Search NASA⌕ Search

SEARCH · Search NASA

Results for “vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 469 records · Page 26
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

ILLICIT TRANSIT INTERDICTION GLOBAL ANALYSIS

This study aims to enhance the security of radioactive materials during transport by analyzing commonalities in cargo thefts conducted by non-state groups such as thieves and terrorists. This research focuses on identifying patterns and trends in the methods used to steal high-value cargo, with the goal of applying these insights to improve transport security of radioactive materials. Key questions addressed include the frequency of specific tools, techniques, and insider involvement in thefts, as well as the use of weapons, electronic jamming equipment, and specialized tools. Findings will inform security design improvements and industry practices to mitigate vulnerabilities. The study involves a comprehensive review of literature and case studies, utilizing data sources from 2018 to 2023. Articles will be selected based on their relevance to thefts of valuable cargo in transit, with a focus on incidents involving non-state actors. The methodology will include statistical and inferential analysis to identify trends, with results visualized through pie charts, frequency analyses, and terrain maps. The discussion will highlight the implications of findings and provide actionable recommendations for strengthening security measures. Limitations such as data availability and reporting inconsistencies will be acknowledged. Suggestions for future improvements will be constructed using existing case studies and expert feedback. The study’s outcomes aim to raise awareness within the industry, inform policy decisions, and enhance security protocols for radioactive material transport. Metrics for impact include the potential publication of findings, presentations at conferences to raise awareness, and the subsequent actions taken by stakeholders based on the research. By identifying trends and vulnerabilities and suggesting improvements, this research contributes to preventing the illicit use of nuclear and radiological materials.

Zineddin, Dr. Z. [ORNL] (ORCID:0009000848740725)↗
DOE OSTI2025

Data Centers and Digital Assurance Workshop 2 – Prioritizing Digital Assurance Challenges, Session 2

The second session of the TADA (Technical Assistance for Digital Assurance) Data Centers Cohort, held on November 10, 2025, focused on prioritizing digital assurance challenges at the intersection of data centers and the electric grid. Building on the foundational concepts introduced in Workshop 1, this session deepened the application of the Threat–Vulnerability–Consequence (TVC) framework and emphasized the urgency of addressing cybersecurity, supply chain integrity, and operational reliability. Participants explored the growing convergence of digital and physical systems, the expanding attack surface due to global supply chain dependencies, and the implications of AI-driven load behavior. Real-world incidents—including the Volt Typhoon campaign and vulnerabilities in Solarman and Deye platforms—were analyzed to illustrate the risks of unpatched systems, insecure APIs, and inadequate vendor oversight. Key themes included architecture and interface weaknesses, governance gaps, and human and procedural shortcomings. The workshop also examined the evolving regulatory landscape, highlighting new federal mandates around Foreign Entity of Concern (FEOC) compliance and large-load reliability standards. Through interactive exercises, stakeholders ranked and mapped digital assurance risks from their respective perspectives—utilities, operators, and vendors—laying the groundwork for mitigation strategies and shared accountability models to be developed in Workshop 3. Session 2 of 3.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2026

Smart Inverters, Dumb Risk: Taking Control of IBR Security in the Digital Age

This presentation addresses the security challenges posed by Inverter-Based Resources (IBRs) in the modern energy landscape. The presentation highlights the vulnerabilities and risks associated with IBRs, including the potential for cyber-attacks, the impact of insecure defaults, and the systemic risks posed by supply chain dependencies. Key topics covered include: 1) The increasing digital transformation in energy systems and the associated security risks. 2) Specific vulnerabilities in IBRs, including weak passwords, hardcoded credentials, and insecure web application interfaces. 3) The implications of persistent connectivity and the strategic risks posed by foreign-manufactured components. 4) The role of regulatory frameworks, such as NERC CIP, in addressing these challenges and the limitations of current oversight. 5) Practical solutions for mitigating risks, including secure design practices, vendor risk assessments, and the importance of strong passwords and role-based access control. The presentation underscores the necessity of a comprehensive, system-of-systems approach to securing IBRs, emphasizing the need for collaboration across various stakeholders, including operators, developers, and regulators, to ensure the resilience and security of the energy grid.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Braxton Marlatt Intern Poster

