Results for “cyber security” — Page 12

DOE OSTI2024

Interdisciplinary Approaches to Cyber-vulnerability Impact Assessment for Energy Critical Infrastructure

As energy infrastructure becomes more interconnected, understanding cybersecurity risks to production systems requires integrating operational and computer security knowledge. We interviewed 18 experts working in the field of energy critical infrastructure to compare what information they find necessary to assess the impact of computer vulnerabilities on energy operational technology. These experts came from two groups: 1) computer security experts and 2) energy sector operations experts. We find that both groups responded similarly for general categories of information and displayed knowledge about both domains, perhaps due to their interdisciplinary work at the same organization. Yet, we found notable differences in the details of their responses and in their stated perceptions of each group’s approaches to impact assessment. Their suggestions for collaboration across domains highlighted how these two groups can work together to help each other secure the energy grid. Our findings inform the development of interdisciplinary security approaches in critical-infrastructure contexts.

97 MATHEMATICS AND COMPUTING↗

NASA NTRS2014

Modernization of the Cassini Ground System

The Cassini Spacecraft and its ground system have been operational for over 16 years. Modernization presents several challenges due to the personnel, processes, and tools already invested and embedded into the current ground system structure. Every mission's ground system has its own unique complexities and challenges, involving various organizational units. As any mission from its inception to its execution, schedules are always tight. This forces GDS engineers to implement a working ground system that is not necessarily fully optimized. Ground system challenges increase as technology evolves and cyber threats become more sophisticated. Cassini's main challenges were due to its ground system existing before many security requirements were levied on the multi-mission tools and networks. This caused a domino effect on Cassini GDS tools that relied on outdated technological features. In the aerospace industry reliable and established technology is preferred over innovative yet less proven technology. Loss of data for a spacecraft mission can be catastrophic; therefore, there is a reluctance to make changes and updates to the ground system. Nevertheless, all missions and associated teams face the need to modernize their processes and tools. Systems development methods from well-known system analysis and design principles can be applied to many missions' ground systems. Modernization should always be considered, but should be done in such a way that it does not affect flexibility nor interfere with established practices. Cassini has accomplished a secure and efficient ground data system through periodic updates. The obstacles faced while performing the modernization of the Cassini ground system will be outlined, as well as the advantages and challenges that were encountered.

Razo, Gus↗

NASA NTRS2014

Modernization of the Cassini Ground System

The Cassini Spacecraft and its ground system have been operational for over 16 years. Modernization presents several challenges due to the personnel, processes, and tools already invested and embedded into the current ground system structure. Every mission's ground system has its own unique complexities and challenges, involving various organizational units. As any mission from its inception to its execution, schedules are always tight. This forces GDS engineers to implement a working ground system that is not necessarily fully optimized. Ground system challenges increase as technology evolves and cyber threats become more sophisticated. Cassini's main challenges were due to its ground system existing before many security requirements were levied on the multi-mission tools and networks. This caused a domino effect on Cassini GDS tools that relied on outdated technological features. In the aerospace industry reliable and established technology is preferred over innovative yet less proven technology. Loss of data for a spacecraft mission can be catastrophic; therefore, there is a reluctance to make changes and updates to the ground system. Nevertheless, all missions and associated teams face the need to modernize their processes and tools. Systems development methods from well-known system analysis and design principles can be applied to many missions' ground systems. Modernization should always be considered, but should be done in such a way that it does not affect flexibility nor interfere with established practices. Cassini has accomplished a secure and efficient ground data system through periodic updates. The obstacles faced while performing the modernization of the Cassini ground system will be outlined, as well as the advantages and challenges that were encountered.

Razo, Gus↗

NASA NTRSDate not supplied

Runtime Analysis with R2U2: A Tool Exhibition Report

We present R2U2 (Realizable, Responsive, Unobtrusive Unit), a hardware- supported tool and framework for the continuous monitoring of safetycritical and embedded cyber-physical systems.With the widespread advent of autonomous systems such as Unmanned Aerial Systems (UAS), satellites, rovers, and cars, real-time, on-board decision making requires unobtrusive monitoring of properties for safety, performance, security, and system health. R2U2 models combine past-time and future-time Metric Temporal Logic, “mission time” Linear Temporal Logic, probabilistic reasoning with Bayesian Networks, and modelbased prognostics. The R2U2 monitoring engine can be instantiated as a hardware solution, running on an FPGA, or as a software component. The FPGA realization enables R2U2 to monitor complex cyber-physical systems without any overhead or instrumentation of the flight software. In this tool exhibition report, we present R2U2 and demonstrate applications on system runtime monitoring, diagnostics, software health management, and security monitoring for a UAS. Our tool demonstration uses a hardware-based processor-in-the-loop “iron-bird” configuration.

