Search NASA⌕ Search

SEARCH · Search NASA

Results for “Cybersecurity”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Cybersecurity Guide for Distributed Wind Presentation

This presentation communicates information about the MIRACL project Resilience Metrics report and Resilience Framework report. It was created for the 2021 MIRACL advisory board meeting. Distributed wind sits at the intersection of grid-connected, off-grid and behind-the-meter cyber-physical electrical energy systems. The unique physical properties and communications requirements for distributed wind systems mean that there are unique cybersecurity considerations, but there is little to no existing guidance on best practices for cybersecurity. This presentation is intended to be a starting point for distributed wind stakeholders including manufacturers, installers and integrators, and operators (facility, aggregator, or utility). A holistic threat perspective is used to describe the adversaries, threats, and potential impacts of cyberattacks, with special emphasis on what sets distributed wind systems apart from other distributed energy resources (DER). We present the recommendations for cybersecurity, both in terms of needs of the system and roles that specific stakeholders should fulfill. Distributed wind systems can come in a variety of architectures and applications, so there is no one-size-fits-all approach to cybersecurity. However, this document contains the relevant information for stakeholders to identify the cybersecurity needs of their system, refer to relevant standards, and apply best practices in a manner most consistent with their security and operational goals.

17 WIND ENERGY↗
DOE OSTI2021

Cybersecurity Training Curriculum Analysis through the application of Machine Learning Text Classification and Natural Language Processing

In the domain of cybersecurity, there are a wide variety of education and training courses offered by a variety of training providers (commercial vendors, governmental, and academic institutions). Unfortunately, a comprehensive cross-provider mapping of the body of course offerings does not currently exist. Furthermore, although individual providers have made efforts, an accepted cross-provider mapping of education and training courses (or categories) to an accepted framework of work-roles by cybersecurity work-role and competency level has not yet been developed. The inability to compare training courses by topic or cybersecurity work-role and the level of difficulty (competency level) affects all organizations in identifying and selecting potential training opportunities for their personnel performing cybersecurity duties. In this work, we report on our application of Machine Learning (ML) Text Classification and Natural Language Processing (NLP) methodologies to begin to create a process to organize an accurate and thorough catalog of course offerings by work-role and competency level. Through the analysis of text-based course attributes (description, learning objectives, prerequisites, etc.) along with the text-based attributes for identified cybersecurity work-roles, our ML efforts examined methods to determine the work-role "best-fit" for each course as well as the competency level through action-verb text comparison.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2022

The Distributed Energy Resource Cybersecurity Framework

For facilities with distributed energy resources (DERs), cybersecurity must be considered holistically, across system architectures and down to individual components. It's hard to know where to start. That's why the National Renewable Energy Laboratory (NREL) has developed an assessment tool for organizations with DERs to understand and improve their cybersecurity. With support from the U.S. Department of Energy's Federal Energy Management Program, the Distributed Energy Resource Cybersecurity Framework (DER-CF) provides a holistic evaluation of a facility's DER cybersecurity and makes customized recommendations that follow widely recognized best practices for cybersecurity. The DER-CF is available at no cost as an interactive web tool (dercf.nrel.gov).

cybersecurity↗
DOE OSTI2022

Cybersecurity Governance

Cybersecurity governance helps an organization detect, prevent, and respond to cyber incidents by establishing cybersecurity policies and procedures for use across the enterprise. As modern energy systems become increasingly reliant on smaller and decentralized generation sources-equipped with complex, data-driven communications-governance will be of growing importance for the continued protection of the electric grid. This presentation sheds light on the important aspects of cybersecurity governance, best practices to ensure a culture of cybersecurity, and approaches to frequent monitoring and assessment of an organization's cybersecurity posture.

business requirements↗
DOE OSTI2022

Draft Methodology for Cybersecurity Analysis for Adoption of Wireless Technology in Nuclear Power Plants

The report is delivered as DOE-NE Cybersecurity Program Milestone M2CT-22IN1104014-Industry cybersecurity guidance adoption status. The milestone is specifically to document the process and the status of the efforts towards developing guidance in support of industry’s adoption of wireless communication technologies. To transform the operation of nuclear power plants, including domestic light-water reactors, advanced reactors, microreactors, and fission battery, for grid and non-grid applications, secure and resilient wireless capabilities are required. In addition, to realize new operational concepts such as autonomous operation and remote monitoring, advanced sensor, and instrumentation, wireless technology is essential. However, industry implementation is low, and there is no technical basis for how to understand and address potential risks for wireless communications for critical plant functions. A methodology with a technical basis for implementing secure wireless communication is crucial. This wireless adoption methodology is intended to assist a licensee in identifying an appropriate technological approach for securing wireless communications in nuclear power plant. However, this methodology does not provide guidance for addressing wireless design criteria or for addressing all the cybersecurity commitments in licensees’ cybersecurity plans (CSPs) including addressing security impact analysis that a licensee must perform before an update to a Critical Digital Asset (CDA). This methodology guides a licensee through a process of evaluating a proposed wireless implementation and drafting a plant change notification for an example use case. The example is a generic/nonproprietary version of the first test case of the methodology, which, if successfully implemented, is part of the consideration for protecting other functions’ use of wireless in a cybersecure manner.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2024

