Search NASA⌕ Search

SEARCH · Search NASA

Results for “Vulnerability Management”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

SCA Tools - SCRM Value Add or Lossy Noise Machines

Software supply chain risk management (SCRM) depends upon accurate information regarding the software components that comprise any given software system. The collection of components included in a software package can be organized within a software bill of materials, or SBOM. SBOMs are ideally generated when the software components are put together, such as at compile time, but for many reasons that has not and is not always possible. For example, legacy or proprietary software packages often do not have SBOMs available to downstream consumers of that software. It’s not just end users that are affected, manufacturers themselves also must deal with this problem. To answer these questions, the market has seen the rise of several commercial software composition analysis (SCA) tools. These tools aim to peer into completed software systems, automatically identifying hidden software dependencies and looking up known vulnerabilities associated with those dependencies to enable end-users to enhance their cyber supply chain risk management processes. These tools are potentially a huge boon to end users of legacy and proprietary software – and a potential bane, depending on how accurate they are. This research asks that question – how accurate are currently available binary SCA tools – and provides answers to several other questions: What does it mean to be “accurate”? What limitations do the tools have in identifying common edge cases that take place in modern software development? Can they help you avoid a devastating supply chain attack, or is it all just noise? After researching SCA tools on the market, we identified three vendors that fit our use case and would provide analysis on compiled binaries. Using these tools, we submitted firmware for critical infrastructure devices for analysis and SBOM generation. The SBOM outputs were then cross referenced with SBOMs generated through manual analysis for comparison. In addition to the firmware samples, we also submitted edge case samples based off a popular open-source library that were specifically crafted to evaluate each tools’ ability to accurately identify components. These samples were customized to be consistent with modifications we have seen in modern software development as well as a couple that are representative of supply chain attacks.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Evaluating Basin-Scale Forest Adaptation Scenarios: Wildfire, Streamflow, Biomass, and Economic Recovery Synergies and Trade-Offs

Active forest management is applied in many parts of the western United States to reduce wildfire severity, mitigate vulnerability to drought and bark beetle mortality, and more recently, to increase snow retention and late-season streamflow. A rapidly warming climate accelerates the need for these restorative treatments, but the treatment priority among forest patches varies considerably. We simulated four treatment scenarios across the 3,450 km 2 Wenatchee River basin in eastern Washington, United States. We used a decision support tool (DST) to assess trade-offs and synergies within and among treatments on wildfire risk and smoke emissions, water yield and snow retention, biomass production, and economic return. Treatment scenarios emphasized prescribed burning ( BurnOnly ), biomass production ( MaxBiomass ), gap-based thinning to optimize water yield ( IdealWater ), and a principle-based restoration scenario ( RA1 ). Fire hazard, smoke emissions, and biomass production metrics were evaluated across scenarios using the Forest Vegetation Simulator, and water yields were modeled using the Distributed Hydrology Soil Vegetation Model. Simulations were summarized to both patch- (10 1 –10 2 ha) and subwatershed- (10 3 –10 4 ha) scales, and treatment effects were evaluated against an untreated baseline landscape. We used logic models to rank effect sizes by scenario across metrics along a continuum between −1 (no or weak effect) to +1 (large effect). All treatments produced benefits across one or more ecosystem services and led to synergistic benefits to water yield and wildfire hazard reduction. Tradeoffs among resource benefits were clear in wilderness where reliance on prescribed burning without mechanical treatment increased costs and eliminated the potential for biomass recovery. The BurnOnly scenario improved fire risk metrics and streamflow, but effect sizes were lower compared to other treatments. IdealWater showed the strongest benefits overall, demonstrating the ability to capture multiple resource benefits through spatially explicit thinning. Our study provides a framework for integrating strategic and tactical models that evaluate tradeoffs and synergies gained through varied management approaches. We demonstrate the utility of decision support modeling to enhance management synergies across large landscapes.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2021

Cyberbiosecurity and Public Health in the Age of COVID-19

Cyberbiosecurity, the aspect of biosecurity involving the digital representation of biological data, had already been emerging as a matter of public concern even prior to the onset of the COVID-19 pandemic. Key issues of concern include, among others, the privacy of patient data, the security of public health databases, the integrity of diagnostic test data, the integrity of public biological databases, the security implications of automated laboratory systems and the security of proprietary biological engineering advances. With the onset of the COVID-19 pandemic, and the importance of digital resources in combatting it, concern about the potential for cyber attacks by state-based or non-state actors has been elevated. To illuminate the challenges, we focus on the cyber vulnerabilities that need to be addressed in public health activities such as disease surveillance and outbreak management. In particular, we examine cyber issues raised by the accelerated pace of development for COVID mitigations, treatments, and vaccines.

