Search NASA⌕ Search

SEARCH · Search NASA

Results for “Cybersecurity”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 649 records · Page 36
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Scalable, Physical Effects Measureable Microgridfor Cyber Resilience Analysis

SPEMMCRA provides a low-cost simulated method to provide for testing of control theory and cybersecurity approaches to microgrid implementations. Specifically, this physics-based approach provides realistic responses to compare control strategies in simulation, but also to demonstrate actions that can or cannot be taken in taking cybersecurity actions . As communications interfaces or other actions are taken that affect the flow of data, SPEMMCRA can show whether the microgrid operation is adversely affected by what is intended to mitigate a cybersecurity event.

Rieger, CraigG↗
DOE OSTI2024

Cyber100 Compass [SWR 23-64]

Cyber100 Compass ("Compass") is a unique risk assessment framework that will enable grid system planners to understand and mitigate cybersecurity risk for grids transitioning to high levels of renewable generation, including 100%. The idea for Compass was developed by NREL based on past work on high-renewable grids and a series of discussions with DOE. Compass is part of Cyber100, a portfolio of proposed research activities that would greatly expand understanding of cybersecurity for high-renewable grids. Compass is a desktop application designed with a user-friendly interface. The tool gathers information from users, conducts probabilistic backend calculations, and outputs a series of visualizations to help users understand and analyze their cybersecurity risks based on the unique features of their future grid. Compass will take as inputs the values for different conditions and produce a risk score of the resulting grid. By trying different configurations, system planners can compare the resultant risks against their own risk tolerance and decide which system-of-system controls to implement as they transition toward a 100% renewable grid.

Martin, Maurice↗
DOE OSTI2016

SDN Project

The SDN Project completed on time and on budget and successfully accomplished 100% of the scope of work outlined in the original Statement of Project Objective (SOPO). The SDN Project formed an alliance between Ameren Corporation, University of Illinois Urbana- Champaign (UIUC), Pacific Northwest National Laboratories (PNNL), and Schweitzer Engineering Laboratories, Inc. (SEL). The objective of the SDN Project is to address Topic Area of Interest 2: Sustain critical energy delivery functions while responding to a cyber-intrusion under Funding Opportunity Announcement DE-FOA-0000797. The goal of the project is to design and commercially release technology that provides a method to sustain critical energy delivery functions during a cyber intrusion and to do this control system operators need the ability to quickly identify and isolate the affected network areas, and re-route critical information and control flows around. The objective of the SDN Project is to develop a Flow Controller that monitors, configures, and maintains the safe, reliable network traffic flows of all the local area networks (LANs) on a control system in the Energy sector. The SDN team identified the core attributes of a control system and produced an SDN flow controller that has the same core attributes enabling networks to be designed, configured and deployed that maximize the whitelisted, deny-bydefault and purpose built networks. This project researched, developed and commercially released technology that: Enables all field networks be to configured and monitored as if they are a single asset to be protected; Enables greatly improved and even precalculated response actions to reliability and cyber events; Supports pre-configured localized response actions tailored to provide resilience against failures and centralized response to cyber-attacks that improve network reliability and availability; Architecturally enables the right subject matter experts, who are usually the information technology and operational technology engineers, to be the ones centrally administering the technology and responding to events; Simplifies network configuration, improving deterministic Ethernet transport times, and providing instant visualization on where the communication circuits are and how all circuits are impacted when changes (e.g., configuration changes, failures or intrusions) happen, allowing operators to minimize downtime; and Improves the ability to identify deviations in network behavior resulting in detection and analysis of potential cyber intrusions and faster response times Results: This project has forever changed the way critical infrastructure networks are designed, secured, deployed and maintained. The cybersecurity and performance advantages achieved are significant, simply put traditional networking has been obsoleted while the team maintained Ethernet interoperability avoiding any legacy concerns. The team commercially released technology that accomplished all the cybersecurity goals outlined in the SOPO and completed it by executing the project management plan approved in the initial contract. The resulting Energy sector SDN flow controller model number is SEL-5056 and can be freely downloaded from the www.SELinc.com website. This technology not only improves the cybersecurity of control systems but has measured results that it improves the performance and reliability of the control system as well. This means the system owners can confidently apply it to their systems knowing that it will, “first do no harm” but actually improve the system as well. Success of the project is best measured by the sales and deployment of the technology. System owners in industrial, electric, defense, and oil and gas only months after commercial release have approved plans for deployment.

