SEARCH · Engineering Papers

Results for “Vulnerability management”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records

All sources NASA NTRS DOE OSTI

NASA NTRS2016

Cyber Security for the Spaceport Command and Control System: Vulnerability Management and Compliance Analysis

With the rapid development of the Internet, the number of malicious threats to organizations is continually increasing. In June of 2015, the United States Office of Personnel Management (OPM) had a data breach resulting in the compromise of millions of government employee records. The National Aeronautics and Space Administration (NASA) is not exempt from these attacks. Cyber security is becoming a critical facet to the discussion of moving forward with projects. The Spaceport Command and Control System (SCCS) project at the Kennedy Space Center (KSC) aims to develop the launch control system for the next generation launch vehicle in the coming decades. There are many ways to increase the security of the network it uses, from vulnerability management to ensuring operating system images are compliant with securely configured baselines recommended by the United States Government.

Cyber Security↗

NASA NTRS2001

Managing a Vulnerability Testing Program

A good vulnerability testing program can help reduce system compromises, provide a way of assessing and measuring improvements in security, and motivate everyone to get involved.

Ray, John↗

NASA NTRS2000

Failure Modes and Effects Analysis (FMEA): A Bibliography

Failure modes and effects analysis (FMEA) is a bottom-up analytical process that identifies process hazards, which helps managers understand vulnerabilities of systems, as well as assess and mitigate risk. It is one of several engineering tools and techniques available to program and project managers aimed at increasing the likelihood of safe and successful NASA programs and missions. This bibliography references 465 documents in the NASA STI Database that contain the major concepts, failure modes or failure analysis, in either the basic index of the major subject terms.

Source record↗

NASA NTRS2017

Synthetic Scenarios from CMIP5 Model Simulations for Climate Change Impact Assessments in Managed Ecosystems and Water Resources: Case Study in South Asian Countries

Increasing population, urbanization, and associated demand for food production compounded by climate change and variability have important implications for the managed ecosystems and water resources of a region. This is particularly true for south Asia, which supports one quarter of the global population, half of whom live below the poverty line. This region is largely dependent on monsoon precipitation for water. Given the limited resources of the developing countries in this region, the objective of our study was to empirically explore climate change in south Asia up to the year 2099 using monthly simulations from 35 global climate models (GCMs) participating in the fifth phase of the Climate Model Inter-comparison Project (CMIP5) for two future emission scenarios (representative concentration pathways RCP4.5 and RCP8.5) and provide a wide range of potential climate change outcomes. This was carried out using a three-step procedure: calculating the mean annual, monsoon, and non-monsoon precipitation and temperatures; estimating the percent change from historical conditions; and developing scenario funnels and synthetic scenarios. This methodology was applied for the entire south Asia region; however, the percent change information generated at 1.5deg grid scale can be used to generate scenarios at finer spatial scales. Our results showed a high variability in the future change in precipitation (-23% to 52%, maximum in the non-monsoon season) and temperature (0.8% to 2.1%) in the region. Temperatures in the region consistently increased, especially in the Himalayan region, which could have impacts including a faster retreat of glaciers and increased floods. It could also change rivers from perennial to seasonal, leading to significant challenges in water management. Increasing temperatures could further stress groundwater reservoirs, leading to withdrawal rates that become even more unsustainable. The high precipitation variability (with higher propensity for localized intense rainfall events) observed in the region can be a key factor for managed ecosystems and water management and could also lead to more incidence of severe urban flooding. The results could be used to assess both mitigation and adaptation alternatives to reduce vulnerabilities in managed ecosystems (agricultural and urban) and water resources.

agriculture↗

NASA NTRS2019

The Role of Alerting System Failures in Loss of Control Accidents CAST SE-210 Output 2

