Search NASA⌕ Search

SEARCH · Search NASA

Results for “critical infrastructures”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Data Analytics and Visualization of Energy Systems for Critical Infrastructure Insights

Modernization of energy systems including transportation facilities provides opportunities for increased efficiency, expansion of commerce and meeting industry and federal goals. A significant increase in electrical demand is projected to meet these needs, which concentrates at facilities such as airports. For example, Xcel Energy working with two airports in their service area recently published information projecting an up to fivefold increase in electricity demand in the next 25 years [1]. Concurrently, the US Government Accountability Office (GAO) recently surveyed 30 commercial service airports identifying more than 300 outages of more than 5 minutes between 2015 and 2022 [2]. Power, reliability, and resilience planning becomes more important to safely maintain operations and the flow of commerce with fewer energy carriers providing necessary energy to safely move passengers and goods. NREL proposes to develop methodologies to allow owners, utilities, and federal agencies to dynamically analyze, forecast, and manage energy loads at airports, focused upon maintaining the flow of commerce in an efficient, sustainable, and resilient way. To address these energy challenges, a suite of technologies and methodologies can be leveraged to validate concepts, inform design, de-risk solutions and optimize energy management during deployment. These technologies include digitalization of energy systems, microgrid methodologies, and related energy technologies for building and vehicle loads. [1] Electrifying Airport Ecosystems - https://www.enterprisemobility.com/content/dam/enterpriseholdings/marketing/innovation-in-mobility/vehicle-innovation/airport-electrification-study-full-report-2024.pdf [2] Airport Infrastructure: Selected Airport's Efforts to Enhance Electrical Resilience https://www.gao.gov/products/gao-23-105203.

critcal infrastructure↗
DOE OSTI2026

Hardware Aware Mitigation of Timing Side-Channel Vulnerabilities in Critical Infrastructure Software

Program runtime/timing attacks exploit variations in a program’s execution times to extract sensitive information from the program (e.g. encryption keys, sensitive variable data, intellectual property). State-of-the-art solutions to runtime sidechannel attacks attempt to balance the execution time of the sensitive code for different control flow paths to eliminate the timing leakage. However, during the mitigation process, most techniques do not consider the underlying hardware/device on which the target program is supposed to run on. This can lead to over-fixing (unnecessary extra operations), under-fixing (not solving the imbalance properly), and even failures. We propose DISARM, a joint hardware-software methodology (unlike any existing solution) for mitigating runtime side-channel vulnerabilities that utilizes timing values from real embedded devices to generate targeted software fixes. We implement DISARM to support C/C++/Java source codes and validate it across 22 standard benchmarks. DISARM outperforms state-of-the-art solutions such as PENDULUM and DifFuzzAR in terms of execution time overhead (up to −46%), code size overhead (up to −10%), and correctness (no failures) on five different embedded/edge devices.

Suha, Tasneem [University of Maine]↗
DOE OSTI2026

Assessing Energy Infrastructure Devices for Vulnerabilities

Industrial control systems prove to be vital to the health and security of the nation in our critical infrastructure. Critical infrastructure includes the most foundational systems to support modern civilization which includes water and wastewater systems, communications, and the electricity we use to name a few sectors. However, these devices' overall composition remains largely unknown and are untested from a cyber security perspective. As part of the Cyber Testing for Resilient Industrial Control Systems (CyTRICS) program, I analyzed one such energy infrastructure device to better understand how it functions, what hardware and software components are present within it, and assess it for security vulnerabilities. To achieve this, I reverse engineered binary files using Ghidra to understand system functionality and learned more about how to collaborate with other researchers on a shared Ghidra project. I learned more about how web sockets function and how to interact with them through Python to test if they are secure or not. This work led me to assess possible vulnerabilities in this device and provide a better understanding of its composition and function, which are essential to INL's mission of securing our nation's energy infrastructure.

