Search NASA⌕ Search

SEARCH · Search NASA

Results for “Vulnerability Management”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 235 records · Page 13
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Cybersecurity Assessment Tools for Distributed Energy Resources

This growing number of smart devices that support DERs can increase the number of access points outside a utility’s administrative domain, which can increase the potential for cyberattack. With the integration of DERs at federal sites, the cybersecurity vulnerabilities of DER systems must be understood and addressed. This presentation covers two NREL tools available. The Distributed Energy Resource Cybersecurity Framework (DER-CF) is a web-based holistic tool for evaluating cybersecurity posture including governance, physical security and technical management. The Distributed Energy Resource Risk Manager (DER-RM) extends the DER-CF by applying it to the NIST risk management framework process. It will be downloadable application that runs locally and documents all the major requirements for achieving Authority to Operate the DER.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗
DOE OSTI2022

Protecting Smart Buildings with STIG

This is a submission for the 2022 Intern Poster Session. The abstract of the poster is: Smart buildings are getting more common, and so are hackers that target them. The physical systems in our businesses and homes are now vulnerable to cyber attacks. Using STIG, an INL program that turns cybersecurity data into graphs, buildings can be better protected.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2025

Data Centers and Digital Assurance Workshop 3 – Mitigations for Digital Assurance Risks

The third session of the TADA (Technical Assistance for Digital Assurance) Data Centers Cohort, held on November 18, 2025, focused on developing mitigation strategies for digital assurance risks identified in previous workshops. Hosted by Idaho National Laboratory (INL) and ScottMadden, the session emphasized the application of Cyber-Informed Engineering (CIE) to data center infrastructure, particularly at the utility–data center interface. Participants revisited and ranked key digital assurance risks, including architecture and interface weaknesses, governance gaps, and AI-enabled threats. The workshop introduced the 12 principles of CIE, advocating for consequence-focused design, engineered controls, and secure information architecture to proactively reduce cyber-physical vulnerabilities. These principles were applied to critical data center systems such as power distribution, UPS, cooling, SCADA/BMS, and grid-forming batteries. The session also addressed governance challenges at the interconnection boundary, highlighting the need for clear roles in telemetry sharing, firmware management, and trip settings. Special attention was given to emerging risks from behind-the-meter (BTM) generation, including reverse-power flow and the integration of small modular reactors (SMRs), which shift data centers from large loads to complex generation nodes. Participants explored how interconnection agreements can serve as enforceable instruments for digital assurance, and reviewed gaps in current standards such as NERC CIP, IEC 62443, and IEEE 1547. The workshop concluded with pathways to standardization, including model agreement language, state-level programs, and expanded NERC guidance. INL also presented tools and frameworks for secure procurement and supplier risk management, reinforcing the need for integrated engineering and policy solutions to secure the evolving data center–grid ecosystem. Session 3 of 3.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Resilient Hierarchical Networked Control Systems: Secure Controls for Critical Locations and at Edge

Integration of information and communication technology (ICT) offers new opportunities in improving the management and operation of critical infrastructures such as power systems as it allows connection of different sensors and control components via a communication network, leading to the so-called networked control systems (NCS). However, the use of open and pervasive ICT such as the Internet or wireless communication technologies comes at a price of making NCS vulnerable to cyber intrusions/attacks which may cause physical damage. Here, this chapter presents control algorithms to ensure resilient and safe operation of NCS under unknown cyberattacks. Specifically, a variant of dynamic watermarking strategies is presented by embedding encoding/decoding components of chaotic signals into the NCS for secure control for critical locations where the measurement/control signals are transmitted to/from the control center via a communication network. In addition, resilient cooperative control algorithms are discussed to ensure safe operation at edge of the NCS which consists of a large number of distributed controllable devices. Several numerical examples are provided to illustrate the proposed control strategies.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗
DOE OSTI2023

Visualizing Comparisons of Bill of Materials

Protecting critical infrastructure from cyber attacks, natural disasters, and other disruptions is a priority of the U.S. Government. Critical infrastructure includes providing electricity to homes and businesses, supplying natural gas for heating, and producing renewable energy sources. A loss of these services, as seen in the Solarwinds supply chain attack in 2020 , Texas snowstorm of 2021, the Colonial Pipeline cyber incident of 2021, and the Washington power substation attacks in 2022 result in high costs to consumers, disruption of everyday life, and even death. To protect the infrastructure, we first have to know what equipment we are protecting. The complexity of distributed manufacturing and development coupled with the increasing prevalence of cyber and supply chain attacks necessitates a greater understanding of the hardware and software components that comprise equipment in critical infrastructure. When a vulnerability in a single software library can have disastrous consequences, it is vital to understand critical equipment and systems at a granular level. This need has led to increased energy around the development and incorporation of bill-of-materials (BOM) into existing asset management practices to aid in mitigating, and responding to future attacks \cite{noauthor_software_nodate}. While much of the current research is devoted to creating BOMs, it is equally important to develop methodologies for leveraging BOMs to answer questions, such as: How has my software changed? Are two pieces of equipment equivalent? Does this piece of equipment that just arrived match my historical information? In this work, we demonstrate how BOMs can be represented by graph structures. We then describe how these structures can be fed into a graph comparison algorithm to produce a novel interactive visualization that allows us to not only identify differences in BOMs, but show exactly where they are in the product.

