SEARCH · Search NASA

Results for “Infrastructure vulnerability”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 343 records · Page 19

All sources NASA NTRS DOE OSTI

DOE OSTI2023

The Impacts of Developing a Port Network for Floating Offshore Wind Energy on the West Coast of the United States

Floating offshore wind is a pre-commercial industry with the potential for significant market growth on the U.S. West Coast in the near future; however, significant investment in port infrastructure will be required to enable the industry to progress from demonstration projects to efficient and cost effective commercial deployment. Developing a system of ports that can enable commercial-scale floating wind development on the West Coast of the United States will require significant levels of funding and coordination between governments, industry, ports, and local communities. A critical first step to strategically planning these resources is understanding the number of ports (and associated investment) that would be required to support different phases of offshore wind projects, including manufacturing, installation, and operation. But simply tallying up these costs is not sufficient to understand how a robust network of ports could impact local communities, the environment, workforce development, the offshore wind industry, and the West Coast region as a whole. In this report, the authors present analyses and perspectives related to port development in California, Oregon, and Washington. We describe the requirements for floating offshore wind ports that conduct manufacturing, installation, and/or service activities, and estimate the investment and time frames required to construct these ports at suitable locations in West Coast states. We develop indicators for the vulnerability and workforce accessibility of coastal communities and consider the potential risks and benefits associated with port development in these locations. We model how the proximity of an offshore wind project to installation and operations ports can impact the levelized cost of energy of the project, and then consider how these costs could be affected by local or foreign supply chains. We build upon these analyses to develop scenarios with increasing levels of offshore wind deployment and port assets on the West Coast and show how these ports could enable deployment goals to be achieved. Finally, we draw upon outreach with key floating wind stakeholders to summarize five key challenges that will need to be overcome to develop a comprehensive port network, and present potential approaches that could help to address these obstacles.

17 WIND ENERGY↗

NASA NTRS2022

Yonkers Urban Development II: Leveraging NASA Earth Observations to Support Modeling Urban Cooling Interventions and Urban Heat Vulnerability in Yonkers, New York

The City of Yonkers, New York, located in Westchester County, is experiencing rising temperatures which are a growing threat to the health and safety of its residents. Furthermore, the risk of heat-related illnesses and mortality disproportionately affects neighborhoods in Yonkers historically subjected to race-based housing segregation. To better understand these inequities, Groundwork Hudson Valley and NASA DEVELOP collaborated for a second term to evaluate community-level heat vulnerability, landcover distribution, street-level thermal comfort, and modeled urban cooling interventions. This team applied 2019 5-year American Community Survey (ACS) data and social and biophysical heat vulnerability variables established by the New York State Department of Health (NYSDOH), along with land surface temperature (LST) data collected from Landsat 8 Thermal Infrared Sensor (TIRS), and ISS ECOsystem Spaceborne Thermal Radiometer Experiment on Space Station (ECOSTRESS) to identify communities in Yonkers in need of prioritized cooling intervention at the census tract level. Data from the Real-Time Mesoscale Analysis (RTMA) provided relevant meteorological data for the ENVI-met model to conduct street-level thermal observations and model tree canopy cooling interventions in the Yonkers neighborhoods of Kimball and Old 7th Ward. The project results will support the prioritization and equitable distribution of cooling infrastructure in identified neighborhoods. Additionally, Groundwork Hudson Valley will use the analyses as a heat literacy tool to improve advocacy efforts and inform both residents and officials about how investment in deliberate modification to tree canopy cover improves the city’s thermal environment and helps mitigate extreme heat.

Tamara Barbakova↗

DOE OSTI2022

Drivers of Future Physical Water Scarcity and Its Economic Impacts in Latin America and the Caribbean