This report is part of a series of reports that address flight deck design and evaluation, written as a response to loss of control accidents. In particular, this activity is directed at failures in airplane state awareness in which the pilot loses awareness of the airplane's energy state or attitude and enters an upset condition. In a report by the Commercial Aviation Safety Team, an analysis of accidents and incidents related to loss of airplane state awareness determined that hazard alerting was not effective in producing the appropriate pilot response to a hazard (CAST, 2014). In the current report, we take a detailed look at 28 airplane state awareness accidents and incidents to determine how well the hazard alerting worked. We describe a five-step integrated alerting-to-recovery sequence that prescribes how hazard alerting should lead to effective flight crew actions for managing the hazard. Then, for each hazard in each of the 28 events, we determine if that sequence failed and, if so, how it failed. The results show that there was an alerting failure in every one of the 28 safety events, and that the most frequent failure (20/28) was tied to the flight crew not orienting to (not being aware of) the hazard. The discussion section summarizes findings and identifies alerting issues that are being addressed and issues that are not currently being addressed. We identify a few recent upgrades that have addressed certain alerting failures. Two of these upgrades address alerting design, but one response to the safety events is to upgrade training for approach to stall and stall recovery. We also describe issues that are not being addressed adequately: better alert integration for flight path management types of hazards, airplanes in the fleet that do not meet the current alerting regulations, a lack of innovation for addressing cases of channelized attention, and existing vulnerabilities in managing data validity.

aviation safety↗

NASA NTRS2021

Storm Surge and Ponding Explain Mangrove Dieback in Southwest Florida Following Hurricane Irma

Mangroves buffer inland ecosystems from hurricane winds and storm surge. However, their ability to withstand harsh cyclone conditions depends on plant resilience traits and geomorphology. Using airborne lidar and satellite imagery collected before and after Hurricane Irma, we estimated that 62% of mangroves in southwest Florida suffered canopy damage, with largest impacts in tall forests (>10 m). Mangroves on well-drained sites (83%) resprouted new leaves within one year after the storm. By contrast, in poorly-drained inland sites, we detected one of the largest mangrove diebacks on record (10,760 ha), triggered by Irma. We found evidence that the combination of low elevation (median = 9.4 cm asl), storm surge water levels (>1.4 m above the ground surface), and hydrologic isolation drove coastal forest vulnerability and were independent of tree height or wind exposure. Our results indicated that storm surge and ponding caused dieback, not wind. Tidal restoration and hydrologic management in these vulnerable, low-lying coastal areas can reduce mangrove mortality and improve resilience to future cyclones.

David Lagomasino↗

NASA NTRS2005

The Hurricane-Flood-Landslide Continuum

In August 2004, representatives from NOAA, NASA, the USGS, and other government agencies convened in San Juan, Puerto Rim for a workshop to discuss a proposed research project called the Hurricane-Flood-Landslide Continuum (HFLC). The essence of the HFLC is to develop and integrate tools across disciplines to enable the issuance of regional guidance products for floods and landslides associated with major tropical rain systems, with sufficient lead time that local emergency managers can protect vulnerable populations and infrastructure. All three lead agencies are independently developing precipitation-flood-debris flow forecasting technologies, and all have a history of work on natural hazards both domestically and overseas. NOM has the capability to provide tracking and prediction of storm rainfall, trajectory and landfall and is developing flood probability and magnTtude capabilities. The USGS has the capability to evaluate the ambient stability of natural and man-made landforms, to assess landslide susceptibilities for those landforms, and to establish probabilities for initiation of landslides and debris flows. Additionally, the USGS has well-developed operational capacity for real-time monitoring and reporting of streamflow across distributed networks of automated gaging stations (http://water.usgs.gov/waterwatch/). NASA has the capability to provide sophisticated algorithms for satellite remote sensing of precipitation, land use, and in the future, soil moisture. The Workshop sought to initiate discussion among three agencies regarding their specific and highly complimentary capabilities. The fundamental goal of the Workshop was to establish a framework that will leverage the strengths of each agency. Once a prototype system is developed for example, in relatively data-rich Puerto Rim, it could be adapted for use in data-poor, low-infrastructure regions such as the Dominican Republic or Haiti. This paper provides an overview of the Workshop s goals, presentations and recommendations with respect to the development of the HFLC.

Negri, Andrew J.↗

NASA NTRS2021

Bias Correction of Hydrologic Projections Strongly Impacts Inferred Climate Vulnerabilities in Institutionally Complex Water Systems

Water-resources planners use regional water management models (WMMs) to identify vulnerabilities to climate change. Frequently, dynamically downscaled climate inputs are used in conjunction with land-surface models (LSMs) to provide hydrologic streamflow projections, which serve as critical inputs for WMMs. Here, we show how even modest projection errors can strongly affect assessments of water availability and financial stability for irrigation districts in California. Specifically, our results highlight that LSM errors in projections of flood and drought extremes are highly interactive across timescales, path-dependent, and can be amplified when modeling infrastructure systems (e.g., misrepresenting banked groundwater). Common strategies for reducing errors in deterministic LSM hydrologic projections (e.g., bias correction) can themselves strongly distort projected climate vulnerabilities and misrepresent their inferred financial consequences. Overall, our results indicate a need to move beyond standard deterministic climate projection and error management frameworks that are dependent on single simulated climate change scenario outcomes.