Johann Martin Schumann↗

DOE OSTI2025

Cyber-Informed Engineering (CIE) Integration into Model- Based Systems Engineering (MBSE)

Engineering design in the field of industrial engineering, such as designing automated factories or warehouses, is critical for the effective operation of facilities. Any design flaws introduced early can result in significant capital expenses to correct. However, early-stage engineering design is inherently complex. The systems are not yet built, requiring designers to integrate various aspects, including digital engineering and cybersecurity, to support virtual representations throughout the design process. In this study, we propose an approach to integrate Cyber-Informed Engineering (CIE) principles into model-based systems engineering (MBSE). This approach facilitates the development of a digital thread for engineering systems, ensuring secure digital artifacts in the design of industrial engineering systems.

42 - ENGINEERING↗

DOE OSTI2024

Reverse Engineering of Medical Devices for Innovation and Advancement in Healthcare

Medical cybersecurity research addresses the critical intersection of healthcare and digital security. As medical devices expand and become increasingly interconnected, the healthcare sector is poised to become a primary target for cyber warfare. This project aims to mitigate the risks associated with a field that often underestimates the importance of cybersecurity.

Baldwin, David↗

DOE OSTI2025

Grid Architecture Mapping to Understand Transformation (GAMUT): Concept Definition

The electric power system is undergoing significant transformation driven by changes in the generation mix, increasing reliance on information and communication technologies, evolving customer expectations, and a dynamic cyber-physical environment. To address these challenges, substantial investments will be made over the next decade to create a flexible, affordable, secure, reliable, and resilient electric system. In response, the U.S. Department of Energy's Office of Electricity is developing knowledge management tools aimed at systematically documenting technology pilots and demonstration projects. This initiative seeks to improve understanding of operating contexts, planning steps, and integration requirements for innovative grid technologies. The Department of Energy project leverages Grid Architecture principles to collect and organize insights into the interdependencies, requirements, and capabilities of various grid solutions. By employing a systematic approach, the project aims to perform a feasibility study for the development of a software tool that will support stakeholders, including regulators, transmission and distribution system operators, distributed energy resources aggregators, and technology providers. By offering a systematic, software-based framework to document technologies, understand their benefits and impacts, and inform deployment strategies, the proposed Grid Architecture Mapping to Understand Transformation (GAMUT) Tool is intended to reduce costs, enhance decision-making, and facilitate scaling and effective deployment of new technologies. The feasibility study will evaluate the technical and financial viability of the GAMUT Tool, identifying stakeholder needs and assessing risks and mitigation strategies. Ultimately, the GAMUT team aims to develop an initial minimal viable product, followed by staged improvements, to aid in the modernization of the electric grid, contributing to a more sustainable and resilient energy future.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2026

Energy Systems Integration Facility Stewardship Summary: Fiscal Year 2025

A summary of NLR's stewardship of the nationally unique Energy Systems Integration Facility (ESIF) highlighting performance metrics, capability upgrades, and examples of R&D impact. 2025 brought a national focus on energy and ESIF is meeting the moment. All eyes are on data centers and domestic manufacturing and bringing the benefits of artificial intelligence to power system planning and operations. In step with national priorities, ESIF is building out capabilities that advance secure, reliable, and affordable power. ESIF hosted 190 multidisciplinary research projects, 855 high-performance computer users, and collaborated with 81 partners from industry, academia, research, and federal agencies. These research projects resulted in an AI method for detecting high-impedance faults with 90% accuracy, a grid controls demonstration in Connecticut, power quality validation of CorePower's flagship inductor, and a cybersecurity assessment of potential rogue capabilities in digitally connected energy devices. Facility infrastructure improvements enhanced the thermal research network, the SCADA system, the cyber range, power hardware-in-the-loop testing, and more. With support from the U.S Department of Energy (DOE), the ESIF laboratories continue to deliver leading solutions for secure, reliable, and affordable power.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2025

