Search NASA⌕ Search

SEARCH · Search NASA

Results for “vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Vulnerability and resilience of urban energy ecosystems to extreme climate events: A systematic review and perspectives

We reviewed the present studies on the vulnerability and resilience of the energy ecosystem (most parts of the energy ecosystem), considering extreme climate events. This study revealed that the increased interactions formed during the transformation of the energy landscape into an ecosystem could notably increase the vulnerability of the energy infrastructure. Such complex ecosystem cannot be assessed using the present state of the art models used by the energy system modelers. Therefore, this study introduces a novel analogy known as the COVID analogy to understand the propagation of disruption within and beyond the energy ecosystem and organized the present state of the art based on the COVID analogy. The analogy helps to categorize the vulnerability of the energy infrastructure into three stages. The study revealed that although there are many publications covering the vulnerability and resilience of the energy infrastructure, considering extreme climate events, the majority are focused on the direct impact of extreme climate on the energy ecosystem. In addition, most of the studies do not consider the impact of future climate variations during this assessment. The propagation of disruptions was assessed mainly for wildfires and hurricanes. Further, there is a clear research gap in considering vulnerability assessment for interconnected energy infrastructure. Here, the transformation of energy systems into a complex ecosystem notably increases the complexity, making it difficult to assess vulnerability and resilience. A shift from a centralized to decentralized modeling architecture could be beneficial when considering the complexities brought by that transformation. Hybrid models consisting of both physical and data-driven machine learning techniques could also be beneficial in this context.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2021

Security Vulnerability and Mitigation in Photovoltaic Systems

Software and firmware vulnerabilities pose security threats to photovoltaic (PV) systems. When patches are not available or cannot be timely applied to fix vulnerabilities, it is important to mitigate vulnerabilities such that they cannot be exploited by attackers or their impacts will be limited when exploited. However, the vulnerability mitigation problem for PV systems has received little attention. This paper analyzes known security vulnerabilities in PV systems, proposes a multi-level mitigation framework and various mitigation strategies including neural network-based attack detection inside inverters, and develops a prototype system as a proof-of-concept for building vulnerability mitigation into PV system design.

14 SOLAR ENERGY↗
DOE OSTI2024

DEReliction: A Cybersecurity Vulnerability Assessment Methodology for Distributed Energy Resources

With the increasing integration of Distributed Energy Resources (DER) into the electric grid, maintaining grid reliability and resilience requires that these devices remain secure. This paper discusses a cybersecurity vulnerability assessment methodology that incorporates best practices from Sandia National Laboratories, SANS Institute, OWASP Foundation, and other web and Internet of Things (IoT) penetration testing (“pen testing”) programs, courses, and frameworks for assessing the security posture of devices. The methodology involves five sequential steps: (1) Collect Public Information, (2) Extract Hardware Details, (3) Inventory Software Components, (4) Identify Vulnerabilities, and (5) Test Vulnerabilities. Each step uncovers potential weaknesses in both hardware and software components of DER devices, considering adversary tactics, techniques, and procedures (TTPs), and potential attack vectors along the way. The results from the execution of this method on multiple residential- and small commercial-scale photovoltaic (PV) inverters reveled hardware and software vulnerabilities, which highlight the benefit of taking a methodical approach to discover vulnerabilities. While the specific vulnerability details are not shared here, a generalized overview of findings underscore the importance of robust security assessments for DER devices. Adoption of an assessment framework of this kind will identify and mitigate cybersecurity threats and bolster the resilience of DER-integrated electric grids.

