Search NASA⌕ Search

SEARCH · Search NASA

Results for “Cyber security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

773 records · Page 43
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Understanding Resilience Valuation for Energy Systems: An Overview of the NREL-NYSERDA Research Collaboration

Energy resilience has become a national priority as Americans experience more power outages attributed to climate change, extreme weather, and cyber events. Energy system owners and operators recognize that they must prepare differently for outages today than they did in the past. Decision makers at all levels face unique challenges and opportunities in effectively and equitably executing a transition to more resilient power systems. The New York State Energy Research and Development Authority (NYSERDA) recently added resilience to its mission statement. The authority engaged with the National Renewable Energy Laboratory (NREL) in a collaborative effort to: 1) understand options for measuring and valuing resilience investment benefits, and 2) inform how resilience could be operationalized across NYSERDA initiatives and program areas.

ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2022

Precursor Analysis Report: Doppelpaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019

The DoppelPaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019 Precursor Analysis Report leverages publicly available information about the PEMEX cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The 2019 DoppelPaymer ransomware attack on PEMEX, Mexico’s nationalized petroleum corporation, highlights a unique threat that ransomware and cybercriminal extortion poses to Operational Technology (OT) environments in critical infrastructure. The incident began with an employee downloading commodity malware that allowed adversaries to gain initial access to PEMEX’s enterprise environment. After conducting privilege escalation, tool ingress, and data exfiltration, the adversaries deployed DoppelPaymer ransomware throughout the PEMEX enterprise environment, resulting in the company having to take dozens of systems offline for at least several days. Although PEMEX stated that their operations were not affected, the data exfiltrated from PEMEX was made available for download on DoppelPaymer’s leak site, as well as on other illicit criminal forums. This stolen data included not only company information, but also sensitive OT-specific configuration data. This incident showcases how cybercriminal exfiltration and posting of sensitive OT architecture documentation can pose security concerns for the targeted organization for years due to the long lifespan of OT assets and architectures. Researchers and analysts identified 18 unique techniques utilized during the attack with a total of 190 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the DoppelPaymer ransomware attack were precursors to the triggering event. Analysis identified 163 observables associated with these precursor techniques, 34 of which were assessed to have an increased likelihood of being perceived in the 60 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Resilient Operating Constraints for Power Distribution Systems under Setpoint Attacks

Integration and operation of distributed generation (DG) and energy storage (ES) in power distribution systems are enabled by communication networks and embedded sensor and control devices that increase the vulnerability of the systems to cyber-threats, broadening the attack surface and making adversary actions more unpredictable. This paper proposes a methodology that uses ellipsoidal approximations to quantify the potential damage caused by successful attacks that affect, directly or indirectly, the desired operation setpoints and may drive the power distribution operation to unsafe states by violating the limits of voltage or line flows. More specifically, a new methodology is introduced to find the optimal non-symmetric operating constraints that can be imposed to each DG and ES in order to guarantee that the power distribution system is resilient to any malicious setpoints. The proposed method takes as inputs the system topology, DG and ES capabilities, and load limits to solve a convex optimization problem formulated using linear matrix inequalities (LMIs) and the power flow equations. The proposed solution is agnostic to the attacker's action or load profile and it does not require any assumption about the location or means of the attack. The numerical results on a test distribution feeder with several DG and ES illustrate how the proposed resilient operating constraints guarantee the security of the power distribution system under setpoint attacks.

Giraldo, Jairo↗
DOE OSTI2025

Edge ML for CAN bus intrusion detection in AVs

Autonomous Vehicles (AVs) are revolutionizing transportation, but their reliance on interconnected cyber-physical systems exposes them to unprecedented cybersecurity risks. This study addresses the critical challenge of detecting real-time cyber intrusions in self-driving vehicles by leveraging a dataset from the Udacity self-driving car project. We simulate four high-impact attack vectors, Denial of Service (DoS), spoofing, replay, and fuzzy attacks, by injecting noise into spatial features (e.g., bounding box coordinates) to replicate adversarial scenarios. We develop and evaluate two lightweight neural network architectures (NN-1 and NN-2) alongside a logistic regression baseline (LG-1) for intrusion detection. The models achieve exceptional performance, with NN-2 attaining an AUC score of 93.15% and 93.15% accuracy, demonstrating their suitability for edge deployment in AV environments. Through explainable AI techniques, we uncover unique forensic fingerprints of each attack type, such as spatial corruption in fuzzy attacks and temporal anomalies in replay attacks, offering actionable insights for feature engineering and proactive defense. Visual analytics, including confusion matrices, ROC curves, and feature importance plots, validate the models' robustness and interpretability. This research sets a new benchmark for AV cybersecurity, delivering a scalable, field-ready toolkit for Original Equipment Manufacturers (OEMs) and policymakers. By aligning intrusion fingerprints with SAE J3061 automotive security standards, we provide a pathway for integrating machine learning into safety-critical AV systems. Our findings underscore the urgent need for security-by-design AI, ensuring that AVs not only drive autonomously but also defend autonomously. This work bridges the gap between theoretical cybersecurity and life-preserving engineering, offering a leap toward safer, more secure autonomous transportation.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2026

