Results for “Secure Software Development” — Page 20

DOE OSTI2017

Characterization of a spectroscopic detector for application in x-ray computed tomography

Recent advances in cadmium telluride (CdTe) energy-discriminating pixelated detectors have enabled the possibility of Multi-Spectral X-ray Computed Tomography (MSXCT) to incorporate spectroscopic information into CT. MultiX ME 100 V2 is a CdTe-based spectroscopic x-ray detector array capable of recording energies from 20 to 160 keV in 1.1 keV energy bin increments. Hardware and software have been designed to perform radiographic and computed tomography tasks with this spectroscopic detector. Energy calibration is examined using the end-point energy of a bremsstrahlung spectrum and radioisotope spectral lines. When measuring the spectrum from Am-241 across 500 detector elements, the standard deviation of the peak-location and FWHM measurements are ±0.4 and ±0.6 keV, respectively. As these values are within the energy bin size (1.1 keV), detector elements are consistent with each other. The count rate is characterized, using a nonparalyzable model with a dead time of 64 ± 5 ns. This is consistent with the manufacturer’s quoted per detector-element linear-deviation at 2 Mpps (million photons per sec) of 8.9% (typical) and 12% (max). When comparing measured and simulated spectra, a low-energy tail is visible in the measured data due to the spectral response of the detector. If no valid photon detections are expected in the low-energy tail, then a background subtraction may be applied to allow for a possible first-order correction. If photons are expected in the low-energy tail, a detailed model must be implemented. A radiograph of an aluminum step wedge with a maximum height of about 20 mm shows an underestimation of attenuation by about 10% at 60 keV. This error is due to partial energy deposition from higher-energy (> 60 keV) photons into a lower-energy (~60 keV) bin, reducing the apparent attenuation. A radiograph of a PTFE cylinder taken using a bremsstrahlung spectrum from an x-ray voltage of 100 kV filtered by 1.3 mm Cu is reconstructed using Abel inversion. As no counts are expected in the low energy tail, a first order background correction is applied to the spectrum. The measured linear attenuation coefficient (LAC) is within 10% of the expected value in the 60 to 100 keV range. Below 60 keV, low counts in the corrected spectrum and partial energy deposition from incident photons of energy greater than 60 keV into energy bins below 60 keV impact the LAC measurements. This report ends with a demonstration of the tomographic capability of the system. The quantitative understanding of the detector developed in this report will enable further study in evaluating the system for characterization of an object’s chemical make-up for industrial and security purposes.

36 MATERIALS SCIENCE↗

DOE OSTI2022

Precursor Analysis Report: Cyber Attack on Thyssenkrupp Blast Furnace 2014

The Cyber Attack on Thyssenkrupp Blast Furnace 2014 Precursor Analysis Report leverages publicly available information about the Thyssenkrupp Steel Mill cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In December 2014, the German Government’s Federal Office for Information Security (BSI) released a report detailing a cyber attack on a German steel mill that occurred earlier that year, though exact dates and details of the attack were not revealed. While the report did not specify the name of the company, multiple sources identified the victim as one of Europe’s largest steel manufacturers, Thyssenkrupp AG. Further, Thyssenkrupp announced on 16 May of that year that Europe’s largest blast furnace, “Schwelgern 2,” located at its facility in Duisburg, Germany, would be offline for several weeks for repairs and upgrades, suggesting Schwelgern 2 was likely the target of the attack. The attack began in early 2014, when adversaries infiltrated the victim steel mill’s Information Technology (IT) network via a spearphishing campaign, then worked their way into the Operational Technology (OT) environment, where they executed software that caused denial of service, denial of control, and eventually a loss of control. This led to the blast furnace shutting down without proper safety procedures, resulting in catastrophic physical damage. No lives were lost in the incident, but ThyssenKrupp suffered $4 million in damage to the blast furnace and an additional $6 million in lost revenue. The adversaries required specialized knowledge and expertise in steel production, which enabled them to compromise a variety of internal systems and components across both IT and OT networks. The attack also demonstrated detailed knowledge of the industrial control systems (ICS) and production processes being used. This combination resulted in one of the earliest known publicly reported cybersecurity incidents resulting in physical damage to ICS equipment. Researchers and analysts identified 19 unique techniques (used in a sequence of 20 steps) utilized during the attack with a total of 454 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the Thyssenkrupp cyber attack were precursors to the triggering event. Analysis identified 369 observables associated with these precursor techniques, 316 of which were assessed to have an increased likelihood of being perceived in the 120 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2023