Jones, Rebecca D.↗
DOE OSTI2022

Authentication of smart grid communications using quantum key distribution

Smart grid solutions enable utilities and customers to better monitor and control energy use via information and communications technology. Information technology is intended to improve the future electric grid’s reliability, efficiency, and sustainability by implementing advanced monitoring and control systems. However, leveraging modern communications systems also makes the grid vulnerable to cyberattacks. Here we report the first use of quantum key distribution (QKD) keys in the authentication of smart grid communications. In particular, we make such demonstration on a deployed electric utility fiber network. The developed method was prototyped in a software package to manage and utilize cryptographic keys to authenticate machine-to-machine communications used for supervisory control and data acquisition (SCADA). This demonstration showcases the feasibility of using QKD to improve the security of critical infrastructure, including future distributed energy resources (DERs), such as energy storage.

24 POWER TRANSMISSION AND DISTRIBUTION↗
NASA NTRS2003

Managing information technology security risk

Information Technology (IT) Security Risk Management is a critical task for the organization to protect against the loss of confidentiality, integrity and availability of IT resources. As systems bgecome more complex and diverse and and attacks from intrusions and malicious content increase, it is becoming increasingly difficult to manage IT security risk. This paper describes a two-pronged approach in addressing IT security risk and risk management in the organization: 1) an institutional enterprise appraoch, and 2) a project life cycle approach.

security toolset↗
DOE OSTI2021

Managing the techno-economic impacts of partial string failure in multistring energy storage systems

The role of energy storage systems (ESSs) is becoming increasingly important for today’s electric power systems. Unavailability of an ESS assigned to critical grid services may cause unwanted disruption of those services and hence, may have a significant techno-economic impact. Like any physical equipment, an ESS is vulnerable to various types of faults. Failure of one or more strings in a multistring ESS does not have to be the cause of shutting down the entire ESS. It can still operate with a partial number of strings and continue providing critical services to the grid, if there are no reliability or safety issues and is acceptable under applicable standards. However, it is important to make sure that the control strategies are adaptable to the changes in ESS capacity caused by failed strings. Also, depending on the previous operation and type of failure, the reallocation of duty cycle burden among available strings could be non-uniform. These complexities suggest that mitigation of the impact of partial failure in multistring ESSs is not trivial and needs careful consideration. This is the topic of this paper. The proposed work investigates the impact of partial failure of a large multistring ESS on the assigned service and develops strategies to adjust the ESS control duty cycles for reducing such impacts. In doing so, the paper proposes a novel two-stage framework that plans for the multistring failure using robust optimization theory and then adjusts in real-time using a rule-based algorithm, based on the real-time information on the power availability of the string. Illustrations provided in this work are based on frequency regulation use-case, which is a common application for many utility-scale ESSs. A 750 kilowatt (kW)/1500 kilowatt-hour (kWh) 3-string ESS is used for the demonstration in this work and the efficacy of the proposed method is demonstrated and compared against methods that do not incorporate string failure in their strategy. In particular, here we show that revenue loss of 93% can be incurred when partial string failure is not included in operation and planning. These losses in revenue are reduced by 60% with the proposed method.

25 ENERGY STORAGE↗
DOE OSTI2021

A Cyber-Resilience Risk Management Architecture for Distributed Wind

Distributed wind is an electric energy resource segment with strong potential to be deployed in many applications, but special consideration of resilience and cybersecurity is needed to address the unique conditions associated with distributed wind. Distributed wind is a strong candidate to help meet renewable energy and carbon-free energy goals. However, care must be taken as more systems are installed to ensure that the systems are reliable, resilient, and secure. The physical and communications requirements for distributed wind mean that there are unique cybersecurity considerations, but there is little to no existing guidance on best practices for cybersecurity risk management for distributed wind systems specifically. This research develops an architecture for the consideration of cyber risks associated with distributed wind systems. The architecture takes into account the configurations, challenges, and standards for distributed wind to create a risk-focused perspective that considers of threats, vulnerabilities, and consequences, with special emphasis on what sets distributed wind systems apart from other distributed energy resources (DER). We discuss common distributed wind architectures and how they are interconnected to larger power systems. Because cybersecurity cannot exist independently, the cyber-resilience architecture must consider the system holistically. Finally, we discuss the implementation of a risk assessment process that uses the cyber-resilience framework to address challenges specific to distributed wind.