cybersecurity, biosecurity↗
DOE OSTI2022

A Privacy-Preserving Strategy for the Trust Layer of the Energy Grid of Things Distributed Energy Resource Management System

Emergent from the shadows of the traditional grid flaws, the Smart Grid (SG) idea was born and led by government mandates toward cleaner energy production. The SG represents the next generation of electricity distribution systems that subsume recent technological innovations. It uses digital communication between its components and entities to attain more automation, self-sufficiency, and reliability. Unfortunately, this relatively new concept is not flawless; the intrinsic reliance on increased digital communication spreads open attack paths for adversaries. Therefore, finding solutions that address information exchange vulnerabilities has become imperative. The Energy Grid of Things (EGoT) is Portland State University’s (PSU’s) implementation of a Distributed Energy Resource Management System (DERMS). The EGoT DERMS requires access to customers’ information to achieve operational objectives. The system’s access to customers’ information needs to be restricted such that it does not violate customers’ privacy. Applying privacy protection models such as K-anonymity to EGoT DERMS sub-components safeguards that privacy. This thesis work proposes a strategy to ensure communication in the EGoT DERMS is privacy-preserving and secure. Specifically, it provides an approach to applying the Mondrian Algorithm to ensure data within the system excludes Personally Identifiable Information (PII) and provides means for securing the communication according to industry standards (IEEE 2030.5). Results suggest that the generalization hierarchy derived for the EGoT DERMS exhibits an Identical Generalization Hierarchy structure. Guarantees of sameness manifested in the test feeder topology would not hold in real-world scenarios. This thesis work proposes a strategy to ensure communication in the EGoT DERMS is privacy-preserving and secure. Specifically, it provides an approach to applying the Mondrian Algorithm to ensure data within the system excludes Personally Identifiable Information (PII) and provides means for securing the communication according to industry standards (IEEE 2030.5). Results suggest that the generalization hierarchy derived for the EGoT DERMS exhibits an Identical Generalization Hierarchy structure. Guarantees of sameness manifested in the test feeder topology would not hold in real-world scenarios.

Alsiad, Mohammed↗
DOE OSTI2020

System Health and Status Reporting is Used to Improve Infrastructure Systems at the Hanford Site - 20449

Reliable physical infrastructure systems are vital to completing the clean-up mission and the start-up and commissioning of new nuclear waste processing facilities at the Hanford Site. Key infrastructure systems at Hanford include water, sewer, and electrical utilities, roads, telecommunications/network systems, and fire systems. All of the infrastructure systems are non-nuclear, General Service systems that are being maintained under formal engineering configuration control and none are specifically credited in any documented safety analysis (DSA). Starting in calendar year 2017, the Hanford Site's infrastructure and services contractor started producing system health and status reports for a total of 15 critical infrastructure systems as means to get a better understanding of each system's health and how it could be improved to ensure better and more reliable service delivery. As the reporting, tracking, and use of the metrics has matured, the number of systems for which reports are being developed has been expanded to a total of 23. Each of the critical infrastructure systems are assigned primary and alternate design authorities that complete qualifications on each assigned system. The design authorities actively manage and maintain configuration control on each of their systems and track metrics associated with availability, maintenance (corrective and preventive), and configuration of the technical baseline. The metrics are based on the principles established in Chapter V of DOE O 420.1C, Facility Safety, [1] and have been tailored as appropriate to each of the key infrastructure systems. An overall assessment of system health is performed and documented on a routine basis (e.g., quarterly). Included in this documentation is a quantitative score for each of the metrics (i.e., availability, maintenance, configuration management) along with results of system walk-downs, description of any permanent design modifications, identification of new or emerging issues and vulnerabilities affecting the system, and an assessment by the design authority of actions necessary to improve the system health score. The overall status scores are calculated using a formula and based on a pre-determined grading scale, a color is assigned for simple presentation. The information gained from developing the reports is being used to (1) assist with making timely and better informed decisions through the use of solid technical bases that are increasing the overall reliability and capabilities of the Site's infrastructure systems as new expense and capital projects in the Reliability Projects Investment Portfolio (RPIP) are prioritized and executed; (2) feed the risk management program, and (3) integrate the technical content of Master Plans that describe the Site's needs for the system and the system's capabilities to meet those future needs. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2026

