Search NASA⌕ Search

SEARCH · Search NASA

Results for “information security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
NASA NTRS2003

Managing information technology security risk

Information Technology (IT) Security Risk Management is a critical task for the organization to protect against the loss of confidentiality, integrity and availability of IT resources. As systems bgecome more complex and diverse and and attacks from intrusions and malicious content increase, it is becoming increasingly difficult to manage IT security risk. This paper describes a two-pronged approach in addressing IT security risk and risk management in the organization: 1) an institutional enterprise appraoch, and 2) a project life cycle approach.

security toolset↗
NASA NTRS2003

Information technology security system engineering methodology

A methodology is described for system engineering security into large information technology systems under development. The methodology is an integration of a risk management process and a generic system development life cycle process. The methodology is to be used by Security System Engineers to effectively engineer and integrate information technology security into a target system as it progresses through the development life cycle. The methodology can also be used to re-engineer security into a legacy system.

Security risk analysis system engineering↗
DOE OSTI2025

Building Cybersecurity Educational Materials for Students: The Windfarm Capture-The-Flag Exercise

Securing and protecting critical infrastructure in an increasingly digital world is vital but it is all too often an afterthought. It is especially important that students become aware of internet safety and security at an early age. However, the availability of interactive and educational cybersecurity material targeted toward students is minimal in the United States. Here we show an example of interactive cyber security educational material that an educator can use in their classroom to encourage students to think about the interaction between real-world physical objects, cyber security, and information security. By putting together a “capture-the-flag” exercise, students can see in real time how hackers and cybercriminals exploit vulnerabilities and gain access information. The students try to “capture” the “flag” (i.e., information) in the wind farm by looking for oddities in the code or by taking advantage of weaknesses in everyday protocols. Students can also see how cybersecurity interacts with the power grid through the wind farm project scenario and how a hacker could cause serious problems to a critical infrastructure sector. Our goal for the project is getting students interested in cybersecurity and help them develop an awareness of how important having robust security systems is. We also hope that this project demonstrates the importance of introducing these concepts early and inspires others to create similar projects geared toward students.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Quantum Computing and Cryptography: Analysis, Risks, and Recommendations for Decisionmakers

Some influential American policymakers, scholars, and analysts are extremely concerned with the effects that quantum computing will have on national security. Similar to the way space technology was viewed in the context of the US-Soviet rivalry in the Cold War, they view scientific advancement in quantum computing as a race with significant national security consequences and a part of the emerging US-China rivalry. It is claimed that the winner of this race will be able to thwart all the cryptographic efforts of the loser and gain unfettered access to any state secret of the losing government. Additionally, it is suggested that the winner will be able to protect their secrets with a higher level of security than contemporary cryptography guarantees at the moment. This paper argues that these three claims are considerably overstated, and that policymakers and scholars should shift focus to a different national security problem that quantum computing will create. Maintaining the long-term security of secret information secured by contemporary cryptographic protections, which will fail against an attack by a future quantum computer, is the predominant challenge needing attention. This paper takes a technically-informed approach to this issue. It first lays out the national security problems that are envisioned in much of the current discourse surrounding quantum computing. Then, it will assess the technical advantages that quantum computers will have over classical computers in the field of cryptography. Next, it will provide an explanation of the specific ways that the technical realities of quantum computing are inconsistent with the predominant areas of concern. Following, it will highlight the more pressing national security problem posed by quantum computing that the public discussion has, for the most part, missed. The piece will conclude with recommendations for how to mitigate this issue.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS1991

MOD control center automated information systems security evolution

The role of the technology infusion process in future Control Center Automated Information Systems (AIS) is highlighted. The following subject areas are presented in the form of the viewgraphs: goals, background, threat, MOD's AISS program, TQM, SDLC integration, payback, future challenges, and bottom line.

Owen, Rich↗
DOE OSTI2019

Enabling Secure Grid Information Sharing through Hash Calendar-based Blockchain Infrastructures

The power grid is becoming increasingly interconnected, as information from grid operations must be accessible to an array of engineers, grid regulators, and market operators. However, there remain challenges ensuring the appropriate integrity and authenticity of the grid information. While traditional cryptographic protocols, like public key infrastructure, provide security for in-transit communication, they come with key exchanges and cost to get public key certificates from a centralized authority. To address these challenges, this paper demonstrates how a hash calendar-based blockchain can be used to provide improved security for communication with the use of distributed ledgers. It demonstrates the security requirements and threats to this communication, and then provides a theoretic definition of the process. Furthermore, it introduces a use-case of the proposed process within the WSU Smart City Testbed DMS with the Guardtime’s Keyless Signature Infrastructure (KSI) architecture.