17 WIND ENERGY↗
NASA NTRS2011

Climate Hazard Assessment for Stakeholder Adaptation Planning in New York City

This paper describes a time-sensitive approach to climate change projections, developed as part of New York City's climate change adaptation process, that has provided decision support to stakeholders from 40 agencies, regional planning associations, and private companies. The approach optimizes production of projections given constraints faced by decision makers as they incorporate climate change into long-term planning and policy. New York City stakeholders, who are well-versed in risk management, helped pre-select the climate variables most likely to impact urban infrastructure, and requested a projection range rather than a single 'most likely' outcome. The climate projections approach is transferable to other regions and consistent with broader efforts to provide climate services, including impact, vulnerability, and adaptation information. The approach uses 16 Global Climate Models (GCMs) and three emissions scenarios to calculate monthly change factors based on 30-year average future time slices relative to a 30- year model baseline. Projecting these model mean changes onto observed station data for New York City yields dramatic changes in the frequency of extreme events such as coastal flooding and dangerous heat events. Based on these methods, the current 1-in-10 year coastal flood is projected to occur more than once every 3 years by the end of the century, and heat events are projected to approximately triple in frequency. These frequency changes are of sufficient magnitude to merit consideration in long-term adaptation planning, even though the precise changes in extreme event frequency are highly uncertain

Horton, Radley M.↗
NASA NTRS2018

Developing Land Use Land Cover Maps for the Lower Mekong Basin to Aid Hydrologic Modeling and Basin Planning

This paper discusses research methodology to develop Land Use Land Cover (LULC) mapsfor the Lower Mekong Basin (LMB) for basin planning, using both MODIS and Landsat satellitedata. The 2010 MODIS MOD09 and MYD09 8-day reflectance data was processed into monthlyNDVI maps with the Time Series Product Tool software package and then used to classify regionallycommon forest and agricultural LULC types. Dry season circa 2010 Landsat top of atmosphere reflectance mosaics were classified to map locally common LULC types. Unsupervised ISODATAclustering was used to derive most LULC classifications. MODIS and Landsat classifications werecombined with GIS methods to derive final 250-m LULC maps for Sub-basins (SBs) 1–8 of the LMB.The SB 7 LULC map with 14 classes was assessed for accuracy. This assessment compared randomlocations for sampled types on the SB 7 LULC map to geospatial reference data such as Landsat RGBs,MODIS NDVI phenologic profiles, high resolution satellite data, and Mekong River Commissiondata (e.g., crop calendars). The SB 7 LULC map showed an overall agreement to reference data of~81%. By grouping three deciduous forest classes into one, the overall agreement improved to ~87%.The project enabled updated regional LULC maps that included more detailed agriculture LULCtypes. LULC maps were supplied to project partners to improve use of Soil andWater AssessmentTool for modeling hydrology and water use, plus enhance LMB water and disaster managementin a region vulnerable to flooding, droughts, and anthropogenic change as part of basin planningand assessment.

land use land cover mapping; SWAT hydrologic model↗
NASA NTRS1997

Alternative Perspectives on Risk

The goal of the commercial air transport system is to provide air transportation to the flying public at an acceptable cost with minimal risk. in an ideal situation these three goals would support each other. In fact, it is sometimes the case that the goals conflict: getting passengers to their destinations on time may conflict with fixing a minor mechanical malfunction that may or may not impact safety; flying a route that will avoid turbulence, thereby providing passengers with a more comfortable ride, may consume more fuel; managing traffic density may mean aircraft are delayed or must use an approach that will result in a long taxi to their gates, costing time and fuel. Various players in the system--pilots, dispatchers, controllers, as well as managers in the airline carriers and traffic management system--make decisions every day that involve trade-offs of benefits and costs. The prospect of revisions in the air traffic management system, with shifts in responsibilities from controllers to users, including airline operations center personnel and pilots, means that individuals may be performing either new jobs or old jobs under new guidance. It will be essential to know how the various players (a) perceive the risks and benefits associated with the decisions they will make under the old and new control structures, and (b) how much risk they are willing to accept in making decisions. Risk is here defined as the probability and magnitude of negative events (after Slovic, 1987). Of primary interest are risks associated with traffic, weather, and operational factors such as schedule, fuel consumption, and passenger service. Previous research has documented differences between groups in perceptions of risks associated with both everyday and aviation related situations. Risk perception varies as a function of familiarity with the situation, degree to which one is potentially affected by the risk, the level of control one has over the situation, and one's level of experience and responsibility in the situation. In our presentation we will consider several factors that may influence differences in risk perception, risk tolerance and risk management among the three major categories of participants in the aviation system (pilots, dispatchers, and controllers). Primary factors that may affect risk attitudes (the collective term we will use for the three components of risk) include: expertise or job-specific knowledge or training, personal involvement or vulnerability to consequences, goals, time horizon (imminence of consequences), span of control and type of control, and information or technology support. These will be considered in the context of five different types of risk (physical threat, economic, social, legal, and ethical). A study designed to study differences between pilots and controllers in their perceptions and responses to traffic risks under the present and a user-preferred control situation will be described. Future studies involving dispatchers' risk perceptions regarding various types of risk will be discussed.