Summary of Technical Peer Review on the Risk Assessment Framework proposed in Report INL/RPT-22-68656 for Digital Instrumentation and Control Systems

This report summarizes the peer review activities initiated by Idaho National Laboratory (INL) during fiscal year (FY) 2023 for the evaluation and improvement of the methodology developed under the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a technical basis to support effective and secure DI&C technologies for digital upgrades/designs. A framework was proposed for this strategy, which aims to (1) provide a best-estimate, risk-informed capability to quantitatively and accurately estimate the risk impact of plant modernization, considering the introduction of high safety-significant safety-related (HSSSR) DI&C systems, (2) support and supplement existing risk-informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems, (4) assure the long-term safety and reliability of HSSSR DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. The R&D efforts of this project from FY 2019 through FY 2022 were focused on methodology improvement and demonstration of the proposed framework for the risk assessment and design optimization of safety-critical DI&C systems. Collaborations with the nuclear industry have been initiated to support the reliability and risk assessment of their DI&C systems by using the proposed framework. In FY 2023, the framework has reached to a point for a technical peer review and obtain stakeholder feedback. This peer review activity includes coordination of the reviews performed by a group of industry stakeholders, documentation of the peer review suggestions, providing resolutions and responses to the peer review comments. The objective of this technical peer review is to obtain representative feedback on the proposed framework to improve the technical qualities of its methodology and readiness for deployment to the industry. Feedback may identify potential areas for improvement and further development. The Subject Matter experts were invited to review the latest project report documenting the methodology developed in the project and provide evaluations of the technical qualities of the proposed framework and relevant methods. The reviewed project report is “An Integrated Framework for Risk Assessment of High Safety-significant Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology and Demonstration” INL/RPT-22-68656 (short as “INL/RPT-22-68656” in this report). This peer review report documents the technical questions provided for technical peer review and introduces the technical peer reviewers from the stakeholders including nuclear utilities, regulators, and universities. Comments from technical peer reviewers and the resolutions and responses to these comments are outlined. Insights and lessons learned from the technical peer review are summarized in conclusions and future work. The primary audience of this report are DI&C designers, engineers, and probabilistic risk assessment (PRA) practitioners. This includes stakeholders, such as the nuclear utilities and regulators who consider the deployment and upgrade of DI&C systems, DI&C software developers and reviewers, and cybersecurity specialists.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2023

A geospatial risk analysis graphical user interface for identifying hazardous chemical emission sources

Background: Performing back trajectory and forward trajectory using the Hybrid Single-Particle Lagrangian Integrated Trajectory Model (HYSPLIT) is a reliable approach for assessing particle transport after release among mid-field atmospheric models. HYSPLIT has an externally facing online interface that allows non-expert users to run the model trajectories without requiring extensive training or programming. However, the existing HYSPLIT interface is limited if simulations have a large amount of meteorological data and timesteps that are not coincident. The objective of this study is to design and develop a more robust tool to rapidly evaluate hazard transport conditions and to perform risk analysis, while still maintaining an intuitive and user-friendly interface. Methods: HYSPLIT calculates forward and backward trajectories of particles based on wind speed, wind direction, and the corresponding location, timestamp, and Pasquill stability classes of the regions of the atmosphere in terms of the wind speed, the amount of solar radiation, and the fractional cloud cover. The computed particle transport trajectories, combined with the online Proton Transfer Reaction-Mass Spectrometry (PTR-MS) data (https://figshare.com/articles/dataset/ARL_Data_from_PROS_station_at_Hanford_site/19993964), can be used to identify and quantify the sources and affected area of the hazardous chemicals’ emission using the potential source distribution function (PSDF). PSDF is an improved statistical function based on the well-known potential source contribution function (PSCF) in establishing the air pollutant source and receptor relationship. Performing this analysis requires a range of meteorological and pollutant concentration measurements to be statistically meaningful. The existing HYSPLIT graphical user interface (GUI) does not easily permit computations of trajectories of a dataset of meteorological data in high temporal frequency. To improve the performance of HYSPLIT computations from a large dataset and enhance risk analysis of the accidental release of material at risk, a geospatial risk analysis tool (GRAT-GUI) is created to allow large data sets to be processed instantaneously and to provide ease of visualization. Results: The GRAT-GUI is a native desktop-based application and can be run in any Windows 10 system without any internet access requirements, thus providing a secure way to process large meteorological datasets even on a standalone computer. GRAT-GUI has features to import, integrate, and convert meteorological data with various formats for hazardous chemical emission source identification and risk analysis as a self-explanatory user interface. The tool is available at https://figshare.com/articles/software/GRAT/19426742.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2026