Enhancing SWAT with mechanistic plant hydraulics: development and application in the Hanjiang River Basin

Plant transpiration plays a critical role in global water and energy cycles, requiring better process understanding as climate change intensifies drought stress and alters plant responses. Most hydrological models such as the widely-used SWAT lack representation of plant hydraulics, the mechanistic processes controlling plant water regulation and transpiration. Here, this study developed SWAT-PHS by integrating a plant hydraulics scheme (PHS) into SWAT hydrological model, enabling explicit simulation of root water uptake, sap flow, storage and transpiration at 30-minute timescales for watershed-scale modeling. In the Hanjiang River Basin, SWAT-PHS mitigated overestimation of runoff during the rainy season and underestimation during the dry season, reducing the overall simulation error by 29% across the entire simulation period. The model can simulate reasonable plant water dynamics, including diurnal transpiration patterns and drought responses showing declining transpiration flux, hydraulic buffering through stem water storage, and depth-dependent root water uptake strategies. Sensitivity analysis shows that SWAT-PHS captured mechanistic relationships between plant hydraulic traits and transpiration, with root distribution and stem capacitance positively affecting annual transpiration while vulnerability parameters showed negative effects. This work provides a pathway for improving hydrologic modeling and water resource management by better representing plant water regulation under climate change and expected intensifying water stress conditions.

China↗
DOE OSTI2023

A critical review of cyber-physical security for building automation systems

Modern Building Automation Systems (BASs), as the brain that enable the smartness of a smart building, often require increased connectivity both among system components as well as with outside entities, such as the cloud, to enable low-cost remote management, optimized automation via outsourced cloud analytics, and increased building-grid integrations. As smart buildings move towards open communication technologies, providing access to BASs through the building's intranet, or even remotely through the Internet, has become a common practice. However, increased connectivity and accessibility come with increased cyber security threats. BASs were historically developed as closed environments with limited cyber-security considerations. As a result, BASs in many buildings are vulnerable to cyber-attacks that may cause adverse consequences, such as occupant discomfort, excessive energy usage, and unexpected equipment downtime. Therefore, there is a strong need to advance the state-of-the-art in cyber-physical security for BASs and provide practical solutions for attack mitigation in buildings. However, an inclusive and systematic review of BAS vulnerabilities, potential cyber-attacks with impact assessment, detection & defense approaches, and cyber resilient control strategies is currently lacking in the literature. This review paper fills the gap by providing a comprehensive up-to-date review of cyber-physical security for BASs at three levels in commercial buildings: management level, automation level, and field level. The general BASs vulnerabilities and protocol-specific vulnerabilities for the four dominant BAS protocols (i.e., BACnet, KNX, LonWorks, and Modbus) are reviewed, followed by a discussion on four attack targets and seven potential attack scenarios. Furthermore, the impact of cyber-attacks on BASs is summarized as signal corruption, signal delaying, and signal blocking. The typical cyber-attack detection and defense approaches are identified at the three levels. Cyber resilient control strategies for BASs under attack are categorized into passive and active resilient control schemes. Open challenges and future opportunities are finally discussed.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Declining Reservoir Reliability and Increasing Reservoir Vulnerability: Long-Term Observations Reveal Longer and More Severe Periods of Low Reservoir Storage for Major United States Reservoirs

Hydrological drought is a pervasive and reoccurring challenge in managing water resources. Reservoirs are critical for lessening the impacts of drought on water available for many uses. We use a novel and generalized approach to identify periods of unusually low reservoir storage—via comparisons to operational rule curves and historical patterns—to investigate how droughts affect storage in 250 reservoirs across the conterminous U.S. (CONUS). We find that the maximum amount of water stored in reservoirs is decreasing, and that periods of unusually low storage are becoming longer, more severe, and more variable in (a) western and central CONUS reservoirs, and (b) reservoirs with primarily over-year storage. Results suggest that reservoir storage has become less reliable and more vulnerable to larger deviations from desired storage patterns. These changes have coincided with ongoing shifts to the hydroclimate of CONUS, and with sedimentation further reducing available reservoir storage.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2023

Innovative Strategies for Long-Term Monitoring of Complex Groundwater Plumes at DOE’s Legacy Sites (Workshop Report)

