Search NASA⌕ Search

SEARCH · Search NASA

Results for “VULNERABILITY”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Vulnerabilities in Artificial Intelligence and Machine Learning Applications and Data

Artificial intelligence (AI) applications driven by machine learning (ML) are transformational technologies within the international nuclear security regime. Advancements realized by AI—faster and improved data insights, more efficient and automated processes, reductions in human error—enable nuclear security applications such as behavior analysis for insider threat mitigation, source tracking of stolen nuclear material, and facial recognition software for physical protection. In addition to the advantages, however, there are also inherent vulnerabilities and threats associated with its use and risk mitigations must be built into any AI/ML-enabled systems. This work provides a background on AI and ML and different data types used in the field, including open-source intelligence information (OSINT) that is discoverable by AI tools and application data that are used by AI tools for decision-making and automation. Current and potential AI applications and vulnerabilities related to their use within the nuclear security regime are also discussed.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Prioritizing ICS Beachhead Systems for Cyber Vulnerability Testing

Cyber Testing for Resilient Industrial Control Systems™ (CyTRICS™) is the Department of Energy’s (DOE’s) program for cybersecurity vulnerability testing, digital subcomponent enumeration, and forensic assessment. CyTRICS leverages best-in-class test facilities and analytic capabilities at six DOE National Laboratories and strategic partnerships with key stakeholders including technology developers, manufacturers, asset owners and operators, and interagency partners. During the program’s development, CyTRICS established a unique methodology for prioritizing digital components within operational technology (OT) and industrial control systems (ICS) in the Energy Sector Industrial Base (ESIB) for cyber vulnerability testing. The CyTRICS Prioritization Process leverages multiple characteristics of systems, components, and their contextual deployment to calculate a quantification of individual digital components for CyTRICS testing. The initial version of the CyTRICS Prioritization Process was premised largely upon the impact which could result to an industrial control system if the digital component under testing was compromised, either through malicious means, faulty engineering, or other modes. The worldwide compromise of the SolarWinds Orion platform, first reported in December 2020, through malicious interference with the digital patching cycle was a watershed event in cyber supply chain security. The SolarWinds compromised demonstrated the strategic importance of certain types of ubiquitous software, and the ability to generate widespread cybersecurity effects. To address this challenge and as a part of the Department of Energy’s response to the SolarWinds compromise, DOE’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) directed the National Laboratories to evolve the CyTRICS Prioritization Process methodology to encompass additional factors related to the strategic importance of digital components. CESER directed CyTRICS researchers to identify, characterize, and append strategic factors to the CyTRICS Prioritization Process to provide additional weight to these characteristics. National Laboratory expert researchers identified functionality, distribution, and platform characteristics for digital components in ICS and OT that they assessed would be likely targeted in strategic initial-access cyber attack. CyTRICS has termed these factors “ICS Beachhead Systems,” leveraging a definition first advanced by Schneider Electric, which is intended as a blanket term to encompass digital components, products, and systems in OT. This paper describes the ICS Beachhead Systems identified and the rationale for inclusion. As a next step in the research and refinement process, the National Laboratories will validate this initial set of characteristics against digital components evaluated by the CyTRICS program and current implementation of the CyTRICS Prioritization Process. After validation, CyTRICS researchers will then develop a scoring methodology to generate a quantitative score to assess the degree to which a digital component is characterized as an ICS Beachhead System. Finally, the National Laboratories will append this scoring to the existing CyTRICS Prioritization Process algorithm.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Automated Vulnerability Detection (AVUD) for Compiled Smart Grid Software

This project developed and implemented a system for conducting cybersecurity vulnerability detection of smart grid components and systems by performing static analysis of compiled software (“firmware”). The resulting system for automated vulnerability detection (AVUD) was implemented as part of Oak Ridge National Laboratory’s existing test bed for smart meters, the Sustainable Campus Initiative. The work consisted of two phases: the first phase implemented the necessary software and computational models to perform the analysis, and the second phase demonstrated the system on example firmware in partnership with smart meter manufacturer Sensus USA, Inc. The resulting system won an R&D 100 award and has been successfully commercialized, winning a National Laboratory Consortium Commercialization Award.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