Davison, Jeannie↗
NASA NTRS2010

Playing a 3-Stringed Violin: Innovation via the Joint Evolution of People, Process, and Knowledge Management System

Users continuously evaluate the value and performance of their Knowledge Management Systems (KMS). As suggested by a punctuated socio-technical system process model, today's success can quickly become tomorrow's failure should the KMS fail to meet evolving needs and expectations. The more deeply a tool is embedded in the actual work process, the more vulnerable it is to emergent changes and perturbations. This paper uses the metaphor of a "3-stringed violin" to explore how differing levels of user knowledge about tools and processes can lead to system perturbations and how the active involvement of other actors can dampen the impact of perturbations, i.e., help the system survive the operational equivalent of a broken string. Recommendations suggest ways to increase system resiliency and contribute to incremental innovation.

Socio-technical systems↗
DOE OSTI2020

Projecting spatiotemporally explicit effects of climate change on stream temperature: A model comparison and implications for coldwater fishes

Conservation planners and resource managers seek information about how the availability and locations of cold-water habitats will change in the future and how these predictions vary among models. In this work, we used a physical process-based model to demonstrate the implications of climate change for streamflow and water temperature in two watersheds with distinctive flow regimes: the Snoqualmie watershed (WA) and Siletz watershed (OR), USA. Our model incorporated a downscaled ensemble of global climate model outputs and was calibrated with in situ and remotely sensed water temperatures. Furthermore, we compared predictions from our processed-based model to those from a publicly available and widely used statistical model. The process-based model projected greater changes in summer maximum water temperatures for the mixed-rain-snow Snoqualmie watershed than for the rain-dominated Siletz watershed as a result of the near-complete loss of winter snowpack and significant reduction in summer flow in the Snoqualmie watershed expected by the 2080s. Both models projected generally similar future spatial patterns of maximum water temperature in the two rivers, with cool reaches distributed farther upstream and fewer in number. However, the process-based model projected higher spatial heterogeneity in water temperature due to our spatially explicit simulation of streamflow and because we calibrated the model with spatially continuous remotely sensed water temperature data. We used stream temperature projections to assess the vulnerability of Pacific salmon and trout to changes in the spatial distribution of cold-water habitats during August by the 2080s. Results suggest that salmonids may have fewer summertime cold-water habitats in both watersheds. Projected stream warming may further limit particular species and life stages, especially in the Snoqualmie watershed. Our comparison of models highlights the importance of considering what might be gained by using a process-based model for evaluating and prioritizing management actions that mitigate climate impacts on cold-water habitats for stream fishes.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2021

Vegetation water sources in California's Sierra Nevada (USA) are young and change over time, a multi-isotope ( δ 18 O, δ 2 H, 3 H) tracer approach.

Sierra Nevada forests transpire a significant amount of California's water resources, sparking interest in applying forest management to improve California's water supply. Determining the source water of evapotranspiration enables forest managers to make informed decisions. To this end, a significant interest in critical zone science is to develop new methods to work across time scales to predict subsurface water storage and use. Here, forest vegetation accessed young water and switched sources depending on availability, suggesting that forest drought vulnerability may depend on the range of water sources available (rain, snowmelt and deeply stored water). This finding also suggests that changes in transpiration rates may have immediate effects on water sources in close proximity to vegetation, and delayed effects on storage and runoff. New δ 18 O, δ 2 H and 3 H data were used to track precipitation, runoff, evapotranspiration and storage through the critical zone seasonally, including seasons where evapotranspiration and snowmelt were in phase (winter snowmelt) and out of phase (seasonally dry summer). The main source of this headwater catchment's runoff is derived from its meadow saturated zone water, which was dominated by snowmelt. Water that originated as snowmelt contributed to transpiration, unless other sources, such as recent rain, became available. In cases where xylem δ 18 O and δ 2 H signatures matched those of deeper saturated zone water, 3 H data showed that xylem water was distinctly younger than the deep saturated zone water. During 2016, which experienced relatively normal snowpack in winter and seasonally dry summer conditions, mean summer saturated zone water and vegetation water were similar in δ 18 O, –12.4 ± 0.04 ‰ and – 12.5 ± 0.3 ‰, respectively, but were distinctly different in 3 H, 5.5 ± 0.2 pCi/L and 13.7 ± 1.1 pCi/L, respectively. While δ 18 O shows that vegetation and meadow saturated zone water have similar origins, 3 H shows they have dissimilar ages.

