SEARCH · Search NASA

Results for “Infrastructure vulnerability”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 235 records · Page 13

All sources NASA NTRS DOE OSTI

DOE OSTI2025

Field Insights: Strengthening Digital Assurance Through On-Site Network Monitoring

The accelerating deployment of digital energy infrastructure, ranging from inverter-based resources (IBRs), battery energy storage systems (BESS), to advanced grid control platforms, has brought unprecedented visibility, flexibility, and efficiency to the electric grid. However, this digital transformation also introduces new cybersecurity challenges, particularly in the form of supply chain risks and operational blind spots at the grid edge. Over the past year, the Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER), through its Rapid Risk Assessment initiative, along with the Grid Deployment Office (GDO), through its Technical Assistance for Digital Assurance (TADA) initiative, have supported a series of on-site network engagements led by Idaho National Laboratory (INL). These engagements, conducted in partnership with asset owners across the country, have focused on identifying real-world vulnerabilities and misconfigurations in operational environments, many of which are not detectable through remote assessments or traditional compliance audits. The goal of this report is to distill key findings and lessons learned during network hunt engagements from INL’s fiscal year (FY) 2024 - 2025. It is intended to help asset owners—regardless of their participation in the program—better understand the evolving threat landscape and adopt practical measures to secure their digital energy infrastructure.

24 - POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2020

Evaluating Resilience of Water Distribution Networks to Operational Failures from Cyber-Physical Attacks

Water cyber-physical systems (CPSs) have gained increasing interest to improve operational efficiency and reliability. However, due to growing exposure to cyber-physical attacks, cybersecurity and resilience against the attacks have become significant concerns. There have been efforts to improve cybersecurity in water CPSs, yet few attempts to investigate resilience against cyber-physical attacks. This study contributes to characterizing resilience of a water CPS and investigating potential resilience strategies. An advanced resilience measure integrating withstanding, absorptive, adaptive, and restorative capability of a system is proposed and applied to the C-town water distribution network (WDN) for 15 failure set scenarios with a pressure-driven hydraulic simulation. The results provide identification of failure sets and unfavorable operational conditions that make the system more vulnerable to the cyber-physical attacks and in turn produce low resilience and capabilities. It is also found that, after recovery of a disrupted component, adjustment of overall operational interactions across system components is needed for complete restoration of disrupted functionality. The findings provide insights on infrastructure investment with resilience strategies in cyber and physical water system domains.

Shin, Sangmin↗

DOE OSTI2020

Safeguarding the Grid: Diverse Resources for Resilience [In My View]

Reports on the vulnerability of the power grid. From wildfires, hurricanes, and floods to cyberattacks, the grid is vulnerable to natural and human-made disasters, which can cause widespread outages that last from hours to months and leave lasting economic impacts. Imagine a coastal region in the United States that has just been hit by a hurricane and lost all power. Besides the electricity infrastructure going out, communications networks, rail transportation, and gasoline pumps may also stop working after the emergency event, which often delays repair efforts to the grid. Unresponsive communications make it difficult to dispatch workers to repair the grid, and missing transportation links delay shipments of replacement equipment for the grid’s restoration.

cybersecurity↗

DOE OSTI2025

Securing the Modern Grid: Federal Investments, Digitization, and Supply Chain Strategy