Building Nuclear-Specific Cybersecurity Expertise in Higher Education

The rapid digitalization of nuclear power plants (NPPs) and the deployment of advanced and small modular reactors (A/SMRs) have expanded the cybersecurity attack surface within the nuclear sector. This evolution introduces unique challenges beyond those faced in general information technology (IT), operational technology (OT) and industrial control system (ICS) security, due to nuclear power’s regulatory rigor, safety-critical nature, and operational needs. A pressing workforce gap persists; cybersecurity graduates typically lack nuclear-specific context and retraining them for industry readiness requires 12–18 months, creating a significant burden. This paper addresses this gap by defining the domains of knowledge that nuclear cybersecurity specialists must master, spanning cybersecurity, nuclear engineering, OT/ICS security, and regulatory governance. We propose a curricular framework integrating technical, regulatory, and applied learning components to accelerate workforce readiness. Our approach builds on existing findings that current curricula inadequately integrate nuclear engineering and cybersecurity, shifting the discourse from why specialization is needed to what knowledge must be taught. The recommendations have implications for workforce development and long-term resilience of the nuclear energy sector.

99 - GENERAL AND MISCELLANEOUS↗
DOE OSTI2024

Does practice make perfect? Lessons learned from full-scale power system incident response exercise

While threats to the energy sector occur daily, few utilities get the opportunity to fully test out their detection and response mechanisms to advanced threats in the real world. With the high demand for reliability, few grid operators would allow execution of simulated cyber-attacks on their live systems. The DOE-funded Liberty Eclipse project offers a unique opportunity for small and large utilities and coops to practice their combined IT/OT responses to a live red team executing attacks against an isolated power system on an island in New York. Both cyber teams and power operations teams must work together to detect and respond to attacks, even restoring the power system against extreme impacts. Lessons learned from these exercises reveal key takeaways for understanding what a real attack against the electric sector will look like, gaps in execution of the best-laid plans when the pressure of a real event is bearing down, and how organizations can better prepare for advanced attacks by optimizing participation in exercises. This presentation will discuss successes and opportunities for improvement both in how utilities can prepare for and respond to events, as well as how full-scale IT/OT exercises can be coordinated.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

A trilevel model against false gas-supply information attacks in electricity systems

The interdependence between natural gas and electricity systems is increasing rapidly due to the growing reliance on natural gas-fired generating units. Availability of natural gas for gas-fired generating units can impact the secure operation of electricity systems. Fuel supply shortage for gas-fired units can be caused by uncertain interruptible supply contracts and incorrect supply information. This article proposes a trilevel min-max-min defender-attacker-operator optimization problem to provide the power system operator a screening methodology that allocates a limited budget for best protecting critical fuel supply information, and also the strategies to sign firm supply contract to reduce natural gas supply uncertainties. We utilize a column and constraint generation (C&CG) algorithm to solve the proposed problem. We illustrate the effectiveness of this trilevel formulation using a case study based on IEEE 24-node test system.

42 ENGINEERING↗
DOE OSTI2024

Lessons Learned for Responsible Use of Cloud in the Cirrus Project, Following the CrowdStrike Outage Event

A disruption in CrowdStrike’s Falcon cybersecurity platform on July 19th, 2024, caused worldwide chaos. This event highlights the imperative need for cloud security measures for networks that are critically reliant on cloud technology. This incident negatively impacted air travel, government networks, and critical infrastructure sectors such as hospitals and financial institutions. While no electric utilities had a physical impact, and few had an IT impact, there were issues created by loss of cloud services, and other interrelated industries. For utilities and energy distribution organizations, understanding and mitigating these risks is essential. The Cirrus tool offers a strategic solution engineered to weave cloud integration seamlessly into the fabric of operational management, thereby enhancing resilience and streamlining efficiency in the face of digital challenges.