42 ENGINEERING↗
DOE OSTI2021

Recommendations for Distributed Energy Resource Access Control

Cybersecurity for internet - connected Distributed Energy Resources (DER) is essential for the safe and reliable operation of the US power system. Many facets of DER cybersecurity are currently being investigated within different standards development organizations, research communities, and industry committees to address this critical need. This report covers DER access control guidance compiled by the Access Controls Subgroup of the SunSpec/Sandia DER Cybersecurity Workgroup. The goal of the group was to create a consensus - based technical framework to minimize the risk of unauthorized access to DER systems. The subgroup set out to define a strict control environment where users are authorized to access DER monitoring and control features through three steps: (a) user is identified using a proof-of-identity, (b) the user is authenticated by a managed database, (c) and the user is authorized for a specific level of access. DER access control also provides accountability and nonrepudiation within the power system control environment that can be used for forensic analysis and attribution in the event of a cyber-attack. This paper covers foundational requirements for a DER access control environment as well as offering a collection of possible policy, model, and mechanism implementation approaches for IEEE 1547-mandated communication protocols.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Prioritizing ICS Beachhead Systems for Cyber Vulnerability Testing

Cyber Testing for Resilient Industrial Control Systems™ (CyTRICS™) is the Department of Energy’s (DOE’s) program for cybersecurity vulnerability testing, digital subcomponent enumeration, and forensic assessment. CyTRICS leverages best-in-class test facilities and analytic capabilities at six DOE National Laboratories and strategic partnerships with key stakeholders including technology developers, manufacturers, asset owners and operators, and interagency partners. During the program’s development, CyTRICS established a unique methodology for prioritizing digital components within operational technology (OT) and industrial control systems (ICS) in the Energy Sector Industrial Base (ESIB) for cyber vulnerability testing. The CyTRICS Prioritization Process leverages multiple characteristics of systems, components, and their contextual deployment to calculate a quantification of individual digital components for CyTRICS testing. The initial version of the CyTRICS Prioritization Process was premised largely upon the impact which could result to an industrial control system if the digital component under testing was compromised, either through malicious means, faulty engineering, or other modes. The worldwide compromise of the SolarWinds Orion platform, first reported in December 2020, through malicious interference with the digital patching cycle was a watershed event in cyber supply chain security. The SolarWinds compromised demonstrated the strategic importance of certain types of ubiquitous software, and the ability to generate widespread cybersecurity effects. To address this challenge and as a part of the Department of Energy’s response to the SolarWinds compromise, DOE’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) directed the National Laboratories to evolve the CyTRICS Prioritization Process methodology to encompass additional factors related to the strategic importance of digital components. CESER directed CyTRICS researchers to identify, characterize, and append strategic factors to the CyTRICS Prioritization Process to provide additional weight to these characteristics. National Laboratory expert researchers identified functionality, distribution, and platform characteristics for digital components in ICS and OT that they assessed would be likely targeted in strategic initial-access cyber attack. CyTRICS has termed these factors “ICS Beachhead Systems,” leveraging a definition first advanced by Schneider Electric, which is intended as a blanket term to encompass digital components, products, and systems in OT. This paper describes the ICS Beachhead Systems identified and the rationale for inclusion. As a next step in the research and refinement process, the National Laboratories will validate this initial set of characteristics against digital components evaluated by the CyTRICS program and current implementation of the CyTRICS Prioritization Process. After validation, CyTRICS researchers will then develop a scoring methodology to generate a quantitative score to assess the degree to which a digital component is characterized as an ICS Beachhead System. Finally, the National Laboratories will append this scoring to the existing CyTRICS Prioritization Process algorithm.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Exploring the Adoption Challenges of Post-Quantum Cryptography in EV Charging Infrastructure