Across the United States (U.S.) grid expansion and modernization is underway, paving the way for accelerated load growth and intelligent resource management. Digitization of the grid is supported by several state and federal programs, providing support for utilities installing advanced metering infrastructure (AMI), AI-powered analytics systems, battery energy storage systems (BESS), and distributed energy resource management systems (DERMS) to transform the grid from a one-way power delivery system into an intelligent, responsive network that will enable faster load growth and power expansion of data centers for advanced artificial intelligence (AI) applications. The digital transformation of America's grid presents opportunity for increased efficiency and resiliency but also introduces new digital risks that require careful management. Digital equipment often contains several vulnerabilities such as unencrypted communication protocols, and persistent remote access capabilities that could be exploited to manipulate device settings, coordinate service disruptions, or inject false data into grid operations. These digital risks become particularly important as the grid must rapidly scale to support AI-driven data centers, which the administration has identified as essential for maintaining U.S. technological leadership and economic competitiveness. These vulnerabilities are compounded by supply chain realities: Chinese manufacturers currently produce 70-90% of essential grid components including inverters, batteries, and control systems, with the U.S. lacking domestic manufacturing capacity for critical assets like extra-high voltage transformers. Recent federal legislation has established Foreign Entity of Concern (FEOC) restrictions to address these risks, requiring projects to achieve escalating thresholds of non-FEOC content to receive tax credits while utilities work to expand sourcing channels for their supply chains and strengthen security measures. These restrictions arrive precisely when utilities face unprecedented electricity demand growth driven by the rapid growth in data centers, creating a considerable challenge: rapidly expanding infrastructure while navigating complex compliance requirements while lacking viable alternatives for many critical components. Idaho National Laboratory (INL) and its partners have developed practical approaches to help utilities navigate these intersecting challenges as they leverage federal investment to strengthen and grow the grid. These solutions include Cyber-Informed Engineering (CIE) principles that build resilience directly into systems, the Cirrus tool for secure cloud migration, and enhanced procurement guidance that embeds security requirements throughout equipment lifecycles. Federal initiatives, such as the Technical Assistance for Digital Assurance (TADA) project, provide direct support to utilities implementing these approaches while facilitating knowledge sharing across the industry. While these tools and frameworks cannot eliminate all risks inherent in foreign supply chain dependencies, they offer pragmatic pathways for strengthening security posture without sacrificing the deployment momentum essential to meeting surging electricity demand. Ultimately, securing America's digital energy infrastructure demands dedicated coordination across multiple fronts: building domestic supply chains, implementing robust digital assurance practices, and maintaining the aggressive modernization timeline necessary for reliability, resilience, and energy independence.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Autonomous Tools for Attack Surface Reduction (Final Report)

The electric power grid is a complex critical infrastructure that forms the lifeline of modern society, and its secure and reliable operation is of paramount importance to national security and economic wellbeing. However, recent findings documented in authoritative sources indicate the threat of cyber-based attacks growing in numbers and sophistication. However, securing the grid against stealthy cyberattacks is a challenging task due to legacy nature of the infrastructure coupled with dynamic nature of threat landscape and ever-growing sophistication of the adversaries. Additionally, the grid’s attack surface continues to grow with the increased dependence on digital communications and control that now extends to each consumer through smart meters and distributed energy resources. Unfortunately, this expansive surface increases the grid’s vulnerability and further exposes critical control systems in both substations and control centers. To respond to this emerging need, we had successfully assembled an interdisciplinary team with academic- industry partnership to successfully conduct research, development, evaluation, demonstration, and commercialization of attack surface reduction tools, whose goal was to significantly reduce the cyber attack surface in the North American power grid. Our proposed project was a synergistic collaborative effort leveraging the synergistic expertise of the team members across power systems, cyber security and CPS security, testbeds, field deployments and demonstration, and successful commercialization. The following are the specific tasks that have been successfully completed two phases (2016-2020). Phase I: Task 1: Developed and implemented a robust Project Management and Data Management Plan, coupled with a well thought out Risk Mitigation Plan. Task 2.1: Developed a comprehensive framework that continually assesses and autonomously reduces the attack surface for the power grid control environment spanning across substations, control center and the SCADA network to significantly reduce the risks of cyber attacks. Task 2.2: Developed attack surface analysis techniques, metrics, and tools that assess the attack surface at multiple levels including the control center, substations, and the SCADA network. Task 2.3: Developed attack surface reduction techniques and tools that dynamically reduce attack surface and hence increase attacker’s cost without interfering in the critical functions of the system. Task 2.4: Prototyped, implemented, and quantitatively evaluated/validated the techniques and tools on a realistic industrial CPS security testbed environment by leveraging the unique resources of the team. Task 3: Developed Commercialization plan to transition the developed tools into power system industry stakeholders for a broader adoption by leveraging the expertise of our industrial members. Phase II: Task 4: Successfully completed field demonstration, verification, and evaluation of the effectiveness of the attack surface analysis and reduction techniques on a realistic utility testbed environment. This also involved the development of realistic scenarios, sound metrics, data sets, evaluation criteria, and documentation. Technology integration & Field demonstration: The project had significantly advanced the state-of-the-art research and practice in improving the cybersecurity of our nation’s power grid infrastructure against cyber threats. In particular, the proposed, designed, and deployed attack surface analysis and reduction algorithms and tools have contributed to significantly reducing the exposure and risk of the devices, substations, and the integrated SCADA/EMS/ DMS grid environment to cyber threat. Strong demonstration and evaluation techniques have verified the feasibility of the developed techniques on realistic cyber-physical testbeds and utility partner's real grid environment, and collaborative research and evaluation of attack surface reduction techniques (for wide-are monitoring and control) within a vendor (GE) EMS platform. The Attack Host Analyzer (AHA) tool that was developed through this project was made available through GitHub.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