BESS Digital Assurance, Supply Chain Risk Management, and Emerging Regulation Session One - Abridged

The TADA BESS Supply Chain Workshops are designed to equip participants with the knowledge and tools necessary to address the evolving challenges at the intersection of battery energy storage systems (BESS), cybersecurity, and supply chain vulnerabilities. The workshops emphasize the application of Cyber-Informed Engineering (CIE) principles using INL’s procurement guide and the CIE-BAT tool. Attendees will develop risk-based security strategies and actionable compliance roadmaps tailored to their BESS projects. Additionally, the program fosters a collaborative network of practitioners and provides guidance on navigating emerging regulatory requirements, including FEOC rules under the OBBB framework, to assess and enhance organizational readiness. This is Session 1 of 3.

25 - ENERGY STORAGE↗

DOE OSTI2025

BESS Digital Assurance, Supply Chain Risk Management, and Emerging Regulation Session Two

The TADA BESS Supply Chain Workshops are designed to equip participants with the knowledge and tools necessary to address the evolving challenges at the intersection of battery energy storage systems (BESS), cybersecurity, and supply chain vulnerabilities. The workshops emphasize the application of Cyber-Informed Engineering (CIE) principles using INL’s procurement guide and the CIE-BAT tool. Attendees will develop risk-based security strategies and actionable compliance roadmaps tailored to their BESS projects. Additionally, the program fosters a collaborative network of practitioners and provides guidance on navigating emerging regulatory requirements, including FEOC rules under the OBBB framework, to assess and enhance organizational readiness. A comprehensive exploration of BESS cybersecurity supply chain risks, systematic vendor risk assessment through the BESS Procurement Guide, and practical application of the INL SCRM Chatbot for enhanced supply chain resilience. This is Session 2 of 3. (Full Version)

25 - ENERGY STORAGE↗

DOE OSTI2025

BESS Digital Assurance, Supply Chain Risk Management, and Emerging Regulation Session One

The TADA BESS Supply Chain Workshops are designed to equip participants with the knowledge and tools necessary to address the evolving challenges at the intersection of battery energy storage systems (BESS), cybersecurity, and supply chain vulnerabilities. The workshops emphasize the application of Cyber-Informed Engineering (CIE) principles using INL’s procurement guide and the CIE-BAT tool. Attendees will develop risk-based security strategies and actionable compliance roadmaps tailored to their BESS projects. Additionally, the program fosters a collaborative network of practitioners and provides guidance on navigating emerging regulatory requirements, including FEOC rules under the OBBB framework, to assess and enhance organizational readiness. This is Session 1 of 3. (Full Version)

25 - ENERGY STORAGE↗

DOE OSTI2024

Developing a Supply Chain Security Program

Amid growing concerns over foreign manufacturing for components and devices deployed in critical energy infrastructure, this research from the national labs will highlight best practices for developing and maintaining a supply chain security program. Tools for asset inventory, tips for developing and maintaining software- and hardware-bills-of-materials (SBOMs and HBOMs), recommended contractual language for vendor agreements, and identification of responsibilities will be shared. We discuss the one-time requirements to enable a successful supply chain security program and the best ways to operationalize this program for maximum impact, including development of robust practices for vulnerability tracking, patch management, and workarounds, with understanding of the reliability and uptime requirements for utilities. The recommendations shared are based on a cyber-informed engineering approach to identification of high-consequence impacts and the engineering controls related to supply chain management that can best mitigate these impacts. This approach allows for prioritization of resources. Additionally, we highlight relative up-front and ongoing costs associated with recommended controls. Viewers will leave with an understanding what a supply chain security program is, and what steps, prioritized for resource-constrained organizations, can build a robust program.

14 SOLAR ENERGY↗

DOE OSTI2026

Securing The Future: 2026 Manufacturing & Critical Infrastructure Threat Landscape

This report outlines the current state of manufacturing weaknesses introduced by the complexities of modern environments, including cloud services and Internet of Things (IoT) devices, with particular attention paid to the unique vulnerabilities encountered by SMMs. It also highlights CyManII’s strategic initiatives and collaborative solutions to mitigate these risks and strengthen the cybersecurity posture of the manufacturing ecosystem. Utilizing data from 2025 to inform forward-looking mitigation strategies, this report provides manufacturers with a clear understanding of both current and emerging cybersecurity threats, as well as practical opportunities to strengthen their cyber ecosystems. The following sections detail key vulnerabilities and threat vectors, along with actionable mitigation strategies, many of which have been developed or piloted through CyManII-led efforts. A thorough understanding of these risks and mitigation strategies is essential for manufacturers seeking to strengthen the security and resilience of their manufacturing operations.

