Search NASA⌕ Search

SEARCH · Search NASA

Results for “Critical Infrastructure Protection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Quantitative Systems Modeling for Critical Infrastructure Predictions in Climate Change: A National Defense Framework

Any national defense is dependent on the efficacy of the available physical infrastructure. Whatever degrades infrastructure, structurally, physically, architecturally, or esthetically, is of interest to the nation. Climate change is now a major significant factor of interest impinging on national critical infrastructure. The devastating effects of climate change have increasing pervasiveness throughout the world. The impact on critical infrastructure is of particular interest to researchers. In consonance with ASCE-ASME's special issue on critical infrastructure protection and resilience, this paper presents a systems-modeling approach for critical infrastructure and predictions in relation to climate change agreements in COP26. The paper addresses high-level critical systems-based assessment of the social, legal, economic, and technical nuances impinging on the viability of COP26 agreements. The paper was written using a multinational collaboration approach. In conclusion, the specific focus of national defense is used as the backdrop for the methodology of the paper.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2026

Digital-Threat Bias and Psychological Distance: Barriers to Foundational Digital-Security Improvement

Modern life is held together by a web of digital dependencies that enable and provide delivery of critical services and functions—think the provision of utilities such as electricity and water, as well as our dependency on digital services for social and economic services (internet, communication, etc.). As this dependency grows, the complexity related to the delivery of these critical services increases as well. As complexity increases, the understanding of the risk and impact associated with potential disruption, degradation, or destruction—due to either malicious or non-malicious events of those digitally enabled functions—decreases. One potential explanation for the difficulty to 1) understand the risks faced and 2) address them appropriately and effectively is the abstractness and psychological distance assigned to “digital threat.” The complexity of these digitally enabled services creates a perceived complicatedness; as a result, digital threats are treated differently than similarly devasting (but more easily understood) kinetic or physical threats. How we categorize these threats also matters. Acts of cyber-enabled sabotage to critical infrastructure need to be defined as irregular warfare. By inadequately defining the threat, we compound the problem. Acknowledging this digital-threat bias is foundational to improving the ability to protect critical infrastructure. Using construal-level theory and psychological-distance concepts provides an intriguing starting point to address these issues, to reframe the challenges faced, and pursue more effective critical infrastructure security and defense policy.

29 - ENERGY PLANNING, POLICY AND ECONOMY↗
DOE OSTI2023

Visualizing Comparisons of Bill of Materials

Protecting critical infrastructure from cyber attacks, natural disasters, and other disruptions is a priority of the U.S. Government. Critical infrastructure includes providing electricity to homes and businesses, supplying natural gas for heating, and producing renewable energy sources. A loss of these services, as seen in the Solarwinds supply chain attack in 2020 , Texas snowstorm of 2021, the Colonial Pipeline cyber incident of 2021, and the Washington power substation attacks in 2022 result in high costs to consumers, disruption of everyday life, and even death. To protect the infrastructure, we first have to know what equipment we are protecting. The complexity of distributed manufacturing and development coupled with the increasing prevalence of cyber and supply chain attacks necessitates a greater understanding of the hardware and software components that comprise equipment in critical infrastructure. When a vulnerability in a single software library can have disastrous consequences, it is vital to understand critical equipment and systems at a granular level. This need has led to increased energy around the development and incorporation of bill-of-materials (BOM) into existing asset management practices to aid in mitigating, and responding to future attacks \cite{noauthor_software_nodate}. While much of the current research is devoted to creating BOMs, it is equally important to develop methodologies for leveraging BOMs to answer questions, such as: How has my software changed? Are two pieces of equipment equivalent? Does this piece of equipment that just arrived match my historical information? In this work, we demonstrate how BOMs can be represented by graph structures. We then describe how these structures can be fed into a graph comparison algorithm to produce a novel interactive visualization that allows us to not only identify differences in BOMs, but show exactly where they are in the product.