Keyvan Malek↗

NASA NTRS1987

The hack attack - Increasing computer system awareness of vulnerability threats

The paper discusses the issue of electronic vulnerability of computer based systems supporting NASA Goddard Space Flight Center (GSFC) by unauthorized users. To test the security of the system and increase security awareness, NYMA, Inc. employed computer 'hackers' to attempt to infiltrate the system(s) under controlled conditions. Penetration procedures, methods, and descriptions are detailed in the paper. The procedure increased the security consciousness of GSFC management to the electronic vulnerability of the system(s).

Quann, John↗

NASA NTRS2013

Toward Global Drought Early Warning Capability - Expanding International Cooperation for the Development of a Framework for Monitoring and Forecasting

Drought has had a significant impact on civilization throughout history in terms of reductions in agricultural productivity, potable water supply, and economic activity, and in extreme cases this has led to famine. Every continent has semiarid areas, which are especially vulnerable to drought. The Intergovernmental Panel on Climate Change has noted that average annual river runoff and water availability are projected to decrease by 10 percent-13 percent over some dry and semiarid regions in mid and low latitudes, increasing the frequency, intensity, and duration of drought, along with its associated impacts. The sheer magnitude of the problem demands efforts to reduce vulnerability to drought by moving away from the reactive, crisis management approach of the past toward a more proactive, risk management approach that is centered on reducing vulnerability to drought as much as possible while providing early warning of evolving drought conditions and possible impacts. Many countries, unfortunately, do not have adequate resources to provide early warning, but require outside support to provide the necessary early warning information for risk management. Furthermore, in an interconnected world, the need for information on a global scale is crucial for understanding the prospect of declines in agricultural productivity and associated impacts on food prices, food security, and potential for civil conflict. This paper highlights the recent progress made toward a Global Drought Early Warning Monitoring Framework (GDEWF), an underlying partnership and framework, along with its Global Drought Early Warning System (GDEWS), which is its interoperable information system, and the organizations that have begun working together to make it a reality. The GDEWF aims to improve existing regional and national drought monitoring and forecasting capabilities by adding a global component, facilitating continental monitoring and forecasting (where lacking), and improving these tools at various scales, thereby increasing the capacity of national and regional institutions that lack drought early warning systems or complementing existing ones. A further goal is to improve coordination of information delivery for drought-related activities and relief efforts across the world. This is especially relevant for regions and nations with low capacity for drought early warning. To do this requires a global partnership that leverages the resources necessary and develops capabilities at the global level, such as global drought forecasting combined with early warning tools, global real-time monitoring, and harmonized methods to identify critical areas vulnerable to drought. Although the path to a fully functional GDEWS is challenging, multiple partners and organizations within the drought, forecasting, agricultural, and water-cycle communities are committed to working toward its success.

GDEWS↗

NASA NTRS2023

Youngstown and Warren Disasters: Mapping Flood Susceptibility, Vulnerability, and Risk and Tree Canopy Coverage in Northern Ohio to Inform Stormwater Management and Flood Mitigation Efforts

Both pluvial and fluvial flooding events pose direct challenges on urban infrastructure and communities across the United States. Heavy rainfall events oversaturate the ground, overflow waterbodies, and overwhelm stormwater infrastructure. Vulnerable areas receive heavy damage from flooding events due to physical factors like increased impervious surfaces, poor stormwater systems, and limited greenspaces. These vulnerable neighborhoods are comprised of aging populations, minority communities, and lower income levels. Lack of data in these communities have made it difficult to implement policymaking and flood mitigation strategies. Using the Urban Flood Risk Mitigation model (InVEST) and the PlanetScope satellite constellation, the team visualized historical flooding and tree canopy coverage as a measure of flood susceptibility. The team also used the Arc-Malstrom model to provide further insight into where flooding accumulates via surface elevation depressions in the study area. To validate these models, the team explored the spatial variation of rainfall events using NASA’s Integrated Multi-satellite Retrievals for Global Precipitation Measurement (GPM IMERG). The resulting maps highlight areas surrounding the cities of Youngstown and Warren as being the most flood susceptible and socially vulnerable, while the city centers contain the lowest tree canopy coverage. The DEVELOP team collaborated with the Environmental Collaborative of Ohio (ECO) to create products for end users within the City of Warren’s Water Pollution Control Department, the Eastgate Regional Council of Governments and the Healthy Community Partnership of Mahoning Valley. These products help identify target areas for preventative flood mitigation measures as well as areas ideal for green infrastructure intervention.