3D Printing↗

NASA NTRS2017

Detection, Localization, and Tracking of Unauthorized UAS and Jammers

Small unmanned aircraft systems (UASs) are expected to take major roles in future smart cities, for example, by delivering goods and merchandise, potentially serving as mobile hot spots for broadband wireless access, and maintaining surveillance and security. Although they can be used for the betterment of the society, they can also be used by malicious entities to conduct physical and cyber attacks to infrastructure, private/public property, and people. Even for legitimate use-cases of small UASs, air traffic management (ATM) for UASs becomes of critical importance for maintaining safe and collusion-free operation. Therefore, various ways to detect, track, and interdict potentially unauthorized drones carries critical importance for surveillance and ATM applications. In this paper, we will review techniques that rely on ambient radio frequency signals (emitted from UASs), radars, acoustic sensors, and computer vision techniques for detection of malicious UASs. We will present some early experimental and simulation results on radar-based range estimation of UASs, and receding horizon tracking of UASs. Subsequently, we will overview common techniques that are considered for interdiction of UASs.

surveillance↗

DOE OSTI2026

Advanced Research on Integrated Energy Systems Cyber Range

As digital technologies expand to meet the needs of a more autonomous, interconnected, and advanced power system, new cybersecurity complexities and vulnerabilities arise. The ARIES Cyber Range enables the energy sector to evaluate these evolutions and validate cybersecurity solutions without impacting live systems. Combining power grid-scale hardware with emulation and simulation approaches, the ARIES Cyber Range can faithfully replicate modern energy systems - from grid physics to communication networks, and everything in between - with real-world fidelity. At NLR, researchers and partners are answering complex power system cybersecurity questions, examining emerging threats to the electric sector, and de risking new security technologies, all at a mission-relevant speed that keeps pace with rapidly evolving systems and hazards.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

DOE OSTI2026

VPP Cybersecurity: Stakeholder Roles and Responsibilities

This presentation was presented at the Aggregation and Grid Security Workshop - held on June 17-18, 2025, at NREL in Golden, Colorado. The goal of the two-day workshop was to address the critical cybersecurity challenges for the future electric grid. This presentation outlines a framework for assessing the roles and responsibilities of virtual power plant stakeholders in mitigating cyber risk to virtual power plant projects and the overall power grid.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

Overview and Commentary on Applying the Coordinated Vulnerability Disclosure Process to Photovoltaic System Devices

The rapid expansion of photovoltaic (PV) systems, particularly inverters, has introduced new cybersecurity challenges that threaten both local operations as well as the broader electrical grid’s stability. PV inverters, integrated into critical energy infrastructure are potential targets for cyber attacks due to vulnerabilities in firmware, remote access systems, and communication protocols. The Coordinated Vulnerability Disclosure (CVD) process, as defined by the Cybersecurity and Infrastructure Security Agency (CISA), provides a framework for identifying, reporting, and addressing these vulnerabilities in a transparent and collaborative manner. This report outlines the CVD process as it applies to PV systems, detailing the roles of key stakeholders, such as manufacturers, grid operators, and security researchers. The report also highlights specific challenges in managing vulnerabilities for new and legacy PV systems, which includes those introduced by insecure communications and third-party supply chain components. By adhering to the CVD process, the PV industry can mitigate cybersecurity risks, ensure regulatory compliance, and maintain consumer trust, while safeguarding the operational resilience of the energy grid. Ultimately, the effective coordination of vulnerability management is crucial for securing the future of PV systems within the critical electric grid infrastructure landscape.

14 SOLAR ENERGY↗

DOE OSTI2025

Cybersecurity Supply Chain Risk Management: Forge Institute Presentation

In this talk, INL will discuss how to develop a cyber supply chain risk management program, to include assessment of vendor risk and applying appropriate mitigations. INL will discuss key risk factors and the challenges of securing supply chain in complex and dynamic vendor environments. Finally, INL will share example language that can be adopted in RFPs and procurement contracts to promote supply chain security.

battery energy storage system↗