The rapid evolution of electric vehicle (EV) technology and the corresponding growth of the Electric Vehicle Charging Infrastructure (EVCI) brings to light significant cybersecurity concerns, notably in the context of emerging post-quantum computing capabilities. This report, prepared by Pacific Northwest National Laboratory (PNNL) under the U.S. Department of Energy contract, delves into the challenges associated with integrating Post-Quantum Cryptography (PQC) into EVCI to safeguard against potential quantum computing threats. Post-quantum computers will eventually be able to invalidate technologies secured through public key cryptography. As part of this effort, the primary gaps and challenges in the EVCI were investigated with a focus on comparing traditional algorithms against PQC algorithms. One of the notable findings was that the P-521 algorithm was frequently surpassed in performance by PQC algorithms. This document provides a thorough examination of the hurdles the industry can expect when transitioning to PQC within the EVCI, such as interoperability concerns, the computational and memory demands of PQC algorithms, and the organizational readiness for such a transition. It emphasizes the necessity of a forward-thinking approach to cybersecurity, advocating for early and strategic engagement among EVCI stakeholders to ensure a seamless and cost-effective migration to quantum-resistant cryptographic standards. Through this report, the authors aim to catalyze awareness and action among policymakers, industry leaders, and cybersecurity professionals towards fortifying the EVCI against emerging quantum threats, thereby securing the infrastructure essential for the future of electric mobility.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2024

Cyber Resilience and Social Equity: Twin Pillars of a Sustainable Energy Future

This paper examines the intersection of security and accessibility within energy systems amidst the rise of grid modernization and digitization, especially considering the regulatory changes and the imperatives of inclusive energy strategies. It addresses the dual need for secure, resilient infrastructure and a commitment to mitigate energy poverty while maintaining equitable access to energy. Amid escalating cybersecurity and physical threats, the paper advocates for sustainable energy delivery systems that ensure robust defenses without compromising the goals of reducing energy poverty and ensuring energy security. This paper identifies the pressing need for Cyber-Informed Engineering (CIE) and Secure-by-Design (SbD) principles, highlighting how these strategies can protect critical infrastructure and democratize access to secure energy, particularly for disadvantaged communities. The analysis underscores the challenges presented by the expansion of attack surfaces, interoperability requirements, and grid-edge analytics, offering innovative solutions that leverage advanced technologies and data-driven insights. Furthermore, this paper addresses the workforce development gap, emphasizing the necessity for public-private partnerships and vendor engagement in creating a skilled cybersecurity workforce. This paper has a dual focus on both the technological aspect of cybersecurity and the social dimension of equity within the context of sustainable energy development. It suggests a comprehensive examination of how these two critical elements interact and support the overarching goal of a sustainable energy future.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2024

Overview and Commentary on Applying the Coordinated Vulnerability Disclosure Process to Photovoltaic System Devices

The rapid expansion of photovoltaic (PV) systems, particularly inverters, has introduced new cybersecurity challenges that threaten both local operations as well as the broader electrical grid’s stability. PV inverters, integrated into critical energy infrastructure are potential targets for cyber attacks due to vulnerabilities in firmware, remote access systems, and communication protocols. The Coordinated Vulnerability Disclosure (CVD) process, as defined by the Cybersecurity and Infrastructure Security Agency (CISA), provides a framework for identifying, reporting, and addressing these vulnerabilities in a transparent and collaborative manner. This report outlines the CVD process as it applies to PV systems, detailing the roles of key stakeholders, such as manufacturers, grid operators, and security researchers. The report also highlights specific challenges in managing vulnerabilities for new and legacy PV systems, which includes those introduced by insecure communications and third-party supply chain components. By adhering to the CVD process, the PV industry can mitigate cybersecurity risks, ensure regulatory compliance, and maintain consumer trust, while safeguarding the operational resilience of the energy grid. Ultimately, the effective coordination of vulnerability management is crucial for securing the future of PV systems within the critical electric grid infrastructure landscape.