FIC Vulnerability Profile

The FIC team is engaged with Pacific Northwest National Laboratory’s (PNNL’s) Shamrock Cyber Team to provide cybersecurity analyses of the FIC software. Shamrock offers both Threat-Based Analysis services and Secure Software Development services. These services are ultimately used to understand and mitigate threats against software and to reduce vulnerabilities in software, thus improving overall cybersecurity and informing decision makers. Shamrock’s Secure Software Development services, specifically Static Analysis Security Testing (SAST) and Open-Source Analysis (OSA), produced this Vulnerability Profile.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Territorial Government Revenue Vulnerability Index (TGRVI): Measuring Financial Impacts to Territorial Governments during the COVID-19 Pandemic

The Territorial Government Revenue Vulnerability Index (TGRVI) measures the vulnerability of U.S. territorial government revenues by estimating monthly changes relative to a January 2020 baseline. Revenues accounted for in the index include: taxes on products and sales, transportation and housing revenues, individual income taxes, severance taxes and royalties, and property taxes.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2024

Charliecloud is not affected by CVE-2024-21626 or related vulnerabilities

As you may be aware, four vulnerabilities in popular open-source container implementations were announced on January 21. Nicknamed “Leaky Vessels” by the Snyk Security Labs team that discovered them [1], these vulnerabilities in runC (CVE-2024-21626) and Moby BuildKit (CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653) allow malicious container images or builds to execute arbitrary code on the container host with the privileges of the container runtime, i.e., a “container breakout”. Often, including typical configurations of Docker and/or Kubernetes, that means full root access.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

A Multi-Model, Multi-Scale Research Program in Stressors, Responses, and Coupled Systems Dynamics at the Energy-Water-Land Nexus and for Concentrated, Interdependent Infrastructures: Toward Next Generation Capabilities in Integrated Impacts, Adaptation, and Vulnerability (I-IAV) Modeling and a Community of Practice

The goal of this research program was to build a next generation integrated suite of science-driven modeling and analytic capabilities, and a more expanded and connected community of practice, for analyses of the stressors, impacts, adaptations and vulnerabilities of global and regional change. The emphasis was on understanding energy-water-land interactions and feedbacks and interdependent infrastructures at appropriate regional and temporal scales. Although the scope spans many complex facets of data, modeling, and analysis, as well as scales appropriate for integrated impacts and adaptation research, the focus of this effort was the development of multi-model, multi-scale capabilities spanning the domains of Multi-Sector Dynamics (MSD) models; Impact, Adaptation, and Vulnerability (IAV) models; and Earth System Models (ESMs).

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

Review of Electric Vehicle Charger Cybersecurity Vulnerabilities, Potential Impacts, and Defenses

Worldwide growth in electric vehicle use is prompting new installations of private and public electric vehicle supply equipment (EVSE). EVSE devices support the electrification of the transportation industry but also represent a linchpin for power systems and transportation infrastructures. Cybersecurity researchers have recently identified several vulnerabilities that exist in EVSE devices, communications to electric vehicles (EVs), and upstream services, such as EVSE vendor cloud services, third party systems, and grid operators. The potential impact of attacks on these systems stretches from localized, relatively minor effects to long-term national disruptions. Fortunately, there is a strong and expanding collection of information technology (IT) and operational technology (OT) cybersecurity best practices that may be applied to the EVSE environment to secure this equipment. In this paper, we survey publicly disclosed EVSE vulnerabilities, the impact of EV charger cyberattacks, and proposed security protections for EV charging technologies.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2023

Insights into the vulnerability of Antarctic glaciers from the ISMIP6 ice sheet model ensemble and associated uncertainty

