DERIVING A FRAMEWORK FOR INSIDER RISK POTENTIAL USING ARTIFICIAL NEURAL NETWORKS FOR INSIDER THREAT DETECTION & MITIGATION.
Abstract not provided.
Heffington, Colton↗
SEARCH · Search NASA
Results for “Insider Threat Mitigation”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Using an NMAC System Enhanced for Nuclear Security to Mitigate the Insider Threat
Explore the source record for details and available documents.
Foust, Nathaniel Edward↗
DERIVING A FRAMEWORK FOR ?INSIDER RISK POTENTIAL? FROM USING ARTIFICIAL NEURAL NETWORKS FOR INSIDER THREAT DETECTION & MITIGATION.
Abstract not provided.
Heffington, Colton↗
Vulnerabilities in Artificial Intelligence and Machine Learning Applications and Data
Artificial intelligence (AI) applications driven by machine learning (ML) are transformational technologies within the international nuclear security regime. Advancements realized by AI—faster and improved data insights, more efficient and automated processes, reductions in human error—enable nuclear security applications such as behavior analysis for insider threat mitigation, source tracking of stolen nuclear material, and facial recognition software for physical protection. In addition to the advantages, however, there are also inherent vulnerabilities and threats associated with its use and risk mitigations must be built into any AI/ML-enabled systems. This work provides a background on AI and ML and different data types used in the field, including open-source intelligence information (OSINT) that is discoverable by AI tools and application data that are used by AI tools for decision-making and automation. Current and potential AI applications and vulnerabilities related to their use within the nuclear security regime are also discussed.
45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
Study on Application of Distributed Network of Sensors with List Mode for NMAC Literature Review
Nuclear material accounting and control (NMAC) for nuclear security detects, deters, and resolves questions related to unauthorized removal (i.e. theft) or misuse of nuclear material. NMAC also serves as a key insider threat mitigation measure and aids in recovery of nuclear material that is missing. Effective nuclear security depends on NMAC for timely and accurate information about nuclear material types, quantities, and locations. Bulk nuclear material processing facilities, however, present unique challenges for effective NMAC due to the presence of large quantities of material in-process and the accumulation of residual material holdup within process equipment. These holdup accumulations can obscure accurate physical inventory taking and complicate efforts to resolve NMAC irregularities at the facility level. Bulk material monitoring systems often rely on material balance calculations and indirect measurement techniques, which may mask protracted theft of smaller amounts of nuclear material. These monitoring limitations have generated increased interest in continuous monitoring technologies, including distributed non-destructive assay (NDA) sensor networks capable of providing real-time or near-real-time measurement of material movement and accumulation within bulk processing environments. Recent advancements in distributed networks of NDA radiation detectors and sensing technologies provide an opportunity to address these limitations. Although such distributed sensor networks have been implemented in select facilities for IAEA Safeguards applications, their potential for supporting NMAC functions specifically tailored to nuclear security objectives remains largely unexplored. Furthermore, emerging list-mode data acquisition technologies have reached high technology readiness levels, enabling time-correlated detection of nuclear events across multiple temporal scales. These capabilities provide enhanced opportunities for accurate holdup measurement, continuous process monitoring, and improved detection of material theft or misuse over time. The increasing global expansion of civil nuclear power and development of related bulk material processing facilities, including those supporting high-assay low-enriched uranium (HALEU) and other advanced reactor fuel fabrication, further increases the need for advanced measurement and monitoring strategies for NMAC.