25 ENERGY STORAGE↗
NASA NTRSDate not supplied

NASA’s Secured Airspace for Urban Air Mobility (UAM)

The Urban Air Mobility (UAM) architecture is leveraged from the Unmanned Traffic Management (UTM) concept of operations. Within the UAM environment, UAM operators work collaboratively to manage aerial vehicles in the urban environment. Providers of Services for UAM (PSU), UAM operators, and Supplemental Data Service Providers (SDSP) provide services to support flight operations within that environment. As a recognized need, various views of UAM flight information are provided to the public and public safety entities. To accomplish this, among other goals, the Federal Aviation Administration (FAA) can coordinate flight information between the FAA controlled National Airspace System (NAS) and the UAM environments through the FAA-Industry Data Exchange Protocol (FIDXP). This concept of UAM proposes to develop short-range, point-to-point transportation systems in metropolitan areas using vertical take-off and landing (VTOL) or short take-off and landing (STOL) aircraft to overcome increasing surface congestion. To garner the support of UAM and to realize its potential, an assurance of cybersecurity is critical for public acceptance. Understanding the various components communicating with one-another cybersecurity, like in other industries, has come to the forefront highlighting the need to protect these networks and systems from cyberattacks. With the planned growth and reach of UAM systems, it’s clear that the associated data exchange and service interactions will be at risk due to numerous types of cybersecurity attacks. Consequently, as these threats evolve, the UAM cybersecurity capabilities must adapt to these changes as well. While learning is always the goal, the overall intent of this workshop is to make recommendations on the following: (1) how future UAM environments can be protected against cyber-attacks, and (2) what mechanisms should be put in place to detect attacks against UAM environments.

UAM↗
DOE OSTI2022

Emerging Threats and Technology Investigation: Industrial Internet of Things - Risk and Mitigation for Nuclear Infrastructure

Industries supporting the global nuclear infrastructure striving for cost savings, expansions in efficiency, and convenience are likely to adopt components (e.g., hardware, software) that comprise the Internet of Things (IoT) and Industrial Internet of Things (IIoT). These devices offer potential improvements along with security challenges. Modern conveniences achieved through application of technology have propagated through society in the form of interconnected devices, from doorbells to microwave ovens, commonly referred to as IoT. IoT devices are often Internet-connected devices that are designed to send data back to a cloud-based server, where a smart phone application then presents device status and control options. Home-based IoT applications carry a different set of risks when compared to a business or security environment, where there is also a history of convenience and interconnection. Industrial settings have long relied on specifically designed Supervisory Control and Data Acquisition (SCADA) systems for process control where IIoT devices are intended to inform business decisions and augment traditional processes. A recent National Institute of Standards and Technology (NIST) report provides a distinction between process control and IIoT in that traditional process control is not replaced by IIoT, but rather IIoT devices are intended to enhance industrial processes through additional monitoring of various sensors and application of data analytics models using artificial intelligence (AI) and machine learning (ML) (Fagan, Marron, et al. 2021) (Ross, et al. 2021).

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2026

Oakland University Cybersecurity Center (Final Scientific/Technical Report)

This report summarizes the outcomes of Award DE-CR0000023, “Oakland University Cybersecurity Center,” a 31-month project funded by the U.S. Department of Energy Office of Cybersecurity, Energy Security, and Emergency Response (CESER). The project addressed cybersecurity risks facing small and medium-sized manufacturers (SMMs) transitioning to Industry 4.0. The project integrated customer discovery, applied research, and cybersecurity training development. A total of 51 cybersecurity assessments identified significant gaps in baseline practices, incident response, and workforce capability. Research efforts produced a scalable mitigation framework tailored to SMM environments, and workforce analysis identified persistent talent gaps. Eight cybersecurity training modules were developed and deployed via Oakland University’s Professional and Continuing Education (PACE) platform. All objectives were completed, with 98.93% federal budget utilization and cost share exceeding requirements. The project establishes a scalable model for strengthening cybersecurity resilience and workforce capacity across U.S. manufacturing supply chains.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Simulating Energy and Security Interactions in Semiconductor Manufacturing: Insights from the Intel Minifab Model

Semiconductor manufacturing is a highly complex. Fabrication plants must deal with re-entrant flows to support multiple types of wafers being produced simultaneously, each with their own deadlines and specifications. The manufacturing process itself depends upon the ability to control and programmatically adjust a variety of environmental conditions including temperature, humidity, and air quality. In addition, wafer fabrication consumes large amounts of electricity. Emerging technologies may help reduce the energy footprint of such facilities but can introduce cybersecurity risks. Therefore, this paper presents a modeling and simulation framework to quantify tradeoffs between operational measures of performance, energy consumption, and cybersecurity controls. We augment the Intel Minifab model, with the Purdue Enterprise Reference Architecture (PERA) for cybersecurity as well as tool-level energy consumption data from a real-world semiconductor manufacturing testbed. In this manner, we intend to provide stakeholders with a systematic, data-driven approach to evaluate emerging risks within the manufacturing process.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2020