24 POWER TRANSMISSION AND DISTRIBUTION↗
NASA NTRSDate not supplied

Assessing Environmental and Socioeconomic Factors of Urban Flood Vulnerability in Kansas City, Kansas

Pluvial flooding, over-saturated ground, and drainage systems disproportionately impact historically marginalized urban neighborhoods during extreme rainfall events. These communities are impacted by physical and socioeconomic factors that make them vulnerable to flooding events, such as high concentrations of impervious landcover, high precipitation rates, and a combined sewer system framework. Despite known vulnerability to environmental hazards, understanding potential pluvial street-level flooding events are largely unknown. Using the open-source National Capital Project’s Integrated Valuation of Ecosystem Services and Tradeoffs (InVEST) Urban Flood Risk Mitigation model, NASA DEVELOP examined neighborhood scale runoff retention and potential economic damages for risk mapping throughout Kansas City, Kansas. The generated outputs aid in identifying vulnerable neighborhoods susceptible to flooding and in need of future intervention. Previous studies have applied this model framework to understand urban flood vulnerability regarding ecosystem services, urban planning, and flood mitigation strategies. We utilized the InVEST outputs to develop indices pertaining to environmental justice factors of race, socioeconomic status, social vulnerability, and health. The findings indicate that historically redlined neighborhoods in Kansas City, Kansas face disproportional impacts from flood events and are subject to greater environmental stressors. This research provides an approach to utilizing an open-source flood vulnerability model to empower neighborhood-scale environmental justice analysis, enhancing the local communities' understanding of present-day impacts of historical environmental injustices.

Hadwynne Gross↗
DOE OSTI2023

An Interpretable Index of Social Vulnerability to Environmental Hazards

Index-based measures of social vulnerability to environmental hazards are commonly modeled from composites of population-level risk factors. These models overlook individual context in communities' experiences of environmental hazards, producing metrics that may hinder spatial decision support for mitigating and responding to hazards. This paper introduces an interpretable, high-resolution model for generating an individual-oriented social vulnerability index (IOSVI) for the United States built on synthetic populations that couples individual and social determinants of vulnerability. The IOSVI combines an individual vulnerability index (IVI) that ranks individuals in an area’s synthetic population based on intersecting risk factors, with a social vulnerability index (SVI) based on the population’s cumulative distribution of IVI scores. Interpretability of the IOSVI procedure is demonstrated through examples of national, metropolitan, and neighborhood (census tract) level spatial variation in index scores and IVI themes, as well as an exploratory analysis examining risk factors affecting a specific sub-population (military veterans) in areas of high social and environmental vulnerability.

Tuccillo, Joe↗
DOE OSTI2023

Community vulnerability is the key determinant of diverse energy burdens in the United States

Low-income households generally experience a high energy burden; however, the factors influencing energy burdens are beyond socio-economics. This study explores the relationships between the multidimensionality of community vulnerability factors and energy burden across multiple geospatial levels in the United States. Our study found the distribution of energy burden in 2020 showed a great deal of variety, ranging from a minimum of 2.93 % to a maximum of 30.45 % across 3142 counties. The results of non-spatial and spatial regressions showed that the vulnerability ranks of socioeconomic, household composition and disability, minority and language, household type and transportation, and COVID mortality rate are significant predictors of energy burdens at the national level. However, at the regional level, only socioeconomic, minority and language significantly influence energy burdens. Minority and language negatively impact energy burdens except for the South East-Central region. Additionally, our analyses highlight the need to consider community vulnerability indicators' spatial homogeneity and heterogeneity. At the national level, only the epidemiological factors index is a spatially homogeneous predictor; on the regional and state level, the spatially homogeneous predictors such as socioeconomic status, household composition and disability, and household type and transportation vary by region. Such a region-sensitive relationship between energy burden and the predictors indicates spatial heterogeneity. Here this study suggests policy recommendations through the lens of the multidimensionality of community vulnerability factors. Implementing flexible national energy policies while making particular energy assistance policies for the vulnerable population at the regional or state levels is essential.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2021

A time-varying vulnerability index for COVID-19 in New Mexico, USA using generalized propensity scores