Future water scarcity is a global concern with significant impacts on the energy, water, and land (EWL) sectors. Countries in Latin America and the Caribbean (LAC) are significant producers of agricultural goods consumed around the world, so disruptions resulting from land and water scarcity in LAC are a source of global supply chain risk. Understanding where water scarcity in LAC could occur and what could drive that scarcity to emerge is critical for strategic resource management and planning, both regionally and globally. Assessing future water scarcity impacts in LAC is challenging given the multisector dynamic interactions among the EWL sectors and the multiple uncertainties acting across different spatial scales. We use scenario discovery to explore the drivers of future water scarcity, considering assumptions related to climate, socioeconomics, and the EWL sectors. Understanding what factors drive uncertainty across outcomes can help stakeholders in targeting long-term solutions and future data collection efforts. To illuminate these dynamics, we use a database consisting of a large ensemble of scenarios representing diverse worlds simulated using the Global Change Analysis Model. We quantify future water scarcity and its economic impacts across the scenarios using three metrics: (1) physical water scarcity, (2) water price, and (3) crop profit. We find that physical water scarcity and water price are driven primarily by reservoir storage capacity assumptions, highlighting the importance of strategic water infrastructure development in maintaining future water availability and accessibility. Crop profit is driven by a combination of water supply and demand assumptions, which emphasizes the complex nature of EWL multisector dynamics. While most of LAC is poised to have abundant land and water resources available for development, water basins in Mexico and along the Pacific coast of South America experience high levels of severity and uncertainty across the future scenarios for at least one of the metrics. We find that the drivers of extreme scarcity vary spatially and across the metrics, further highlighting the heterogeneity of the region and the importance of considering multiple metrics to assess water scarcity vulnerability.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2026

Roadmap for Solar Photovoltaic (PV) Cybersecurity: A vision for improving cyber maturity of distributed and utility-scale solar energy installations

As the solar energy sector continues to expand, its integration into the broader energy infrastructure presents both unprecedented opportunities and new risks. The increasing reliance on digital technologies and interconnected systems in solar energy creates an expanded attack surface for motivated cyber adversaries. Cyberattacks have the potential to cause disruptions in energy production, damage to equipment, financial losses, and compromises in national security. Therefore, ensuring robust cybersecurity measures is paramount to protect the integrity, availability, confidentiality, and access control of solar energy systems. However, there are still key gaps and challenges to be addressed in industry and research, which stakeholders must race to address as they combat a growing number of real-world cyber incidents that affect solar energy systems and a growing number of vulnerabilities discovered and disclosed in key types of equipment. This roadmap explore the current state of solar PV cybersecurity and the gaps and challenges still to be addressed.

14 - SOLAR ENERGY↗

DOE OSTI2021

Future Changes in Snowpack, Snowmelt, and Runoff Potential Extremes Over North America

Snowpack and snowmelt-driven extreme events (e.g., floods) have large societal consequences including infrastructure failures. However, it is not well understood how projected changes in the snow-related extremes differ across North America. Using dynamically downscaled regional climate model (RCM) simulations, we found that the magnitudes of extreme snow water equivalent, snowmelt, and runoff potential (RP; snowmelt plus precipitation) decrease by 72%, 73%, and 45%, respectively, over the continental United States and southern Canada but increase by up to 8%, 53%, and 41% in Alaska and northern Canada by the late 21st century. In California and the Pacific Northwest, there is a notable increase in extreme RP by 21% contrary to a decrease in snowmelt by 31% by the late century. These regions could be vulnerable to larger rain-on-snow floods in a warmer climate. Regions with a large variability among RCM ensembles are identified, which require further investigation to reduce the regional uncertainties.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2023

Incremental Threshold Scheme Enabled IoT Group Key Management

Cyber landscape evolves rapidly. Internet of Things (IoT) and Edge Computing (EC) have rapidly become an integral part of the modern computing infrastructure. It is expected that there will be more than 50 billion active and connected IoT devices by 2025 [1]. Pervasive IoT/EC creates unprecedented opportunities bridging the gap between previously segregated cyber and physical spaces. However, this progress also brings along new security challenges. IoT devices typically have limited computation, communication, and storage resources. This leads to security architecture designs such as using symmetric keys for group communication. While secure and efficient in stable network settings, symmetric key solutions are ill-adapted for IoT's highly dynamic device mobility behavior and frequent group membership turnover. Whenever IoT members leave a group, the known symmetric keys cannot be made forgotten, posing a serious vulnerability. This leads to frequent re-groupings that require expensive re-authentication, key regeneration, and key redistribution in order to maintain IoT/EC security. We present a novel symmetric key management framework that integrate an Incremental Threshold Scheme (ITS) cryptographical function into communication protocol's key rotation mechanism to allow for secure and efficient symmetric key communication group member node revocation. This ITS-enabled key management framework alleviates the need of frequent and expensive re-grouping and re-keying needed by today's large and dynamic IoT/EC operations. We further applied this ITS-enabled key management framework to a distributed IoT/EC-integrated publish and subscribe framework for applicability validation.