73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
Artificial Intelligence for (AI) Nuclear Security: Expert Perspectives on AI Priorities for the Office of International Nuclear Security
Artificial intelligence (AI) has the potential to transform nuclear security operations, offering opportunities to enhance effectiveness while simultaneously introducing new challenges. As AI technologies rapidly evolve, agencies across the United States Government (USG) are researching, implementing, and evaluating various AI models and systems. Given the broad capabilities and applications of these technologies, it is essential for each agency to identify and articulate those areas where it can make meaningful contributions aligned with its mission and expertise. To address this need for strategic focus, in late Fiscal Year 2025 (FY2025), the Office of International Nuclear Security (INS) established an AI Task Force (AITF) to gather input from subject matter experts (SMEs) regarding the most appropriate role INS could serve in researching, evaluating, or implementing AI for nuclear security. The AITF engaged 15 experts from national laboratories with backgrounds in cyber security, physical security, transport security, insider threat mitigation, nuclear engineering, human-systems engineering, and AI/ML development. This white paper summarizes the insights gathered from these SMEs and presents a potential roadmap for INS engagement with AI technologies. The recommendations outlined here are intended to inform INS leadership as they make strategic decisions about resource allocation and program direction in this rapidly evolving technological domain.
97 MATHEMATICS AND COMPUTING↗
Operationalizing Insider Threat Potential and Risk-Significant Insiders to Enhance Insider Threat Detection and Mitigation
Explore the source record for details and available documents.
Williams, Adam David↗
Test and Evaluation of Radiofrequency Tamper Indicating Devices for Remote Monitoring of Advanced/Small Modular Reactors
Advanced and small modular reactors (A/SMRs), due to their versatile nature, are likely to be used in remote locations to provide electrical power or other services in regions that are difficult to access or have limited transportation infrastructure. This will result in limited on-site staff, therefore driving A/SMR vendors to consider remote monitoring as a solution to support nuclear security. Maintaining Continuity of Knowledge (CoK) of nuclear material quantities and locations is vital to nuclear security, and remote monitoring of active tamper indicating devices (TIDs) has been well established as a component of International Atomic Energy Agency (IAEA) Safeguards since the early 2000s. Active TIDs, such as radiofrequency TIDs (RFTIDs), immediately alarm upon unauthorized access attempts, promoting timely detection. In contrast, passive TIDs require a surveillance regime and offer delayed detection. Active TIDs deter insiders and enable prompt detection of malicious acts. They can be used on nuclear material containers and controlled entry points like vaults and toolboxes. Therefore, the implementation of RFTIDs into security programs bolsters overall nuclear material control, and provides a visible deterrent, with primary efficacy in mitigating the insider threat and potentially allowing for Security by Design considerations. They are a strong candidate technology for maintaining nuclear security of A/SMRs but need to be evaluated for feasibility and implementation into the wider physical protection system.
22 GENERAL STUDIES OF NUCLEAR REACTORS↗
Domestic Extremism: How to Counter Threats Posed to Critical Assets
Although facilities with sensitive information, hazardous materials, critical infrastructure, or other sensitive items have security measures in place to protect those critical assets, the threat of domestic extremism (DE) has challenged those security measures in new ways. The project described in this brief report used focus groups to identify best practices, tools, or techniques relevant to preventing or countering DE and sought to identify gaps in security measures. Five focus groups with twenty-two subject matter experts from government, healthcare, and other stakeholder groups were conducted to understand how organizations protect critical assets against the DE threat. The results of the focus groups underscore the importance of organizational culture, codes of conduct, and behavior observation programs in prevention of DE events. In addition, results emphasized the value of multidisciplinary teams, employee assistance programs, and regular threat assessment as resources when responding to DE incidents. However, monitoring of social media and lack of adequate resources remain challenges when attempting to prevent or counter the DE threat.
98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
C.9 Scribe NMAC Layer Video Development
This task incorporates NMAC insider threat principles and good practices into video format for aiding in training activities. It was labeled as Task C.9 under the FY24 Annex 1 for NA-211 SSM A&I Pillar. For activity development, the setting of a research and test reactor, RTR, was selected as the focus of this fiscal year. More specifically, a TRIGA reactor was selected for facility and reactor inspiration. FY 23/24 developed materials Research Reactor Facility Measures against the Insider Threat, LLNL-MI-839144, was used as a reference for selecting relevant, suggested mitigation measures to incorporate into the script and subsequent videos. Throughout the initial phases of development, discipline SMEs met with Scribe SMEs from Sandia National Laboratory to create the initial story arc and assess the limits of Scribe/Odin technologies available for the project. As a result, the decision for a two-fold deliverable was developed and utilized as the basis for script development efforts over the first half of the fiscal year.