Jones, Rebecca D.↗
DOE OSTI2016

Architecture and Methods for Substation SCADA Cybersecurity: Best Practices

There are over 3000 electricity providers in the United States, encompassing investor and publicly owned utilities as well as electric cooperatives. There has been ongoing trends to increasingly automate and provide remote control and monitoring of electric energy delivery systems. The deployment of computer network technologies has increased the efficiency and reliability of electric power infrastructure. However, the increased use of digital communications has also increased the vulnerability to malicious cyber attacks [1]. In 2004 the National Research Councils (National Academies) formed a committee of specialists to address these vulnerabilities and propose possible solutions with an objective to prioritize the R&D needs for developing countermeasures. The committee addressed many potential concerns in the electric power delivery system and classified them based upon different criteria and presented recommendations to minimize the gap between the academic research directions and the needs of the electric utility industry. The complexity and diversity of the electric power delivery system in the U.S. has opened many ports for attackers and intruders [1]. This complexity and diversity is attributed to the fact that power delivery system is a network of substations, transmission and distribution lines, sub-networks of controlling, sensing and monitoring units, and human operator involvement for running the system [1]. Accordingly, any incident such as the occurrence of a fault or disturbance in this complex network cannot be deferred and should be resolved within an order of milliseconds, otherwise there is risk of large-scale outages similar to the occurrences in India and the U.S. in 2003 [2]. There are three main vulnerabilities in supervisory control and data acquisition (SCADA) systems commonly identified—physical vulnerability, cyber vulnerability and personal vulnerability [1]. In terms of cyber threats, SCADA systems are the most critical elements in the electric power grid in the U.S. Unauthorized access to a SCADA system could enable/disable unexpected equipment (such as disable the protection system or a circuit breaker) which could cause large scale disruptions of electric power delivery. This paper provides an overview of power system SCADA technologies in transmission substations (Section 2) and summarizes the best practices for implementing a cyber security program. After introducing SCADA system operations in Section 2, a description of the security challenges for SCADA systems is presented in Section 3. In Section 4, NECRC Critical Infrastructure Protection standards CIP-002 through CIP-009 are summarized. An overview of industry best practices is presented in Section 5.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Dover CoreGuard Ⓡ Cybersecurity Protections for Critical Energy Infrastructure Final Report

This report documents the status of technical objectives and activities for the Department of Energy (DOE) Small Business Innovation Research (SBIR) Phase I project, titled “Dover CoreGuard Ⓡ Cybersecurity Protections for Critical Energy Infrastructure” (Award No. DE-SC0023743), undertaken by Dover Microsystems, Inc., Wayland, MA. The Principal Investigator for this project was Dr. Stephen Papa, Dover’s Chief Technology Officer (CTO). The contract PoP (Period of Performance) is scheduled for completion by February 9, 2024.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2024

Cyber Resilience and Social Equity: Twin Pillars of a Sustainable Energy Future

This paper examines the intersection of security and accessibility within energy systems amidst the rise of grid modernization and digitization, especially considering the regulatory changes and the imperatives of inclusive energy strategies. It addresses the dual need for secure, resilient infrastructure and a commitment to mitigate energy poverty while maintaining equitable access to energy. Amid escalating cybersecurity and physical threats, the paper advocates for sustainable energy delivery systems that ensure robust defenses without compromising the goals of reducing energy poverty and ensuring energy security. This paper identifies the pressing need for Cyber-Informed Engineering (CIE) and Secure-by-Design (SbD) principles, highlighting how these strategies can protect critical infrastructure and democratize access to secure energy, particularly for disadvantaged communities. The analysis underscores the challenges presented by the expansion of attack surfaces, interoperability requirements, and grid-edge analytics, offering innovative solutions that leverage advanced technologies and data-driven insights. Furthermore, this paper addresses the workforce development gap, emphasizing the necessity for public-private partnerships and vendor engagement in creating a skilled cybersecurity workforce. This paper has a dual focus on both the technological aspect of cybersecurity and the social dimension of equity within the context of sustainable energy development. It suggests a comprehensive examination of how these two critical elements interact and support the overarching goal of a sustainable energy future.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2019