The coronavirus disease (COVID-19) pandemic has highlighted systemic inequities in the United States and resulted in a larger burden of negative social outcomes for marginalized communities. New Mexico, a state in the southwestern US, has a unique population with a large racial minority population and a high rate of poverty that may make communities more vulnerable to negative social outcomes from COVID-19. To identify which communities may be at the highest relative risk, we created a county-level vulnerability index. After the first COVID-19 case was reported in New Mexico on March 11, 2020, we fit a generalized propensity score model that incorporates sociodemographic factors to predict county-level viral exposure and thus, the generic risk to negative social outcomes such as unemployment or mental health impacts. We used four static sociodemographic covariates important for the state of New Mexico—population, poverty, household size, and minority population—and weekly cumulative case counts to iteratively run our model each week and normalize the exposure score to create a time-varying vulnerability index. We found the relative vulnerability between counties varied in the first eight weeks from the initial COVID-19 case before stabilizing. This framework for creating a location-specific vulnerability index in response to an ongoing disaster may be used as a quick, deployable metric to inform health policy decisions such as allocating state resources to the county level.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2020

An Authentication Vulnerability Assessment of Connected Lighting Systems

Emerging connected lighting systems (CLS) that incorporate distributed intelligence, network interfaces, and sensors can become data-collection platforms that enable a wide range of valuable new capabilities as well as greater energy savings in buildings and cities. However, CLS technology is currently at an early stage of development, and its increased connectivity introduces cybersecurity risks that are new to the lighting industry and that must be addressed for successful integration with other systems. While a number of existing frameworks, guidelines, and tests for evaluating cybersecurity vulnerability may apply to CLS in whole or in part, there is currently no mandatory requirement for cybersecurity testing or certification. The lighting industry, including technology developers and specification organizations, is currently evaluating the suitability of existing frameworks and guidelines for CLS. To support these efforts, Pacific Northwest National Laboratory (PNNL) is conducting a series of studies intended to educate lighting industry stakeholders on specific cybersecurity practices and characterize their implementation in commercially available CLS with varying system architectures, network-communication technologies, and degrees of maturity. This study demonstrates that tests for authentication vulnerabilities can be developed with objective pass/fail criteria, therby facilitating comparisons between CLS. Based on the limited results of this study, it appears that the CLS that are being brought to market have varying levels of authentication vulnerability. It is hoped that these evaluations will support and perhaps accelerate industry discussions on the risks of specific security vulnerabilities, what vulnerabilities should be addressed by in-development of future lighting-specific best practices, and whether any such practices should be included in voluntary lighting standards.

42 ENGINEERING↗
DOE OSTI2024

Overview and Commentary on Applying the Coordinated Vulnerability Disclosure Process to Photovoltaic System Devices

The rapid expansion of photovoltaic (PV) systems, particularly inverters, has introduced new cybersecurity challenges that threaten both local operations as well as the broader electrical grid’s stability. PV inverters, integrated into critical energy infrastructure are potential targets for cyber attacks due to vulnerabilities in firmware, remote access systems, and communication protocols. The Coordinated Vulnerability Disclosure (CVD) process, as defined by the Cybersecurity and Infrastructure Security Agency (CISA), provides a framework for identifying, reporting, and addressing these vulnerabilities in a transparent and collaborative manner. This report outlines the CVD process as it applies to PV systems, detailing the roles of key stakeholders, such as manufacturers, grid operators, and security researchers. The report also highlights specific challenges in managing vulnerabilities for new and legacy PV systems, which includes those introduced by insecure communications and third-party supply chain components. By adhering to the CVD process, the PV industry can mitigate cybersecurity risks, ensure regulatory compliance, and maintain consumer trust, while safeguarding the operational resilience of the energy grid. Ultimately, the effective coordination of vulnerability management is crucial for securing the future of PV systems within the critical electric grid infrastructure landscape.