Hydrogeological assessment of CO2 containment assurance and wellbore integrity at a Gulf Coast storage site

Abstract A large-scale carbon capture and storage (CCS) initiative on the Texas Gulf Coast serves as a premier demonstration of the U.S. Department of Energy’s CarbonSAFE program. Targeting deep saline formations, specifically Oligo-Miocene deltaic sequences, the project aims to establish technical and commercial viability for geologic CO2 storage within a major industrial corridor. This study provides a rigorous hydrogeological assessment to support Class VI permitting by quantifying the high degree of containment security. Utilizing a compositional reservoir simulator, we developed a suite of 27 distinct simulation cases to evaluate vertical plume dynamics near both planned injection wells and proximal legacy infrastructure. To ensure numerical accuracy near wellbores, we implemented a refined mesh strategy, determining that a 5.6 ft × 5.6 ft grid refinement offered the optimal balance between computational efficiency and descriptive precision. The modeling framework utilized a systematic sensitivity-based approach to evaluate the mechanical redundancy of the subsurface system by performing a bounding analysis of wellbore interfaces against hypothetical high-permeability microannuli. By systematically isolating competing physical drivers, including permeability, porosity, gas hysteresis, thermal gradients, salinity, and solubility trapping (quantified via Henry’s law with dynamically adjusted coefficients), this work moves beyond binary assessments to establish a nuanced hierarchy of containment factors. The results confirm that primary trapping mechanisms (e.g., gas hysteresis and solubility), combined with the site's unique geomechanical stratigraphy, significantly restrict vertical mobility and reinforce the robust containment security of the reservoir. Baseline results demonstrate substantial vertical separation between the CO2 plume and the upper confining system, ensuring robust containment. Sensitivity analysis reveals that even under highly conservative bounding scenarios—assuming theoretical 10-Darcy pathways at specific wellbore locations—the 2,900-ft thick multi-layered confining zone remains a reliable barrier. In these hypothetical upper-bound cases, peak upward fluxes of CO2 and saltwater after 15 years of injection remain localized and dissipate rapidly within the lower sections of the confining interval, leaving the integrity of the seal uncompromised. Furthermore, the study identifies that while localized wellbore pathways define theoretical upper bounds of vertical migration, the Area of Review (AoR) is primarily sensitive to regional thermal gradients and hysteresis, which can influence the AoR by over 3,000 acres in pessimistic configurations. Also, primary trapping mechanisms, specifically gas hysteresis and solubility, work in tandem with the Gulf Coast’s unique geomechanical stratigraphy to significantly restrict vertical mobility. Ductile, smectite-rich mudstones facilitate natural borehole convergence and the self-healing of potential conduits, creating a natural geomechanical bridge that effectively mitigates migration potential at both current injection points and legacy-well locations. This comprehensive modeling effort demonstrates that the integration of high-resolution wellbore simulations and regional geomechanical observations confirms the long-term storage security of the studied site, providing a physics-based foundation for industrial-scale CCS deployments. This modeling framework establishes a baseline for future research into coupled geomechanical effects, such as time-dependent borehole convergence, to further refine long-term containment projections. Acknowledgements We thank the Gulf Coast Carbon Center (GCCC) at the Bureau of Economic Geology for foundational research support. We appreciate Alex Bump for technical guidance and David Hoffman for model mesh generation. This work used TACC’s Frontera cluster for simulations and CMG Ltd. software licenses provided to UT-Austin. This material is based upon work supported by the Department of Energy under Award Number DE-FE0032338. Disclaimer This material is based upon work supported by the U.S. Department of Energy’s Fossil Energy and Carbon Management Office under the CarbonSAFE program, award Number DE-FE0032338. The views expressed herein do not necessarily represent the views of the U.S. Department of Energy or the United States Government.