Assessment and Coordination of EVSE Cybersecurity Standards

Cybersecurity certification programs for Electric Vehicle Supply Equipment (EVSE) are fragmented due to no single certification covering all aspects of the device and additionally the existence of multiple programs and under different levels of regulation. These devices are also confronted by the intricate assembly of product software, firmware, and hardware. Devices contain both logical and physical interfaces. These multifaceted devices have vulnerabilities at many levels and interconnect with other potentially vulnerable systems including the electric vehicle, the cloud where data and payment information are stored, and the electric grid and electric grid equipment including utilities. Of the EVSE certification programs that are found, none are directly for the cybersecurity of EVSE. Many standards are for safety, specifically battery safety, some are cybersecurity standards for other types of equipment and can be modeled for EVSE. In specific, ISA/IEC 62443 is found to be significantly in line with EVSE security needs and will be used in future testing to certify EVSE and help guide the project to demonstrate where gaps exist, where strengths lie in the standard and how this can be used to lead the certification efforts in harmonizing EVSE cybersecurity standards. In addition, there are multiple efforts that are currently seeking to build EVSE standards or revise existing standards to address gaps. This effort is seeking to establish a cybersecurity program for EVSE that will inform customers and help increase the level of security across products and state EVSE procurements to achieve consistency across different jurisdictions.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2024

Enhancing Cloud Cybersecurity: Prescriptive Controls for Operational Technology

This whitepaper provides strategic insights and recommendations into security cloud-based solutions for electric utilities, encompassing operational technology (OT), virtual power plants (VPP), distributed energy resources (DERs), applications, networks, and data storage as they transition to and leverage cloud infrastructure through managed service providers (MSPs) and cloud service providers (CSPs). Principles derived from established frameworks serve as a foundation for best practices across cybersecurity projects and remove the constraints of settling on a single framework. For organizations that prefer not to integrate a specific framework altogether, elements of the proposed approach could be adopted or tailored to best fit defined requirements and expected functionalities. The Cirrus assessment, a utility cloud feasibility tool, and the roadmap it provides serve as a precursor to this paper, which seeks to be a valuable resource for defining next steps following cloud technology integration feasibility appraisal. With its comprehensive approach to adoption, the Cirrus framework offers strategic guidance on responsibly preparing for or deploying a utility cloud solution. The previously published whitepaper, “Use Case-Informed Framework for Utility Cloud Migration,” details the guiding strategy, research, and deployment of cloud solutions within electric and interconnected grid systems. Before implementing the controls suggested in this document, it is recommended that stakeholders complete Cirrus's cloud integration assessment and pair the results with their unique cybersecurity controls to form a comprehensive cloud-based utility cybersecurity plan. The Cirrus outcome will consider a series of future architectures for the grid before and after the energy transition and evaluate the arguments for and against cloud applications for each electric and interconnected grid layer. This document is a companion to the original whitepaper, "Use Case-Informed Framework for Utility Cloud Migration" to further identify and recommend security controls based on Cirrus’s cloud integration assessment output. The following whitepaper outlines the cybersecurity controls that secure cloud-service models pertinent to the electric sector using the predefined categories identify, protect, detect, and respond and recover. The objective is to outline prescriptive security controls based on the type of architecture and data stored in the cloud. The focus includes dissecting the shared responsibility model and elucidating what on-premises Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) entail. A pivotal consideration in this context is allocating responsibility for foundational cybersecurity aspects—having used Cirrus for the cloud integration assessment. The ensuing controls detailed herein also represent a checklist of controls necessary for a secure cloud transition, equipping utilities with the knowledge to navigate this digital transformation with confidence and strategic foresight in a safe and responsible manner.

