SEARCH · Search NASA

Results for “Utility Cybersecurity”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2

All sources NASA NTRS DOE OSTI

DOE OSTI2021

Cybersecurity in Photovoltaic Plant Operations

This paper provides practical information for PV plant operators regarding cybersecurity. Plans to integrate photovoltaic generation into utility systems requires that cybersecurity be considered in every aspect- from customer data to business information to plant monitoring and control operations. This paper describes the types of threats encountered in operation of PV plants; challenges faced by photovoltaic plant operators in implementing cybersecurity; cybersecurity standards that apply to photovoltaic plant operations; cybersecurity response plans and recommended best practices to ensure photovoltaic plant cybersecurity.

14 SOLAR ENERGY↗

DOE OSTI2019

MS-SPEAK: Final Report and Implementation Roadmap

This report describes the scope and results of a project undertaken to help consumer-owned electric utilities improve the cybersecurity of their system interfaces. The team developed a cybersecurity reference architecture for the MultiSpeak interoperability standard, which is used by many of these consumer-owned utilities and their supporting vendors. The analysis and use cases focused on the Remote Connect/Disconnect (RCD) interface, and its vulnerabilities. An open-source toolkit has also been developed to facilitate customized intrusion detection systems (IDS) for MultiSpeak applications. This report includes a roadmap for others to use and customize this IDS toolkit for additional MultiSpeak versions and interfaces.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2023

Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure

This document is the Cybersecurity Framework Profile (Profile) developed for the Electric Vehicle Extreme Fast Charging (EV/XFC) ecosystem, including the four domains that relies on the ecosystem (i) Electric Vehicles (EV); (ii) Extreme Fast Charging (XFC); (iii) XFC Cloud or Third-Party Operations; and (iv) Utility and Building Networks. This Profile utilizes the NIST Cybersecurity Framework Version 1.1 and provides voluntary guidance to help relevant parties develop Profiles specific to their organization to understand, assess, and communicate their cybersecurity posture as a part of their risk management process. The Profile is intended to supplement, not replace, an existing risk management program or cybersecurity standards, regulations, and industry guidelines that are in current use by the EV/XFC industry.

33 ADVANCED PROPULSION SYSTEMS↗

DOE OSTI2022

California Energy Systems for the 21st Century (CES-21) Program, CRADA TC02200 (Final Report)

The following report representsthe culmination of a five-year Cybersecurity Research and Development (R&D) program performed by California’s Investor-Owned Utilities (IOUs) and Lawrence Livermore National Laboratory (LLNL) and funded by the IOUs’ electricity ratepayers as authorized by California Legislation and the California Public Utilities Commission (CPUC). The cybersecurity R&D, which was intensely technical in nature, was broken into three major workstreams: 1. The development of a modeling & simulation platform, to explore the potential effects of various threat and response scenarios at grid scale; 2. The establishment of a physical testbed with separate substation instances from each of the IOUs, to evaluate threats and responses on actual substation equipment; 3. The development of a research package consisting of several capabilities to support the industry’s evolution towards automated threat response and other next-generation cybersecurity techniques Throughout the program, there was extensive collaboration between the program team and national laboratories, federal departments, academic institutions and industry organizations. Several of the tools developed through the program have been made available to the open source community, to enable faster adoption and continued development of important cybersecurity capabilities. While this program began to develop much of the foundation for automated threat response, much work remains to be done, and this report recommends a series of next steps. While the Executive Summary below has been simplified as much as possible, the very technical nature of the subject matter would make further reduction difficult without causing meaning to be lost. Due to the sensitive nature of the research, some topics are intentionally covered at a high level to protect the research and therefore the electric grid and customers of California and the Nation. For further detail, clarification or questions we suggest discussion with the program team.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

DOE OSTI2026

EVs-at-RISC: A Secure and Resilient Interoperable SCM Control System Architecture for Electric Vehicle’s-at-Scale (Final Technical Report)

