Search NASA⌕ Search

SEARCH · Search NASA

Results for “Vulnerability Management”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

Examples of Mission-driven Data Science from Jefferson Lab and ACES

This presentation details mission-driven data science initiatives at Jefferson Lab and the Joint Institute for Advanced Computing on Environmental Studies (ACES). JLab, a U.S. Department of Energy Office of Science national laboratory, operates the Continuous Electron Beam Accelerator Facility (CEBAF), and is the lead institute for the new High Performance Data Facility (HPDF) Hub. The Joint Institute for ACES brings together interdisciplinary teams in health informatics, climate modeling, computer science, and physics to address environmental challenges, including flood modeling. The Hampton Roads region, particularly Norfolk and Virginia Beach, faces increasing flood risks, motivating the need for rapid, reliable, and risk-aware decision support. ACES’s flooding work has a focus on uncertainty quantification (UQ) and machine learning (ML) for coastal flood management. The work is motivated by the increasing vulnerability of communities such as Norfolk and Virginia Beach, Virginia, to frequent coastal flooding events, and the need for rapid, reliable decision support. The research develops computationally efficient ML surrogate models to forecast water levels and flooding risk. A central theme is the quantification and calibration of predictive uncertainty, especially for out-of-distribution (OOD) scenarios, using techniques such as Monte Carlo Dropout, Deep Ensembles, Gaussian Processes, and Deep Quantile Regression (DQR). The study demonstrates that distance-aware UQ is critical for reliable scientific AI, particularly in high-dimensional, safety-critical, and real-time applications.

McSpadden, Diana [Thomas Jefferson National Accele↗
DOE OSTI2025

SWARM: Reimagining scientific workflow management systems in a distributed world

Modern scientific workflows process massive amounts of data from diverse instruments and sensors, leveraging geographically distributed, heterogeneous compute and storage resources—from leadership-class systems to edge devices—connected by high-performance networks. The diversity of resources introduces challenges in harnessing their full potential, with resilience issues arising across applications, system software, networks, storage, and hardware. Today, workflow management systems (WMS) coordinate the execution of computation and data management tasks across target resources. However, WMS’s centralized nature makes them vulnerable to faults and scalability issues that may result in failures of entire computational campaigns. In conclusion, this paper introduces a novel agentic framework for workflow management, fully distributing and decentralizing the WMS functions and modeling them as swarm intelligence agents infused with advanced artificial intelligence solutions and traditional distributed computing algorithms that can make coordinated decisions in the presence of failures of the underlying cyberinfrastructure.

Swarm intelligence↗
DOE OSTI2020

Lac du Flambeau - Climate Change Resilience Initiative (Final Report)

The goals of this project were to create a comprehensive Environmental Resiliency Plan and to increase the capacity of all Lac du Flambeau Tribal Program Managers to incorporate environmental impact thinking into the everyday management of their departments. Environmental Resiliency Planning utilized current Tribal documents, which include the Integrated Resource Management Plan (IRMP), the Lac du Flambeau Tribal Emergency Management Plan (EMP), and the Lac du Flambeau Strategic Energy Plan, as guidance throughout the process. A vulnerability assessment initiated our technical process and allowed us to identify, quantify, and prioritize (or rank) the vulnerabilities in our system. This set the stage for a reduction and resilience plan as well as providing insight for revisions of existing management plans such as the Energy and Integrated Resources Management Plans

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

RADAMS: Resilient and adaptive alert and attention management strategy against Informational Denial-of-Service (IDoS) attacks

Attacks exploiting human attentional vulnerability have posed severe threats to cybersecurity. In this work, we identify and formally define a new type of proactive attentional attacks called Informational Denial-of-Service (IDoS) attacks that generate a large volume of feint attacks to overload human operators and hide real attacks among feints. Here, we incorporate human factors (e.g., levels of expertise, stress, and efficiency) and empirical psychological results (e.g., the Yerkes-Dodson law and the sunk cost fallacy) to model the operators’ attention dynamics and their decision-making processes along with the real-time alert monitoring and inspection. To assist human operators in dismissing the feints and escalating the real attacks timely and accurately, we develop a Resilient and Adaptive Data-driven alert and Attention Management Strategy (RADAMS) that de-emphasizes alerts selectively based on the abstracted category labels of the alerts. RADAMS uses reinforcement learning to achieve a customized and transferable design for various human operators and evolving IDoS attacks. The integrated modeling and theoretical analysis lead to the Product Principle of Attention (PPoA), fundamental limits, and the tradeoff among crucial human and economic factors. Experimental results corroborate that the proposed strategy outperforms the default strategy and can reduce the IDoS risk by as much as 20%. Besides, the strategy is resilient to large variations of costs, attack frequencies, and human attention capacities. We have recognized interesting phenomena such as attentional risk equivalency, attacker’s dilemma, and the half-truth optimal attack strategy.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2026