99 GENERAL AND MISCELLANEOUS↗
Analyzing Insider Risk Threat to the Internet of Things (IoT)
Recent technological advancement has created a growing convergence of innovation. From machine learning to ubiquitous computing to wireless networks and automation, the world is seeing new technology increasingly capable of connecting with each other. Devices and systems use open communications networks to interact, process information, and react. This is called the Internet of Things (IoT) and is comprised of physical devices that exchange data over networks, creating revolutionary possibilities. The most common way most people interact with an IoT is through ‘smart home’ products like Amazon’s Alexa, which use microphones, speakers, and phones to control a variety of devices, from lights and thermostats, to cameras, to appliances and vacuum cleaners. But the open nature of IoT networks—necessary for their ability to communicate and operate—also introduces privacy and security concerns. At a personal level, this might mean a hack into a home to steal private information, but when applied in broader industries like healthcare, transportation, manufacturing, or the military, this vulnerability can have serious consequences. As IoT usage and interconnectivity increases, so too does the susceptibility to malicious actors. And the entire system is only as secure as its least secure member. This creates particular risk and vulnerability to radiological material industries, as a competent insider adversary could utilize the IoT to potentially steal or access classified or sensitive information about employees, sites, or systems; or simply sabotage security or maintenance from a more remote—and less secure—device. The IoT relies on a secure network across the entire system, especially in transport which may lack the security of more permanent locations; if one device fails, it can create a ripple effect and an insider threat may seek to exploit that connectivity. While IoT benefits drive increased innovation and usage, there are also vulnerabilities an insider threat could exploit; this risk of an IoT to radiological material must be addressed in any mitigation effort.
Kinney, Justin↗
Data Centers and Digital Assurance Introduction to Supply Chain and Cybersecurity for Data Centers, Session 1
The first session of the TADA (Technical Assistance for Digital Assurance) Data Centers Cohort Workshop, held on October 30, 2025, introduced foundational concepts of Digital Assurance in the context of data center and grid integration. Sponsored by the U.S. Department of Energy, the workshop brought together utilities, data center operators, developers, and vendors to address cybersecurity and supply chain vulnerabilities. The session emphasized the growing criticality of data centers within the electric grid and the need for secure, real-time, bidirectional communication. Participants explored the principles of Digital Assurance, including cybersecurity, cyber-informed engineering (CIE), and lifecycle security, and applied a threat-vulnerability-consequence framework to identify and mitigate risks at the data center–grid interface. Discussions covered a range of threats such as spoofed dispatch signals and insider threats, architectural vulnerabilities like SCADA interfaces and insecure protocols, and potential consequences including cascading grid failures. The session also raised strategic questions about business value, vendor assurance, and defining cyber boundaries and responsibilities. This foundational workshop set the stage for deeper technical analysis and the development of actionable frameworks in subsequent sessions. Session 1 of 3.