The EVs-at-RISC project was a five-year research, development, and demonstration initiative to create foundational tools for utility-scale fleet aggregation and Smart Charge Management (SCM) of Electric Vehicles (EV), Electric Vehicle Charging Infrastructure (EVCI), and related Distributed Energy Resources (DER). Rather than seeking to develop and demonstrate highly perfected SCM algorithms and control strategies, this project instead focused on creating foundational software solutions that enable unprecedented digital interoperability across the communications technologies and vendor platforms used to manage EV , EVCI, and DER, as well as existing energy management infrastructure operated by utilities, grid operators, and aggregators. This project then extends these novel interoperability capabilities to develop and deploy powerful middleware abstractions across grid edge networks and EVCI/DER fleet aggregations incorporating modern software tools and best practices, such as CI/CD, to bring the immense capabilities of infrastructure-as-code and policy-as-code to modern grid edge network environments. This addresses the foremost systemic issues preventing realization of any net operational benefits from scaled deployment of behind-the-meter EV, EVCI, and DER assets in electric power grids and markets today. The results of this approach and project unlock massive potential for new SCM capabilities to be easily prototyped, evaluated, and deployed at-scale within the existing grid edge network infrastructure and EVCI/DER technology ecosystem. The EVs-at-RISC project achieves this by extending Open Field Message Bus (OpenFMB), a conceptual model for digital interoperability and distributed intelligence in traditional front-of-meter utility SCADA networks, validating our hypothesis that OpenFMB could be similarly used to solve systemic digital interoperability issues in behind-the-meter environments and unlock real-world utility-scale SCM capabilities without requiring any new proprietary vendor solutions or significant infrastructure reconfiguration.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2026

Roadmap for Solar Photovoltaic (PV) Cybersecurity: A vision for improving cyber maturity of distributed and utility-scale solar energy installations

As the solar energy sector continues to expand, its integration into the broader energy infrastructure presents both unprecedented opportunities and new risks. The increasing reliance on digital technologies and interconnected systems in solar energy creates an expanded attack surface for motivated cyber adversaries. Cyberattacks have the potential to cause disruptions in energy production, damage to equipment, financial losses, and compromises in national security. Therefore, ensuring robust cybersecurity measures is paramount to protect the integrity, availability, confidentiality, and access control of solar energy systems. However, there are still key gaps and challenges to be addressed in industry and research, which stakeholders must race to address as they combat a growing number of real-world cyber incidents that affect solar energy systems and a growing number of vulnerabilities discovered and disclosed in key types of equipment. This roadmap explore the current state of solar PV cybersecurity and the gaps and challenges still to be addressed.

14 - SOLAR ENERGY↗

DOE OSTI2017

States of Cybersecurity: Electricity Distribution System Discussions

State and local entities that oversee the reliable, affordable provision of electricity are faced with growing and evolving threats from cybersecurity risks to our nation's electricity distribution system. All-hazards system resilience is a shared responsibility among electric utilities and their regulators or policy-setting boards of directors. Cybersecurity presents new challenges and should be a focus for states, local governments, and Native American tribes that are developing energy-assurance plans to protect critical infrastructure. This research sought to investigate the implementation of governance and policy at the distribution utility level that facilitates cybersecurity preparedness to inform the U.S. Department of Energy (DOE), Office of Energy Policy and Systems Analysis; states; local governments; and other stakeholders on the challenges, gaps, and opportunities that may exist for future analysis. The need is urgent to identify the challenges and inconsistencies in how cybersecurity practices are being applied across the United States to inform the development of best practices, mitigations, and future research and development investments in securing the electricity infrastructure. By examining the current practices and applications of cybersecurity preparedness, this report seeks to identify the challenges and persistent gaps between policy and execution and reflect the underlying motivations of distinct utility structures as they play out at the local level. This study aims to create an initial baseline of cybersecurity preparedness within the distribution electricity sector. The focus of this study is on distribution utilities not bound by the cybersecurity guidelines of the North American Electric Reliability Corporation (NERC) to examine the range of mechanisms taken by state regulators, city councils that own municipal utilities, and boards of directors of rural cooperatives.

