Search NASA⌕ Search

SEARCH · Search NASA

Results for “software security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Charting the unknown: A dive into the world of standards mapping

When you hear standards mapping what do you think about? For the Secure Software Central (SSC) project this means comparing our process to the National Institute of Standards and Technology’s (NIST) security control catalog. So how is it done? The project completed this summer can be broken down into three simple phases. Phase one consists of mapping the SSC process to the NIST’s security control catalog. While phase two entails mapping mitigations from a threat profile to NIST. Lastly phase three requires the creation of a knowledge base allowing for the reuse of controls across numerous projects This project presented a few different challenges: locating the correct control within the NIST catalog while correctly matching the proposed mitigations from the SSC team, accurately leveling the mitigation to the security level of the system, creating a toolbox to showcase a dataset of mitigations and standards to be used in current and future projects. each challenge allowed for opportunities in growth and understanding of how security controls can map to a governing set of standards. These standards maps are a crucial element to support the insights provided by the SSC team and allow the client to have confidence in the work being completed. My internship has allowed me to set and achieve many goals such as coming to understand that the field of cybersecurity truly is the right place for me. I have also learned that it’s ok to be wrong if you learn something from it. For significant accomplishments I have helped integrate standards mapping into the fabric of SSC. The field experience that I have gained such as interacting with the SSC team along with other senior staff and building a good rapport are crucial skills to. This time at PNNL has been an irreplaceable experience.

42 ENGINEERING↗
NASA NTRS2016

Empirical Analysis and Automated Classification of Security Bug Reports

With the ever expanding amount of sensitive data being placed into computer systems, the need for effective cybersecurity is of utmost importance. However, there is a shortage of detailed empirical studies of security vulnerabilities from which cybersecurity metrics and best practices could be determined. This thesis has two main research goals: (1) to explore the distribution and characteristics of security vulnerabilities based on the information provided in bug tracking systems and (2) to develop data analytics approaches for automatic classification of bug reports as security or non-security related. This work is based on using three NASA datasets as case studies. The empirical analysis showed that the majority of software vulnerabilities belong only to a small number of types. Addressing these types of vulnerabilities will consequently lead to cost efficient improvement of software security. Since this analysis requires labeling of each bug report in the bug tracking system, we explored using machine learning to automate the classification of each bug report as a security or non-security related (two-class classification), as well as each security related bug report as specific security type (multiclass classification). In addition to using supervised machine learning algorithms, a novel unsupervised machine learning approach is proposed. An ac- curacy of 92%, recall of 96%, precision of 92%, probability of false alarm of 4%, F-Score of 81% and G-Score of 90% were the best results achieved during two-class classification. Furthermore, an accuracy of 80%, recall of 80%, precision of 94%, and F-score of 85% were the best results achieved during multiclass classification.

Cybersecurity↗
NASA NTRS1998

Practical Computer Security through Cryptography

The core protocols upon which the Internet was built are insecure. Weak authentication and the lack of low level encryption services introduce vulnerabilities that propagate upwards in the network stack. Using statistics based on CERT/CC Internet security incident reports, the relative likelihood of attacks via these vulnerabilities is analyzed. The primary conclusion is that the standard UNIX BSD-based authentication system is by far the most commonly exploited weakness. Encryption of Sensitive password data and the adoption of cryptographically-based authentication protocols can greatly reduce these vulnerabilities. Basic cryptographic terminology and techniques are presented, with attention focused on the ways in which technology such as encryption and digital signatures can be used to protect against the most commonly exploited vulnerabilities. A survey of contemporary security software demonstrates that tools based on cryptographic techniques, such as Kerberos, ssh, and PGP, are readily available and effectively close many of the most serious security holes. Nine practical recommendations for improving security are described.

McNab, David↗
NASA NTRS1976

Standardized development of computer software. Part 1: Methods

This work is a two-volume set on standards for modern software engineering methodology. This volume presents a tutorial and practical guide to the efficient development of reliable computer software, a unified and coordinated discipline for design, coding, testing, documentation, and project organization and management. The aim of the monograph is to provide formal disciplines for increasing the probability of securing software that is characterized by high degrees of initial correctness, readability, and maintainability, and to promote practices which aid in the consistent and orderly development of a total software system within schedule and budgetary constraints. These disciplines are set forth as a set of rules to be applied during software development to drastically reduce the time traditionally spent in debugging, to increase documentation quality, to foster understandability among those who must come in contact with it, and to facilitate operations and alterations of the program as requirements on the program environment change.