24 - POWER TRANSMISSION AND DISTRIBUTION↗
Proactive Intrusion Detection and Mitigation System
SAND2023-05661O The proactive intrusion detection and mitigation system (PIDMS) provides grid-edge situational awareness for cybersecurity defense by capturing real-time distributed energy resource (DER) network traffic and performance data with a novel approach that improves the detection and prevention of cyber-physical attacks. The PIDMS addresses the grid-edge security gap with real-time analysis of both network traffic and photovoltaic performance data to deliver a novel, cyber-physical intrusion detection system (IDS) approach that increases the accuracy and effectiveness of detection and mitigation. This hybrid IDS analysis enables dual monitoring that increases the workload of the adversary; both cyber and physical data would have to be simultaneously spoofed to evade detection. Furthermore, monitoring and analyzing cyber data are insufficient in some cases. For example, in an insider threat aimed at disrupting inverter grid-support functions where proper credentials and authentication are achieved, only the altered PV performance would indicate abnormal behavior. All in all, the PIDMS provides novel capabilities for: • Distributed, real-time cyber-physical detection and mitigation analysis • Cybersecurity defense for grid-edge systems • Analysis framework that can provide situational awareness across the transmission, distribution, and DER systems The PIDMS sensor is designed to collect cyber-physical data, process the data using machine-learning algorithms, detect abnormal events, and deploy mitigations. With these goals, the main functional PIDMS objectives are: • Capability to collect cyber-physical data • Onboard storage of cyber-physical data • Peer-to-peer communication • Computationally efficient machine-learning algorithms • Online cyber-physical data analysis • Alerting/visualization capabilities • Mitigation deployment capability with bump-in-the-wire (BITW) implementation Each of these functional objectives enable PIDMS to perform effective cyber-physical intrusion detection and mitigation. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.
Jones, Christian↗
Addressing Consequence within Operational Risk (O.T. Gagnon III) 9-18-2024
Addressing Consequence within Operational Risk: Why threats and security are just not that important! When dealing with cyber or physical risk within any critical infrastructure (CI) environment, don’t concern yourself with vulnerabilities and threats, at least not at first! Also, don’t be overly fixated on “securing the systems” within the organization. The endeavor of tackling operational risk focused on consequences in any critical infrastructure environment to include the complex Aviation ecosystem is challenging even for the most resourced entity but can be advanced though a simplified approach: identifying, binning, and prioritizing the infrastructure environment. While no two entities within a single element of the 16 critical infrastructure sectors are exactly alike when it comes to risk, there is a basic process to move toward a greater understanding of operational risk through becoming more informed about the infrastructure environment in which the entity exists. The process starts with bringing internal and external stakeholders and subject matter experts together to analyze key areas such as Information Technology (IT) and Operational Technology (OT) components and points of convergence, analyzing internal and external cyber and physical dependencies, accounting for explosive growth in devices and wireless technology, and leveraging the contributions of people inside and outside the operational environment. Attaining a common understanding of the infrastructure environment as part of addressing consequences within operational risk is not easy to do or resource light, but the process outlined provides the framework to further any entity’s efforts in this space. When it comes to cyber risks, before an organization can consider vulnerabilities within and threats to its operations, it must first have a solid understanding of the consequences existing inside its infrastructure environment. Idaho National Lab’s Consequence-Driven, Cyber-Informed Engineering is offered as an example of this approach to effective and efficient cyber risk mitigation.
99 GENERAL AND MISCELLANEOUS↗
Lightning Threat Analysis for the Space Shuttle Launch Pad and the Payload Changeout Room Using Finite Difference Methods
This report describes finite difference computer calculations for the Space Shuttle Launch Pad which predict lightning induced electric currents and electric and magnetic fields caused by a lightning strike to the Lightning Protection System caternary wire. Description of possible lightning threats to Shuttle Payload components together with specifications for protection of these components, result from the calculation of lightning induced electric and magnetic fields inside and outside the during a lightning event. These fields also induce currents and voltages on cables and circuits which may be connected to, or a part of, shuttle payload components. These currents and voltages are also calculated. These threat levels are intended as a guide for designers of payload equipment to specify any shielding and/or lightning protection mitigation which may be required for payload components which are in the process of preparation or being transferred into the Shuttle Orbiter.