99 - GENERAL AND MISCELLANEOUS↗
DOE OSTI2023

Implementation of an ICS Ransomware Testbed: Scenarios, Variants, and Evaluation Methods

Ransomware attacks on Industrial Control Systems (ICS) have emerged as a formidable threat to the United States’ critical infrastructure, eliciting grave concerns regarding national security. In March 2023, the FBI Internet Crime Complaint Center (IC3) unveiled its 2022 Internet Crime Report, highlighting a concerning 870 complaints related to ransomware impacting U.S. critical infrastructure. Of the country's 16 critical infrastructure sectors, 14 encountered at least one ransomware attack. Notably, while the Healthcare and Public Health sector suffered the most, reporting 210 attacks, sectors pivotal to ICS networks and governmental organizations were also targeted: the Defense Industrial Base reported 1 attack, Water and Wastewater Systems 3, Chemical 19, Energy 15, Government Facilities 115, and Critical Manufacturing 157. For instance, a ransomware attack on a major chemical company could jeopardize not only its production but also pose environmental risks should systems controlling hazardous materials be compromised. In 2022, three ransomware variants predominantly targeted U.S. critical infrastructure: HIVE, with 87 attacks; ALPHV/BlackCat, with 114; and LOCKBIT, with 149. Several cyber-attacks, such as the MOVEit data breach in May 2023 and the Colonial Pipeline ransomware attack in May 2021, have been so impactful that they commanded national attention. The DarkSide hacking group's assault on the Colonial Pipeline, initiated on May 6th, 2021, stands as one of the most substantial and publicly acknowledged cyber-attacks against U.S. critical infrastructure. The group exploited an exposed Virtual Private Network (VPN) password, paving the way for initial intrusion and subsequent data theft. A mere day later, DarkSide unleashed a ransomware attack that compromised vital accounting and billing systems, prompting an immediate shutdown of the pipeline to mitigate further ransomware proliferation across its network. This crisis spurred a robust response from the U.S. president and regulators, culminating in a national emergency declaration related to the pipeline shutdown on May 9th, 2021. This incident mirrors the 2017 NotPetya ransomware attack that significantly impacted the shipping giant Maersk, highlighting an urgent need for fortified cybersecurity across various industries. Future incidents, akin to the Colonial Pipeline attack, could potentially be mitigated—or entirely averted—should government agencies and private entities scrutinize system vulnerabilities, exploring various ransomware types and entry points. Proactive measures, such as conducting experiments on VPN accounts or auditing passwords to pinpoint duplicate usage across diverse systems and software, might illuminate feasible entry points and vulnerability zones within an organization's systems.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2022

Smart Microgrids

The Nation’s electrical power depends on one bulk power grid to support security and economic prosperity. According to the Department of Homeland Security’s Homeland Threat Assessment of 2020, the largest cyber threat to homeland security is potential disruption to critical infrastructure, including power grids. Critical infrastructure includes the physical and cyber systems which generate, transmit, and distribute electricity with an impact on economic security, public health, or safety. The surety of the Nation’s power grid is vital for providing essential services and would put the population at risk if disrupted. Power outages can have catastrophic consequences for critical organizations such as hospitals and military installations. Additionally, the current fossil-fuel dependent power grid is extremely fragile and vulnerable to overloads, storms that destroy power lines, and cyber-attacks.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2019

Demonstration of the Cybersecurity Framework through Real-world Cyber Attack

The Cybersecurity Framework (CSF) developed by the National Institute of Standards and Technology Cybersecurity, provides five concurrent and continuous functions to Identify, Protect, Detect, Respond, and Recover from cyber threats and vulnerabilities to buildings. Based on the core architecture and security best practices defined in the CSF guidelines, we developed the CSF webtools. The CSF webtools provide actionable functions that can be easily adopted by a facility operator to enhance their critical infrastructure security. The essence is captured in a set of “how-to” instructions for the facility operators to adopt, adapt, and apply to their critical infrastructure facilities. When considered together, these functions provide a high-level, strategic view of the lifecycle of an organization’s cybersecurity risk management. The CSF webtools provide an easy to follow set of cybersecurity best practices, policies, and procedures to improve the cybersecurity posture of our nation’s buildings and other critical infrastructures. The CSF webtools are also designed to facilitate communication of cybersecurity activities and outcomes across the organization from the executive to operations levels. Finally, the CSF webtools allow the critical infrastructure operators to assess the overall cybersecurity maturity and posture. The goal of this paper is to demonstrate the capabilities of the CSF webtools through an illustrative cyber-attack based on a real-world scenario.