Li, Mingyan↗

NASA NTRS2011

Safety-Critical Partitioned Software Architecture: A Partitioned Software Architecture for Robotic

The flight software on virtually every mission currently managed by JPL has several major flaws that make it vulnerable to potentially fatal software defects. Many of these problems can be addressed by recently developed partitioned operating systems (OS). JPL has avoided adopting a partitioned operating system on its flight missions, primarily because doing so would require significant changes in flight software design, and the risks associated with changes of that magnitude cannot be accepted by an active flight project. The choice of a partitioned OS can have a dramatic effect on the overall system and software architecture, allowing for realization of benefits far beyond the concerns typically associated with the choice of OS. Specifically, we believe that a partitioned operating system, when coupled with an appropriate architecture, can provide a strong infrastructure for developing systems for which reusability, modifiability, testability, and reliability are essential qualities. By adopting a partitioned OS, projects can gain benefits throughout the entire development lifecycle, from requirements and design, all the way to implementation, testing, and operations.

(Avionics Application Standard Software Interface ↗

NASA NTRS2021

Future Changes in Snowpack, Snowmelt, and Runoff Potential Extremes Over North America

Eunsang Cho↗

DOE OSTI2022

Cybersecurity Standards for Photovoltaic Operations

Solar energy plays an important role in securing a more resilient, cyber-secure electrical grid in Pennsylvania. Solar's ability to be widely "distributed" on residential and large roofs, marginal lands, and many other locations across Pennsylvania - as opposed to being centralized - offers a strong option for addressing the myriad of potential disruptions that can occur to the grid's infrastructure. And when combined with energy storage, local energy needs can be met immediately without having to wait on the delivery of an off-site fuel source. As more and more distributed solar electricity generation is brought online, researchers, technology developers, solar developers and grid operators are paying close attention to the potential for solar to enhance grid cybersecurity. Although nobody may know when, where, or how the next cyberattack will take place, there are security measures, technical solutions, and management practices that are being implemented across the industry to protect against network control issues and grid operations. Everyone participating in the solar value chain stands to gain from a coordinated, iterative approach to protect against cyber vulnerabilities and build deeper resilience into the architecture of our grid.

cybersecurity↗

DOE OSTI2022

WISP: Watching grid Infrastructure Stealthily through Proxies (Final Technical Report)

The complex interdependencies of cyber systems (sensors and communications), physical grids and associated electricity market operations make protecting electric power grids a significant challenge. The energy sector is constantly under new, targeted, advanced and dangerous cyber-attacks that have the potential to result in the loss of human life. These threats are further exacerbated by our need to modernize the grid. One focus of cyber security research in smart grids is the securing of the SCADA system through advanced intrusion detection systems (IDS) and bad data detection algorithms in state estimation. These methods either require full knowledge of the system topology and parameters or fail to understand the physical behaviors under attack. WISP (Watching grid Infrastructure Stealthily through Proxies) is designed to provide additional protection to the power grid using only publicly available data. In particular, WISP exploits the spatio-temporal nature of the real time locational marginal prices (LMPs), in conjunction with other information such as bids, weather, outages and load data to analyze anomalous power pricing behaviors and then correlate those observations to localize regions of interest and identify potential cyber events. WISP is non-intrusive as the tool is deployed as a service in the Cloud or on premise and provides reliable information to system operators for enhanced situational awareness, without impeding energy delivery functions. The WISP technology comprises three modules: the data-driven anomaly detection core, the vulnerability and risk analysis and the root cause analysis. The data-driven anomaly detection core performs the tasks of feature selection, anomaly detection and attack region localization. The vulnerability and risk analysis module provides system level information of the vulnerable variables and times, assisting the operators in selecting monitoring and protection nodes. The root cause analysis module takes the detection results and identifies potential operational conditions that contribute to the detected anomalies. In Phase I, we have demonstrated the feasibility and effectiveness of WISP. We developed a realistic electricity market simulator capable of generating normal and attack market data under various operational conditions. We developed a series of cyber-attack detection and analysis algorithms and evaluated them under multiple data sources. Finally, we integrated all modules into an end-to-end software, providing functions for data management, data analytics and visualization. Specifically, we have achieved: (i) real-time data acceptance from external utility interfaces with >99% acceptance rate; (ii) high performance anomaly detection algorithms with >98% detection accuracy and <0.1% false alarm rate; and (iii) ultra-low computing delay <50 milliseconds. Additionally, our team developed algorithms to identify the vulnerable variables in electricity market operations and root cause analysis functions to identify major contributors to the price spikes. These ancillary modules are necessary when deploying WISP in real world industry environment. In Phase II, we have demonstrated the effectiveness of WISP software on realistic largescale power systems. We performed red team testing for the Phase I WISP software and identified software vulnerabilities and implemented corresponding mitigation solutions. We adapted the electricity market simulator for the Texas synthetic 2000-bus system and generated datasets for the false data injection attacks. We created database and visualization interfaces for the Texas system and the ISO New England system. We performed software optimization in terms of operation efficiency, computing speed and detection accuracy. Finally, we tested the software on the Texas system and the ISO New England system and evaluated the detection performance. Overall, we achieved above 89% detection rate, below 3% false alarm rate and below 37 seconds of end-to-end detection delay.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2026