14 SOLAR ENERGY↗

DOE OSTI2018

Selection of Ten (10) Cybersecurity Scenarios For Project Cybersecure Interconnection of Distributed Energy Resources

Utilities use state-of-the-art tools for reliable integration of Distributed Energy Resources (DER) within the power grid. These tools evaluate how power grid operations might be affected by various DER integration scenarios, and help the utility develop strategies to ensure reliability and safety of the power grid. These tools were developed in response to rapid wide-scale DER deployment, and are now in common use to aid the process of operating a grid with high penetration of DER. As power system technologies continually advance, these tools must also be advanced to assist the development of cyber-secure architectures for the new communication and control pathways that are being introduced with technologies such as smart inverters and local storage control.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2023

DER Cybersecurity R&D

The National Renewable Energy Laboratory (NREL) conducted more than 30 assessments for utilities across the United States with a cybersecurity assessment tool based on the U.S. Department of Energy (DOE) Cybersecurity Capability Maturity Model (C2M2) and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and focused on business process. With funding from the DOE Office of Renewable Energy and Energy Efficiency Federal Energy Management Program, NREL modified the current cyber governance assessment tool to include an assessment process specifically for distributed energy resources (DERs). The Distributed Energy Resources Cybersecurity Framework (DER-CF) was developed to help federal agencies mitigate gaps in their cybersecurity posture for distributed energy systems.

cybersecurity valuation↗

DOE OSTI2024

Enhancing Cloud Cybersecurity: Prescriptive Controls for Operational Technology

This whitepaper provides strategic insights and recommendations into security cloud-based solutions for electric utilities, encompassing operational technology (OT), virtual power plants (VPP), distributed energy resources (DERs), applications, networks, and data storage as they transition to and leverage cloud infrastructure through managed service providers (MSPs) and cloud service providers (CSPs). Principles derived from established frameworks serve as a foundation for best practices across cybersecurity projects and remove the constraints of settling on a single framework. For organizations that prefer not to integrate a specific framework altogether, elements of the proposed approach could be adopted or tailored to best fit defined requirements and expected functionalities. The Cirrus assessment, a utility cloud feasibility tool, and the roadmap it provides serve as a precursor to this paper, which seeks to be a valuable resource for defining next steps following cloud technology integration feasibility appraisal. With its comprehensive approach to adoption, the Cirrus framework offers strategic guidance on responsibly preparing for or deploying a utility cloud solution. The previously published whitepaper, “Use Case-Informed Framework for Utility Cloud Migration,” details the guiding strategy, research, and deployment of cloud solutions within electric and interconnected grid systems. Before implementing the controls suggested in this document, it is recommended that stakeholders complete Cirrus's cloud integration assessment and pair the results with their unique cybersecurity controls to form a comprehensive cloud-based utility cybersecurity plan. The Cirrus outcome will consider a series of future architectures for the grid before and after the energy transition and evaluate the arguments for and against cloud applications for each electric and interconnected grid layer. This document is a companion to the original whitepaper, "Use Case-Informed Framework for Utility Cloud Migration" to further identify and recommend security controls based on Cirrus’s cloud integration assessment output. The following whitepaper outlines the cybersecurity controls that secure cloud-service models pertinent to the electric sector using the predefined categories identify, protect, detect, and respond and recover. The objective is to outline prescriptive security controls based on the type of architecture and data stored in the cloud. The focus includes dissecting the shared responsibility model and elucidating what on-premises Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) entail. A pivotal consideration in this context is allocating responsibility for foundational cybersecurity aspects—having used Cirrus for the cloud integration assessment. The ensuing controls detailed herein also represent a checklist of controls necessary for a secure cloud transition, equipping utilities with the knowledge to navigate this digital transformation with confidence and strategic foresight in a safe and responsible manner.