42 ENGINEERING↗
DOE OSTI2026

Building Nuclear-Specific Cybersecurity Expertise in Higher Education

The rapid digitalization of nuclear power plants (NPPs) and the deployment of advanced and small modular reactors (A/SMRs) have expanded the cybersecurity attack surface within the nuclear sector. This evolution introduces unique challenges beyond those faced in general information technology (IT), operational technology (OT) and industrial control system (ICS) security, due to nuclear power’s regulatory rigor, safety-critical nature, and operational needs. A pressing workforce gap persists; cybersecurity graduates typically lack nuclear-specific context and retraining them for industry readiness requires 12–18 months, creating a significant burden. This paper addresses this gap by defining the domains of knowledge that nuclear cybersecurity specialists must master, spanning cybersecurity, nuclear engineering, OT/ICS security, and regulatory governance. We propose a curricular framework integrating technical, regulatory, and applied learning components to accelerate workforce readiness. Our approach builds on existing findings that current curricula inadequately integrate nuclear engineering and cybersecurity, shifting the discourse from why specialization is needed to what knowledge must be taught. The recommendations have implications for workforce development and long-term resilience of the nuclear energy sector.

99 - GENERAL AND MISCELLANEOUS↗
DOE OSTI2022

Cybersecurity vulnerability mitigation framework

Systems, methods, and computer media for mitigating cybersecurity vulnerabilities of systems are provided herein. A current cybersecurity maturity of a system can be determined based on maturity criteria. The maturity criteria can be ranked based on importance. Solution candidates for increasing the cybersecurity maturity of the system can be determined based on the ranking. The solution candidates specify cybersecurity levels for the maturity criteria. A present state value reflecting the current cybersecurity maturity of the system can be calculated. For the solution candidates, an implementation state value and a transition state value can be determined. The implementation state value represents implementation of the maturity levels of the solution candidate, and the transition state value represents a transition from the present state value to the implementation state value. Based on the transition state values, a solution candidate can be selected for the system, and the system can be modified accordingly.

Gourisetti, Sri Nikhil Gupta↗
DOE OSTI2024

ChatGPT and Other Large Language Models for Cybersecurity of Smart Grid Applications

Cybersecurity breaches targeting electrical substations constitute a significant threat to the integrity of the power grid, necessitating comprehensive defense and mitigation strategies. Any anomaly in information and communication technology (ICT) should be detected for secure communications between devices in digital substations. This paper proposes large language models (LLMs), e.g., ChatGPT, for the cybersecurity of IEC 61850-based communications. Multi-cast messages such as generic object oriented system events (GOOSE) and sampled values (SV) are used for case studies. The proposed LLM-based cybersecurity framework includes, for the first time, data pre-processing of communication systems and human-in-the-loop (HITL) training (considering the cybersecurity guidelines recommended by humans). The results show a comparative analysis of detected anomaly data carried out based on the performance evaluation metrics for different LLMs. A hardware-in-the-loop (HIL) testbed is used to generate and extract a dataset of IEC 61850 communications.

ChatGPT↗
DOE OSTI2021

Evaluation of Hands-On Cybersecurity Skills Development

Cybersecurity is a relatively new and quickly advancing industry, though there is a deficit in industry professionals throughout the world. This deficit is a result of the inability of education to keep up with the continuously changing cyber-threat landscape. A lack of effective, accessible, hands-on training platforms is a barrier for students and professionals who seek to gain the skills and abilities necessary to enter the workforce. Additionally, the lack of adequate training makes it difficult for industry experts to upskill or stay up to date on new advancements within the field of cybersecurity. The goal of this cohort is to discover what makes an effective or ineffective training platform, what platforms are currently available, and to determine the next steps for hands-on learning. Hands-on experience is necessary to create workforce ready professionals, yet it is underutilized by students and professionals of cybersecurity due to costs, availability, and ease of use. This cohort has uncovered hands-on training solutions, identified many effective training solutions, and explored potential improvement to cybersecurity training. These findings resulted in the cohort moving beyond research to test the resources that currently exist or are in development, and to apply that knowledge to discovering and developing engaging hands-on training.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Idaho Cyber Heroes: Helping Individuals Navigate Career Pathways in Cybersecurity

In 2019, there was a shortage of 3.5 million qualified cybersecurity professionals. Cyberattacks are ever on the rise, making it increasingly important these positions be filled quickly. The purpose of this research, as part of the Idaho Cyber Research Project, was to use information collected from open-source materials to depict the career path issues in cybersecurity for individuals. Interviews with professionals from various industry sectors in Idaho also influenced the course of our research. Early research revealed that one of the main problems is an unclear career path for individuals wanting to enter the cybersecurity workforce. Unclear pathways are defined by of a lack of awareness about a career field, uncertainty surrounding the knowledge and skills taught in college due to a lack of standardization between institutions, high qualification standards in hiring, and a lack of diverse representation in the cybersecurity workforce. Additionally, a platform called CyberKnights was assessed as it applies to the individual and their pathway. However, CyberKnights is not the only solution to this problem, and further research is needed to identify additional solutions.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Distributed Energy Resource Cybersecurity Framework and Cyber Range Integration