A U.S. scientific community review of carbon cycle science gaps and opportunities to better support earth system science and carbon management

Greenhouse gas (GHG) emissions continue to grow, while natural carbon reservoirs are becoming increasingly vulnerable to anthropogenic pressures, climate extremes, and disturbance. These changes are impacting humans, ecosystems, and natural resources worldwide. Tracking and mitigating GHG emissions require a pivot to operational monitoring of regional carbon flux and stock changes. The current GHG observing system is addressing needs at two distinct scales: 1) Local scale (< 1 km), related to anthropogenic point source emissions, and 2) global scales (> 1000 km), related to land and ocean carbon sinks. More focus on intermediate (10–1000 km) scales is needed to more effectively monitor progress in reducing carbon emissions, enhancing removals, and maintaining sinks. Representatives from carbon cycle biomass and flux communities across United States government agencies and academic institutions met in September 2024 to discuss the rationale and scientific context for more effectively implementing an operational system for GHG monitoring in support of urban and national carbon management needs. To guide development of this system, we propose a multi-tiered global spaceborne observing framework for carbon flux and stock, prioritizing: 1) frequent GHG partial columns for carbon emissions and removals; 2) continuous time series and data fusion of biomass from Lidar and Synthetic Aperture Radar (SAR) for carbon stocks, and 3) expanded coverage of tropical, high latitude, and oceanic regions to monitor carbon cycle tipping points and feedbacks. This system should be complemented by expanded surface and airborne networks for oceanic and terrestrial/aquatic ecosystems for calibration, ground truthing, and study of under-sampled regions.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

Energy Management Information Systems Cybersecurity Best Practices

Energy management information systems (EMIS) are a broad and rapidly evolving family of tools that monitor, analyze, and control building energy use and system performance. Critical systems are often integrated with or operate on the same networks as EMIS scope systems, necessitating stable, continuous, and secure communication. When connecting EMIS to building automation and utility control systems, there are also many physical assets that could cause harm to the building and its occupants if a malicious act or human error were introduced. It is imperative to ensure all EMIS scope systems are connected securely to the EMIS and do not open vulnerable pathways to other facility networks and operations. The Federal Energy Management Program (FEMP) promotes best practices for impactful utilization of EMIS at federal facilities. This best practice document is part of a series of fact sheets created to help accelerate the market adoption and use of EMIS in the federal sector. It provides an overview of required EMIS cybersecurity standards for compliance and authority to operate along with additional recommendations.

cybersecurity↗
DOE OSTI2022

Energy Management Information Systems Cybersecurity Best Practices

Energy management information systems (EMIS) are a broad and rapidly evolving family of tools that monitor, analyze, and control building energy use and system performance. Critical systems are often integrated with or operate on the same networks as EMIS scope systems, necessitating stable, continuous, and secure communication. When connecting EMIS to building automation and utility control systems, there are also many physical assets that could cause harm to the building and its occupants if a malicious act or human error were introduced. It is imperative to ensure all EMIS scope systems are connected securely to the EMIS and do not open vulnerable pathways to other facility networks and operations. The Federal Energy Management Program (FEMP) promotes best practices for impactful utilization of EMIS at federal facilities. This best practice document is part of a series of fact sheets created to help accelerate the market adoption and use of EMIS in the federal sector. It provides an overview of required EMIS cybersecurity standards for compliance and authority to operate along with additional recommendations.