14 SOLAR ENERGY↗
DOE OSTI2025

Evaluation of IEC 62443 Standard Gaps for Electric Grid Substation Model Use Case

This report presents an evaluation of the IEC 62443 standards in the context of electric grid substations, as part of a collaborative effort among Sandia National Laboratories (SNL), Idaho National Laboratory (INL), and the National Renewable Energy Laboratory (NREL). The primary objective is to assess the applicability of these standards to enhance cybersecurity measures for industrial automation and control systems (IACS) within the energy sector. The evaluation identifies strengths, such as the scalability of security levels and the structured lifecycle guidance provided by IEC 62443. However, it also highlights significant gaps, including limited integration of physical security, insufficient guidance for legacy systems, and challenges in addressing emerging threats like supply chain vulnerabilities. Recommendations for refining the standards are proposed, including the need for tailored guidance for securing legacy systems, integrating physical security with cybersecurity frameworks, and enhancing interoperability across multi-vendor environments. By addressing these gaps, the IEC 62443 standards can be strengthened to ensure comprehensive cybersecurity for electric grid substations, thereby supporting the resilience and reliability of critical energy infrastructure.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2026

Navigating United States Standards and Regulation for Digital Energy Systems

This report provides an analysis of the U.S. standards and regulatory landscape for digital energy systems, focusing on cybersecurity, safety, and reliability requirements. It examines the interplay between federal mandates, state regulations, voluntary industry standards, and utility-specific policies, highlighting critical gaps between compliance and real-world risk mitigation. While NERC CIP standards enforce cybersecurity for Bulk Electric System assets, distribution-level infrastructure and emerging technologies often fall outside mandatory oversight, creating vulnerabilities. The report identifies systemic challenges such as reliance on self-attestation, uneven state adoption of safety codes, and lagging standards for advanced technologies like battery energy storage and inverter-based resources. Through a detailed gap analysis, it underscores the urgency of proactive risk-based approaches, independent verification, and strategic engagement with state and federal entities. Recommendations include adopting tiered security frameworks, strengthening procurement practices, and addressing emerging technology risks to ensure resilient and secure digital energy infrastructure. This guidance is intended for utilities, regulators, and stakeholders navigating compliance obligations and seeking to enhance cybersecurity and safety beyond minimum standards.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

CYVET: A Cyber-Physical Assurance Framework Based on a Semi-Supervised Vetting Approach

The project is designed to directly address the needs described in the Topic Area 4 (“Cybersecurity Verification and Validation”) of the CEDS’19 Research Call. The proposed CYVET system directly addresses the need to elevate the current industry capabilities to verify and validate OT cybersecurity and associated control system infrastructure. Currently, there is a significant gap in the energy sector’s capability in that regard during infrastructure improvement, equipment procurement, and compliance certification. CYVET provides that needed capability. CYVET is device and architecture agnostic and thus broadly applicable across the energy sector. The goal of this project is to develop and deliver a cybersecurity verification and validation framework testing capability to verify and validate OT equipment, software, and the underlying control system architecture. The primary project objectives are (i) Verification: the synthesis and reconciliation of standards and vendor supplied features, (ii) Validation: the generation, execution, and presentation of testing scripts of verified security features, and (3) Demonstration: apply the developed technology capabilities for verification and validation at a relevant end-user facility in the energy sector.

Lopez Jr, Juan↗
DOE OSTI2015

Understanding the Value of a Computer Emergency Response Capability for Nuclear Security

The international nuclear community has a great understanding of the physical security needs relating to the prevention, detection, and response of malicious acts associated with nuclear facilities and radioactive material. International Atomic Energy Agency (IAEA) Nuclear Security Recommendations (INFCIRC_225_Rev 5) outlines specific guidelines and recommendations for implementing and maintaining an organization’s nuclear security posture. An important element for inclusion into supporting revision 5 is the establishment of a “Cyber Emergency Response Team (CERT)” focused on the international communities cybersecurity needs to maintain a comprehensive nuclear security posture. Cybersecurity and the importance of nuclear cybersecurity require that there be a specific focus on developing an International Nuclear CERT (NS-CERT). States establishing contingency plans should have an understanding of the cyber threat landscape and the potential impacts to systems in place to protect and mitigate malicious activities. This paper will outline the necessary components, discuss the relationships needed within the international community, and outline a process by which the NS-CERT identifies, collects, processes, and reports critical information in order to establish situational awareness (SA) and support decision-making