Safe and Private Forward-trading Platform for Transactive Microgrids

Power grids are evolving at an unprecedented pace due to the rapid growth of distributed energy resources (DER) in communities. These resources are very different from traditional power sources, as they are located closer to loads and thus can significantly reduce transmission losses and carbon emissions. However, their intermittent and variable nature often results in spikes in the overall demand on distribution system operators (DSO). To manage these challenges, there has been a surge of interest in building decentralized control schemes, where a pool of DERs combined with energy storage devices can exchange energy locally to smooth fluctuations in net demand. Building a decentralized market for transactive microgrids is challenging, because even though a decentralized system provides resilience, it also must satisfy requirements such as privacy, efficiency, safety, and security, which are often in conflict with each other. As such, existing implementations of decentralized markets often focus on resilience and safety but compromise on privacy. In this article, we describe our platform, called TRANSAX, which enables participants to trade in an energy futures market, which improves efficiency by finding feasible matches for energy trades, enabling DSOs to plan their energy needs better. TRANSAX provides privacy to participants by anonymizing their trading activity using a distributed mixing service, while also enforcing constraints that limit trading activity based on safety requirements, such as keeping planned energy flow below line capacity. We show that TRANSAX can satisfy the seemingly conflicting requirements of efficiency, safety, and privacy. We also provide an analysis of how much trading efficiency is lost. Trading efficiency is improved through the problem formulation, which accounts for temporal flexibility, and system efficiency is improved using a hybrid-solver architecture. Lastly, we describe a testbed to run experiments and demonstrate its performance using simulation results.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2021

Cybersecurity Guide for Distributed Wind

Distributed wind sits at the intersection of grid-connected, off-grid and behind-the-meter cyber-physical electrical energy systems. The unique physical properties and communications requirements for distributed wind systems mean that there are unique cybersecurity considerations, but there is little to no existing guidance on best practices for cybersecurity. This document is intended to be a starting point for distributed wind stakeholders including manufacturers, installers and integrators, and operators (facility, aggregator, or utility). We discuss common distributed wind architectures and describe their role in the larger power system, pointing out some of the key connections to be aware of. Cybersecurity cannot exist in a vacuum, but rather must consider all the system and all its connections holistically. The role of distributed wind and the functions it can serve are described to gain understanding of the full range of capabilities. The purpose and application of relevant standards that may apply to certain distributed wind systems is presented. These standards may not apply to all installations, but even for systems that are not required to meet these standards they can be a good reference for best practices. A holistic threat perspective is used to describe the adversaries, threats, and potential impacts of cyberattacks, with special emphasis on what sets distributed wind systems apart from other distributed energy resources (DER). Finally, we present the recommendations for cybersecurity, both in terms of needs of the system and roles that specific stakeholders should fulfill. Distributed wind systems can come in a variety of architectures and applications, so there is no one-size-fits-all approach to cybersecurity. However, this document contains the relevant information for stakeholders to identify the cybersecurity needs of their system, refer to relevant standards, and apply best practices in a manner most consistent with their security and operational goals.