42 ENGINEERING↗

DOE OSTI2024

Independent Review of the Proof-of-Concept Cyber100 Compass Cybersecurity Risk Tool

The U.S. Department of Energy (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER), and Office of Electricity (OE) commissioned the National Renewable Energy Laboratory (NREL) to develop a method and tool to enable electric utilities to understand and manage the risk of cybersecurity events that can lead to physical effects like blackouts. This tool, called Cyber100 Compass, uses cybersecurity data elicited from cybersecurity experts, then incorporates that data into a tool designed to be usable by cybersecurity non-experts who understand the system itself. The tool estimates dollar-valued risks for a current or postulated future electric power digital control configuration, in order to enable utility risk planners to prioritize among proposed cybersecurity risk mitigation options. With the development of the Cyber100 Compass tool for quantification of future cyber-physical security risks, NREL has taken an initial bold step in the direction of enabling and indeed encouraging electric utilities to address the potential for cybersecurity incidents to produce detrimental physical effects related to electric power delivery. As part of the Cyber100 Compass development process, DOE funded NREL to seek out an independent technical review of the risk methodology embodied in the tool. NREL requested this review from Sandia National Laboratories, and made available to Sandia a very late version of the project report, as well as NREL personnel to provide clarification and to respond to questions. This paper provides the result of the independent review activity.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Power Sector Cybersecurity Building Blocks

The Power Sector Cybersecurity Building Blocks, developed through the USAID-NREL Partnership and the Resilient Energy Platform, are designed to help a variety of stakeholders improve security for the electrical grid. This effort grows out of USAID and NREL's discussions with utilities around the world, as well as past cybersecurity assessments performed by NREL on dozens of utilities and government agencies, with a focus on the cybersecurity challenges faced by small and under-resourced utilities. This document outlines eleven building blocks for power sector cyber security. It functions as a guide to help organizations develop a robust, balanced cybersecurity defense program. Individually, each building block represents a cluster of related activities within cybersecurity on which an organization should focus. Using the building blocks, organizations can effectively prioritize their cybersecurity efforts to best thwart a wide range of potential cyberattacks.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Resilient Energy Platform. Fact Sheet: Power Sector Cybersecurity Building Blocks

building blocks↗

DOE OSTI2019

Cybersecurity Assessments on Emulated DER Communication Networks

An increasing number of public utility commissions are adopting Distributed Energy Resource (DER) interconnection standards which require photovoltaic (PV) inverters, energy storage systems, and other DER to include interoperable grid-support functionality. The recently updated national standard, IEEE 1547-2018, requires all DER to include a Sun Spec Modbus, IEEE 2030.5, or IEEE 1815 communication interface in order to provide local and bulk power system services. Those communication protocols and associated information models will ensure system interoperability for PV and storage systems, but these new utility-to-DER communication networks must be deployed with sufficient cybersecurity to protect the U.S. power system and other critical infrastructure reliant on dependable power. Unlike bulk generators, DER are commonly connected to grid operators via public internet channels. These DER networks are exposed to a large attack surface that may leverage sophisticated techniques and infrastructure developed on IT systems, including remote exploits and distributed attacks. Although DER make up a growing portion of the national generation mix, they have limited processing capabilities and do not typically support modern security features such as encryption or authentication. In this work, Sandia National Laboratories constructed simulated DER communication net- works with a range of security features in order to study the security posture of different communication approaches. The experimental test environment was created in a Sandia-developed co-simulation platform, called SCEPTRE, which emulated Sun Spec-compliant DER equipment, the utility DER management system, communication network, and distribution power system. Adversary-based assessments were conducted and a quantitative scoring criteria was applied to evaluate the resilience of various architectures against cyber attacks and to measure the systemic impact during such attacks. The team found that network segmentation, encryption, and moving target defense improved the security of these networks and would be recommended for utility, aggregator, and local DER networks.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2026

Securing The Future: 2026 Manufacturing & Critical Infrastructure Threat Landscape

This report outlines the current state of manufacturing weaknesses introduced by the complexities of modern environments, including cloud services and Internet of Things (IoT) devices, with particular attention paid to the unique vulnerabilities encountered by SMMs. It also highlights CyManII’s strategic initiatives and collaborative solutions to mitigate these risks and strengthen the cybersecurity posture of the manufacturing ecosystem. Utilizing data from 2025 to inform forward-looking mitigation strategies, this report provides manufacturers with a clear understanding of both current and emerging cybersecurity threats, as well as practical opportunities to strengthen their cyber ecosystems. The following sections detail key vulnerabilities and threat vectors, along with actionable mitigation strategies, many of which have been developed or piloted through CyManII-led efforts. A thorough understanding of these risks and mitigation strategies is essential for manufacturers seeking to strengthen the security and resilience of their manufacturing operations.