Kaur, Kudrat J.↗
DOE OSTI2019

EFCOG, IOSC Best Practices Guide

Members of the Energy Facility Contractors Group (EFCOG), Safeguards and Security Working Group, Information Security Sub-Working Group Incidents of Security Concern (IOSC) Team prepared this best practice guide. For the purposes of this guide, “best practices” are “positive examples of work processes, procedures, good ideas, or effective solutions. The team made up of IOSC Subject Matter Experts (SME) identified these best practices as a result of actual operational experience and training. The guide describes best practices for categorizing incidents and managing inquiries. These practices may serve as guidelines for developing program plans, policy and procedures. These practices are suggestions for Department sites to consider while working in the IOSC subject area. The authors acknowledge that there may be alternatives to the practices identified in this guide. Subject matter Experts from the IOSC program across the Department developed this guide. Extensive discussion and document reviews were conducted to identify best practices relating to security inquiries. It was not within the scope of this study to assess individual site performance or evaluate compliance. Department of Energy’s (DOE), Order 470.4B, Chg.2, Safeguards and Security Program, July-21-2011, Chg 2, January-17-2017, Attachment 5, Incidents of Security Concern, contains the requirements for the IOSC program. In accordance with DOE directives and requirements established by DOE/National Nuclear Security Administration (NNSA) oversight, the working group evaluated elements of the IOSC program at each of the working group member’s sites such as categorizing events, conducting inquiries, and reporting events. Inconsistencies in categorization across the sites may be due to various factors, including each local field office having different reporting expectations, subjectivity in making determinations, and potential inherent deficiencies in the categorization tables and category descriptions. Many sites have adopted a sub reportable category for a security anomaly event that it believes does not meet the criteria as a reportable IOSC. The sites typically establish a local standardized process for reporting, analyzing, and trending sub-reportable events. Security incident program managers may need to discuss inconsistent categorization with other Inquiry Officials (IO) and suggest standardized solutions (ie…through policy changes or a forum attended by incident program managers and inquiry officials to discuss standardization solutions. At least one EFCOG IOSC team member’s site is currently using the best practices identified in this guide.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗
DOE OSTI2019

Risk-informed Physical Security Using Dynamic Force-on-Force Modelling Tools (ABSTRACT)

Physical security requirement of nuclear power plants (NPPs) in the US is regulated in a mainly prescriptive manner. This “one size fits all” approach may consequently overlook plant-specific characteristics which are beneficial for the inherent safety and security of the plant. Although a performance-based security measure has been promulgated in 10 CFR 73.55(r), current evaluation methods generally emphasize static and conservative assumptions on physical security uncertainties. This conservatism contributes to the overall operational and maintenance costs, which account to 70% of total operating expenditures for an NPP. This paper describes an ongoing work at the Idaho National Laboratory within the Light Water Reactor Sustainability pathway, which aims to optimize physical protection system with regards to system effectiveness and dollar costs. To achieve this goal, a risk-informed approach to physical security is proposed. This approach leverages the Event Modeling Risk Assessment using Linked Diagrams (EMRALD) tool to model facility infiltration and Force-on-Force (FoF) engagement in a dynamic manner. The dynamic FoF analysis was conducted by coupling human performance uncertainties modeled in EMRALD to existing commercial 3-dimensional FoF software, i.e. SCRIBE3D, AVERT and Simajin. Meanwhile, risk analysis was accomplished by coupling the attack outcomes to existing plant Probabilistic Risk Assessment (PRA) model with FLEX strategy. This approach reduces the conservatisms in security modeling and further acknowledges the possibility for plant operators to mitigate the attack outcomes. A sabotage attack on a hypothetical NPP facility was devised to demonstrate the proposed methodology. Dynamic FoF rules were implemented in EMRALD coupled to SCRIBE3D. This dynamic evaluation revealed an additional 21% system effectiveness in protecting the target set relative to the static modelling approach. Furthermore, the conditional core damage probability could be reduced by up to 46% by crediting operator actions in mitigating the sabotage outcomes. We evaluated the relative importance of each component of the physical security posture included in the model and assessed tradeoffs between components to identify potential opportunities for cost reduction while maintaining a specific level of system effectiveness. Results of the cost analysis will be presented in the conference. This study is expected to help NPP operators in allocating resources optimally to satisfy the security requirements.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Contact-Less Integrity Verification of Microelectronics Using Near-Field EM Analysis