cybersecurity framework, maturity model, critical ↗
DOE OSTI2021

CCE and Resilience Strategies

Consequence-driven Cyber-informed Engineering (CCE) is a methodology focused on securing the nation’s critical infrastructure systems. Developed at Idaho National Laboratory, CCE starts with the assumption that if a critical infrastructure system is targeted by a skilled and determined adversary, the targeted network can and will be penetrated. This think like the adversary approach provides critical infrastructure owners, operators, vendors and manufacturers with a disciplined methodology to: evaluate complex systems; determine what must be fully safeguarded; and apply proven engineering strategies to isolate and protect an industry’s most critical assets.

42 ENGINEERING↗
DOE OSTI2024

Demystifying Cyberattacks: Potential for Securing Energy Systems With Explainable AI : Preprint

Modernization of energy systems has led to in- creased interactions among multiple critical infrastructures and diverse stakeholders making the challenge of operational decision making more complex and at times beyond cognitive capabilities of human operators. The state-of-the-art machine learning and deep learning approaches show promise of supporting users with complex decision-making challenges, such as those occurring in our rapidly transforming cyber-physical energy systems. However, successful adoption of data-driven decision support technology for critical infrastructure will be dependent on the ability of these technologies to be trustworthy and contextually interpretable. In this paper, we investigate the feasibility of implementing XAI for interpretable detection of cyberattacks in the energy system. Leveraging a proof-of-concept simulation use case of detection of a data falsification attack on a photovoltaic system using XGBoost algorithm, we demonstrate how Local Interpretable Model-Agnostic Explanations (LIME), a flavor XAI approach, can help provide contextual and actionable interpretation of cyberattack detection.

artificial intelligence↗
DOE OSTI2023

Visualizing Comparisons of Bill of Materials

Protecting critical infrastructure from cyber attacks, natural disasters, and other disruptions is a priority of the U.S. Government. Critical infrastructure includes providing electricity to homes and businesses, supplying natural gas for heating, and producing renewable energy sources. A loss of these services, as seen in the Solarwinds supply chain attack in 2020 , Texas snowstorm of 2021, the Colonial Pipeline cyber incident of 2021, and the Washington power substation attacks in 2022 result in high costs to consumers, disruption of everyday life, and even death. To protect the infrastructure, we first have to know what equipment we are protecting. The complexity of distributed manufacturing and development coupled with the increasing prevalence of cyber and supply chain attacks necessitates a greater understanding of the hardware and software components that comprise equipment in critical infrastructure. When a vulnerability in a single software library can have disastrous consequences, it is vital to understand critical equipment and systems at a granular level. This need has led to increased energy around the development and incorporation of bill-of-materials (BOM) into existing asset management practices to aid in mitigating, and responding to future attacks \cite{noauthor_software_nodate}. While much of the current research is devoted to creating BOMs, it is equally important to develop methodologies for leveraging BOMs to answer questions, such as: How has my software changed? Are two pieces of equipment equivalent? Does this piece of equipment that just arrived match my historical information? In this work, we demonstrate how BOMs can be represented by graph structures. We then describe how these structures can be fed into a graph comparison algorithm to produce a novel interactive visualization that allows us to not only identify differences in BOMs, but show exactly where they are in the product.

Jones, Rebecca D.↗
DOE OSTI2024

Correlating Power Outage Spread with Infrastructure Interdependencies During Hurricanes

Power outages caused by extreme weather events, such as hurricanes, can significantly disrupt essential services and delay recovery efforts, underscoring the importance of enhancing our infrastructure's resilience. This study investigates the spread of power outages during hurricanes by analyzing the correlation between the network of critical infrastructure and outage propagation. We leveraged datasets from Hurricanemapping.com, the North American Energy Resilience Model Interdependency Analysis (NAERM-IA), and historical power outage data from the Oak Ridge National Laboratory (ORNL)'s EAGLE-I system. Our analysis reveals a consistent positive correlation between the extent of critical infrastructure components accessible within a certain number of steps (k-hop distance) from initial impact areas and the occurrence of power outages in broader regions. This insight suggests that understanding the interconnectedness among critical infrastructure elements is key to identifying areas indirectly affected by extreme weather events.