58 GEOSCIENCES↗
DOE OSTI2026

FFTSF: Revisiting Sub-Seasonal Streamflow Forecasting with Simple Feedforward Network

Accurate short-to-subseasonal streamflow forecasts are vital for water management, including flood preparedness, drought mitigation, hydropower scheduling, and ecosystem protection. However, extending a forecast beyond a few days remains challenging due to complexity of hydrological processes. While recent self-attention based transformer architectures such as iTransformer have gained traction in time-series forecasting, these models suffer from several critical limitations: (1) significant computational overhead that scales quadratically with sequence length, (2) vulnerability to overfitting on limited hydrological datasets, (3) degraded performance on long-horizon forecasts due to attention decay, and (4) excessive architectural complexity that hampers interpretability and operational deployment. In this study, we propose a simple Feedforward Time Series Forecasting (FFTSF) network that directly addresses these limitations through its lightweight architecture and long-range forecasting capabilities. We evaluate FFTSF across 178 USGS stream gauges spanning diverse climate regimes by forecasting lead times of 1-, 7-, 14-, and 30-days. Our results demonstrate that FFTSF achieves competitive performance at short lead times (NSE of 0.778 for 1-day forecasts) while substantially outperforming complex baselines at longer forecast period, achieving the highest NSE (0.271) at 30-day forecasts with greater robustness and stability. For 30-day forecasts, FFTSF achieves a 71% improvement over NLinear, 57% improvement over DLinear and 12% improvement over the computationally intensive iTransformer while requiring fewer computational resources. Our findings reveal that architectural complexity is not necessary for hydrological forecasting, demonstrating that well-designed simple models can outperform attention mechanisms for subseasonal streamflow forecasting. The computational efficiency and consistent long-range performance of FFTSF make it suitable for water management applications where reliable extended forecasts are essential.

Krishnan Kutty Ambika, Anukesh [ORNL] (ORCID:00000↗
NASA NTRS2018

Radiation Testing Electronics with Heavy Ions-The Best Way to Hit a Target Moving Ever Exponentially Faster

In 1972, when engineers at Hughes Aircraft Corporation discovered that errors in their satellite avionics were being caused by cosmic rays (so-called single-event effects, or SEE), Moore's Law was only 7 years old. Now, more than 45 years on, the scaling that drove Moore's Law for its first 35 years has reached its limits. However, electronics technology continues to evolve exponentially and SEE remain a formidable issue for use of electronics in space. SEE occur when a single ionizing particle passes through a sensitive volume in an active semiconductor device and generates sufficient charge to cause anomalous behavior or failure in the device. Because SEE can occur at any time during the mission, the emphasis of SEE risk management methodologies is ensuring that all SEE modes in a device under test are detected by the test. Because a particle's probability of causing an SEE generally increases as the particle becomes more ionizing, heavy-ion beams have been and remain the preferred tools for elucidating SEE vulnerabilities. In this talk we briefly discuss space radiation environments and SEE mechanisms, describe SEE test methodologies and discuss current and future challenges for use of heavy-ion beams for SEE testing in an era when the continued validity of Moore's law depends on innovation rather than CMOS scaling.

space radiation environments↗
DOE OSTI2021

Automation for Distributed Energy Resources Risk Manager Using OSCAL

The risk management framework (RMF) provides a well-organized and thorough approach to diagnose information technology (IT) system threats, to gather required materials to comply with industry standards, and to document a plan for achieving authority to operate (ATO). ATO is given by the operating authority with the awareness of vulnerabilities that arise when operating the IT system. The primary goal of the National Renewable Energy Laboratory’s (NREL’s) distributed energy resource (DER) RM application is to provide a user-friendly interface and in-depth guidance for generating the authorization package for the authorizing official to review. In other words, the application satisfies steps 1 through 7 of the RMF process with a focus on DERs.

cybersecurity↗