Cybersecurity↗
DOE OSTI2023

Software Bill of Materials in the Nuclear Industry

Nuclear power plants (NPP) have thousands of digital assets throughout their facility. Typically, NPPs have asset and configuration management programs that capture the make, model, and version of a component. This information, however, usually only includes first- or second-tier components and does not capture the complete enumeration of software components and their dependencies within operational technology (OT) equipment. As seen with recent cyberattacks, this level of detail is insufficient for identifying if and where an exploitable vulnerability exists within a facility. A software bill of materials (SBOM) provides this detailed enumeration. Further, integrating SBOMs with vulnerability data sources and vulnerability attestation reports can provide improved awareness leading to better cyber risk management and incident response. Preferably, SBOMs are provided by the supplier; however, when an NPP already owns a device, it is less likely they will have a supplier provided-SBOM. Fortunately, SBOMs can be generated on installed digital assets. This paper provides an introduction to the U.S. Department of Energy Office of Nuclear Energy paper titled “Towards Software Bill of Materials in the Nuclear Industry,” which describes the SBOM ecosystem and provides a suggested approach to methodically and seamlessly integrate an SBOM program in an NPP.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2024

Digital Tools for the Preventive Conservation of Built Heritage: The Church of Santa Ana in Seville

Historic Building Information Modelling (HBIM) plays a pivotal role in heritage conservation endeavours, offering a robust framework for digitally documenting existing structures and supporting conservation practices. However, HBIM’s efficacy hinges upon the implementation of case-specific approaches to address the requirements and resources of each individual asset and context. This paper defines a flexible and generalisable workflow that encompasses various aspects (i.e., documentation, surveying, vulnerability assessment) to support risk-informed decision making in heritage management tailored to the peculiar conservation needs of the structure. This methodology includes an initial investigation covering historical data collection, metric and condition surveys and non-destructive testing. The second stage includes Finite Element Method (FEM) modelling and structural analysis. All data generated and processed are managed in a multi-purpose HBIM model. The methodology is tested on a relevant case study, namely, the church of Santa Ana in Seville, chosen for its historical significance, intricacy and susceptibility to seismic action. The defined level of detail of the HBIM model is sufficient to inform the structural analysis, being balanced by a more accurate representation of the alterations, through linked orthophotos and a comprehensive list of alphanumerical parameters. This ensures an adequate level of information, optimising the trade-off between model complexity, investigation time requirements, computational burden and reliability in the decision-making process. Field testing and FEM analysis provide valuable insight into the main sources of vulnerability in the building, including the connection between the tower and nave and the slenderness of the columns.

Chaves, Estefanía↗
DOE OSTI2022

Increasing risk of cascading hazards in the central Himalayas

Cascading hazards are becoming more prevalent in the central Himalayas. Primary hazards (e.g., earthquakes, avalanches, and landslides) often trigger secondary hazards (e.g., landslide dam, debris flow, and flooding), compounding the risks to human settlements, infrastructures, and ecosystems. Risk management strategies are commonly tailored to a single hazard, leaving human and natural systems vulnerable to cascading hazards. In this commentary, we characterize diverse natural hazards in the central Himalayas, including their cascading mechanisms and potential impacts. A scientifically sound understanding of the cascading hazards, underlying mechanisms, and appropriate tools to account for the compounding risks are crucial to informing the design of risk management strategies. Here, we also discuss the need for an integrated modeling framework, reliable prediction and early warning system, and sustainable disaster mitigation and adaptation strategies.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2021

Analyzing the Effects of Cyberattacks on Distribution System State Estimation

Key components of power systems—such as energy management systems, automatic generation control, and state estimation—are under serious vulnerability from cyberattacks. Cyber threats in electric grids have increased significantly because of the increased interconnectivity of supervisory control and data acquisition systems and public network infrastructure. As the penetration level of distributed energy resources increases, it is imperative to employ system-monitoring techniques such as state estimation for the reliable operation of distribution systems. Recently, multiple methods have been developed that exploit the low rank property of distribution system state matrix and are robust to bad data, such as matrix completion. This paper analyzes the impact of various realistic cyberattack scenarios on matrix completion. Realistic cyberattack scenarios are converted into data corruption models that are used in an extensive simulation of a custom IEEE 123-bus system.