The Internet of Things (IoT) encompasses a vast network of interconnected devices embedded with software, sensors, and network connectivity, enabling data collection and exchange. While IoT technology revolutionizes various industries, it also introduces significant security challenges. This research focuses on enhancing IoT security through the implementation of Zero Trust Architecture concepts, specifically targeting the Network and Device pillars of the Cybersecurity and Infrastructure Security Agency’s Zero Trust Maturity Model. By generating Codified Attack Surfaces (CAS) using custom Structured Threat Information eXpression bundles, this project aims to provide enhanced visibility into network communications, detect vulnerabilities in device firmware, and improve the overall security posture for IoT devices and networks. The methodology involves defining custom STIX schema and objects, collecting data from intra-IoT traffic, external network traffic, and firmware analysis, and automating the conversion and correlation of this data into STIX bundles. The automated generation of attack surfaces offers comprehensive insights into activity, vulnerabilities, and anomalies within an IoT environment, enabling proactive threat identification and mitigation.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Advanced Transmission Technologies – GETs and HPCs Session 2: Advanced Power Flow Control and Transmission Topology Optimization

The INL TADA GETs Cohort Session 2, held on November 7, 2025, conducted in collaboration with ScottMadden, focused on two core Advanced Transmission Technologies (ATTs): Advanced Power Flow Control (APFC) and Transmission Topology Optimization (TTO). These technologies are pivotal in enhancing grid flexibility, reliability, and cybersecurity resilience. APFC, particularly through modular FACTS devices like Modular Static Synchronous Series Compensators (M-SSSCs), enables dynamic voltage injection to reroute power flows. The session highlighted the deployment benefits of APFC, such as rapid installation, minimal civil works, and re-deployability. Regulatory drivers like FERC Order 2023 mandate the inclusion of Grid-Enhancing Technologies (GETs) in interconnection studies. Case studies from Central Hudson, CAISO, and National Grid (UK) demonstrated APFC’s effectiveness in congestion relief and cost savings. The session also addressed cybersecurity concerns, including firmware vulnerabilities, SCADA integration risks, and supply chain dependencies. Participants engaged in interactive exercises to rank cybersecurity and supply chain risks, emphasizing the need for robust digital assurance strategies. TTO involves software-based reconfiguration of transmission networks to optimize power flow without new infrastructure. The session showcased its operational value, with examples from SPP, PJM, and MISO showing significant congestion cost reductions. Cybersecurity vulnerabilities were discussed, particularly in API security and software supply chains, referencing incidents like SolarWinds and attacks on Danish utilities. Digital assurance exercises explored worst-case scenarios, attack paths, and mitigation responsibilities between vendors and utilities. Reliability challenges such as algorithm stability, vendor dependency, and operator trust were also examined. Cross-cutting themes emphasized the importance of digital assurance tools, including Software Bills of Materials (SBOMs) and hardware-in-loop testing. Human performance, training, and operational confidence were identified as critical enablers of technology adoption. The session concluded with a preview of Session 3, which will focus on High Performance Conductors (HPCs) and risk-based cybersecurity tools. Session 2 of 3.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Inventory and Probabilistic Function of Natural Hazards in the United States: July 19, 2018 - September 18, 2018

The U.S. Department of Energy's National Renewable Energy Laboratory (NREL) developed a standardized risk assessment process that considers the location-specific vulnerabilities and threats (climate-related as well as human-caused) at a site to generate a ranked list of organizational risks and associated mitigation options for reducing those risks. To support this effort, the Southern Climate Impacts Planning Program (SCIPP), a National Oceanic and Atmospheric (NOAA) Regional Integrated Sciences and Assessments (RISA) team, was selected to provide climate science expertise to develop a comprehensive inventory and probabilistic function of natural hazards (e.g., hurricanes, tornadoes, flooding, and sea level rise) for the entire United States by region. The inventory of climate-related hazards and the associated likelihood scores are incorporated into a companion risk assessment tool enabling standardized comparisons of risk at sites across the country.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2025

Yesterday’s extremes, today’s new normal: flood risk in the Kathmandu Valley, Nepal