58 GEOSCIENCES↗

DOE OSTI2026

Hydrogeological assessment of CO2 containment assurance and wellbore integrity at a Gulf Coast storage site

Abstract A large-scale carbon capture and storage (CCS) initiative on the Texas Gulf Coast serves as a premier demonstration of the U.S. Department of Energy’s CarbonSAFE program. Targeting deep saline formations, specifically Oligo-Miocene deltaic sequences, the project aims to establish technical and commercial viability for geologic CO2 storage within a major industrial corridor. This study provides a rigorous hydrogeological assessment to support Class VI permitting by quantifying the high degree of containment security. Utilizing a compositional reservoir simulator, we developed a suite of 27 distinct simulation cases to evaluate vertical plume dynamics near both planned injection wells and proximal legacy infrastructure. To ensure numerical accuracy near wellbores, we implemented a refined mesh strategy, determining that a 5.6 ft × 5.6 ft grid refinement offered the optimal balance between computational efficiency and descriptive precision. The modeling framework utilized a systematic sensitivity-based approach to evaluate the mechanical redundancy of the subsurface system by performing a bounding analysis of wellbore interfaces against hypothetical high-permeability microannuli. By systematically isolating competing physical drivers, including permeability, porosity, gas hysteresis, thermal gradients, salinity, and solubility trapping (quantified via Henry’s law with dynamically adjusted coefficients), this work moves beyond binary assessments to establish a nuanced hierarchy of containment factors. The results confirm that primary trapping mechanisms (e.g., gas hysteresis and solubility), combined with the site's unique geomechanical stratigraphy, significantly restrict vertical mobility and reinforce the robust containment security of the reservoir. Baseline results demonstrate substantial vertical separation between the CO2 plume and the upper confining system, ensuring robust containment. Sensitivity analysis reveals that even under highly conservative bounding scenarios—assuming theoretical 10-Darcy pathways at specific wellbore locations—the 2,900-ft thick multi-layered confining zone remains a reliable barrier. In these hypothetical upper-bound cases, peak upward fluxes of CO2 and saltwater after 15 years of injection remain localized and dissipate rapidly within the lower sections of the confining interval, leaving the integrity of the seal uncompromised. Furthermore, the study identifies that while localized wellbore pathways define theoretical upper bounds of vertical migration, the Area of Review (AoR) is primarily sensitive to regional thermal gradients and hysteresis, which can influence the AoR by over 3,000 acres in pessimistic configurations. Also, primary trapping mechanisms, specifically gas hysteresis and solubility, work in tandem with the Gulf Coast’s unique geomechanical stratigraphy to significantly restrict vertical mobility. Ductile, smectite-rich mudstones facilitate natural borehole convergence and the self-healing of potential conduits, creating a natural geomechanical bridge that effectively mitigates migration potential at both current injection points and legacy-well locations. This comprehensive modeling effort demonstrates that the integration of high-resolution wellbore simulations and regional geomechanical observations confirms the long-term storage security of the studied site, providing a physics-based foundation for industrial-scale CCS deployments. This modeling framework establishes a baseline for future research into coupled geomechanical effects, such as time-dependent borehole convergence, to further refine long-term containment projections. Acknowledgements We thank the Gulf Coast Carbon Center (GCCC) at the Bureau of Economic Geology for foundational research support. We appreciate Alex Bump for technical guidance and David Hoffman for model mesh generation. This work used TACC’s Frontera cluster for simulations and CMG Ltd. software licenses provided to UT-Austin. This material is based upon work supported by the Department of Energy under Award Number DE-FE0032338. Disclaimer This material is based upon work supported by the U.S. Department of Energy’s Fossil Energy and Carbon Management Office under the CarbonSAFE program, award Number DE-FE0032338. The views expressed herein do not necessarily represent the views of the U.S. Department of Energy or the United States Government.