41 EE - Solar Energy Technologies Office (EE-4S)↗
DOE OSTI2023

A Framework to Design Consumer-Centric Operational Strategies for Resilience Enhancement

Extreme temperature-related events like heat waves or cold snaps can significantly stress the power distribution grid as electricity demand spikes leading to brownouts or blackouts if not managed properly. In addition, such extreme events can exacerbate inequity, with vulnerable populations (for example, houses with poor insulation, located in non-critical zones, and lack of local resources) at greater risk. There is a growing deployment of distribution systems automation technologies such as advanced metering infrastructure, sensors, and automated control systems to enhance the visibility of the entire distribution grid while meeting resilience objectives. Here, this paper proposes a framework for investigating how automation can improve the distribution system's resilience and ensure customers' health and safety during such extremes. The proposed framework's efficacy will be demonstrated for the Electricity Reliability Council of Texas (ERCOT) during winter storm Uri with varying levels of distribution automation technologies such as feeder isolation using smart switches, remote outage signals using advanced meters, and comfort-aware outage using advanced analytics and communication. Simulation results show that an outage strategy involving advanced grid technology and communication can reduce the occupant exposure to severe cold by 93% and, simultaneously, reduce expected energy not served by 73.2% when compared against feeder isolation.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Cybersecurity for the Operational Technology Environment (CyOTE) (Final Technical Report)

Electric grids have historically been susceptible to both physical attacks and environmental hazards but the implementation of smart grids, remote management, and self-healing networks, has now made the grid vulnerable to cyber attacks. To address risks introduced by routable connectivity, utilities must establish dynamic solutions to identify, protect, detect, respond to, and recover from cyber security threats and vulnerabilities. In response to the evolving threat landscape U.S. Department of Energy-Office of Cybersecurity, Energy Security, and Emergency Response (DOE CESER) initiated the Cybersecurity for the OT Environment (CyOTE) pilot program, a U.S. Department of Energy (DOE) effort designed to leverage U.S. intelligence capabilities to prevent, detect, or mitigate a cyber attack on utility operational technology (OT) networks. As part of the CyOTE pilot, The Southern Company (Southern Company or Southern) researched, evaluated and deployed emerging Commercial off the Shelf (COTS) technologies and cyber security monitoring architectures to provide previously unrealized network visibility and situational awareness through deep packet inspection and data analytics. This Final Scientific/Technical Report documents the objectives, methodology, lessons learned, and results of Southern Company’s participation in the CyOTE pilot from December 2018 to September 2023.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Citizen-Led Community Innovation for Food Energy Water Nexus Resilience

Food-energy-water (FEW) resources are necessary for the function of multiple socio-natural systems. Understanding the synergies and trade-offs in the FEW nexus, and how these interconnections impact earth’s systems, is critical to ensure adequate access to these resources in the future; an essential component for achieving the Sustainable Development Goals (Scanlon et al., 2017). Although, over the last decade, the identification of FEW nexus complexities has increased at a global (IPCC, 2018; D’Orodico et al., 2018), national (Lant et al., 2019), and city scale (Rushforth and Ruddell, 2018), these findings are yet to be adequately translated into ‘on the ground’ action due a lack of technical and political capacity (Weitz et al., 2017). Specifically, local FEW systems have been overlooked in these analyses (Scanlon et al., 2017; Lant et al., 2019), thus leaving small and medium towns vulnerable due to a lack of data and inadequate FEW system management. Building on three years of field-tested FEW nexus research in the Ruddell Lab, we argue that participatory citizen science projects, such as our FEWSION for Community Resilience initiative, can bridge the data-policy gaps that exist within local FEW system management by: 1) providing last mile data on the FEW system, and 2) translating local data into evidence-based solutions at a grassroots level. Thus, we present a broadly applicable framework and call to action for local scale participatory citizen science to solve complex FEW nexus issues at a local, regional, and national scale.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2021

A Survey on Cybersecurity Challenges, Detection, and Mitigation Techniques for the Smart Grid

The world is transitioning from the conventional grid to the smart grid at a rapid pace. Innovation always comes with some flaws; such is the case with a smart grid. One of the major challenges in the smart grid is to protect it from potential cyberattacks. There are millions of sensors continuously sending and receiving data packets over the network, so managing such a gigantic network is the biggest challenge. Any cyberattack can damage the key elements, confidentiality, integrity, and availability of the smart grid. The overall smart grid network is comprised of customers accessing the network, communication network of the smart devices and sensors, and the people managing the network (decision makers); all three of these levels are vulnerable to cyberattacks. In this survey, we explore various threats and vulnerabilities that can affect the key elements of cybersecurity in the smart grid network and then present the security measures to avert those threats and vulnerabilities at three different levels. In addition to that, we suggest techniques to minimize the chances of cyberattack at all three levels.