Unplanned urban growth has left many cities increasingly vulnerable to extreme rainfall events, particularly in regions with inadequate drainage infrastructures and development encroaching on natural floodplains. Here, in this perspective paper, we examine the September 2024 floods that struck Central Nepal, triggered by a persistent low-pressure system and enhanced by converging moisture flows from the Arabian Sea and the Bay of Bengal which led to widespread catastrophic damage. In the Kathmandu Valley, floodwaters expanded to more than 2.5 times the bankfull water extent, causing significant damage to housing, transportation network, and critical infrastructure, displacing thousands of residents, and severely disrupting urban services. This event highlights the urgent need for improved flood management strategies that integrate both structural and non-structural measures into the infrastructure development. While early warning systems provided critical lead time, challenges remain in reducing forecasting uncertainties and improving communication across government agencies and with local communities. A forward-looking approach is essential, including probabilistic flood forecasting systems, sustainable floodplain management, risk-sensitive land use planning, climate- and disaster- resilient infrastructure development, and the integration of nature-based solutions like urban green and blue spaces to mitigate flood impacts. By involving local communities in planning and preparedness efforts, particularly through citizen science initiatives, and engagement with underserved and disadvantaged communities, Nepal can better adapt to the growing risks posed by extreme rainfall and urban flooding and enhance long-term disaster resilience in rapidly urbanizing areas like Kathmandu Valley.

Kathmandu Valley↗
DOE OSTI2022

RADAMS: Resilient and adaptive alert and attention management strategy against Informational Denial-of-Service (IDoS) attacks

Attacks exploiting human attentional vulnerability have posed severe threats to cybersecurity. In this work, we identify and formally define a new type of proactive attentional attacks called Informational Denial-of-Service (IDoS) attacks that generate a large volume of feint attacks to overload human operators and hide real attacks among feints. Here, we incorporate human factors (e.g., levels of expertise, stress, and efficiency) and empirical psychological results (e.g., the Yerkes-Dodson law and the sunk cost fallacy) to model the operators’ attention dynamics and their decision-making processes along with the real-time alert monitoring and inspection. To assist human operators in dismissing the feints and escalating the real attacks timely and accurately, we develop a Resilient and Adaptive Data-driven alert and Attention Management Strategy (RADAMS) that de-emphasizes alerts selectively based on the abstracted category labels of the alerts. RADAMS uses reinforcement learning to achieve a customized and transferable design for various human operators and evolving IDoS attacks. The integrated modeling and theoretical analysis lead to the Product Principle of Attention (PPoA), fundamental limits, and the tradeoff among crucial human and economic factors. Experimental results corroborate that the proposed strategy outperforms the default strategy and can reduce the IDoS risk by as much as 20%. Besides, the strategy is resilient to large variations of costs, attack frequencies, and human attention capacities. We have recognized interesting phenomena such as attentional risk equivalency, attacker’s dilemma, and the half-truth optimal attack strategy.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Hydraulic safety and growth rather than climate of origin influence survival in desert shrubs and trees

The species-poor woodlands and forests in arid regions are particularly vulnerable to climate change induced plant die-off. Searching for species suitable to replant in these areas is an effective way to prevent further expansion of land desertification. Good knowledge of drought resistance of species is critical for current replanting efforts, however, the related plant survival mechanisms in the process of restoration remain limited. Here, we tested the dominant drivers of plant survival in relation to climate factors, growth characteristics and functional traits including hydraulics and gas exchange across 35 multiple shrub and tree woody species in a common garden at the Tengger Desert, northwest China. We found the desert plants had a wide range of hydraulic thresholds among these desert species, with relative high hydraulic safety, and low xylem hydraulic conductivity. Pant survival was largely determined by hydraulic safety and growth status, but was not affected by the climate of the species’ site of origin. Shrubs and trees diverged in hydraulic and growth characteristics, while there was no difference between native and introduced species. In this study, our results highlight the critical roles of hydraulic safety and growth on determining the survival and drought adaptation during desert vegetation development, which provide a new insight into ecological restoration in arid regions under changing climate conditions.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Projecting spatiotemporally explicit effects of climate change on stream temperature: A model comparison and implications for coldwater fishes

Conservation planners and resource managers seek information about how the availability and locations of cold-water habitats will change in the future and how these predictions vary among models. In this work, we used a physical process-based model to demonstrate the implications of climate change for streamflow and water temperature in two watersheds with distinctive flow regimes: the Snoqualmie watershed (WA) and Siletz watershed (OR), USA. Our model incorporated a downscaled ensemble of global climate model outputs and was calibrated with in situ and remotely sensed water temperatures. Furthermore, we compared predictions from our processed-based model to those from a publicly available and widely used statistical model. The process-based model projected greater changes in summer maximum water temperatures for the mixed-rain-snow Snoqualmie watershed than for the rain-dominated Siletz watershed as a result of the near-complete loss of winter snowpack and significant reduction in summer flow in the Snoqualmie watershed expected by the 2080s. Both models projected generally similar future spatial patterns of maximum water temperature in the two rivers, with cool reaches distributed farther upstream and fewer in number. However, the process-based model projected higher spatial heterogeneity in water temperature due to our spatially explicit simulation of streamflow and because we calibrated the model with spatially continuous remotely sensed water temperature data. We used stream temperature projections to assess the vulnerability of Pacific salmon and trout to changes in the spatial distribution of cold-water habitats during August by the 2080s. Results suggest that salmonids may have fewer summertime cold-water habitats in both watersheds. Projected stream warming may further limit particular species and life stages, especially in the Snoqualmie watershed. Our comparison of models highlights the importance of considering what might be gained by using a process-based model for evaluating and prioritizing management actions that mitigate climate impacts on cold-water habitats for stream fishes.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