The UCAR Africa Initiative: Recent insights, challenges, and opportunities to foster collaborative research for environmental sustainability

Africa is increasingly being exposed to the negative impacts of climate and environmental change, while having less capacity to respond compared to other continents. The vulnerability partially results from unprecedented demographic growth, urbanization, and industrialization. However, the continent has still largely been underserved by the broader Earth System Science (ESS) community, as evidenced by the limited amount of ESS data and research that cover Africa compared to other areas of the world. Here we present the recent University Corporation for Atmospheric Research (UCAR) Africa Initiative that aims to enhance environmental sustainability in Africa by fostering international collaborative research partnerships co-led by African scientists. Specifically, we outline urgent challenges and opportunities identified through an international workshop in six areas of ESS namely (1) air quality and health, (2) weather, (3) climate, (4) land and water, (5) social science perspectives, and (6) developing equitable collaboration and sustainable infrastructure. We highlight examples of successful partnerships and conclude with recommendations to advance collaborative, actionable ESS research that addresses Africa’s critical environmental challenges.

African weather and land variability↗

DOE OSTI2024

Coupling of the Electricity and Transportation Sectors - Part I: Sector Overviews

“Sector coupling” is a concept that addresses potential designs for the future power industry. Traditionally, the energy sectors, i.e., electricity supply, transport, and industry, have functioned largely independently from one another. Thus, the concept of sector coupling means that the electricity sector would become the central pillar of the energy system, supplying the other sectors – transportation and industry – with energy in various ways, a scheme described by the term “Power-to-X”. This report delves into the ambitious goal set by the United States to achieve net-zero emissions by 2050, with a pivotal milestone of making half of all passenger vehicles sold in America zero-emission by 2030. Central to achieving this objective is the electrification of the transportation sector, resulting in complex interactions between this sector and the electric industry. As electric vehicles become more prevalent, a shift in the dependency on electricity for vehicle charging emerges, alongside a reduction in the electricity demand associated with maintaining the fossil fuel supply chain. Both the electricity and fossil fuel have been identified as critical infrastructure sectors, the transportation sector's historical reliance on fossil fuels, and the mature supply chain supporting them are explored. This study emphasizes the existing sectoral coupling between the electric energy and transportation sectors, extending beyond vehicle charging to essential operations at refineries, pipeline facilities, storage, and fuel extraction. Recognizing the critical dependency of fossil fuel supply chain operations on the electric sector, this research underscores the need for a comprehensive view of the evolving dynamics between the transportation and electric sectors. This study has been split into two segments, Part-I provides an overview of the existing fossil fuel supply chain architecture and the electrical sector. We provide an in-depth analysis of the grid-transportation sectoral coupling, its interactions, the vulnerabilities and essential take-aways that would help us to address them and apply towards an electrified transportation sector in the future. We engaged with stakeholders to understand their expectations in enabling an electrified transportation. We accumulate the understandings from the current fossil fuel-based system in developing a risk matrix, by identifying all the threats and vulnerabilities and how would they apply to both the current and future transportation systems in Part-II of this report.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2023

Implementation of an ICS Ransomware Testbed: Scenarios, Variants, and Evaluation Methods