17 WIND ENERGY↗
DOE OSTI2020

Cybersecurity for Distance Relay Protection

This project is a DOE follow-up effort on the CREDC workshop held on September 13, 2018 in Cambridge, MA to discuss cybersecurity of distance relays, which considered the benefits, vulnerabilities and risk mitigations for the use of communication systems in power system protection. The objectives of this project are to define the taxonomy of relay protection and associated communications; define use cases describing approaches to reduce the cyber-attack surface on those protective relays; and evaluate the loss of operational functional capability from changes to communication coverage. Mitigating controls will also be evaluated to understand if there are other approaches to reduce attack surfaces while maintaining communications or partial communications. Distance relays are used to protect transmission lines of approximately 10 to 300 miles in length, by detecting short circuits (i.e., faults) on the lines and then tripping circuit breakers in the substation. Such protection systems are a subset of the power system and they incorporate sensing, logic and communication functions. Protection system exposure to cyberattack could be drastically limited by disconnecting relays from all vulnerable communication systems, but this may adversely impact overall power system performance in the absence of cyberattack. This project began with a use case analysis of protection systems with communications, as summarized in this report. It continued with modeling, testing and evaluation in a miniature power system (MPS), located in the Western Area Power Administration (WAPA) Electric Power Training Center (EPTC). The project also incorporated feedback from two industry meetings held in February and September 2019. The suggested next steps account for and complement the work already underway with DOE/CESER funding: 1. Study the performance of LCD and PC vs. PUTT, which is less reliant on communication system performance and GPS timing references. The PUTT scheme could prove to be more resilient to cyberattack or communications-related disruption. It could also be more tolerant of message re-routing with SDN/SDR communication systems. On the other hand, it will be more vulnerable to false tripping during dynamic events or to loss of the voltage signal. The optimum choice of scheme may depend on the specific power system and risk assessment. This study could provide a new template for evaluation based on business functions. 2. Research and develop new methods to detect and monitor distributed physical attacks, possibly using drones, video sensors, thermal sensors, machine learning and other advanced techniques. This will help mitigate the impact of cyberattack on the protection system, and will also help mitigate the impact of wild fires. 3. Implement a scalable PKI for use in electric utility protection systems. This will encourage widespread adoption of secure authentication methods that are already available, but not widely used at present. This will help secure engineering access to the relays. 4. Investigate the use of SDN in combination with SDR to achieve better cybersecurity and electromagnetic security of the network, incorporating path variability. This would help secure both engineering access and peer-to-peer GOOSE messaging. 5. Perform additional testing, with operator evaluation of “red button” scenarios, PUTT vs. LCD, relay mis-operations, and other cyberattacks in the EPTC. This is an important advantage of testing in the EPTC rather than by computer simulation or even hardware-in-the-loop simulation; the EPTC is already dedicated to managing the situational awareness, operator response times and other human impacts. One of the project objectives was to settle on a common nomenclature for this problem space. We have concluded that the OSI layer model, supplemented by ANSI device numbers and other IEEE standards, is already well-accepted by the industry. The IEEE PSRC knowledge base provides a great deal of public information

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Microgrid's Role in Enhancing the Security and Flexibility of City Energy Systems

Smart cities depend on flexible and secure energy systems to ensure resilient power for critical infrastructure; however, recent weather-related events and cyberattacks have highlighted weaknesses in our energy systems, with the potential for widespread economic and security impacts. As stated by the Executive Office of the President, "the resilience of the US electric grid is a key part of the nation's defense against severe weather." To address the energy delivery security challenge, microgrids are rising as a viable solution that enhances the flexibility and resilience of the distribution grid and boosts the reliability of the local supply for the end-user. Traditionally, high capital investment has been a barrier to large-scale adoption of microgrid technology. Understanding the flexibility and resilience benefits of microgrids and accounting for the associated value streams can make the microgrid's proposition economically viable. In this chapter, microgrids' utility and their potential to serve as a flexible and resilient resource for the utility grid by providing capabilities such as peak shaving, demand response, and frequency regulation is presented. Moreover, other value streams, such as (1) their ability to island during a disaster and sustain critical loads which makes them a robust resilience solution for end-users, in the event of the utility grid outage and (2) microgrids also provide a flexible platform for integrating distributed energy resources in conjunction with storage and conventional generation technologies, strengthen microgrid's role in reducing the over-arching goal of emission reduction. Given the myriad of benefits associated with microgrids, we present strategies which can be employed for making microgrid itself resilient against physical and cyberthreats by employing hardware, software, and personnel training solutions to operate the microgrid before, during, and after a potential disaster. This chapter, thus, provides a holistic study of the microgrid as a resilience resource, for the utility grid, and a self-contained end-user for the end-user.

cyber-physical system↗
DOE OSTI2024

Clean Energy Cybersecurity Accelerator: Cohort 2 - Asimily Public Report

The U.S. Department of Energy (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER) sponsors the Clean Energy Cybersecurity Accelerator (TM) (CECA) to expedite the deployment of emerging security technologies that address the most urgent security concerns facing modern and future electric grids. CECA Cohort 2 assessed solutions focused on hidden risks due to incomplete system visibility and device security and configuration. Improving visibility can be achieved through operational technology (OT) asset identification solutions, including capabilities like automatic discovery, vulnerability reporting, and configuration monitoring. Solutions that monitor and identify assets in information technology (IT) networks in other domains are widely used; however, there is far less adoption of monitoring solutions for operational technology environments. Wider adoption may increase with increased confidence in the ability for these solutions to understand and respond to the specific requirements of OT environments. CECA Cohort 2 evaluated the active and passive asset discovery capabilities of market-ready solutions, documented and analyzed results, and identified gaps in functionality or capabilities. This report and describes how these results can help advance the adoption of these and similar solutions in the electric sector.

24 POWER TRANSMISSION AND DISTRIBUTION↗