Collier, Richard S.↗
Security Vulnerability and Mitigation in Photovoltaic Systems
Software and firmware vulnerabilities pose security threats to photovoltaic (PV) systems. When patches are not available or cannot be timely applied to fix vulnerabilities, it is important to mitigate vulnerabilities such that they cannot be exploited by attackers or their impacts will be limited when exploited. However, the vulnerability mitigation problem for PV systems has received little attention. This paper analyzes known security vulnerabilities in PV systems, proposes a multi-level mitigation framework and various mitigation strategies including neural network-based attack detection inside inverters, and develops a prototype system as a proof-of-concept for building vulnerability mitigation into PV system design.
14 SOLAR ENERGY↗
Assessment of Physical Security Modeling and Simulation in the Vulnerability Assessment Process
This report provides a comprehensive assessment of physical security modeling and simulation tools available for use in the vulnerability assessment (VA) process for nuclear facilities. It outlines the historical evolution of VA methodologies, emphasizing the transition from traditional layer-based approaches to a more holistic framework that integrates detection probabilities directly into combat simulations. The document details the critical components of the VA process, including the characterization of targets, threats, and protective measures, as well as the development of adversary scenarios that reflect both insider and outsider threats. It highlights the importance of performance assurance programs, emphasizing the need for continuous evaluation and testing of security systems to ensure their effectiveness against evolving threats. Additionally, the report discusses the significance of utilizing accredited modeling and simulation tools in accredited areas to accurately represent adversary actions and the corresponding responses of protective forces. By establishing a systematic approach to VA, this document aims to enhance the overall security posture of nuclear facilities, ensuring compliance with regulatory standards while effectively mitigating risks associated with potential adversarial actions.
45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
Limiting Future Collision Risk to Spacecraft: An Assessment of NASA's Meteoroid and Orbital Debris Programs
Over the past 50 years, various NASA communities have contributed significantly to maturing NASA s meteoroid and orbital debris (MMOD)1 programs to their current state. As a result of these community efforts, and to NASA s credit, NASA s MMOD programs and models are now widely used and respected by the providers and users of both government and commercial satellites, nationally as well as internationally. Satellites have been redesigned to protect critical components from MMOD damage by moving critical components from exterior surfaces to deep inside a satellite s structure. Orbits are monitored and altered to minimize the risk of collision with tracked orbital debris. MMOD shielding added to the International Space Station (ISS) protects critical components and astronauts from potentially catastrophic damage that might result from smaller, untracked debris and meteoroid impacts. The space shuttle, as it orbited Earth, and whether docked to the ISS or not, was optimally oriented to protect its fragile thermal protection and thermal radiation systems from MMOD damage. In addition, astronauts inspected its thermal protection system for MMOD damage before the shuttle reentered Earth s atmosphere; Orion, NASA s capsule to carry astronauts to low Earth orbit, includes designs to mitigate the threat of MMOD damage and provide increased safety to the crew. When a handful of reasonable assumptions are used in NASA s MMOD models, scenarios are uncovered that conclude that the current orbital debris environment has already reached a "tipping point." That is, the amount of debris - in terms of the population of large debris objects, as well as overall mass of debris in orbit - currently in orbit has reached a threshold where it will continually collide with itself, further increasing the population of orbital debris. This increase will lead to corresponding increases in spacecraft failures, which will only create more feedback into the system, increasing the debris population growth rate. The increase thus far has been most rapid in low Earth orbit (LEO), with geosynchronous Earth orbits (GEOs) potentially suffering the same fate, but over a much longer time period. The exact timing and pace of this exponential growth are uncertain, but the serious implications of such a scenario require careful attention because of the strategic importance of U.S. space operations. The Office of Science and Technology Policy and the Office of Management and Budget contracted with the National Research Council for a study to perform three tasks: review NASA s MMOD programs and efforts, recommend in which of those NASA should increase or decrease its effort or change focus, and determine whether NASA should pursue work in any new MMOD areas. The official letter requesting the study and the full statement of task for the Committee for the Assessment of NASA s Orbital Debris Programs are in Appendixes A and B, respectively.
Source record↗