Most remaining Department of Energy (DOE) sites will require extended periods of institutional control, especially at complex groundwater sites where attenuation-based strategies have been implemented to facilitate closure. The current practice of monitoring—obtaining and analyzing contaminant concentration in groundwater samples at numerous wells—will account for a large portion of the projected life-cycle at these DOE sites unless a new approach is adopted. State-of-the-art technologies are being developed, including in situ sensors, geophysics, radiation mapping, numerical modeling and AI/ML. These technologies can optimize monitoring strategies in space and time, provide spatially extensive information at vulnerable regions and/or provide more continuous monitoring at lower cost. As part of DOE’s Office of Environmental Management (DOE-EM’s) efforts to advance long-term monitoring systems, an in-person/virtual hybrid workshop was hosted by Savannah River National Laboratory (SRNL) on January 24 and 25, 2023, in Augusta, Georgia. Because DOE-EM’s complex sites will eventually be transferred to DOE’s Office of Legacy Management (DOE-LM), representatives of DOE-LM were important participants in the workshop. The purpose of the workshop was to identify challenges and opportunities for deploying advanced technologies for long-term monitoring at DOE sites. The key questions during the workshop were: 1) the regulatory acceptance of replacing a process that traditionally has used laboratory sampling and analysis of groundwater samples, and 2) the application of this strategy to the southwestern arid sites that include many of the remaining DOE-EM and DOE-LM complex groundwater plumes. Characteristics common to most arid sites present both limitations and opportunities for advanced technologies. DOE-EM has funded a National Laboratory team from SRNL, Lawrence Berkeley National Laboratory (LBNL), and Pacific Northwest National Laboratory (PNNL) to establish the overarching framework of long-term monitoring by systematically combining advanced hardware and software technologies. This project is titled “Advanced Long-Term Environmental Monitoring Systems (ALTEMIS)” and is sponsored by the DOE-EM Technology Development Program. The multi-laboratory team is currently developing and testing innovative monitoring strategies, including the use of in situ groundwater sensors, geophysics, drone/satellite-based remote sensing, reactive transport modeling, and artificial intelligence/machine learning (AI/ML). The project’s demonstration testbed is at the Savannah River Site (SRS) F-Area Seepage Basins, where a well-characterized complex groundwater plume composed of uranium and other radionuclides is in the latter stages of remediation. The workshop included more than 70 participants, presentations, a field visit to F-Area, breakout working groups, and large group discussion. Participants developed recommendations on five topics: in situ sensors, spatially integrative tools, challenges to regulatory acceptance, AI/ML strategies, and transitioning sites to DOE-LM.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2025

Infrastructure-Based Cooperative Perception at a Traffic Intersection: Overview and Challenges

Traffic intersections are crucial and challenging nodes in transportation networks where multiple lanes of vehicles and pedestrians converge. About one-quarter of traffic fatalities and about one-half of all traffic injuries in the United States happen at traffic intersections . Effective management of these intersections is important to ensure safety and efficiency of all users - vehicles, pedestrians, cyclists, and vulnerable road users (VRUs). With advancements in sensor perception technologies such as radar, light detection and ranging (lidar), and cameras, traffic intersections are developing into dynamic and data-rich environments. By using these data to create a real-time digital twin, we can enable real-time data-driven decision making and a range of applications such as sharing perception information to connected vehicles (CVs) and connected autonomous vehicles (CAVs), safety affirmative signaling, and curb optimizing to improve efficiency and enhance safety.This paper presents an overview of the concept and examines the challenges involved in implementing an infrastructure-based cooperative perception engine at a traffic intersection. In addition to outlining the physical components, this study also addresses important challenges involved in a multi-sensor system. We present results from deploying the National Renewable Energy Laboratory's (NREL's) Infrastructure Perception and Control (IPC) mobile trailer at a traffic intersection in the city of Colorado Springs, Colorado, USA that employed multiple radars and lidars to capture the data. This study provides necessary practical learning for the Cooperative Driving Automation (CDA) and traffic engineering communities for next-generation infrastructure-based cooperative perception that promises improvements in signal control for optimized traffic flow, among other applications, and documents findings for ongoing research and development efforts in other areas.