2019 Wireless Test Bed Range Manual

Idaho National Laboratory (INL), Next Generation Wireless Test Bed (NGWTB) program, is part of the Critical Infrastructure Protection (CIP) initiative. Our nation’s reliance on wireless and Internet technology is rapidly evolving as more corporations and government agencies, employees, and handheld devices include mobile connectivity for both voice and data. The competitive advantage offered by a mobile workforce is leading many corporations to make wireless integration and convergence a top business priority. Similarly, military systems worldwide are rapidly embracing next-generation commercial technologies to accelerate network-centric capabilities and provide enhanced situational awareness. While handheld devices such as laptops, BlackBerrys, and cell phones once had limited mobility and range, they are rapidly incorporating new and multiple protocols such as Bluetooth, Wi-Fi, Satellite, and broadband cellular (3G/4G) on a single platform to increase their effectiveness and agility. Worldwide there is exponential growth in public Wi-Fi and/or Satellite connectivity access nodes, and 3G/4G cellular continues to evolve and expand the range and speed of these devices. Additionally, critical infrastructure networks, previously isolated or connected with dedicated wireline circuits, are incorporating Zigbee for wireless sensor networks, wireless LANs for maintenance functions, and cellular or Internet based backhaul to manage control centers. Yet with all the build-up surrounding wireless technology, few understand the complexities surrounding wireless protocols and security, the risks of converged network infrastructures, need for interoperability of communication systems, or mitigation measures to safely use and improve new technologies in both commercial and military environments. With no single vendor source for all the telecommunications equipment needed for wireless infrastructure upgrades, and no one entity providing end-to-end testing or independent validation, the INL's NGWTB program fulfills a niche for facilitating integrated testing of multiple technologies, across multiple wireless domains, of next generation wireless telecommunications systems. NGWTB engineers and technicians have constructed and operate domain infrastructure in the Wireless Personal Area Network (WPAN), Wireless Local Area Network (WLAN), Wireless Metropolitan Area Networks (WMAN), and Wireless Wide Area Networks (WWAN). Advantages that make the INL's NGWTB the place to conduct project and programmatic testing include: • NTIA Experimental Station authority • Geographically isolated and low-noise radio frequency (RF) test areas located on a 890 sm DOE reservation • Access to isolated high-speed LAN and FOT networks The rollout of next-generation networks will involve deploying new technologies at every level including new: handsets, frequencies, antenna arrays, cell configurations that are optimized for both data and voice, massive upgrade of cell controllers’ “land-line” phone links from low bandwidth connections to higher capacity fiber or wireless backhaul, and integration of voice switching and Internet/data network protocols (Voice-Over-IP, Web phones). These systems are expected to greatly transform our nation's communications infrastructure and the types of services it provides.

2G↗
DOE OSTI2023

DER Digital Supply Chain Gap Analysis

Solar photovoltaic (PV) cybersecurity is a growing field of research. As deployments of solar PV have increased, cyber risk has also increased. Utility solar PV installations, however, are not required to comply with the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) plan unless they meet a minimum generation threshold of 75 MW. Individual residential-scale solar PV deployments will not meet that generation threshold and are therefore excluded from the NERC CIP requirements. With most solar installations less than 75 MW, solar PV has been deployed with minimal oversight and highly variable cybersecurity maturity. The resources that comprise the digital supply chain can include software, code, data, and other digital components. But as clean energy technologies advance, cybersecurity threats and vulnerabilities continue to evolve and grow in sophistication. Supply chain cybersecurity represents a critical area for ensuring safe operations as the U.S. moves toward a clean energy future.

cybersecurity↗
DOE OSTI2018

Nuclear Power Plant Simulation and Cybersecurity

Critical infrastructure protection is vital to the day-to-day operation of any country, and those systems need to be protected to the fullest extent possible. As with what was seen in Ukraine in late 2016, with the cyber attack on the power grid, these systems are susceptible to attacks that can cause serious damage, both physically and economically. This incident shut down the power grid for 6 hours, with nearly 80,000 people affected. Cyber security can be referred to as the protection of data and systems in networks, both wired and wireless, from unauthorized access or attack. In nuclear power plants, assessments of cyber security are critical to ensuring the safe and reliable operation of the systems used. According to the Nuclear Regulatory Commission (NRC), the purpose of cyber security assessments is to detect and then eliminate or mitigate vulnerabilities in the digital system that could be exploited either from outside or inside the digital system protected area. These cyber security assessments are essentially intended to reduce cyber security risk. The NRC refers to cyber security risk as the combination of the consequence to the nuclear power plant and the susceptibility of a digital system to internal and external cyber attack.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2023

Supply Chain Cybersecurity Recommendations for Solar Photovoltaics

Solar photovoltaic (PV) cybersecurity is a growing field of research. As deployments of solar PV has increased, cyber risk has also increased. However, utility solar PV installations are not required to comply with North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) unless they meet a minimum generation threshold of 75 Megawatts (MW). Individual residential scale solar PV deployments will not meet that generation threshold and are therefore excluded from NERC CIP requirements. With most solar installations below 75MW, solar PV has been deployed with minimal oversight and highly variable cybersecurity maturity. The resources that make up the digital supply chain can include software, code, data, as well as other digital components. However as clean energy technology advances, cybersecurity threats and vulnerabilities continue to evolve and grow in sophistication. Solar PV faces a unique challenge in which it can be deployed in residential buildings and purchased by a consumer directly. This makes the supply chain of PV a unique challenge, where responsible parties for cybersecurity vary widely depending on the type of solar PV being deployed. Supply chain cybersecurity for solar PV represents a critical area for ensuring safe operations as the U.S. moves towards a clean energy future.