A Typology for Characterizing Human Action in MultiSector Dynamics Models

The role of individual and collective human agency is increasingly recognized as a prominent and arguably paramount determinant in shaping the behavior, trajectory, and vulnerability of multisector systems. This human influence operates at multiple scales: from short-term (hourly to daily) to long-term (annually to centennial) timescales, and from the local to the global, pushing systems towards either desirable or undesirable outcomes. However, the effort to represent human systems in multisector models has been fragmented across philosophical, methodological, and disciplinary lines. To cohere insights across diverse modeling approaches, we present a new typology for classifying how human actors are represented in the broad suite of coupled human-natural system models that are applied in MultiSector Dynamics (MSD) research. The typology conceptualizes a “sector” as a system-of-systems that includes a diverse group of human actors, defined across individual to collective social levels, involved in governing, provisioning, and utilizing products, goods, or services towards some human end. We trace the salient features of modeled representations of human systems by organizing the typology around three key questions: 1) Who are the modeled actors in MSD systems? 2) What are their modeled actions? 3) How and for what purpose are these actors and actions operationalized in a computational model? The typology is used to critically examine existing models and chart the frontier of future human systems modeling for MSD research.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2022

A typological framework of non-floodplain wetlands for global collaborative research and sustainable use

Non-floodplain wetlands (NFWs) are important but vulnerable inland freshwater systems that are receiving increased attention and protection worldwide. However, a lack of consistent terminology, incohesive research objectives, and inherent heterogeneity in existing knowledge hinder cross-regional information sharing and global collaboration. To address this challenge and facilitate future management decisions, we synthesized recent work to understand the state of NFW science and explore new opportunities for research and sustainable NFW use globally. Results from our synthesis show that although NFWs have been widely studied across all continents, regional biases exist in the literature. We hypothesize these biases in the literature stem from terminology rather than real geographical bias around existence and functionality. To confirm this observation, we explored a set of geographically representative NFW regions around the world and characteristics of research focal areas. We conclude that there is more that unites NFW research and management efforts than we might otherwise appreciate. Furthermore, opportunities for cross-regional information sharing and global collaboration exist, but a unified terminology will be needed, as will a focus on wetland functionality. Based on these findings, we discuss four pathways that aid in better collaboration, including improved cohesion in classification and terminology, and unified approaches to modeling and simulation. In turn, legislative objectives must be informed by science to drive conservation and management priorities. Finally, an educational pathway serves to integrate the measures and to promote new technologies that aid in our collective understanding of NFWs. Our resulting framework from NFW synthesis serves to encourage interdisciplinary collaboration and sustainable use and conservation of wetland systems globally.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Identification of Worst Impact Zones for Power Grids During Extreme Weather Events Using Q-learning

Both the frequency and intensity of extreme weather events have been trending higher in recent years, leading to significant infrastructure damage in the electric grid. The impact of these extreme weather events is desired to be analyzed and quantified to help transmission and distribution system operators prepare for and prevent significant damage and subsequent loss of power. In this paper, we develop an approach that models the impact of extreme weather on the grid and identifies the worst impact zone using Q-learning (a reinforcement learning approach). The identification results reveal grid vulnerability to weather events and provide insights for system operators to help achieve optimal resource allocation and crew dispatch to minimize the adverse impacts of extreme weather. Simulation studies are conducted on the IEEE 123-node system to demonstrate the performance of the proposed approach.

distribution system↗
DOE OSTI2022

Cyber-Physical Security and Resiliency Analysis Testbed for Critical Microgrids with IEEE 2030.5: Preprint

IEEE 2030.5, also known as the Common Smart Inverter Standard (CSIP) is a protocol that specifies the interface between the end user and the smart grid. This standard was proposed recently, and provides many functions which if implemented incorrectly might lead to vulnerabilities. This paper proposes a cyber-physical microgrid testbed using OpenDSS and IEEE 2030.5 that can be used to study the performance of the CSIP protocol various scenarios. For critical microgrid installations, it is essential that the critical loads are served in spite of multiple contingencies. A resiliency analysis is performed for a military microgrid to study its performance and the results are analyzed.