Ransomware attacks on Industrial Control Systems (ICS) have emerged as a formidable threat to the United States’ critical infrastructure, eliciting grave concerns regarding national security. In March 2023, the FBI Internet Crime Complaint Center (IC3) unveiled its 2022 Internet Crime Report, highlighting a concerning 870 complaints related to ransomware impacting U.S. critical infrastructure. Of the country's 16 critical infrastructure sectors, 14 encountered at least one ransomware attack. Notably, while the Healthcare and Public Health sector suffered the most, reporting 210 attacks, sectors pivotal to ICS networks and governmental organizations were also targeted: the Defense Industrial Base reported 1 attack, Water and Wastewater Systems 3, Chemical 19, Energy 15, Government Facilities 115, and Critical Manufacturing 157. For instance, a ransomware attack on a major chemical company could jeopardize not only its production but also pose environmental risks should systems controlling hazardous materials be compromised. In 2022, three ransomware variants predominantly targeted U.S. critical infrastructure: HIVE, with 87 attacks; ALPHV/BlackCat, with 114; and LOCKBIT, with 149. Several cyber-attacks, such as the MOVEit data breach in May 2023 and the Colonial Pipeline ransomware attack in May 2021, have been so impactful that they commanded national attention. The DarkSide hacking group's assault on the Colonial Pipeline, initiated on May 6th, 2021, stands as one of the most substantial and publicly acknowledged cyber-attacks against U.S. critical infrastructure. The group exploited an exposed Virtual Private Network (VPN) password, paving the way for initial intrusion and subsequent data theft. A mere day later, DarkSide unleashed a ransomware attack that compromised vital accounting and billing systems, prompting an immediate shutdown of the pipeline to mitigate further ransomware proliferation across its network. This crisis spurred a robust response from the U.S. president and regulators, culminating in a national emergency declaration related to the pipeline shutdown on May 9th, 2021. This incident mirrors the 2017 NotPetya ransomware attack that significantly impacted the shipping giant Maersk, highlighting an urgent need for fortified cybersecurity across various industries. Future incidents, akin to the Colonial Pipeline attack, could potentially be mitigated—or entirely averted—should government agencies and private entities scrutinize system vulnerabilities, exploring various ransomware types and entry points. Proactive measures, such as conducting experiments on VPN accounts or auditing passwords to pinpoint duplicate usage across diverse systems and software, might illuminate feasible entry points and vulnerability zones within an organization's systems.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

NASA NTRSDate not supplied

The Application of Remote Sensing using NASA Earth Observations paired with Sociodemographic Indicators to Identify Communities Most Susceptible to Urban Heat Exposure in Austin, Texas

In recent years, Austin, Texas has experienced an increase in population and urban development. Additionally, the City’s climate—already characterized by periods of extreme heat and drought—continues to change. As temperatures and demand for utilities and cooling resources rise, the number of heat-related deaths and illnesses in socially vulnerable populations (e.g., older, lower-income populations) is expected to increase. The City of Austin, The University of Texas at Austin (UT Austin), and The University of Texas Health Science Center at Houston (UT Health) partnered with NASA DEVELOP to examine the distribution of urban heat throughout the City. This project used land surface temperature, greenness, plant water content, and urban surface material analysis parameters derived from NASA Earth observations from Landsat 8 Operational Land Imager (OLI), Landsat 8 Thermal Infrared Sensor (TIRS), and Aqua and Terra Moderate Resolution Imaging Spectroradiometer (MODIS). The project team produced three different indices to create a spatial analysis for the study area including a social vulnerability index (SoVI), heat exposure index (HEI), and an overall heat priority index (HPI) score. This overall score was determined with a weighted analysis of heat-related environmental variables from NASA Earth observations and socioeconomic data from the 2019 American Community Survey. Based on the HPI score, the project team identified 121 census block groups out of 605 total that are designated as being most at risk of adverse impacts from extreme heat events. To test the sensitivity of the HPI, the team used a Monte Carlo analysis using different approaches for geographic scale, variable inclusion, census uncertainty, and index aggregation. Based on the sensitivity analysis, the resulting HPI score showed the metric was consistent with the baseline HPI. This provided increased confidence the score can be used as a tool to make informed infrastructure improvement plans in targeted areas (e.g., siting of cooling centers) and ensure equitable sustainable development.

Ryan Hammock↗

DOE OSTI2025

The Sensor Dilemma in Intelligent Transportation Systems: Evaluating Radar, Lidar and Camera: Preprint

Intelligent transportation systems (ITS) are at the forefront in advancing the way we interact with and perceive the transportation network. This revolution is fueled by the significant advancement in sensor perception technologies such as radar, lidar, and video imaging, which are the most popular modalities for ITS. Real-time perception data from these sensors allow intelligent infrastructure-side decision-making to improve the energy, efficiency, and safety at traffic intersections. As traffic departments across the United States transition from traditional loop detectors and emulators and embrace newer technologies, they are often left with a dilemma in choosing a sensor technology for infrastructure-based perception that is reliable, inexpensive, and easy to set up and that has robust performance in varying weather conditions. However, choosing a sensor that checks all these boxes is not straightforward, as every sensor type has unique benefits and drawbacks. Radar is excellent at detecting long-range vehicles and weather resistance but lacks high resolution. Lidar is expensive and weather-sensitive, while cameras provide rich visual data at a low cost but are constrained by lighting and visibility. This study examines radar, lidar, and camera sensor capabilities to ascertain whether any of these qualifies as the "best" sensor for ITS perception. While no single sensor can meet all the demands of ITS, a hybrid approach combining multiple sensor modalities like radar, lidar, and cameras offers the most robust solution for enhancing the safety and efficiency of ITS. Through this evaluation, we hope to draw attention to the necessity of the National Renewable Energy Laboratory's infrastructure perception and control framework, which presents a multisensor track data fusion engine to assimilate multiple data streams in order to provide robust and reliable perception.