14 SOLAR ENERGY↗
DOE OSTI2019

Risk Assessment at the Edge: Applying NERC CIP to Aggregated Grid-Edge Resources

Distributed energy resources (DERs) promise to deliver benefits for both utilities and consumers by dynamically interoperating utility systems with customer-owned grid-edge technologies. These small energy-consuming devices are increasingly being aggregated for participation in grid markets, planning and operations. A cyber attack penetrating the control system of aggregated DERs could negatively impact the operation of the grid. In the worst case, the power grid could be severely damaged and physical safety compromised. In this paper we analyze cybersecurity risks associated with the aggregation of DERs and develop an approach to mitigating that risk. The approaches to both cyber risk analysis and mitigation were developed during a recent research project that serves as an example of how the approaches could be applied. However, both the risk analysis and mitigation are applicable to the broader domain of all DERs. An important conclusion is that the successful cyber compromise of aggregated DERs could have a significant impact on the bulk power system. This is the case even if each individual DER falls below the threshold of compliance with bulk-grid cybersecurity standards. For this reason, we specifically investigate how National Electricity Reliability Corporation's Critical Infrastructure Protection requirements could flow down to interactions between DER aggregators and the DERs themselves in order to protect the grid from these bulk-scale cyber attack impacts.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2017

States of Cybersecurity: Electricity Distribution System Discussions

State and local entities that oversee the reliable, affordable provision of electricity are faced with growing and evolving threats from cybersecurity risks to our nation's electricity distribution system. All-hazards system resilience is a shared responsibility among electric utilities and their regulators or policy-setting boards of directors. Cybersecurity presents new challenges and should be a focus for states, local governments, and Native American tribes that are developing energy-assurance plans to protect critical infrastructure. This research sought to investigate the implementation of governance and policy at the distribution utility level that facilitates cybersecurity preparedness to inform the U.S. Department of Energy (DOE), Office of Energy Policy and Systems Analysis; states; local governments; and other stakeholders on the challenges, gaps, and opportunities that may exist for future analysis. The need is urgent to identify the challenges and inconsistencies in how cybersecurity practices are being applied across the United States to inform the development of best practices, mitigations, and future research and development investments in securing the electricity infrastructure. By examining the current practices and applications of cybersecurity preparedness, this report seeks to identify the challenges and persistent gaps between policy and execution and reflect the underlying motivations of distinct utility structures as they play out at the local level. This study aims to create an initial baseline of cybersecurity preparedness within the distribution electricity sector. The focus of this study is on distribution utilities not bound by the cybersecurity guidelines of the North American Electric Reliability Corporation (NERC) to examine the range of mechanisms taken by state regulators, city councils that own municipal utilities, and boards of directors of rural cooperatives.

14 SOLAR ENERGY↗
DOE OSTI2017

Recommended Guidelines for NERC CIP Compliance for Synchrophasor Systems

Compliance with the NERC requirements for Critical Infrastructure Protection (CIP) for synchrophasor systems in the Version 5 paradigm seems to be a matter of some uncertainty for those in the synchrophasor user community. This report aims to provide clarification and guidance in the form of case studies based on methods seen in the industry

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2018

Executive Summary to PDCI Oscillation Damping Controller Software Documentation

This report serves as the executive summary to the comprehensive document that describes the software, control logic, and operational functions of the Pacific DC Intertie (PDCI) Oscillation Damping Controller. The purpose of the damping controller (DCON) is to mitigate inter-area oscillations in the Western Interconnection (WI) by active improvement of oscillatory mode damping using phasor measurement unit (PMU) feedback to modulate power flow in the PDCI. This report provides the high level descriptions, diagrams, and charts to receive a basic understanding of the organization and structure of the DCON software. This report complements the much longer comprehensive software document, and it does not include any proprietary information as the more comprehensive report does. The level of detail provided by the comprehensive report on the software documentation is intended to assist with the process needed to obtain compliance for North American Electric Reliability Corporation Critical Infrastructure Protection (NERC-CIP) as a Bulk energy system Cyber Asset (BCA) device. That report organizes, summarizes, and presents the charts, figures, and flow diagrams that detail the organization and function of the damping controller software. The PDCI Wide-Area Damping Controller is the result of a collaboration between Sandia National Laboratories (SNL), Bonneville Power Administration (BPA), Montana Tech University (MTU), and the Department of Energy (DOE).