Cybersecurity Lessons Learned from Vehicle to Grid Engagement

As the transportation industry continues to become electrified, introduction of additional digital devices within associated actions such as recharging bring additional potential for cybersecurity attacks. Devices that are designed, implemented, and operated with cybersecurity as a crucial consideration exacerbate these concerns by failing to provide strict boundaries on access to and use of the equipment. Emerging use cases such as Vehicle to Grid (V2G) charging may expand the potential physical effects of a cybersecurity attack by providing indirect access to electrical components of a building microgrid or portions of the larger power grid. This paper serves as an overview of findings and recommendations based on cybersecurity testing performed at a V2G implementation site operated by a member of the Memorandum of Understanding (MOU) to Establish the Vehicle-to-Everything (V2X) Collaboration [1]. The Department of Energy Office of Cybersecurity, Energy Security, and Emergency Response is a signatory of the MOU, and has funded this research paper and associated body of work regarding V2X cybersecurity. Sandia has a large background of previous research focused on Electric Vehicle (EV) cybersecurity, such as reference [2], which includes an overall survey of EV infrastructure cybersecurity and recommendations based on those findings. This report seeks to expand knowledge of EV cybersecurity status and needs by focusing on a specific implementation of V2G charging, and providing recommendations based on the relevant findings. This report serves as a publicly available, sanitized description of applied vulnerability testing on an operational V2G implementation. A more in-depth technical version of the report is provided to the MOU partner, but not available at the time of writing due to inclusion of proprietary information. V2G charging comes with many research problems that must be solved before the technology can securely implemented in sites with unrestricted public access or where cybersecurity attacks could have increased consequences, such as government offices. V2G charging requires many stakeholders such as end users, host sites, equipment vendors, and integrators, which all rely on operational safety and security as well as security and trustworthiness of any associated financial transactions.

33 ADVANCED PROPULSION SYSTEMS↗

DOE OSTI2025

Evaluating Hydropower Plants for Wildfire Resilient Microgrids

The increasing occurrence and severity of wildfires in recent years is severely impacting critical infrastructures, including the power grid, compromising the quality of life and provision of essential services, including electricity. The western parts of the United States, more specifically Washington, Oregon, and California, which are prone to large wildfires, are also rich in hydropower resources. Hydropower resources located close to communities vulnerable to wildfire can be utilized to develop wildfire-resilient microgrids to support critical needs of those communities. Therefore, this paper develops a framework to characterize hydropower plants and evaluate their feasibility to operate in microgrids during wildfire-related outages. In the proposed framework, hydropower plants are characterized using various plant and site attributes and evaluated in terms of capability and performance indicative metrics. A case study is carried out evaluating the Hills Creek hydropower plant located in a wildfire-prone region of Oregon for wildfire-resilient microgrid. The results of steady-state and dynamic simulations show that the hydropower plant is capable of providing the essential microgrid services and powering nearby communities during extended wildfire-related outages.