InVEST Urban Flood Risk Mitigation Model↗

NASA NTRS2018

Coordinating AgMIP Data and Models Across Global and Regional Scales for 1.5°C and 2.0°C Assessments

The Agricultural Model Intercomparison and Improvement Project (AgMIP) has developed novel methods for Coordinated Global and Regional Assessments (CGRA) of agriculture and food security in a changing world. The present study aims to perform a proof of concept of the CGRA to demonstrate advantages and challenges of the proposed framework. This effort responds to the request by the UN Framework Convention on Climate Change (UNFCCC) for the implications of limiting global temperature increases to 1.5°C and 2.0°C above pre-industrial conditions. The protocols for the 1.5°C/2.0°C assessment establish explicit and testable linkages across disciplines and scales, connecting outputs and inputs from the Shared Socio-economic Pathways (SSPs), Representative Agricultural Pathways (RAPs), Half a degree Additional warming, Prognosis and Projected Impacts (HAPPI) and Coupled Model Intercomparison Project Phase 5 (CMIP5) ensemble scenarios, global gridded crop models, global agricultural economics models, site-based crop models and within-country regional economics models. The CGRA consistently links disciplines, models and scales in order to track the complex chain of climate impacts and identify key vulnerabilities, feedbacks and uncertainties in managing future risk. CGRA proof-of-concept results show that, at the global scale, there are mixed areas of positive and negative simulated wheat and maize yield changes, with declines in some bread basket regions, at both 1.5°C and 2.0°C. Declines are especially evident in simulations that do not take into account direct CO2 effects on crops. These projected global yield changes mostly resulted in increases in prices and areas of wheat and maize in two global economics models. Regional simulations for 1.5°C and 2.0°C using site-based crop models had mixed results depending on the region and the crop. In conjunction with price changes from the global economics models, productivity declines in the Punjab, Pakistan, resulted in an increase in vulnerable households and the poverty rate. This article is part of the theme issue ‘The Paris Agreement: understanding the physical and social challenges for a warming world of 1.5°C above pre-industrial levels’.

interdisciplinary↗

NASA NTRS2013

Security Risk Assessment Process for UAS in the NAS CNPC Architecture

This informational paper discusses the risk assessment process conducted to analyze Control and Non-Payload Communications (CNPC) architectures for integrating civil Unmanned Aircraft Systems (UAS) into the National Airspace System (NAS). The assessment employs the National Institute of Standards and Technology (NIST) Risk Management framework to identify threats, vulnerabilities, and risks to these architectures and recommends corresponding mitigating security controls. This process builds upon earlier work performed by RTCA Special Committee (SC) 203 and the Federal Aviation Administration (FAA) to roadmap the risk assessment methodology and to identify categories of information security risks that pose a significant impact to aeronautical communications systems. A description of the deviations from the typical process is described in regards to this aeronautical communications system. Due to the sensitive nature of the information, data resulting from the risk assessment pertaining to threats, vulnerabilities, and risks is beyond the scope of this paper

data links↗

NASA NTRS2013

Security Risk Assessment Process for UAS in the NAS CNPC Architecture

Iannicca, Dennis C.↗

NASA NTRS2016

Cyber-Threat Assessment for the Air Traffic Management System: A Network Controls Approach