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

CCE Phase 1: Consequence Prioritization

Idaho National Laboratory (INL) developed the Consequence-driven Cyber-informed Engineering (CCE) methodology to provide public and private organizations with steps to work collaboratively and establish a working relationship to protect critical infrastructure and other national assets. This process is a considerable undertaking, iterative in nature, and—as time and resources allow—should become a part of a company’s culture. By focusing on the impact of potentially negative Events, CCE provides a better understanding of how and why adversaries can affect critical functions and services using cyber-enabled sabotage. This document describes Phase 1 of the CCE process.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2021

Machine learning and artificial intelligence for wildfire prediction

Wildfire ignition, intensity, and spread rates are tightly linked with water cycle extremes. The science of wildfire prediction has traditionally encompassed the use of physical and empirical models to quantify the direction and speed of fire spread, plume injection and fire-aerosol impacts on atmospheric composition, predictions of fire season severity on subseasonal-to-seasonal (S2S) time scales, and assessment of the spatial and temporal patterns of fire risk across landscapes. Together with expanding observation networks, machine learning and artificial intelligence (AI) have the potential to revolutionize the application of such models for fire science, saving lives, protecting critical infrastructure, and providing more accurate estimates of wildfire-climate feedbacks.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2023

Bat Smart Curtailment: Efficacy and Operational Testing

Curtailment, or blanket curtailment, is a leading method to mitigate the impacts to bats from operating wind turbines. Although this strategy results in considerable decreases in bat fatalities, it also results in decreased energy production. In 2019, Natural Power was awarded funding by the Department of Energy to assess the readiness of the informed smart curtailment technology, EchoSense (formerly referred to as Detection and Active Response Curtailment, [DARC]). The research undertaken by this project expands the understanding of alternative methods, known as smart curtailment, to maintain a reduction in bat fatalities while simultaneously recovering lost energy associated with blanket curtailment. The overall project was composed of three major tasks; Task 1 was focused on cybersecurity compliance of the EchoSense system in accordance with the North American Electric Reliability Corporation Critical Infrastructure Protection (“NERC CIP”) standards, Task 2 assessed the mechanical loads exerted on turbines when operating under a smart curtailment regime, and Task 3 assessed the efficacy of the EchoSense system at an operational wind farm. Regarding Task 1, an external review by the National Renewable Energy Laboratory determined that the EchoSense system did not create any new cybersecurity weaknesses and was compliant with the NERC CIP standards. As a result of this process, Natural Power developed some best practices (10.1) for wind- wildlife technology developers. In conjunction with the National Renewable Energy Laboratory, the results (10.2) of the loads testing demonstrated that the periodic curtailment and release of turbines by the EchoSense system did not have any detrimental impact on the mechanical components of a wind turbine (Task 2). During the late summer to fall of 2020 and 2021, Natural Power demonstrated that the use of the EchoSense smart curtailment system resulted in no significant difference in bat fatalities compared to blanket curtailment with cut-in speeds at 6.9 m/s (2020) and 5.0 m/s (2021) while resulting in a significant difference in decreased lost energy (Task 3). This translates to an average of 41% (2020) and 56% (2021) reduction in per turbine energy loss compared to blanket curtailment. The reduction in energy loss that would have been achieved by EchoSense curtailment compared to blanket curtailment, if applied across all 69 turbines, is roughly equivalent to having an additional turbine on site. These results are notable for finding a balance between the environmental impact of wind energy and the economic feasibility in energy production associated with mitigating that impact. https://www.naturalpower.com/us/expertise/service/engineering-operations/echosense

17 WIND ENERGY↗
DOE OSTI2024

Multilevel Cybersecurity for Photovoltaic Systems

The motivation behind this project is to protect critical infrastructure in electric power generation pertaining to solar photovoltaic (PV) systems. This growing renewable energy resource is becoming a more vital part of the nation’s energy portfolio, particularly since it has achieved grid-parity to existing generation methods in terms of cost. It is thus vital that steps be taken to ensure the cybersecurity of these assets. The project goal was to devise a multilevel cybersecurity solution to address PV security gaps at the inverter and system levels, and field test the solution under the supervision and review of a US-based solar inverter manufacturer and PV installer/operator. A two-level cyberattack defense approach was formulated whereby the first level, the solar inverter level, hardens individual devices and achieves a deeply cyber-secure inverter. The inverter level security involves a multi-layer defense-in-depth approach for securing the inverter while also providing data for the system level algorithms. The second level, the system level, addresses intrusion detection and restoration involving an ensemble of inverters and relevant systems.

14 SOLAR ENERGY↗