14 SOLAR ENERGY↗
DOE OSTI2021

ML Clustering to Identify Natural Gas Pipeline Infrastructure Vulnerabilities

The network of more than 2.5 million miles of natural gas pipelines the U.S. are exposed to a range of vulnerabilities, ranging from extreme weather, to human behavior, and increasingly, to cyber threats. Advanced, data-driven analytics, including the use of machine learning and artificial intelligence, afford an opportunity to identify potential vulnerabilities, better understand risks, and help mitigate vulnerabilities in the network. At NETL, machine learning is being used to explore pipeline vulnerabilities and identify significant clusters of failure events, including failures due to weather, human behavior, and materials. These findings are being used to support the development of new technologies, including sensors, but can also be used to evaluate and inform mitigation strategies to reduce risks and vulnerabilities throughout the network.

Bauer, Jennifer↗
DOE OSTI2025

Generative Vulnerability Assessment for Cyber-Physical Systems

Cyber-physical systems (CPS) are highly susceptible to malicious attacks due to their complex dynamics and interconnectivity. A comprehensive understanding of their vulnerabilities is essential for designing effective resilience measures. This paper presents a data-driven attack generative system for evaluating the vulnerability of CPS. The proposed approach formulates the vulnerability assessment problem as determining the feasibility of a specific attack set based on two boundary functions that represent the effectiveness and stealthiness of attacks. The attack generative model is trained using a custom loss function, with two universal approximators designed to learn the effectiveness and stealthiness functions simultaneously. Theoretical results for successful generation and asymptotic convergence of the resulting training algorithm are given. As a result, the proposed approach is evaluated via numerical simulation of an IEEE 14-bus system and gas pipeline systems, demonstrating its viability in learning how to attack nonlinear CPS and identify potential vulnerabilities.

Computer systems organization↗
DOE OSTI2020

Economic losses from extreme weather in the U.S. Gulf Coast region: spatially differential contributions of climate hazard and socioeconomic exposure and vulnerability

Worldwide economic losses from extreme weather events (EWE) have increased over recent decades, with significant geographic heterogeneity in damages. The IPCC defines the risk from EWE as a function of the climate hazard, socioeconomic exposure, and vulnerability. Although these three drivers vary at fine spatial scales, spatial variability largely has been overlooked in assessments of the drivers of economic loss from EWE. Using cluster analysis, we developed a novel socio-climate hazard typology (SCT) that integrates locally defined climate hazard and socioeconomic exposure and social vulnerability typologies. The results identified 838 unique SCT types impacted by EWE across the Gulf Coastal United States during 1981–2010. We regressed the SCT types and their constituent hazard and socioeconomic components against the cumulative economic loss (1981–2010) from EWE for each SCT type. Across the landscape, economic damages of SCT types were determined by unique, spatially explicit combinations of different risk factors, even in explaining the same level of economic loss. For example, multi-billion-dollar damages in the central Gulf Coast and peninsular Florida were explained by different drivers of risk, with damages in the former explained by additive interaction between climate hazard and multiplicative interaction between climate hazard and socioeconomic exposure and vulnerability, and in the latter explained by socioeconomic exposure and vulnerability. These results highlight the need to diagnose additive and multiplicative interactions among drivers of EWE risk in a spatially explicit context.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2021

Hydraulically‐vulnerable trees survive on deep‐water access during droughts in a tropical forest

Summary Deep‐water access is arguably the most effective, but under‐studied, mechanism that plants employ to survive during drought. Vulnerability to embolism and hydraulic safety margins can predict mortality risk at given levels of dehydration, but deep‐water access may delay plant dehydration. Here, we tested the role of deep‐water access in enabling survival within a diverse tropical forest community in Panama using a novel data‐model approach. We inversely estimated the effective rooting depth (ERD, as the average depth of water extraction), for 29 canopy species by linking diameter growth dynamics (1990–2015) to vapor pressure deficit, water potentials in the whole‐soil column, and leaf hydraulic vulnerability curves. We validated ERD estimates against existing isotopic data of potential water‐access depths. Across species, deeper ERD was associated with higher maximum stem hydraulic conductivity, greater vulnerability to xylem embolism, narrower safety margins, and lower mortality rates during extreme droughts over 35 years (1981–2015) among evergreen species. Species exposure to water stress declined with deeper ERD indicating that trees compensate for water stress‐related mortality risk through deep‐water access. The role of deep‐water access in mitigating mortality of hydraulically‐vulnerable trees has important implications for our predictive understanding of forest dynamics under current and future climates.