Tausworthe, R. C.↗
DOE OSTI2022

Wiretap

SAND2023-12116O Wiretap is an offensive security software package meant for penetration testers and red teams. Unlike a traditional VPN, Wiretap transparently proxies networking traffic without requiring administrator privileges. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Rindels, Raymond↗
DOE OSTI2021

Improving the Cyber and Physical Security Posture of the Electric Sector (Final Report)

Cooperative electric utilities represent an integral part of the larger electric grid and are part of the nation’s critical infrastructure. The National Rural Electric Cooperative Association (NRECA) has a unique relationship with approximately 900 cooperatively owned and operated electric utilities and engaged in a program with the Department of Energy (DOE) to promote a culture of cybersecurity and resiliency within the electric cooperative community. The Rural Cooperative Cybersecurity Capabilities (RC3) Program, funded under a Cooperative Agreement with DOE (Project DE-OE-0000807), focused on improving the cybersecurity and resiliency capabilities of small and mid-sized electric distribution cooperatives. This segment of electric utilities faces many challenges, but also embraces a culture of cooperation that presents opportunities. A customized approach is needed to reach these utilities – one that emphasizes collaboration, more focused and personalized training, use of trusted and familiar experts that can be deployed as needed, software security services that require limited in-house cybersecurity expertise, and shared resource models that enable access to more expensive cybersecurity options.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Blockchain-Based Smart Contracts Use for Photovoltaic Energy Trade Transactions

In recent decades, interest in renewable energy via solar energy has increased, especially in California and Nevada. In a region that can produce enough solar power for self-use, prosumers must use or sell surplus energy. Solar energy self-consumption is essential in modern energy transactions in the grid. This paper proposes an approach towards grid services that includes photovoltaic hardware to store the excess energy in battery storage. Such energy can then be sold to power companies while the transaction is handled using blockchain. Software, security architecture and data flow requirements based on the Ethereum Blockchain are included. Furthermore, this solution protects the private information of seller and buyer and secures transactions.

14 SOLAR ENERGY↗
NASA NTRSDate not supplied

Data & Reasoning Fabric

A Data & Reasoning Fabric shall provide a set of secured software infrastructure, tools, protocols, governance and policies to implement, administer, manage and operate data sharing and reasoning services across the entire span of air mobility and other ”smart” edge nodes.

Aeronautics↗
NASA NTRSDate not supplied

Data & Reasoning Fabric Overview

A Data & Reasoning Fabric shall provide a set of secured software infrastructure, tools, protocols, governance and policies to implement, administer, manage and operate data sharing and reasoning services across the entire span of air mobility and other ”smart” edge nodes.

National Airspace↗
NASA NTRS2006

Security Verification Techniques Applied to PatchLink COTS Software

Verification of the security of software artifacts is a challenging task. An integrated approach that combines verification techniques can increase the confidence in the security of software artifacts. Such an approach has been developed by the Jet Propulsion Laboratory (JPL) and the University of California at Davis (UC Davis). Two security verification instruments were developed and then piloted on PatchLink's UNIX Agent, a Commercial-Off-The-Shelf (COTS) software product, to assess the value of the instruments and the approach. The two instruments are the Flexible Modeling Framework (FMF) -- a model-based verification instrument (JPL), and a Property-Based Tester (UC Davis). Security properties were formally specified for the COTS artifact and then verified using these instruments. The results were then reviewed to determine the effectiveness of the approach and the security of the COTS product.

patch↗
DOE OSTI2025

SUNSet: The Software Understanding for National Security Dataset Repo

SAND2025-00511O SUNSet: The Software Understanding for National Security Dataset Repo serves as a repository for software understanding researchers to conduct systematic research in the field. It provides a platform for storing questions, answers, and scripts related to software programs, supporting research in software understanding. The repository is a nascent effort aimed at exploring the support needed by researchers and documenting how software understanding questions can be addressed using existing tools. The software consists of a simple database and front end interface for easy access and management of the stored information. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Amon, Tod [Sandia National Lab. (SNL-CA), Livermor↗
NASA NTRS1994

Software For Computer-Security Audits

Information relevant to potential breaches of security gathered efficiently. Automated Auditing Tools for VAX/VMS program includes following automated software tools performing noted tasks: Privileged ID Identification, program identifies users and their privileges to circumvent existing computer security measures; Critical File Protection, critical files not properly protected identified; Inactive ID Identification, identifications of users no longer in use found; Password Lifetime Review, maximum lifetimes of passwords of all identifications determined; and Password Length Review, minimum allowed length of passwords of all identifications determined. Written in DEC VAX DCL language.

Arndt, Kate↗
NASA NTRS2004

Security Risks: Management and Mitigation in the Software Life Cycle

A formal approach to managing and mitigating security risks in the software life cycle is requisite to developing software that has a higher degree of assurance that it is free of security defects which pose risk to the computing environment and the organization. Due to its criticality, security should be integrated as a formal approach in the software life cycle. Both a software security checklist and assessment tools should be incorporated into this life cycle process and integrated with a security risk assessment and mitigation tool. The current research at JPL addresses these areas through the development of a Sotfware Security Assessment Instrument (SSAI) and integrating it with a Defect Detection and Prevention (DDP) risk management tool.

securiy↗