Air transportation networks are being disrupted with increasing frequency by failures in their cyber- (computing, communication, control) systems. Whether these cyber- failures arise due to deliberate attacks or incidental errors, they can have far-reaching impact on the performance of the air traffic control and management systems. For instance, a computer failure in the Washington DC Air Route Traffic Control Center (ZDC) on August 15, 2015, caused nearly complete closure of the Centers airspace for several hours. This closure had a propagative impact across the United States National Airspace System, causing changed congestion patterns and requiring placement of a suite of traffic management initiatives to address the capacity reduction and congestion. A snapshot of traffic on that day clearly shows the closure of the ZDC airspace and the resulting congestion at its boundary, which required augmented traffic management at multiple locations. Cyber- events also have important ramifications for private stakeholders, particularly the airlines. During the last few months, computer-system issues have caused several airlines fleets to be grounded for significant periods of time: these include United Airlines (twice), LOT Polish Airlines, and American Airlines. Delays and regional stoppages due to cyber- events are even more common, and may have myriad causes (e.g., failure of the Department of Homeland Security systems needed for security check of passengers, see [3]). The growing frequency of cyber- disruptions in the air transportation system reflects a much broader trend in the modern society: cyber- failures and threats are becoming increasingly pervasive, varied, and impactful. In consequence, an intense effort is underway to develop secure and resilient cyber- systems that can protect against, detect, and remove threats, see e.g. and its many citations. The outcomes of this wide effort on cyber- security are applicable to the air transportation infrastructure, and indeed security solutions are being implemented in the current system. While these security solutions are important, they only provide a piecemeal solution. Particular computers or communication channels are protected from particular attacks, without a holistic view of the air transportation infrastructure. On the other hand, the above-listed incidents highlight that a holistic approach is needed, for several reasons. First, the air transportation infrastructure is a large scale cyber-physical system with multiple stakeholders and diverse legacy assets. It is impractical to protect every cyber- asset from known and unknown disruptions, and instead a strategic view of security is needed. Second, disruptions to the cyber- system can incur complex propagative impacts across the air transportation network, including its physical and human assets. Also, these implications of cyber- events are exacerbated or modulated by other disruptions and operational specifics, e.g. severe weather, operator fatigue or error, etc. These characteristics motivate a holistic and strategic perspective on protecting the air transportation infrastructure from cyber- events. The analysis of cyber- threats to the air traffic system is also inextricably tied to the integration of new autonomy into the airspace. The replacement of human operators with cyber functions leaves the network open to new cyber threats, which must be modeled and managed. Paradoxically, the mitigation of cyber events in the airspace will also likely require additional autonomy, given the fast time scale and myriad pathways of cyber-attacks which must be managed. The assessment of new vulnerabilities upon integration of new autonomy is also a key motivation for a holistic perspective on cyber threats.

Complex Networks↗

NASA NTRSDate not supplied

Youngstown & Warren Disasters: Mapping Flood Susceptibility, Vulnerability, and Risk and Tree Canopy Coverage in Northern Ohio to Inform Stormwater Management and Flood Mitigation Efforts

Explore the source record for details and available documents.

Lauren Mahoney↗

NASA NTRSDate not supplied

Youngstown & Warren Disasters: Mapping Flood Susceptibility, Vulnerability, and Risk and Tree Canopy Coverage in Northern Ohio to Inform Stormwater Management and Flood Mitigation Efforts

Explore the source record for details and available documents.

Lauren Mahoney↗

NASA NTRS2013

IT Security Support for the Spaceport Command Control Systems Development Ground Support Development Operations

Security is one of the most if not the most important areas today. After the several attacks on the United States, security everywhere was heightened from Airports to the communication among the military branches legionnaires. With advanced persistent threats (APTs) on the rise following Stuxnet, government branches and agencies are required, more than ever, to follow several standards, policies and procedures to reduce the likelihood of a breach. Attack vectors today are very advanced and are going to continue to get more and more advanced as security controls advance. This creates a need for networks and systems to be in an updated and secured state in a launch control system environment. FISMA is a law that is mandated by the government to follow when government agencies secure networks and devices. My role on this project is to ensure network devices and systems are in compliance with NIST, as outlined in FISMA. I will achieve this by providing assistance with security plan documentation and collection, system hardware and software inventory, malicious code and malware scanning and configuration of network devices i.e. routers and IDSsIPSs. In addition I will be completing security assessments on software and hardware, vulnerability assessments and reporting, conducting patch management and risk assessments. A guideline that will help with compliance with NIST is the SANS Top 20 Critical Controls. SANS Top 20 Critical Controls as well as numerous security tools, security software and the conduction of research will be used to successfully complete the tasks given to me. This will ensure compliance with FISMA and NIST, secure systems and a secured network. By the end of this project, I hope to have carried out stated above as well as gain an immense knowledge about compliance, security tools, networks and network devices, policies and procedures.

computer information security↗