Modern microelectronics life-cycle and supply chain ecosystem bring multiple untrusted entities, which can compromise their integrity. A major integrity issue of microelectronics stems from piracy of intellectual properties (IP) and counterfeiting, which causes significant revenue loss to the semiconductor manufacturers. Further, these components often lead to compromised functionality, reliability, security, and safety of an electronic system. This paper presents secure information transmission and probing methods for verifying the integrity of digital integrated circuit (ICs) based on their electromagnetic (EM) near-field emissions and thereby protecting systems against counterfeit components. The proposed method has been tested on both high-level instructions executed by microprocessors or Systems-on-Chip (serving as examples of software), and also logic circuits within FPGA fabrics and ASICs (serving as examples of hardware). The authentication information required by each digital system is generated using a pseudo-random number generator circuit and securely transmitted via near-field magnetic emissions. The authorized party can probe these emissions using a near-field probe, process the acquired signals to improve the signal-to-noise ratio (SNR), and then recover the secure information through matched filtering. Experimental results from commercial SoCs are used to demonstrate the proposed technique. Methods for reducing EM interference during integrity verification of both FPGAs and ASICs are also described.

47 OTHER INSTRUMENTATION↗
DOE OSTI2024

Trust Model Measurements for the Energy Grid of Things

Information security is essential for the reliable operation of an Energy Grid of Things (EGoT). In addition to basic information security protocols as defined by published standards, there is a need for a monitoring function that measures the trustworthiness of the various actors participating in an EGoT. We describe in this paper the implementation and evaluation of a Distributed Trust Model that was developed specifically for monitoring communication within an EGoT. We then show how the model parameters are set using statistical measures for hypothesis testing.

Energy Grid of Things, EGoT, Smart Grid Security, ↗
DOE OSTI2019

Final Report for Industrial Base Cybersecurity Initiative (IBCI) Project (FY2019)

Information security issues impact all manufacturing sectors and are particularly troublesome when designs for advanced weapons systems are lost via attacks that propagate through the relatively unprotected lower tiers of the nation's supply chains. The US Manufacturing Industrial Base (MIB) consists of suppliers and distributors that range in size from large prime contractors with extensive cybersecurity resources to small shops with little or no in-house information technology capabilities. The acquisition and maintenance of the technologies, systems, and financial resources needed to assure secure collaborations can be an overwhelming challenge for many manufacturers yet the cost of poor cybersecurity practices can lead to the compromise of national security information worth hundreds of millions of dollars. The Department of Defense Manufacturing Industrial Base Policy organization and the Department of Energy, Energy Efficiency and Renewable Energy Advanced Manufacturing Office have chartered the Los Alamos National Laboratory (LANL) and the Oak Ridge Y-12 National Security Complex (Y-12) to design, develop, and demonstrate a Manufacturing Threat Evaluation Wargaming System (MTEWS). The MTEWS concept is based on the use of a virtual model of the computer networks and cybersecurity protocols used across the MIB that will be continuously updated to reflect the dynamic threat environment. The MTEWS cyber-physical test range will demonstrate a prototype wargaming system that analyzes the impact of new and existing cybersecurity threats while also providing the information needed to sustain the integrity of the MIB supply chains. A long-term goal is the establishment of an enduring national manufacturing operations center that proactively responds to the continuously changing attacks that threaten the MIB and US national security. LANL and Y-12 have formed an Industrial Base Cybersecurity Initiative Team (IBCI), consisting of partners from the public, private and academic sectors, that is developing the MTEWS. To date, most of the project tasks have been centered on the technologies required to create a representative model of the MIB because this is a foundational element for the entire project. Modeling activities at the University of North Carolina at Charlotte (UNC Charlotte) have demonstrated a VMware-based prototype system that can accommodate a network model with up to 350 nodes and includes features such as the option to incorporate network scanning information when building the model and the ability to down select the elements of duplicative networks to a statistically significant subset that avoids redundantly duplicating network configurations. Broad Ordering Agreements have been established with UNC Charlotte and the University of West Florida (UWF) that support a variety of cybersecurity for manufacturing tasks and wide-spread endorsement has been received from government, industry and academia sectors concerning the IBCI goals and technical direction.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
NASA NTRS2015

Cyber Security: Big Data Think II Working Group Meeting

This presentation focuses on approaches that could be used by a data computation center to identify attacks and ensure malicious code and backdoors are identified if planted in system. The goal is to identify actionable security information from the mountain of data that flows into and out of an organization. The approaches are applicable to big data computational center and some must also use big data techniques to extract the actionable security information from the mountain of data that flows into and out of a data computational center. The briefing covers the detection of malicious delivery sites and techniques for reducing the mountain of data so that intrusion detection information can be useful, and not hidden in a plethora of false alerts. It also looks at the identification of possible unauthorized data exfiltration.