Bose, Avishek↗
DOE OSTI2024

Dover CoreGuard Ⓡ Cybersecurity Protections for Critical Energy Infrastructure Final Report

This report documents the status of technical objectives and activities for the Department of Energy (DOE) Small Business Innovation Research (SBIR) Phase I project, titled “Dover CoreGuard Ⓡ Cybersecurity Protections for Critical Energy Infrastructure” (Award No. DE-SC0023743), undertaken by Dover Microsystems, Inc., Wayland, MA. The Principal Investigator for this project was Dr. Stephen Papa, Dover’s Chief Technology Officer (CTO). The contract PoP (Period of Performance) is scheduled for completion by February 9, 2024.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2024

Addressing Consequence within Operational Risk (O.T. Gagnon III) 9-18-2024

Addressing Consequence within Operational Risk: Why threats and security are just not that important! When dealing with cyber or physical risk within any critical infrastructure (CI) environment, don’t concern yourself with vulnerabilities and threats, at least not at first! Also, don’t be overly fixated on “securing the systems” within the organization. The endeavor of tackling operational risk focused on consequences in any critical infrastructure environment to include the complex Aviation ecosystem is challenging even for the most resourced entity but can be advanced though a simplified approach: identifying, binning, and prioritizing the infrastructure environment. While no two entities within a single element of the 16 critical infrastructure sectors are exactly alike when it comes to risk, there is a basic process to move toward a greater understanding of operational risk through becoming more informed about the infrastructure environment in which the entity exists. The process starts with bringing internal and external stakeholders and subject matter experts together to analyze key areas such as Information Technology (IT) and Operational Technology (OT) components and points of convergence, analyzing internal and external cyber and physical dependencies, accounting for explosive growth in devices and wireless technology, and leveraging the contributions of people inside and outside the operational environment. Attaining a common understanding of the infrastructure environment as part of addressing consequences within operational risk is not easy to do or resource light, but the process outlined provides the framework to further any entity’s efforts in this space. When it comes to cyber risks, before an organization can consider vulnerabilities within and threats to its operations, it must first have a solid understanding of the consequences existing inside its infrastructure environment. Idaho National Lab’s Consequence-Driven, Cyber-Informed Engineering is offered as an example of this approach to effective and efficient cyber risk mitigation.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2026

Digital-Threat Bias and Psychological Distance: Barriers to Foundational Digital-Security Improvement

Modern life is held together by a web of digital dependencies that enable and provide delivery of critical services and functions—think the provision of utilities such as electricity and water, as well as our dependency on digital services for social and economic services (internet, communication, etc.). As this dependency grows, the complexity related to the delivery of these critical services increases as well. As complexity increases, the understanding of the risk and impact associated with potential disruption, degradation, or destruction—due to either malicious or non-malicious events of those digitally enabled functions—decreases. One potential explanation for the difficulty to 1) understand the risks faced and 2) address them appropriately and effectively is the abstractness and psychological distance assigned to “digital threat.” The complexity of these digitally enabled services creates a perceived complicatedness; as a result, digital threats are treated differently than similarly devasting (but more easily understood) kinetic or physical threats. How we categorize these threats also matters. Acts of cyber-enabled sabotage to critical infrastructure need to be defined as irregular warfare. By inadequately defining the threat, we compound the problem. Acknowledging this digital-threat bias is foundational to improving the ability to protect critical infrastructure. Using construal-level theory and psychological-distance concepts provides an intriguing starting point to address these issues, to reframe the challenges faced, and pursue more effective critical infrastructure security and defense policy.

29 - ENERGY PLANNING, POLICY AND ECONOMY↗