3D Printing↗

DOE OSTI2022

Public – Private Partnership to Promote Efficient Manufacturing and Workforce Development (IAC Final Technical Report)

Through delivering ninety (90) energy assessments to small- and medium-sized manufacturing facilities in and around Tennessee, significant understandings were gained through providing detailed energy assessment reports to manufacturers and training seventy-seven (77) engineering students in which thirty-five (35) certified IAC students were recognized by DOE. The robust involvement of Tennessee Valley Authority (TVA), local utility and Tennessee Tech’s Cybersecurity Education, Research, and Outreach Center (CEROC) in majority of assessments made the technical operation very effective where leaded to 40.5% implementation rate of energy recommendations. Other benefits of the award to the public are a dynamic modeling tool capable of analyzing existing cooling towers for energy use optimization was developed and presented to DOE IAC, providing technical assistance to non-participating manufacturers in the form of workshop and training, publishing fifteen (15) peer-reviewed conference and journal papers as well as a book chapter in the area of industrial energy efficiency field, assisting the TVA Magnolia Combined Cycle Power Plant to become the First 50001 Ready Certified Power Plant in the U.S. through briefing them on ISO 50001 and 50001 Ready as well as providing an energy assessment to the plant, assisted the new IAC center at Clemson University with on-site and remote support, and provided assessment and training in unique areas of water, waste water, cyber security and smart manufacturing to our clients, students and community.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2025

V-INT: Automated Vulnerability Intelligence and Risk Assessment

The project team, including the University of Arkansas (UA) as the lead, the University of Arkansas at Little Rock (UALR), Network Perception (NP), and Bastazo, has successfully researched, developed, and demonstrated the V-INT toolset, and also integrated it into the commercial products of NP (i.e., NP-View) and Bastazo (i.e., Spartan). The end product is a cybersecurity software tool for energy utilities that can automatically assess the risks of software vulnerabilities in an organization’s assets considering the organization’s firewall policies. It allows security operators to identify the small portion of vulnerabilities that poses true threats to their system (i.e., those that are not protected by firewall policies) and prioritize the mitigation of these vulnerabilities to minimize risks. It also allows security operators to identify the vulnerability-induced attack paths under their organization’s firewall policy, providing effective decision supports for mitigating potential attacks.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2024

Using Gamification to Enhance Mastery of Network Security Concepts

Gamification has proven to be effective in engaging and encouraging people to work towards and achieve goals. Many students struggle to focus on schoolwork, due to a lack of interest, lack of understanding, or other factors unique to the student. Applying gamification elements to education can help engage these students in learning their course material and help them excel academically. This study examines the effectiveness of using gamification techniques to enhance the learning experience in college Computer Science courses. A video game application is utilized to review and reinforce cybersecurity concepts that students have already been taught in class. Previous work has been made on a prototype game build that teaches about ARP (Address Resolution Protocol) components. The focus of this study is to refine and develop the structure of the prototype into a more interactive and enjoyable format with non-competitive and captivating activities that allow students to study at their own pace. An updated version of the game was created that focused on reaching a balance between education and entertainment. The game was used by students enrolled in a cybersecurity class, where pre-survey, post-survey and a focus group interview were conducted to determine how effective the updated version is compared to the current build, in addition to how effective the gamification method is regarding student retention of taught material. The pre-survey and post-survey results revealed an increase in interest and mastery of cybersecurity concepts as a result of playing the game. Students found value in the game as both a method of reviewing material taught in class and an entertaining and engaging game. These results show potential in using gamification in cybersecurity and education.

Hilliard, Kevin↗