Distributed energy resource (DER) systems feature complex, data-driven communications networks that require careful system coordination and constant vigilance to ensure that grid assets are secure. Because DERs are an important component of the decarbonization strategy, agencies need to secure energy data that could implicate issues of national security if compromised. To help federal energy managers assess, monitor, and manage cybersecurity while achieving decarbonization, the National Renewable Energy Laboratory's (NREL's) Distributed Energy Resource Cybersecurity Framework (DER-CF) offers a comprehensive, web-based assessment tool focusing on cyber governance or policies, technical management, and physical security. The DER-CF currently presents users with a series of pertinent cybersecurity questions that are used to generate a site-specific report and recommendations. This paper outlines a plan to integrate the DER-CF with another key asset-NREL's cyber range-to visualize cybersecurity resilience and compliance and to enhance the usability and accessibility of the DER-CF for federal facility energy managers and planners. This integration will result in a visualization environment to interpret and interact with compliance data. Its development will include regular conversations with stakeholders to assess the effectiveness of these efforts, refine the visualization capability, and ensure its value to our partners.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

Consequence-Driven Cybersecurity for High-Power Electric Vehicle Charging Infrastructure

Cybersecurity of high-power charging infrastructure for electric vehicles (EVs) is critical to the safety, reliability, and consumer confidence in this publicly accessible technology. Cybersecurity vulnerabilities in high-power EV charging infrastructure may also present risks to broader transportation and energy-infrastructure systems. Here, this paper details a methodology used to analyze and prioritize high-consequence events that could result from cybersecurity sabotage to high-power charging infrastructure. The highest prioritized events are evaluated under laboratory conditions for the severity of impact and the complexity of cybersecurity manipulation. Mitigation solutions and strategies are presented to secure the vulnerabilities that potentially lead to high-consequence events. These mitigations can be immediately implemented by industry or executed during the design stage.

25 ENERGY STORAGE↗
DOE OSTI2023

Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure

This document is the Cybersecurity Framework Profile (Profile) developed for the Electric Vehicle Extreme Fast Charging (EV/XFC) ecosystem, including the four domains that relies on the ecosystem (i) Electric Vehicles (EV); (ii) Extreme Fast Charging (XFC); (iii) XFC Cloud or Third-Party Operations; and (iv) Utility and Building Networks. This Profile utilizes the NIST Cybersecurity Framework Version 1.1 and provides voluntary guidance to help relevant parties develop Profiles specific to their organization to understand, assess, and communicate their cybersecurity posture as a part of their risk management process. The Profile is intended to supplement, not replace, an existing risk management program or cybersecurity standards, regulations, and industry guidelines that are in current use by the EV/XFC industry.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2022

Caribbean Energy Sector Cybersecurity Forum: Modernizing and Securing the Grid

This presentation on Modernizing and Securing the Grid brought together regional and NREL cybersecurity expertise for USAID's Caribbean Energy Sector Cybersecurity Forum. The presentation's overall purpose was to provide a deep dive into the changes underway in the electric grid, including the greater integration of renewables and distributed energy resources. The presentation also reviewed best practices for building cybersecurity into modern energy systems, including in the areas of vendor assessment and supply chain cybersecurity.

Caribbean↗
DOE OSTI2022

Always look on the bright side of life: Taking a different perspective on cybersecurity performance

This presentation will introduce participants to key mental models on how to think about and understand safety from two of the leading voices in the discipline – Dr. Erik Hollnagel and Dr. Todd Conklin – and from there we ask the simple question of “how can we apply this to cybersecurity?” At the completion of this presentation attendees will be able to describe Dr. Hollnagel’s Safety-II approach and Dr. Conkiln’s definition of safety as “not the absence of accidents but the presence of effective defenses.” They will be able to explain how these ideas translate to the cybersecurity world broadly, and more specifically to operational technology cybersecurity where physical safety consequences are coupled to control system performance. Finally, participants will be able to identify how selected principles from Weick and Sutcliffe’s high reliability organization theory can help operationalize these key mental models around safety, for improved organizational cybersecurity over the long run.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2022

Integrating Cybersecurity with System Operations and Restoration

This presentation covers the interaction of the discipline of system operations with the discipline of cybersecurity. First, a common mental model for risk - both cybersecurity and all-hazards - is presented, followed by a discussion of high-level management strategies for different kinds of cyber harm facing system operators, based on the consequences and frequencies of the harm. The next section covers the importance of cybersecurity for a system operator organization and explains some general concepts to understand the relationships. Finally the role of system operators in the security of the grid as a larger system of systems is discussed over the framework of a resilience event.

24 POWER TRANSMISSION AND DISTRIBUTION↗