Abstract. The Antarctic Ice Sheet represents the largest source of uncertainty in future sea level rise projections, with a contribution to sea level by 2100 ranging from −5 to 43 cm of sea level equivalent under high carbon emission scenarios estimated by the recent Ice Sheet Model Intercomparison for CMIP6 (ISMIP6). ISMIP6 highlighted the different behaviors of the East and West Antarctic ice sheets, as well as the possible role of increased surface mass balance in offsetting the dynamic ice loss in response to changing oceanic conditions in ice shelf cavities. However, the detailed contribution of individual glaciers, as well as the partitioning of uncertainty associated with this ensemble, have not yet been investigated. Here, we analyze the ISMIP6 results for high carbon emission scenarios, focusing on key glaciers around the Antarctic Ice Sheet, and we quantify their projected dynamic mass loss, defined here as mass loss through increased ice discharge into the ocean in response to changing oceanic conditions. We highlight glaciers contributing the most to sea level rise, as well as their vulnerability to changes in oceanic conditions. We then investigate the different sources of uncertainty and their relative role in projections, for the entire continent and for key individual glaciers. We show that, in addition to Thwaites and Pine Island glaciers in West Antarctica, Totten and Moscow University glaciers in East Antarctica present comparable future dynamic mass loss and high sensitivity to ice shelf basal melt. The overall uncertainty in additional dynamic mass loss in response to changing oceanic conditions, compared to a scenario with constant oceanic conditions, is dominated by the choice of ice sheet model, accounting for 52 % of the total uncertainty of the Antarctic dynamic mass loss in 2100. Its relative role for the most dynamic glaciers varies between 14 % for MacAyeal and Whillans ice streams and 56 % for Pine Island Glacier at the end of the century. The uncertainty associated with the choice of climate model increases over time and reaches 13 % of the uncertainty by 2100 for the Antarctic Ice Sheet but varies between 4 % for Thwaites Glacier and 53 % for Whillans Ice Stream. The uncertainty associated with the ice–climate interaction, which captures different treatments of oceanic forcings such as the choice of melt parameterization, its calibration, and simulated ice shelf geometries, accounts for 22 % of the uncertainty at the ice sheet scale but reaches 36 % and 39 % for Institute Ice Stream and Thwaites Glacier, respectively, by 2100. Overall, this study helps inform future research by highlighting the sectors of the ice sheet most vulnerable to oceanic warming over the 21st century and by quantifying the main sources of uncertainty.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2021

Heat Vulnerability Index Development and Mapping

Extreme heat is one of the leading causes of weather-related deaths in the U.S. Exposure to extreme heat will be exacerbated due to global climate change. It is thus crucial to design a key performance indicator, heat vulnerability index (HVI), to represent overall heat risk which can help identify susceptible regions and sub-populations in cities in the face of heatwaves. Most existing HVI tools only consider outdoor heat exposure. This paper developed an HVI web map tool incorporating both the outdoor and the indoor heat exposure, as well as population sensitivity and adaptation capability across census tracts in the city of Fresno, California. The tool can assist the planning of infrastructure and resources to reduce residents’ vulnerability to extreme heat events.

Xu, Yujie↗
DOE OSTI2023

Gramian-Based Characterization of Network Vulnerability to Nodal Impulse Inputs: Preprint

Impulsive inputs applied at influential nodes of a network system may result in undesirable behavior and degrade performance. This paper proposes the notion of vulnerability matrix (VM) to characterize the effect of impulse inputs on a network following either discrete-time or continuous-time dynamics. The VM describes the first-order effects of impulse inputs on edge flows and is based on the controllability Gramian. We provide explicit expressions for the elements of the vulnerability matrix for the class of directed line networks in terms of the edge weights. Simulations validate our results and highlight the utility of the proposed metric in capturing the transient effects of nodal impulse inputs on edge flows.

controllability Gramian↗
DOE OSTI2023

Liveness as a factor to evaluate memory vulnerability to soft errors

Memory, used by a computer to store data, is generally prone to faults, including permanent faults (i.e. relating to a lifetime of the memory hardware), and also transient faults (i.e. relating to some external cause) which are otherwise known as soft errors. Since soft errors can change the state of the data in the memory and thus cause errors in applications reading and processing the data, there is a desire to characterize the degree of vulnerability of the memory to soft errors. In particular, once the vulnerability for a particular memory to soft errors has been characterized, cost/reliability trade-offs can be determined, or soft error detection mechanisms (e.g. parity) may be selectively employed for the memory. In some cases, memory faults can be diagnosed by redundant execution and a diagnostic coverage may be determined.

Bramley, Richard Gavin↗
DOE OSTI2021

PV System Owner's Guide to Identifying, Assessing, and Addressing Weather Vulnerabilities, Risks, and Impacts

The report is designed to help federal facility managers, engineers, contractors, and consultants identify the most common PV system vulnerabilities that could lead from mild to catastrophic loss of PV systems during severe weather events. The guide helps users understand the type and severity of severe weather that can occur at any given location, and provides pre- and post-storm operations and maintenance (O&M) measures that can reduce the potential for damage to a PV system during a severe weather event and help speed the recovery of a PV system damaged during a storm. The guide emphasizes safety in responding to damage from severe weather events.