33 ADVANCED PROPULSION SYSTEMS↗

NASA NTRS2016

Climate Science for Decision-Making in the New York Metropolitan Region

New York City is one of the world's most vulnerable cities to coastal flooding, due to a high concentration of population and assets near a coastline exposed to warm-season tropical storms and cold -season Nor'easter storms. Among U.S. cities, New York City is second only to New Orleans in population living less than 4 ft above the local high tide. By the 2050s, average annual losses due to coastal flooding alone could exceed $2 billion for the combined New York City-Newark region. Perhaps the most iconic example of a vulnerable New York City asset is the financial district located at the southern tip of Manhattan, however low-lying coastal assets include the full complement of major highways, subways and tunnels, hospitals, schools, wastewater treatment plants, food distribution centers, and people's homes. Given the magnitude of the assets at risk, a compelling case can be made that long-term adaptation makes economic sense for New York City. Given New York's access to economic, human, and technological resources for resilience measures, the City may be able to achieve this resilience. The city's political environment-New York City is a place where climate science is generally not a partisan issue-and the city's experience with uncertainty and overall risk framing (e.g., financing of bond issues for multi-billion dollar infrastructure with multidecade expected lifetimes), encourage climate risk framing.

Horton, Radley↗

DOE OSTI2024

SCA Tools - SCRM Value Add or Lossy Noise Machines

Software supply chain risk management (SCRM) depends upon accurate information regarding the software components that comprise any given software system. The collection of components included in a software package can be organized within a software bill of materials, or SBOM. SBOMs are ideally generated when the software components are put together, such as at compile time, but for many reasons that has not and is not always possible. For example, legacy or proprietary software packages often do not have SBOMs available to downstream consumers of that software. It’s not just end users that are affected, manufacturers themselves also must deal with this problem. To answer these questions, the market has seen the rise of several commercial software composition analysis (SCA) tools. These tools aim to peer into completed software systems, automatically identifying hidden software dependencies and looking up known vulnerabilities associated with those dependencies to enable end-users to enhance their cyber supply chain risk management processes. These tools are potentially a huge boon to end users of legacy and proprietary software – and a potential bane, depending on how accurate they are. This research asks that question – how accurate are currently available binary SCA tools – and provides answers to several other questions: What does it mean to be “accurate”? What limitations do the tools have in identifying common edge cases that take place in modern software development? Can they help you avoid a devastating supply chain attack, or is it all just noise? After researching SCA tools on the market, we identified three vendors that fit our use case and would provide analysis on compiled binaries. Using these tools, we submitted firmware for critical infrastructure devices for analysis and SBOM generation. The SBOM outputs were then cross referenced with SBOMs generated through manual analysis for comparison. In addition to the firmware samples, we also submitted edge case samples based off a popular open-source library that were specifically crafted to evaluate each tools’ ability to accurately identify components. These samples were customized to be consistent with modifications we have seen in modern software development as well as a couple that are representative of supply chain attacks.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

2021 Annual Report Laboratory Directed Research & Development

The Department of Energy’s (DOE) Laboratory Directed Research and Development (LDRD) program is an essential pathway for innovation, capability growth, and research staff development at Idaho National Laboratory (INL). This program enables timely and agile response to national security, energy, and environmental challenges that motivate INL’s mission to discover and demonstrate innovative nuclear energy solutions and other clean energy options as well as securing our critical infrastructure. This report highlights INL’s LDRD projects concluding in fiscal year (FY) 2021 which included innovative research and development (R&D) across INL’s five science and technology initiatives: nuclear reactor sustainment and expanded deployment, integrated fuel cycle solutions, integrated energy systems, advanced design and manufacturing for extreme environments, and secure and resilient cyber-physical systems.

99 GENERAL AND MISCELLANEOUS↗