58 GEOSCIENCES↗

DOE OSTI2018

Nebraska Integrated Carbon Capture and Storage Pre-Feasibility Study

In collaboration with the Nebraska Public Power District (NPPD), the Energy & Environmental Research Center (EERC) has conducted a pre-feasibility study for a commercial-scale carbon dioxide (CO 2 ) geologic storage complex in western Nebraska integrated with potential CO 2 capture at Gerald Gentleman Station (GGS). GGS is the largest coal-fired electricity-generating station in Nebraska, emitting 8.5 million metric tons (Mt) of CO 2 annually, and is located near the town of Sutherland. This pre-feasibility (Phase 1) project has been executed as part of the U.S. Department of Energy (DOE) CarbonSAFE program, a multiphase initiative to support the deployment of large-scale carbon capture and storage (CCS) projects. Each CarbonSAFE project is required to demonstrate the potential to capture and store at least 50 million tonnes (Mt) of CO 2 over a 25-year operational period. The EERC and NPPD established a coordination team to identify challenges to a potential Nebraska CCS project, comprising local stakeholder organizations, which met twice in Lincoln and via several Webinars, providing feedback and guidance throughout the pre-feasibility study. The EERC also secured the technical support of Schlumberger Carbon Services and Computer Modelling Group Ltd. (CMG). The project comprised four technical themes, all using published information sources. Regional and stakeholder analysis, including identification of sensitive environmental areas, potential resource conflicts, and strategies for public outreach. A review of geographic and socioeconomic characteristics, in combination with geologic characterization in the subbasinal analysis described below, identified an area to the southwest and within a 75-mile radius of GGS as the most prospective for development of a storage site. This area largely avoided lands with protected status such as wetlands. A public outreach plan has also been developed for implementation in any further phases of CCS assessment in western Nebraska, for example a CarbonSAFE Phase 2 feasibility study. Scenario analysis, addressing economic and regulatory factors. GGS is the only single major source of CO 2 emissions capable of satisfying the CarbonSAFE 50-Mt scale requirement within the study region. Chemical absorption using amines was identified as the most viable technology for postcombustion CO 2 capture at GGS. The total cost of a CCS project at GGS was estimated to be between $67/tonne CO 2 for capture and auxiliary boiler to minimize parasitic load and $70/tonne CO 2 avoided cost, using the Carnegie-Mellon University Integrated Environmental Control Model (IECM). The total avoided cost included the capture facility and parasitic load, a flue gas desulfurization plant required for the use of amine solvent technology, transport via pipeline, and dedicated storage infrastructure. Nebraska has no legislation in place to address typical CCS-specific issues, for example pore space ownership for storage. Long-term liability, therefore, falls under the U.S. Environmental Protection Agency Underground Injection Control (UIC) Class 6 program regulations. Subbasinal analysis, addressing the potential for a dedicated subsurface “container” to store the required 50-Mt quantity of CO 2 . Modeling and simulation studies identified an area to the southwest of GGS with the potential for storage of 50 Mt CO 2 in the Cloverly Formation, comprising sandstones with interbedded and intermingled shales. The area of review (AOR) that would be required for monitoring under a Class VI operating permit was estimated to be as high as 400–700 square miles, due to uncertain pressure effects. The viability of this storage option is subject to significant uncertainty due to the relatively limited amount of existing characterization data available to the pre-feasibility study; for example, dynamic simulation indicated that the proposed storage rate might require as little as two or as many as 14 injection wells. A key uncertainty is the relative proportion and distribution of sandstone and shale within the Cloverly Formation. A preliminary, semiquantitative risk assessment also suggested uncertainty over storage capacity and injectivity constitute the most significant project risks at this pre-feasibility stage. No assessed risks were considered to rule out the possibility of a project moving to deployment. National Risk Assessment Partnership (NRAP) validation, using software tools developed by the National Energy Technology Laboratory (NETL) to assess risks associated with the potential 50-Mt CO 2 storage complex. NRAP tools were used to assess hypothetical leakage scenarios. Results broadly supported the conclusion of the semiquantitative risk analysis – for example, even worst-case analysis of theoretical leakage scenarios found limited migration rates and impacts. In summary, the work undertaken in this Phase 1 pre-feasibility study has shown that western Nebraska has potential to host a commercial-scale CCS project, including a dedicated storage “container” for 50 Mt of CO 2 . However, the following key challenges would need to be overcome: The business case for deploying CCS projects is uncertain; recently announced federal tax credits and sales of CO 2 for enhanced oil recovery may not cover the full costs of a CCS project at GGS, as estimated by this pre-feasibility study. The potential 50-Mt CO 2 dedicated storage container defined in this pre-feasibility study should be regarded as having a relatively low level of readiness to support a CCS project. Public outreach would be a vital element in western Nebraska, where sensitivities around such environmental issues as water resource protection and pipeline construction would need to be carefully addressed.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2018