29 - ENERGY PLANNING, POLICY AND ECONOMY↗

DOE OSTI2022

On the Use of Satellite Nightlights for Power Outages Prediction

Hurricanes are a dominant disaster in the Caribbean, always causing serious power outages throughout the islands. Hurricane Maria was a prime example, causing unimaginable destruction of the power infrastructure of Puerto Rico (PR). Consequently, one month after the hurricane landfall, approximately 80% of the population was still without power. After an event of such massive destruction, the electric power restoration process progresses very slowly. This timeline can be improved using power outage (PO) forecast models that help identify the vulnerable places before the hurricane landfall. Generally, these models are trained with historical power outages records, associated data on weather conditions, and additional information about the natural and built environments. However, PO records are often difficult to acquire, and, in many instances, the power utility companies may not record them. This study utilizes a satellite-based Visible Infrared Imaging Radiometer Suite (VIIRS) night light data product as a surrogate for the power delivery to predict hurricane-induced PO in areas having limited to nonexistent historical data records. The processed satellite data is then used along with geographic variables, and simulated weather data to formulate machine learning-based algorithms to predict PO for future hurricane events. These models are applied and validated in the context of the PR catastrophic storm, Hurricane Maria.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2021

Integrated Water-Power System Resilience Analysis in a Southeastern Idaho Irrigation District: Minidoka Case Study

This study investigates the joint water–power system resilience of an irrigation district in southeastern Idaho. Irrigation districts face difficulties in the delivery of water to farmers under drought conditions, during equipment failures, or unplanned infrastructure disruptions. The resilience of interconnected water and power systems can be better analyzed and understood through an integrated approach, using a model that connects the dependencies between the two halves of the system. Using a multi-agent system model capturing both water and power system components, as well as their linkages, we capture the interdependencies of these systems and highlight opportunities for improvement when faced with disruptions. Through simulation scenarios, we examine the system resilience using system performance, quantified as the percentage of met demand of the power and water system, when subjected to drought water year, an unforeseen water demand increase, power outage and dam failure. Scenario results indicate that the effects of low flow years are mostly felt in the power system; unexpected increases in water demand marginally impact irrigation system performance; dams and pumps present vulnerabilities of the system, causing substantial unmet demand during disruptions. Noting the interdependencies between the water–power system halves while leveraging an integrated simulation allows for an insightful analysis of the system impacts during disruptions.

13 HYDRO ENERGY↗

DOE OSTI2022

Resilient Hierarchical Networked Control Systems: Secure Controls for Critical Locations and at Edge

Integration of information and communication technology (ICT) offers new opportunities in improving the management and operation of critical infrastructures such as power systems as it allows connection of different sensors and control components via a communication network, leading to the so-called networked control systems (NCS). However, the use of open and pervasive ICT such as the Internet or wireless communication technologies comes at a price of making NCS vulnerable to cyber intrusions/attacks which may cause physical damage. Here, this chapter presents control algorithms to ensure resilient and safe operation of NCS under unknown cyberattacks. Specifically, a variant of dynamic watermarking strategies is presented by embedding encoding/decoding components of chaotic signals into the NCS for secure control for critical locations where the measurement/control signals are transmitted to/from the control center via a communication network. In addition, resilient cooperative control algorithms are discussed to ensure safe operation at edge of the NCS which consists of a large number of distributed controllable devices. Several numerical examples are provided to illustrate the proposed control strategies.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗

DOE OSTI2020

Autonomous Tools for Attack Surface Reduction

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2025

Data Centers and Digital Assurance Workshop 3 – Mitigations for Digital Assurance Risks

The third session of the TADA (Technical Assistance for Digital Assurance) Data Centers Cohort, held on November 18, 2025, focused on developing mitigation strategies for digital assurance risks identified in previous workshops. Hosted by Idaho National Laboratory (INL) and ScottMadden, the session emphasized the application of Cyber-Informed Engineering (CIE) to data center infrastructure, particularly at the utility–data center interface. Participants revisited and ranked key digital assurance risks, including architecture and interface weaknesses, governance gaps, and AI-enabled threats. The workshop introduced the 12 principles of CIE, advocating for consequence-focused design, engineered controls, and secure information architecture to proactively reduce cyber-physical vulnerabilities. These principles were applied to critical data center systems such as power distribution, UPS, cooling, SCADA/BMS, and grid-forming batteries. The session also addressed governance challenges at the interconnection boundary, highlighting the need for clear roles in telemetry sharing, firmware management, and trip settings. Special attention was given to emerging risks from behind-the-meter (BTM) generation, including reverse-power flow and the integration of small modular reactors (SMRs), which shift data centers from large loads to complex generation nodes. Participants explored how interconnection agreements can serve as enforceable instruments for digital assurance, and reviewed gaps in current standards such as NERC CIP, IEC 62443, and IEEE 1547. The workshop concluded with pathways to standardization, including model agreement language, state-level programs, and expanded NERC guidance. INL also presented tools and frameworks for secure procurement and supplier risk management, reinforcing the need for integrated engineering and policy solutions to secure the evolving data center–grid ecosystem. Session 3 of 3.

24 - POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2025

SECURED: Simulator-Enhanced Control and Understanding of Reactor systems for cyber-Event Defense

The study discusses a learning approach for analyzing cyber-events in reactor systems using integrated hardware and personal computer simulator models. Key points include the rise in cyber-attacks and their sophistication in industrial control systems (ICS), the necessity for awareness, understanding, resource allocation, and preparation to combat these threats, and the digital transformation of old and new nuclear plants, increasing their exposure to cyber threats. It highlights the cyber vulnerabilities of advanced reactor systems, which rely on digital instrumentation and control for operations and safety functions, making them susceptible to cyber-attacks. The approach involves demonstrating reactor system plant ICS cyber-attacks under various operational conditions utilizing tools like simulator models and hardware-based kits. A strategic solution approach tailored to critical infrastructure is emphasized, along with community engagement for public and government support, adopting effective learning approaches, and the preparation for anticipated future challenges. The presentation concludes with a call to action to address challenges, leverage opportunities, and advance through lesson learning in cybersecurity for nuclear energy systems.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

DOE OSTI2022

Protection and restoration of coastal habitats yield multiple benefits for urban residents as sea levels rise

Globally, rising seas threaten massive numbers of people and significant infrastructure. Adaptation strategies increasingly incorporate nature-based solutions. New science can illuminate where these solutions are appropriate in urban environments and what benefits they provide to people. Together with stakeholders in San Mateo County, California, USA, we co-developed nature-based solutions to support adaptation planning. We created six guiding principles to shape planning, summarized vulnerability to sea-level rise and opportunities for nature-based solutions, created three adaptation scenarios, and compared multiple benefits provided by each scenario. Adaptation scenarios that included investments in nature-based solutions deliver up to eight times the benefits of a traditionally engineered baseline as well as additional habitat for key species. The magnitude and distribution of benefits varied at subregional scales along the coastline. Our results demonstrate practical tools and engagement approaches to assessing the multiple benefits of nature-based solutions in an urban estuary that can be replicated in other regions.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2022