ADVANCED PROPULSION SYSTEMS,MATHEMATICS AND COMPUT↗
DOE OSTI2026

Persistence and potential of soil organic carbon in nature‐based climate solutions: A review of managed disturbances

Societal Impact Statement Implementing nature-based climate solutions is important for mitigating climate change, which is a global issue, but requires local adjustments in management practices. Using the association between soil carbon and minerals as a proxy for carbon persistence, we evaluated the effect of different management regimes on soil carbon sequestration and loss. We identified areas where management practices that increase carbon inputs should be prioritized and areas where management should focus on avoiding severe disturbances. Using this storage-potential-and-persistence framework to identify how to increase or maintain soil organic carbon storage locally will increase the effectiveness of nature-based climate solutions globally. Summary Increasing soil organic carbon storage could reduce the pace of climate change, but the longevity of this nature-based climate solution depends on the persistence of carbon in soils, not just the input rates into soils. We apply a framework for considering how soil carbon persistence—namely, via the association with minerals—sheds light on soil carbon sequestration. We review how management of disturbances, such as prescribed burning, forestry, and grazing, can change soil carbon storage, persistence, and potential. Past work demonstrated that management of disturbances can sequester soil carbon, but it remains unclear how the potential stabilization of that accrual and vulnerability to loss varies across disturbance types and geographies. We found that there is substantial geographical heterogeneity in the overlap among estimates of carbon accrual, disturbance occurrence, and potential stabilization: Fire-prone grasslands and intensively grazed rangelands occur in areas estimated to have high potential to store mineral-associated organic carbon, and studies also find that adjusted fire and grazing can promote mineral-associated organic carbon. Plantation forestry and burned area span large regions where particulate organic matter is the dominant form, and studies find that particulate organic carbon is disproportionately lost following intense wildfires and forest harvests. Thus, areas with high mineral-associated organic carbon deficits should be prioritized for practices that increase carbon inputs; whereas areas with high proportions of particulate organic carbon should be prioritized for practices that help to avoid severe disturbances. Taken together, the distribution of and changes in persistence mechanisms shed light on the durability of nature-based climate solutions.

fire↗
DOE OSTI2026

Mechanical characterization of Bi-2212 composite winding pack samples for high-field superconducting magnet design

Bi₂Sr₂CaCu₂O8−x (Bi-2212) multi-filament round wire is a high-temperature superconductor (HTS) capable of carrying high transport currents, which makes it suitable for high-field magnet applications. However, its weak Ag–Mg sheath leaves it vulnerable to mechanical stress, posing challenges for high-field magnet design. To better understand and improve mechanical stress management in Bi-2212 winding packs, we conducted an experimental study evaluating the axial stress–strain behavior of five winding pack configurations with varying insulation materials, reinforcement strategies, and construction quality. Using uniaxial tensile testing at 77 K, we measured Young’s modulus and Poisson’s ratio for each composition. Our results show that pure alumina braid insulation and co-wind reinforcements significantly enhance stiffness compared to aluminosilicate braids, with more than 2.5 times increased winding pack Young’s modulus. Rule of mixtures analysis further quantified the contribution of non-wire composite components to overall stiffness. These findings highlight the critical role of insulation material selection and reinforcement design in optimizing Bi-2212 coil performance under stress, providing a foundation for improved mechanical models and more reliable high-field HTS magnet designs.

Bi-2212 magnet↗
DOE OSTI2024

Lamellar: A Rust-based Asynchronous Tasking and PGAS Runtime for High Performance Computing

Cybersecurity is one of the largest concerns in modern computing, impacting and dictating how governments, private corporations, and individuals interact with and live in an increasingly digital world. The NSA has recently released a memo [ 1] on “Software Memory Safety” where they highlight that both Microsoft and Google have stated around 70% of software vulnerabilities were due to memory safety issues. Although languages such as C and C++ provide freedom and flexibility with memory management, guaran- teeing safety falls mostly on the developer. The NSA recommends using “memory safe” languages whenever possible. In this paper we introduce Lamellar, an asynchronous tasking and PGAS HPC runtime written in Rust, one such "memory safe" language. We describe the entire Lamellar stack, from network interfaces to high- level abstractions such as distributed LamellarArrays and Active Messages. We conclude by showing comparable performance to legacy PGAS runtimes (e.g. OpenSHMEM) on a subset of the BALE kernel suite while maintaining strong memory safety principles.