CERT↗
DOE OSTI2020

A PROVEN APPROACH FOR EFFECTIVE COMPUTER SECURITY SELF-ASSESSMENTS AT NUCLEAR FACILITIES

A proven method for conducting cybersecurity self-assessments at nuclear power plants is now available for international use. This method was originally developed by Pacific Northwest National Laboratory, under the sponsorship of the U.S. Nuclear Regulatory Commission (NRC), for use at U.S. nuclear power plants. The “Method,” described in NUREG/CR-6847 “Cyber Security Self-Assessment Method for U.S. Nuclear Power Plants,” was originally a limited release document that was withheld from public disclosure but is now publicly available. The Method provides a systematic, phased, and risk-informed approach to help decision makers and security specialists understand their relative cybersecurity posture. Completed Method assessments may be used to support or validate selection of computer security controls to mitigate cyber threats as well as demonstrate compliance with regulations or statutes enacted by competent authorities. The Method assesses the cybersecurity posture of key systems at a nuclear facility with a focus on protection of design base functions. It considers both physical and digital elements of system vulnerabilities and the resulting potential consequences from exploitation. It is well-suited for addressing blended cyberattacks. A semi-quantitative analytical approach is used in the evaluation of potential vulnerabilities, consequences, and risks and provides a technical basis for the selection of security controls to mitigate cyberattacks. The Method’s application at U.S. nuclear power plants has been very encouraging. The only nuclear plant in the United States that did not have adverse findings during its initial NRC computer security inspection prepared for inspection through the diligent application of this self-assessment method and the implementation of recommendations that came out of that self-assessment. Nuclear facilities around the world might find application of the Method extremely helpful for making cost-effective, risk-based decisions regarding computer security and for preparing to pass computer security inspections by their competent authorities.

Cyber security, Nuclear security, Self-assessment↗
DOE OSTI2022

Simulating Energy and Security Interactions in Semiconductor Manufacturing: Insights from the Intel Minifab Model

Semiconductor manufacturing is a highly complex. Fabrication plants must deal with re-entrant flows to support multiple types of wafers being produced simultaneously, each with their own deadlines and specifications. The manufacturing process itself depends upon the ability to control and programmatically adjust a variety of environmental conditions including temperature, humidity, and air quality. In addition, wafer fabrication consumes large amounts of electricity. Emerging technologies may help reduce the energy footprint of such facilities but can introduce cybersecurity risks. Therefore, this paper presents a modeling and simulation framework to quantify tradeoffs between operational measures of performance, energy consumption, and cybersecurity controls. We augment the Intel Minifab model, with the Purdue Enterprise Reference Architecture (PERA) for cybersecurity as well as tool-level energy consumption data from a real-world semiconductor manufacturing testbed. In this manner, we intend to provide stakeholders with a systematic, data-driven approach to evaluate emerging risks within the manufacturing process.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2023

Standards Quick Guide

This report contains a list of relevant standards developed or in development for the cybersecurity of solar energy resources. It outlines different types of standards, such as industry standards, enforceable regulations, and conceptual relevant cybersecurity studies. Users may use this quick guide as a tool to enhance understanding of existing standards and for brainstorming new ideas to help states improve the cybersecurity of solar energy resources in their jurisdiction through innovative policy.

14 SOLAR ENERGY↗
DOE OSTI2025

Improving Cyber Situational Understanding

Effective cybersecurity operations require the ability to analyze large amounts of information to assess security risks and formulate defensive strategies against adversaries. This has become more complex in recent years as the sprawl and interconnectivity of devices grows through implementation of virtualization, cloud computing, and Internet of Things (IoT). The amount of data and analysis required for effective cybersecurity command and control decisions far exceeds humans’ capacity to perform manually. We characterize the analysis problem as cyber situational understanding. The research presented to improve cyber situational understanding focuses on vulnerability analysis and threat intelligence. Regarding vulnerabilities, entities must analyze and plan work for between thousands and tens of thousands of software vulnerabilities annually. Entities heavily use network firewalls to limit vulnerability exposure. As a result, some of these vulnerabilities permit exposure to adversarial exploitation, whereas others are inaccessible and therefore present negligible risk of exploitation. Distinguishing between high and low risk software vulnerabilities requires a deep understanding of the vulnerability, network firewall protection, and characteristics of the targeted device. This problem is solved by extracting network service features from vulnerability data features using both machine-learning and natural language processing. Then, the network firewall topology is parsed to determine which vulnerabilities are reachable by adversaries. Ultimately, a state-based safety analysis ascertains which vulnerabilities are unsafe. A related vulnerability analysis problem occurs in cybersecurity operations when associating an entity’s hardware and software assets to public vulnerability databases. Assets often reveal hardware and software through installation artifacts and network service identification, and entities store these artifacts in inventory databases. However, software and hardware vendors apply a standard Common Platform Enumeration (CPE) naming convention when publicly reporting vulnerabilities. Associating these two datasets often requires many hours to days of manual inspection. The proposed solution automates the mapping approach of human analysts using fuzzy matching techniques, natural language processing, and, ultimately, machine learning to present a small set of recommendations for mapping the two datasets. The result significantly reduces human analysis time and reduces the occurrence of false positives in vulnerability notifications. Finally, cyber threat intelligence (CTI) requires associating cyber observable artifacts, such as IP addresses, URIs, and file hashes, with cyber threat tactics, techniques, and procedures. Unfortunately, most CTI data is compartmentalized across multiple organizations and cannot be shared due to the legal and reputational risk with cyber threat being associated with the entity. The approach to solving this problem inovlves using a distributed ledger with anonymous token spending and authentication. This allows a consortium of semi-trusted entities to share the workload of curating CTI for a threat sharing community’s cooperative benefit.