14 SOLAR ENERGY↗
DOE OSTI2026

Vulnerability Management for Electric Vehicle Supply Equipment

Vulnerability management for EVSE is a challenging undertaking with all the necessary stakeholders and devices that are interconnected, this presentation reviews the challenges and opportunities for conducting CVD for EVSE.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Cyber–physical vulnerability and resiliency analysis for DER integration: A review, challenges and research needs

High penetration of renewable and sustainable Distributed Energy Resources (DER) into the traditional distribution system requires a well-coordinated control strategy for the improvement of system-wide reliability and resiliency. Implementation of such a holistic control architecture requires a flexible, near real-time, and bi-directional communication framework for facilitating the participation of various agents in a multi-vendor heterogeneous smart grid. While the sustainability of energy generation is ensured, this exposes the smart grid to extrinsic cyber threats, and appropriate defense mechanism(s) must be deployed to guarantee continued reliability and resiliency of the power grid. Further, the comprehensive literature review presented in this paper discusses the latest trends in the DER control schemes with fast communication requirements and their accompanying cyber–physical vulnerabilities. These control schemes are compared and contrasted for various traits. A three-level DER system architecture has been depicted, facilitating the deployment of these control schemes. The current developments of standard communication protocols, key security mechanisms, and best practices along major standards and guidelines are explored. The impacts of different attack types with miscellaneous DER functions based on various control schemes and associated mitigation solutions are also provided. Finally, challenges and future research directions for limiting cyber-power susceptibility to enhance resiliency are summarized. The work presented here will help us enabling a cyber-resilient and sustainable smart electric grid.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

The Enzymatic Activity of Inosine 5'-Monophosphate Dehydrogenase May Not Be a Vulnerable Target for Staphylococcus aureus Infections

Many bacterial pathogens, including Staphylococcus aureus, require inosine 5'-monophosphate dehydrogenase (IMPDH) for infection, making this enzyme a promising new target for antibiotics. Although potent selective inhibitors of bacterial IMPDHs have been reported, relatively few have displayed antibacterial activity. Here we use structure-informed design to obtain inhibitors of S. aureus IMPDH (SaIMPDH) that have potent antibacterial activity (minimal inhibitory concentrations less than 2 μM) and low cytotoxicity in mammalian cells. The physicochemical properties of the most active compounds were within typical Lipinski/Veber space, suggesting that polarity is not a general requirement for achieving antibacterial activity. In this work, five compounds failed to display activity in mouse models of septicemia and abscess infection. Inhibitor-resistant S. aureus strains readily emerged in vitro. Resistance resulted from substitutions in the cofactor/inhibitor binding site of SaIMPDH, confirming on-target antibacterial activity. These mutations decreased the binding of all inhibitors tested, but also decreased catalytic activity. Nonetheless, the resistant strains had comparable virulence to wild-type bacteria. Surprisingly, strains expressing catalytically inactive SaIMPDH displayed only a mild virulence defect. Collectively these observations question the vulnerability of the enzymatic activity of SaIMPDH as a target for the treatment of S. aureus infections, suggesting other functions of this protein may be responsible for its role in infection.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2023

Incorporating Social Vulnerability Variables in Measures to Quantify Access to Opportunities

Herein this study quantifies access to travel opportunities to understand what societal factors are linked with local access and to identify communities with reduced access. We introduce a method to compare accessibility across all census tracts in the United States that can be used across geographically diverse communities ranging from sparsely to densely populated areas. This study considers six key opportunities which we consider essential for all communities (grocery stores, public schools, daycares, primary care doctors, pharmacies, and parks), and six additional destinations which can be viewed as a social safety net (homeless shelters, women’s shelters, food pantries, libraries, vocational schools, and banks). We quantify accessibility to these opportunities within a 15 min walk, transit trip, bicycle ride, and automobile drive for every census tract in the United States, and observe a decrease in vehicle miles traveled and vehicle ownership in tracts with increased walkability. Through analysis at the census tract level, this study incorporates variables of social vulnerability with these cumulative opportunity metrics to better understand diminished accessibility as attributed to social and racial inequities. As example findings, we find decreased access to financial services in communities with high minority and limited English speaking populations, no apparent change in access for childcare in communities with high percentages of single-parent families, and potentially increased or decreased access to women’s healthcare resources for Black women depending on the travel mode.

99 GENERAL AND MISCELLANEOUS↗