54 ENVIRONMENTAL SCIENCES↗
NASA NTRS2021

Spatiotemporal Associations Between Social Vulnerability, Environmental Measurements, and COVID-19 in the Conterminous United States

This study summarizes the results from fitting a Bayesian hierarchical spatiotemporal model to coronavirus disease 2019 (COVID-19) cases and deaths at the county level in the United States for the year 2020. Two models were created, one for cases and one for deaths, utilizing a scaled Besag, York, Mollié model with Type I spatial-temporal interaction. Each model accounts for 16 social vulnerability and 7 environmental variables as fixed effects. The spatial pattern between COVID-19 cases and deaths is significantly different in many ways. The spatiotemporal trend of the pandemic in the United States illustrates a shift out of many of the major metropolitan areas into the United States Southeast and Southwest during the summer months and into the upper Midwest beginning in autumn. Analysis of the major social vulnerability predictors of COVID-19 infection and death found that counties with higher percentages of those not having a high school diploma, having non-White status and being Age 65 and over to be significant. Among the environmental variables, above ground level temperature had the strongest effect on relative risk to both cases and deaths. Hot and cold spots, areas of statistically significant high and low COVID-19 cases and deaths respectively, derived from the convolutional spatial effect show that areas with a high probability of above average relative risk have significantly higher Social Vulnerability Index composite scores. The same analysis utilizing the spatiotemporal interaction term exemplifies a more complex relationship between social vulnerability, environmental measurements, COVID-19 cases, and COVID-19 deaths.

spatial epidemiology↗
NASA NTRS2023

Portland Urban Development: Quantifying and Visualizing Urban Heat with Compounding Vulnerabilities to Support Community Depaving Initiatives

Urban heat is a pressing concern in Portland, Oregon as climate change induced heat waves increase. Cities experience higher temperatures due to the urban heat island effect (UHI), and environmental injustice and disenfranchisement in minority communities expose low-income and Black, Indigenous, and People of Color (BIPOC) residents to more extreme and debilitating heat events. Our team identified Portland’s communities on the frontlines of urban heat impacts by overlapping environmental and social vulnerabilities using NASA Earth observations. We partnered with Depave, a Portland-based nonprofit that works alongside communities to replace pavement with greenspace in historically disenfranchised areas. Using Landsat 8 Thermal Infrared Sensor (TIRS) imagery, we mapped Land Surface Temperature (LST) and developed a heat-specific Social Vulnerability Index (SVI) through a Principal Component Analysis (PCA) to identify Portland’s communities with the highest potential heat vulnerability. Then, we calculated the temperature change of depaving in six case studies to quantify Depave's efforts in heat mitigation and environmental justice. Our analysis demonstrated that, throughout Portland, there are frontline communities experiencing high potential social vulnerability to extreme temperatures due to environmental injustices and over-pavement. Finally, Depave’s impact on urban heat is observable and quantifiable using remote-sensing data and tools, with an average of 1ºF LST decrease across the six case studies. We illustrated the significance of local urban heat mitigation efforts and propose next steps for conducting inclusive and intentional research that highlights the lived experiences and resilience of frontline communities.