Tufail, Shahid↗
DOE OSTI2020

Analyzing the Effects of Cyberattacks on Distribution System State Estimation: Preprint

Key components of power systems—such as energy management systems, automatic generation control, and state estimation—are under serious vulnerability from cyber attacks. Cyber threats in electric grids have increased significantly because of the increased interconnectivity of supervisory control and data acquisition systems and public network infrastructure. As the penetration level of distributed energy resources increases, it is imperative to employ system-monitoring techniques such as state estimation for the reliable operation of distribution systems. Recently, multiple methods have been developed that exploit the low rank property of distribution system state matrix and are robust to bad data, such as matrix completion. This paper analyzes the impact of various realistic cyber attack scenarios on matrix completion. Realistic cyber attack scenarios are converted into data corruption models that are used in an extensive simulation of a custom IEEE 123-bus system.

41 EE - Solar Energy Technologies Office (EE-4S)↗
DOE OSTI2023

Emulation and Adversarial Analysis of EV Charging Networks

In the effort of decarbonization and evolution of the modern electrical grid, electric vehicles (EVs) play a key part to transform the grid. However, due to the rapid adoption of EVs and the demand of the charging infrastructure required to power said EVs, risk of a cyber-attack may impose serious consequences. There is a need to analyze and protect the charging ecosystem infrastructure from cyber threats before it reaches wide-scale deployment. In an effort to secure vehicle to grid (V2G) communications, standardization is necessary for continued reliable system operation. The protocol ISO 15118 outlines controls and practices that should be implemented for secure vehicle to grid (V2G) communications. The standard is gaining momentum for American markets as the demand for EV infrastructure grows. The adoption of ISO 15118 in American markets poses several challenges: the deployment of a public key infrastructure (PKI) as outlined within the standard, interoperability of charging different EVs with chargers from different manufactures using the PKI, and scaling the ecosystem to meet the demand while managing risks. This project was created to understand potential cyber and scaling challenges of PKI for EV infrastructure through utilizing a series of emulated components mapping to what exists in the EV ecosystem today, and the components of the PKI that are under development. The key nodes within the emulation that are under development are: electric vehicle (EV), electric vehicle supply equipment (EVSE), charge network operator (CNO), certificate authority (CA), and online certificate status protocol (OCSP) that must all interact using secure and trusted communications. With these emulated components and utilizing orchestration methods to rapidly deploy and scale the components, the ability to analyze risks of the ecosystem and address gaps before the PKI ecosystem is fully deployed to production should yield a more robust and mature production charging infrastructure. Our approach will use a modular architecture of virtual machines within an orchestration platform and will target scales of 100s, 1000s, and 10,000s of entities interacting. The core research questions trying to be answered with this scope of work are: what are the impacts of a rogue CA, what are the risks of certificate revocation list (CRL) management, what is the value of OCSP stapling, what components are vulnerable to DOS attacks, and what test effective payloads may impact the components.

charging ecosystem↗
DOE OSTI2024

Mitigating drought mortality by incorporating topography into variable forest thinning strategies

Abstract Drought-induced productivity reductions and tree mortality have been increasing in recent decades in forests around the globe. Developing adaptation strategies hinges on an adequate understanding of the mechanisms governing the drought vulnerability of forest stands. Prescribed reduction in stand density has been used as a management tool to reduce water stress and wildfire risk, but the processes that modulate fine-scale variations in plant water supply and water demand are largely missing in ecosystem models. We used an ecohydrological model that couples plant hydraulics with groundwater hydrology to examine how within-stand variations in tree spatial arrangements and topography might mitigate forest vulnerability to drought at individual-tree and stand scales. Our results demonstrated thinning generally ameliorated plant hydraulic stress and improved carbon and water fluxes of the remaining trees, although the effectiveness varied by climate and topography. Variable thinning that adjusted thinning intensity based on topography-mediated water availability achieved higher stand productivity and lower mortality risk, compared to evenly-spaced thinning at comparable intensities. The results from numerical experiments provided mechanistic evidence that topography mediates the effectiveness of thinning and highlighted the need for an explicit consideration of within-stand heterogeneity in trees and abiotic environments when designing forest thinning to mitigate drought impacts.

Environmental Sciences & Ecology↗