Huff, Philip↗
DOE OSTI2025

Advanced Transmission Technologies –GETs and HPCs Session 3: HPCs and Building Actions Plans to Digital Assurance Risks

The third session of the Idaho National Laboratory’s (INL) Technical Assistance for Digital Assurance (TADA) program, held on November 11, 2025, centered on High Performance Conductors (HPCs) and the formulation of action plans to address digital assurance risks associated with Grid-Enhancing Technologies (GETs). This session convened experts from utilities, vendors, and government agencies to examine the technical, operational, and cybersecurity aspects of HPC deployment. Discussions highlighted the benefits of HPCs, such as their ability to rapidly increase transmission capacity using existing corridors, improve grid resilience, reduce system losses, and align with FERC Orders 2023 and 1920. Participants evaluated supply chain and digital assurance risks, including reliance on imported materials, limited domestic manufacturing capacity, workforce shortages, and traceability issues. The session also emphasized the importance of digital trust, integration-layer cybersecurity, and unified risk frameworks, introducing tools like intrusion detection systems, encryption, zero trust networking, and firmware integrity. Recaps of earlier workshops on Dynamic Line Ratings (DLRs), Advanced Power Flow Control (APFC), and Transmission Topology Optimization (TTO) underscored institutional barriers and integration challenges. Action plans were proposed to mitigate issues such as inconsistent cybersecurity practices, SBOM usage, supply chain visibility, operator trust, and misaligned incentives. Additionally, INL presented its supply chain risk management tools and Cyber-Informed Engineering (CIE) principles to support secure procurement and system design. The session concluded with a commitment to share key takeaways, incorporate cohort feedback into future policy development, and continue collaborative engagement through upcoming pilot activities. Session 3 of 3.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2015

The Need for Cyber-Informed Engineering Expertise for Nuclear Research Reactors

Engineering disciplines may not currently understand or fully embrace cyber security aspects as they apply towards analysis, design, operation, and maintenance of nuclear research reactors. Research reactors include a wide range of diverse co-located facilities and designs necessary to meet specific operational research objectives. Because of the nature of research reactors (reduced thermal energy and fission product inventory), hazards and risks may not have received the same scrutiny as normally associated with power reactors. Similarly, security may not have been emphasized either. However, the lack of sound cybersecurity defenses may lead to both safety and security impacts. Risk management methodologies may not contain the foundational assumptions required to address the intelligent adversary’s capabilities in malevolent cyber attacks. Although most research reactors are old and may not have the same digital footprint as newer facilities, any digital instrument and control function must be considered as a potential attack platform that can lead to sabotage or theft of nuclear material, especially for some research reactors that store highly enriched uranium. This paper will provide a discussion about the need for cyber-informed engineering practices that include the entire engineering lifecycle. Cyber-informed engineering as referenced in this paper is the inclusion of cybersecurity aspects into the engineering process. A discussion will consider several attributes of this process evaluating the long-term goal of developing additional cyber safety basis analysis and trust principles. With a culture of free information sharing exchanges, and potentially a lack of security expertise, new risk analysis and design methodologies need to be developed to address this rapidly evolving (cyber) threatscape.

CCE↗