CVSS↗
DOE OSTI2020

Q-Learning-Based Impact Assessment of Propagating Extreme Weather on Distribution Grids

The increasing number of power outage events due to extreme weather conditions is hampering us socioeconomically. Preparing in advance for the extreme weather event is critical. It can help utility operators to reduce grid damages, restore grid service quickly, allocate energy resources and repair crews strategically, and hence dramatically increase grid resilience. In this paper, we propose a method to identify the sequence of worst impact zones in the power grid caused by extreme weather events based on Q-learning (a reinforcement learning algorithm). To quantity the weather severity and its effect on the grid, we model the impact of extreme weather on the grid as a function of intensity, vulnerability, and exposure. A modified IEEE 123-node distribution feeder is presented in a mesh grid and experimented for sequences of zones identification. Finally, simulation results present the identified sequences and their associated impacts on the grid caused by extreme weather events.

distribution system↗
DOE OSTI2021

A Cyber-Resilience Risk Management Architecture for Distributed Wind

Distributed wind is an electric energy resource segment with strong potential to be deployed in many applications, but special consideration of resilience and cybersecurity is needed to address the unique conditions associated with distributed wind. Distributed wind is a strong candidate to help meet renewable energy and carbon-free energy goals. However, care must be taken as more systems are installed to ensure that the systems are reliable, resilient, and secure. The physical and communications requirements for distributed wind mean that there are unique cybersecurity considerations, but there is little to no existing guidance on best practices for cybersecurity risk management for distributed wind systems specifically. This research develops an architecture for the consideration of cyber risks associated with distributed wind systems. The architecture takes into account the configurations, challenges, and standards for distributed wind to create a risk-focused perspective that considers of threats, vulnerabilities, and consequences, with special emphasis on what sets distributed wind systems apart from other distributed energy resources (DER). We discuss common distributed wind architectures and how they are interconnected to larger power systems. Because cybersecurity cannot exist independently, the cyber-resilience architecture must consider the system holistically. Finally, we discuss the implementation of a risk assessment process that uses the cyber-resilience framework to address challenges specific to distributed wind.

17 WIND ENERGY↗
DOE OSTI2025

Data Repository for Multi-Objective Urban Observational Strategies: A risk-based framework for expanding flood sensor networks.

These data support the manuscript "Multi-Objective Urban Observational Strategies: A risk-based framework for expanding flood sensor networks." These data are generated to allow water managers to reason about optimal locations to expand a flood observation system from multiple perspectives, specifically focusing on flood hazards, and population exposure to flooding. The data included are a) a shapefile of individual sensor locations b) a shapefile of river reach catchments, c) raster of FEMA flood likelihood layers d) shapefile of population locations and population socioeconomic characteristics. The code is written in R and includes all files necessary to generate the figures for the associated manuscript. Interactive maps of the final calculated maps of hazard, vulnerability, exposure, and risk are also included as html files.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Fossil Power Plant Cyber Security Life-Cycle Risk Reduction, A Practical Framework for Implementation

Market conditions are forcing fossil electricity generation facility owners and operators to implement advanced digital technologies. These technologies enable efficiencies, operational flexibility, operations and maintenance efficiencies, and adapting to a transitioning workforce. These digital technologies, however, can increase the cybersecurity attack surface. The purpose of this research was to develop a holistic cybersecurity risk reduction framework for fossil generation facilities. The framework begins with assessing how cyber risk changes across facility life cycles, including plant, system, vendor, and business life cycles. The next phase performs consequence analysis to prioritize high consequence events. Focusing on high consequence events allows owners to use a graded, risk-informed approach to prioritize cybersecurity efforts. The final phase identifies the digital asset attack surface in sensors and instrumentation and control equipment. After the vulnerabilities are identified, the owner selects mitigating cybersecurity control measures (or countermeasures) based on the risk analysis from the previous phases. This report describes the current industry cybersecurity best practices in fossil generation that are based on the first principles for cybersecurity engineering. The report is divided into five sections that describe the implementation of the risk reduction framework and present identified research, methodological, and technology gaps that were identified through this course of research and development.

01 COAL, LIGNITE, AND PEAT↗