Development of a Methodology to Assess the Impact of Non-Conventional Waste Streams Following a Radiological Incident - 18271

The Environmental Protection Agency's (EPA's) Waste Estimation Support Tool (WEST) is a Geographic Information System (GIS)-based decision support tool for estimating waste generated from remediation and cleanup activities following a radiological incident. WEST uses the Federal Emergency Management Agency's (FEMA's) Hazus-MH software's infrastructure information combined with image classification capabilities to estimate the quantity of waste and debris that may result from a radiological incident. WEST can be used to create customized decontamination strategies that allow end-users to evaluate different means of decontamination and how those strategies may impact the resulting waste stream in each geographical locality. This capability can potentially reduce the response/recovery time frame and cost. One of the key observations from past applications of WEST is that planning scenarios are site-specific, especially when dealing with chemical, biological, radiological, or nuclear (CBRN) waste management issues. Furthermore, site-specific issues are not limited to resource limitations or response bottlenecks but should also account for differences in an area's geography and urban footprint, a phenomenon observed during the Fukushima response. For instance, a recent WEST case study found that the amount of waste generated per unit of affected area, for a given decontamination approach, is largely a function of the building surface area in the affected area (relative to the ground surfaces). However, differences in the geometry and density of contaminated objects in the landscape may impact the amount and characteristics of the waste stream. Although buildings typically constitute a large portion of the surface area in urban environments, other objects such as vehicles and trees can be just as prominent. For example, seasonal changes in the amount of foliage present can alter the non-structural surface area calculated for an area like New York City by 20-30%. Very little is known about the impact that these non-conventional waste streams have on overall remediation strategies, or to what extent differences in characteristics of urban versus rural environments, traffic activities, or seasonal variations may have on these factors. This paper will present the proposed methodology to incorporate into WEST the impacts that niche, nonconventional waste streams might have from rural and urban environments following a nuclear power plant incident or detonation of a radiological dispersal device or improvised nuclear device. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2015

ASCR Cybersecurity for Scientific Computing Integrity - Research Pathways and Ideas Workshop

At the request of the U.S. Department of Energy's (DOE) Office of Science (SC) Advanced Scientific Computing Research (ASCR) program office, a workshop was held June 2-3, 2015, in Gaithersburg, MD, to identify potential long term (10 to +20 year) cybersecurity fundamental basic research and development challenges, strategies and roadmap facing future high performance computing (HPC), networks, data centers, and extreme-scale scientific user facilities. This workshop was a follow-on to the workshop held January 7-9, 2015, in Rockville, MD, that examined higher level ideas about scientific computing integrity specific to the mission of the DOE Office of Science. Issues included research computation and simulation that takes place on ASCR computing facilities and networks, as well as network-connected scientific instruments, such as those run by various DOE Office of Science programs. Workshop participants included researchers and operational staff from DOE national laboratories, as well as academic researchers and industry experts. Participants were selected based on the submission of abstracts relating to the topics discussed in the previous workshop report [1] and also from other ASCR reports, including "Abstract Machine Models and Proxy Architectures for Exascale Computing" [27], the DOE "Preliminary Conceptual Design for an Exascale Computing Initiative" [28], and the January 2015 machine learning workshop [29]. The workshop was also attended by several observers from DOE and other government agencies. The workshop was divided into three topic areas: (1) Trustworthy Supercomputing, (2) Extreme-Scale Data, Knowledge, and Analytics for Understanding and Improving Cybersecurity, and (3) Trust within High-end Networking and Data Centers. Participants were divided into three corresponding teams based on the category of their abstracts. The workshop began with a series of talks from the program manager and workshop chair, followed by the leaders for each of the three topics and a representative of each of the four major DOE Office of Science Advanced Scientific Computing Research Facilities: the Argonne Leadership Computing Facility (ALCF), the Energy Sciences Network (ESnet), the National Energy Research Scientific Computing Center (NERSC), and the Oak Ridge Leadership Computing Facility (OLCF). The rest of the workshop consisted of topical breakout discussions and focused writing periods that produced much of this report.

97 MATHEMATICS AND COMPUTING↗