HPC Software Systems, Rust Programming Language, P↗
DOE OSTI2025

Templates for Risk Informed Assurance with Curvature Embeddings (TRACE)

We investigate recovery of geometric structure from networks embedded in manifolds with spatially varying curvature, extending the constant-curvature framework of Lubold et al. (2023). Our work supports cascade risk assessment in critical infrastructure through the Templates for Risk-informed Assurance with Curvature Embeddings (TRACE) framework. Simulations on a bi-modal Gaussian surface show that constant-curvature methods yield weighted averages shaped by clique patterns, while hierarchical clustering identifies distinct regimes. Localized estimation, however, reveals boundary contamination in transitional regions. To address heterogeneity, we develop distance metrics for graphs with edge and node features, proving their metric validity, and validate them via deterministic graph generation from canonical tilings. We further propose a diffusion-based anomaly detection approach that treats networks as glued manifolds, using curvature discontinuities to detect structural anomalies. Employing the carré-du-champ operator and scalar curvature, we achieve robust anomaly discrimination, demonstrated on the Singapore Water Treatment (SWaT) dataset with joint network-traffic and sensor features. Integration with TRACE reveals how curvature shapes cascade dynamics: positive curvature impedes, while negative curvature accelerates propagation. This geometric perspective provides interpretable risk metrics and visualization tools for critical infrastructure managers. While full validation remains ongoing, our contributions establish a rigorous foundation for geometric analysis of network resilience and cascade vulnerability.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

A Risk Assessment Framework for Cyber-Physical Security in Distribution Grids with Grid-Edge DERs

Integration of inverter-based distributed energy resources (DERs) is reshaping the landscape of distribution grids to fulfill the socioeconomic, environmental, and sustainability goals. Addressing the technological challenges of DER grid integration requires an adaptive communication layer for efficient DER management and control. This transition has given rise to a cyberphysical system (CPS) architecture within the distribution system, causing new vulnerabilities for cyberphysical attacks. To better address potential threats, this paper presents a comprehensive risk assessment framework for cyberphysical security in distribution grids with grid-edge DERs. The framework incorporates a detailed CPS model accounting for dynamic DER characteristics within the distribution grid. It identifies vulnerabilities in DER communication systems, models attack scenarios, and addresses communication latency crucial for inverter control timescales. Subsequently, the quantification of attack impacts employs an attack probability model including both the vulnerability and criticality of cyber components. The proposed risk assessment framework was validated through testing on the modified IEEE 13-node and 123-node test feeders.

cyberattack↗
DOE OSTI2022

Vulnerability Research Development Program Guide v.1

SAND2021-15515 O The Vulnerability Research Development Program (VRDP) Guide is a training program developed to help general purpose computer science staff become independently capable vulnerability researchers. VRDP Guide is both a course description and curriculum for the program. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Salim, Nasser↗
DOE OSTI2025

Cybersecurity and Infrastructure Security Agency (CISA) Infrastructure Security Division (ISD) Assessment Prioritization Project

The Cybersecurity and Infrastructure Security Agency’s Infrastructure Security Division (CISA ISD) manages a diverse portfolio of assessments across the nation’s critical infrastructure sectors. These assessments—ranging in type, scope, and complexity—are essential for identifying vulnerabilities and strengthening national security. However, the wide variation in assessment offerings and the increasing demand for limited resources have highlighted the need for a transparent, structured approach to prioritizing assessment activities. To address this challenge, CISA ISD partnered with Lawrence Livermore National Laboratory (LLNL) to review current assessment methodologies, analyze existing prioritization practices, and develop a comprehensive, national-security-focused prioritization framework. This report summarizes the project’s approach, key findings, and actionable recommendations for enhancing ISD’s assessment program.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Supply Chain Risk Management: Data Structuring

Supply chain risk management (SCRM) is an area of research that addresses both logistics concepts to maximize efficiency, reliability, and revenue as well as risk features, such as potential weak points, break points, and vulnerabilities within the supply chain. SCRM is used to find risks introduced at each node in a supply chain and how these risks can impact a company’s products, individuals, customers, and reputation. SCRM is a relatively new field, so standardized processes including data structuring are not fully documented. This paper explains the importance of a standard data structuring methodology and how it can enhance current SCRM efforts. Data ingest, structuring, and analysis are predominantly managed by humans. Automating some of the less complex steps can positively impact SCRM by allowing human analysts to focus on more strategic analyses. Types of data to be collected and structured are collected via publicly available information related to hardware, software, and corporate entities. After the data has been collected, the information is formatted in a specific manner, conforming to a schema, to allow for more effective and efficient ingest for further analysis. This paper outlines data structures used by Pacific Northwest National Laboratory for SCRM research and analysis purposes. These structures have been used for hundreds of analyses and have been successful in developing a common baseline. Data structuring is one of the first steps in data standardization, which will further mature and enhance the SCRM research area.

supply chain risk management, data structuring, re↗