Environmental justice↗
DOE OSTI2020

Geothermal Sector Cybersecurity Vulnerability Assessment

A review of geothermal sector-specific cybersecurity vulnerabilities and risks (consequences) was conducted at the request of the Geothermal Technologies Office (GTO). The vulnerabilities and risks reviewed in this study have relevance to achieving the 2019 GeoVision Report (DOE GTO 2019) technological advancements and expected sector growth. The study offers areas for consideration but does not quantify the likelihood (frequency) of the consequences. This cybersecurity analysis project represents a proactive effort to identify areas to enhance cybersecurity in geothermal development and operations. It was not initiated to address any immediate threat or specific known risk. Of the eight identified vulnerabilities analyzed, the review identified reservoir data system monitoring as one that is unique to geothermal systems and may warrant further investigation to better understand risk and mitigation. A detailed analysis of the other vulnerabilities may highlight additional uniqueness relative to other industries. Further research actions are recommended to better quantify risk and enhance cybersecurity preparedness of the sector. As the geothermal industry grows, the cybersecurity strategies to be deployed will be of increasing importance to ensure resilient, reliable, and secure clean energy for years to come.

cyber-physical security↗
DOE OSTI2020

Cybersecurity Vulnerability Mitigation Framework through Empirical Paradigm: Enhanced Prioritized Gap Analysis

Existing cybersecurity vulnerability assessment tools were designed based on the policies and standards defined by organizations such as the U.S. Department of Energy and the National Institute of Standards and Technology (NIST). Frameworks such as the cybersecurity capability maturity model (C2M2) and the NIST Cybersecurity Framework (CSF) are often used by the critical infrastructure owners and operators to determine the cybersecurity maturity of their facility. Although these frameworks are exceptional at performing qualitative cybersecurity analysis and identifying vulnerabilities, they do not provide a means to perform prioritized mitigation of those vulnerabilities in order to achieve a desired cybersecurity maturity. To address that challenge, we developed a framework and software application called the cybersecurity vulnerability mitigation framework through empirical paradigm (CyFEr). This paper presents the detailed architecture of CyFEr’s enhanced prioritized gap analysis (EPGA) methodology and its application to CSF. The efficacy of the presented framework is demonstrated by comparing against existing similar models and testing against the cyber injects from a real-world cyber-attack that targeted industrial control systems (ICS) in critical infrastructures.

Gourisetti, Sri Nikhil G.↗
DOE OSTI2022

VWC-BERT: Scaling Vulnerability–Weakness–Exploit Mapping on Modern AI Accelerators

Defending cybersystems needs accurate mapping of software and hardware vulnerabilities to generalized descriptions of weaknesses, and weaknesses to exploits. These mappings enable cyber defenders to build plans for effective defense and assessment of potential risks to a cybersystem. With close to 170k vulnerabilities, manual mapping is not a feasible option. However, automated mapping is challenging due to limited training data, computational intractability, and limitations in computational natural language processing. Tools based on breakthroughs in Transformer-based language models have been demonstrated to classify vulnerabilities with high accuracy. We make three key contributions in this paper: (1) We present a new framework, \VWCBERT, that augments the Transformer-based hierarchical multi-class classification framework of Das et al. (\textsc{V2W-BERT}) with the ability to map weaknesses to exploits. (2) We implement \VWCBERT~ on modern AI accelerator platforms using two data parallel techniques for the pre-training phase and demonstrate nearly linear speedups across NVIDIA and Graphcore accelerator platforms. We observe nearly linear speedups for up to 16 V100 and 8 A100 GPUs, and about 3.4$\times$ speedup for A100 relative to V100 GPUs. We also observe excellent speedups on Graphcore, with $5.7\times$ speedup on 128 IPUs relative to 16 IPUs. Enabled by scaling, we also demonstrate higher accuracy using a larger language model, RoBERTa-Large. We show up to 87\% accuracy for strict and up to 98\% accuracy for relaxed classification. (3) We develop a novel parallel link manager for the link prediction phase and demonstrate up to 21$\times$ speedup with 16 V100 GPUs relative to one V100 GPU, and thus reducing the runtime from 2.5 hours to 10 minutes. We believe that generalizability and scalability of \VWCBERT~ will benefit both the theoretical development and practical deployment of novel cyberdefense solutions and vulnerability classification.

Das, Siddhartha Shankar↗