operation's risks on impacting overarching mission success. The team analyzed interview transcripts for common themes and principles using the qualitative methods of thematic analysis based on consensus, co-occurrence, and comparison. As a result, nine primary risk consideration themes and nine contributing factor themes emerged, all of which will ideally inform future medical evacuation decision-making tools and operational decision-making for exploration class missions. Specific aims for this study included: 1. Identification of common principles used to assess risks and benefits of medical evacuations in extreme environments 2. Identification of common points of friction or complication and challenges in extreme environment evacuations

A T Almand↗

NASA NTRSDate not supplied

Modeling Logistics and Supportability for Crewed Missions Beyond Low Earth Orbit

NASA’s future missions aim to establish a sustained human presence on the lunar surface and send humans to Mars. These missions will send crews farther from home than previous missions, limiting the opportunities for resupply missions. Additionally, the use of multiple launches and reusable elements will increase mission and campaign complexity. Logistics and supportability analysis evaluates the link between mission and system characteristics and key metrics such as logistics and spares mass and volume, crew time, and risk. As missions become increasingly complex and crews are logistically isolated for longer periods of time, logistics and supportability will become more powerful drivers of risk and cost and, therefore, more important considerations during system and mission development. When logistics and supportability are considered from the beginning of system and mission development, opportunities arise to create more efficient, lower-risk systems. Design choices made without detailed consideration of logistics and supportability have the potential to result in greater risks and increased costs as all options may not have been analyzed. This paper provides an overview of a methodology used for space mission logistics and supportability analysis, including key metrics, assumptions, and required inputs. Example applications of this methodology to explore the impacts of system architecture, dormancy, and synergies between lunar and Mars missions are also presented. Conducting these holistic analyses enables informed decision-making for mission planning and system design, which can help mitigate the risk of loss of mission, vehicle, or crew. Using the knowledge of historical missions, experiences gained on the lunar surface, and logistics and supportability analyses, NASA can examine and optimize supportability characteristics for safer and more effective operations for future lunar and Mars missions.

Supportability↗

NASA NTRSDate not supplied

Modeling Logistics and Supportability for Crewed Missions Beyond Low Earth Orbit

NASA’s future missions aim to establish a sustained human presence on the lunar surface and send humans to Mars. These missions will send crews farther from home than previous missions, limiting the opportunities for resupply missions. Additionally, the use of multiple launches and reusable elements will increase mission and campaign complexity. Logistics and supportability analysis evaluates the link between mission and system characteristics and key metrics such as logistics and spares mass and volume, crew time, and risk. As missions become increasingly complex and crews are logistically isolated for longer periods of time, logistics and supportability will become more powerful drivers of risk and cost and, therefore, more important considerations during system and mission development. When logistics and supportability are considered from the beginning of system and mission development, opportunities arise to create more efficient, lower-risk systems. Design choices made without detailed consideration of logistics and supportability have the potential to result in greater risks and increased costs as all options may not have been analyzed. This paper provides an overview of a methodology used for space mission logistics and supportability analysis, including key metrics, assumptions, and required inputs. Example applications of this methodology to explore the impacts of system architecture, dormancy, and synergies between lunar and Mars missions are also presented. Conducting these holistic analyses enables informed decision-making for mission planning and system design, which can help mitigate the risk of loss of mission, vehicle, or crew. Using the knowledge of historical missions, experiences gained on the lunar surface, and logistics and supportability analyses, NASA can examine and optimize supportability characteristics for safer and more effective operations for future lunar and Mars missions.

Supportability↗

DOE OSTI2023

Hydropower Cybersecurity Value-at-Risk Framework

Hydropower remains one of the strongest forms of renewable energy generation methods. It is crucial to address the increasing risks associated with the rapid digitization. The push towards decarbonization also factors in the need to ensure security and resilience for grid-connected renewable energy resources. This report summarizes the U.S. Department of Energy's Water Power Technologies Office's effort to develop a cybersecurity valuation methodology that assists hydropower stakeholders in assessing risks associated with plan operations and gathers valuation guidance through a web-based application. The Hydropower Cybersecurity Value-at-Risk Framework delivers a platform for industry members to perform self-assessments and make informed decisions on their cybersecurity investments.

13 HYDRO ENERGY↗

DOE OSTI2022

A Cybersecurity Threat Profile for a Connected Lighting System

In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

A Cybersecurity Threat Profile for a Connected Lighting System

In anticipation of improved energy performance and cost savings, cities and building owners are increasingly considering “smart lighting initiatives” that aim to convert their collection of simple luminaires (i.e., lighting fixtures) into an intelligent connected lighting system (CLS) capable of remotely monitoring energy consumption and fault conditions, and possibly implementing adaptive lighting schemes. The U.S. Department of Energy (DOE) has set an national goal of tripling the energy efficiency and demand flexibility of the buildings sector by 2030, relative to 2020 levels 1. It is forecast that connected lighting systems can contribute to that goal by delivering 125 TWh of annual energy savings by 2035 2, equivalent to the annual output of 50 typical (500 MW) power plants. However, these energy savings and the DOE goal are put at significant risk if connected technologies are not adopted due to real or perceived cybersecurity concerns. Connected IoT devices such as these have historically been rife with vulnerabilities which sometimes put security considerations secondary to functionality and operability. What are the cybersecurity threats that will impact these systems, as formerly banal luminaires transition into intelligent connected devices that collect information about themselves, their surrounding environment, and possibly us? In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement. Fifty-seven threats were identified. Among our key findings: (1) 65% (37/57) of the threats did not involve the luminaires, but rather the other components needed to communicate with and manage them; (2) 63% (36/57) of the threats could have been mitigated through manufacturer-implemented defensive techniques or “controls”; and (3) 23% (13/57) of the threats were dependent on the network configuration. Recommendations based on the results of this work are made to key stakeholder groups. Notably, lighting technology developers are advised to address all threats that can be reasonably controlled with baked-in technology solutions (e.g., encryption or authentication controls), and employ some form of secure supply chain management and tracking where other parts (e.g., sensors, microprocessors) of a luminaire must also be built and manufactured with the proper security controls in place. Developers should also review threats involving assets not developed in-house to understand how connectivity with other devices will affect their product during system operation and determine if a compensating control for a defense-in-depth strategy will be needed. Finally, those interested in deploying CLS should compare the differences between cloud and on-premise models to determine which is more suitable for their needs and the abilities of their security team.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