Ransomware and Today's Electric Grid

Cyberattacks come in many forms, including one of the newest and most threatening of attacks: ransomware. The rise in ransomware impacts businesses small and large -- and have the potential to significantly disrupt the operations of critical infrastructure. This presentation will explain what utilities can expect from a ransomware attack, sharing examples from specific events, provide guidance on how to prepare for the unknown, and offer possible ways to respond when an attack occurs. The presentation will also discuss cybersecurity governance as an effective method in taking preventative action to ransomware by identifying and addressing vulnerabilities through monitoring and assessment.

assessment↗

DOE OSTI2023

Towards generic memory forensic framework for programmable logic controllers

A Programmable Logic Controller (PLC) is a microprocessor-based controller that is used to automate physical processes in critical infrastructure and various other industries and manufacturing sectors. Initially, PLCs were completely isolated from the Internet, and cyber security was not incorporated at the time of development. The introduction of industry 4.0 and the evolution of ICS systems to communicate over public IP addresses from the Internet enhanced productivity and efficiency, but Internet connectivity exposed the systems and their vulnerabilities, which led to an increase in cyber attacks. When a system is sabotaged/compromised, security analysts need to get to the root cause of the attack as quickly as possible to recover the system. To do so, memory forensic analysis is critical to provide a unique insight into the run-time memory activities and extract a reliable source of evidence. In this paper, we analyze the memory structure of the Schneider Electric Modicon M221 PLC. To build a memory profile, we reverse engineer the communication protocol and conduct differential analysis to gain knowledge about the structure of the memory and the low-level representation of control logic instructions. We then identify dynamic and static memory regions by modifying different project fields and conducting differential analysis, which allows us to identify boundaries of critical memory structures and extract important forensic artifacts that can be found in the memory. The Python implementation of the memory profile can help reduce the time and effort required for manual analysis in case of cyber incident or system failure.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2020

Resilience of Urban Transport Network-of-Networks under Intense Flood Hazards Exacerbated by Targeted Attacks

Natural hazards including floods can trigger catastrophic failures in interdependent urban transport network-of-networks (NoNs). Population growth has enhanced transportation demand while urbanization and climate change have intensified urban floods. However, despite the clear need to develop actionable insights for improving the resilience of critical urban lifelines, the theory and methods remain underdeveloped. Furthermore, as infrastructure systems become more intelligent, security experts point to the growing threat of targeted cyber-physical attacks during natural hazards. Here we develop a hypothesis-driven resilience framework for urban transport NoNs, which we demonstrate on the London Rail Network (LRN). We find that topological attributes designed for maximizing efficiency rather than robustness render the network more vulnerable to compound natural-targeted disruptions including cascading failures. Our results suggest that an organizing principle for post-disruption recovery may be developed with network science principles. Our findings and frameworks can generalize to urban lifelines and more generally to real-world spatial networks.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2025

Evaluation of IEC 62443 Standard Gaps for Electric Grid Substation Model Use Case

This report presents an evaluation of the IEC 62443 standards in the context of electric grid substations, as part of a collaborative effort among Sandia National Laboratories (SNL), Idaho National Laboratory (INL), and the National Renewable Energy Laboratory (NREL). The primary objective is to assess the applicability of these standards to enhance cybersecurity measures for industrial automation and control systems (IACS) within the energy sector. The evaluation identifies strengths, such as the scalability of security levels and the structured lifecycle guidance provided by IEC 62443. However, it also highlights significant gaps, including limited integration of physical security, insufficient guidance for legacy systems, and challenges in addressing emerging threats like supply chain vulnerabilities. Recommendations for refining the standards are proposed, including the need for tailored guidance for securing legacy systems, integrating physical security with cybersecurity frameworks, and enhancing interoperability across multi-vendor environments. By addressing these gaps, the IEC 62443 standards can be strengthened to ensure comprehensive cybersecurity for electric grid substations, thereby supporting the resilience and reliability of critical energy infrastructure.

24 POWER TRANSMISSION AND DISTRIBUTION↗