computer security↗
NASA NTRS2017

Smashing the Stovepipe: Leveraging the GMSEC Open Architecture and Advanced IT Automation to Rapidly Prototype, Develop and Deploy Next-Generation Multi-Mission Ground Systems

Satellite/Payload Ground Systems - Typically highly-customized to a specific mission's use cases - Utilize hundreds (or thousands!) of specialized point-to-point interfaces for data flows / file transfers Documentation and tracking of these complex interfaces requires extensive time to develop and extremely high staffing costs Implementation and testing of these interfaces are even more cost-prohibitive, and documentation often lags behind implementation resulting in inconsistencies down the road With expanding threat vectors, IT Security, Information Assurance and Operational Security have become key Ground System architecture drivers New Federal security-related directives are generated on a daily basis, imposing new requirements on current / existing ground systems - These mandated activities and data calls typically carry little or no additional funding for implementation As a result, Ground System Sustaining Engineering groups and Information Technology staff continually struggle to keep up with the rolling tide of security Advancing security concerns and shrinking budgets are pushing these large stove-piped ground systems to begin sharing resources - I.e. Operational / SysAdmin staff, IT security baselines, architecture decisions or even networks / hosting infrastructure Refactoring these existing ground systems into multi-mission assets proves extremely challenging due to what is typically very tight coupling between legacy components As a result, many "Multi-Mission" ops. environments end up simply sharing compute resources and networks due to the difficulty of refactoring into true multi-mission systems Utilizing continuous integration / rapid system deployment technologies in conjunction with an open architecture messaging approach allows System Engineers and Architects to worry less about the low-level details of interfaces between components and configuration of systems GMSEC messaging is inherently designed to support multi-mission requirements, and allows components to aggregate data across multiple homogeneous or heterogeneous satellites or payloads - The highly-successful Goddard Science and Planetary Operations Control Center (SPOCC) utilizes GMSEC as the hub for it's automation and situational awareness capability Shifts focus towards getting GS to a final configuration-managed baseline, as well as multi-mission / big-picture capabilities that help increase situational awareness, promote cross-mission sharing and establish enhanced fleet management capabilities across all levels of the enterprise.

GMSEC↗
DOE OSTI2019

Information-Theoretically Secure Distributed Machine Learning

A previously obscure area of cryptography known as Secure Multiparty Computation (MPC) is enjoying increased attention in the field of privacy-preserving machine learning (ML), because ML models implemented using MPC can be uniquely resistant to capture or reverse engineering by an adversary. In particular, an adversary who captures a share of a distributed MPC model provably cannot recover the model itself, nor data evaluated by the model, even by observing the model in operation. We report on our small project to survey current MPC software and judge its practicality for fielding mission-relevant distributed machine learning models.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2000

Challenges of Information Technology Security in the NASA Environment

A brief description of the NASA organization and how the CIO responsibilities are integrated into that organization followed by an introduction of the NASA ITS Program goals and objectives. An overview of the four major enterprises' cultures and how those cultures tie back to the Enterprises' missions. A description of the ITS challenges that exist stemming from the competing NASA Enterprises' requirements and how they have formed the basis of the NASA ITS Program. A talk will focus on policies and procedures and the technology being incorporated into the NASA infrastructure and how that technology ties back to the policies and procedures.

Santiago, S. S.↗
DOE OSTI2022

Licensing, Regulations and Developing Guidance for Nuclear Technology Deployment for Embarking countries in Africa

The African region is witnessing an increased number of countries at different stages of implementing or considering the introduction of peaceful nuclear power programs to meet the demand of their rapidly growing economies as well as clean energy needs. Grid size, cost, licensing, and regulations will be some of the challenges to deploying larger power reactors. A key element of the regulatory framework will be the inclusion of nuclear security information and assurance that security is integrated into the license review process.As each country continue to implement and consider different reactor designs from several vendors, the significance of customer knowledge of licensing, Regulations, and guidance document to facilitate the deployment and operational needs for nuclear technology cannot be over-emphasized. This special session will bring together a selected panel of key stakeholders and policymakers from embarking countries in Africa to participate in a panel discussion to share their experience in the licensing, regulations, and development of guidance for power plant deployment. The session will also consider and identify potential gaps that may affect the licensing and regulatory applications for the future nuclear infrastructure. As well, the panel will promote regional networking and communication to increase capacities in readiness for the potential deployment of additional technology, such as Small Modular Reactors.

Dahunsi, Stephen↗