SEARCH · Search NASA

Results for “Vulnerability Management”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 109 records · Page 6

All sources NASA NTRS DOE OSTI

DOE OSTI2025

Environmental drivers of spatial variation in tropical forest canopy height: Insights from NASA’s GEDI spaceborne LiDAR

Forest canopy height is a fundamental ecosystem property—influencing patterns of forest carbon storage and forest ecosystem responses to climate variability and change. Previous studies have analyzed environmental drivers influencing spatial variation in canopy height at landscape-to-regional scales; however, far less is known about the environmental determinants underlying regional and global scale variation in forest canopy height. Using the canopy height metrics products from Global Ecosystem Dynamics Investigation (GEDI), a space-borne Light Detection and Ranging (LiDAR) instrument specifically designed to characterize forest structure, we analyze the environmental correlates of spatial variation of global tropical forest canopy height. Our study demonstrates that climate, topography, and soil properties account for 75% of the variation in tropical forest canopy height. Elevation, dry season length, and solar radiation are the most important drivers in determining canopy height both locally and regionally. These results emphasize the vulnerability of tropical forest structure to ongoing changes in the earth’s climate and provide a valuable empirical baseline for tropical forest management.

Science & Technology - Other Topics↗

DOE OSTI2021

Impact Analysis of Data Integrity Attacks on FACTS-based Wide-Area Voltage Control System

Energy management system (EMS) consists of several wide-area control applications that serve as a backbone for security, stability, and reliability of the power system. Wide-area voltage control system (WAVCS), one of the critical wide-area applications, operates in coordination with local Flexible AC Transmission System (FACTS) devices to provide voltage security and optimal management of active and reactive power resources. Since the WAVCS relies on wide-area communication and data sharing devices, possible cybersecurity vulnerabilities have to be addressed to ensure the closed-loop operation of WAVCS. In this paper, we present a methodology for performing an impact analysis of cyber-attacks in WAVCS cybersecurity. In particular, different types of data integrity attacks, such as malicious tripping, fault replay, and signal altering attacks, are considered, and detailed impact analysis is conducted in a testbed environment using the Kundur's four machine two-area system. For performing an impact analysis, the transient voltage stability of the sensitive bus voltage is studied, followed by the quantitative assessment and severity ranking using the voltage profile index. Our experimental evaluation reveals that the data integrity attacks on control signals exhibit a higher attack severity than on the measurement signals. Further, the severity of these attacks varies with nature (static or dynamic), location, and types of attacks.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2025

Mississippi's Strategic Resilience: A multi-systems approach to secure, reliable, and adaptable electric grid infrastructure

Mississippi’s electric grid resilience challenges are linked to an intersection of complex socioeconomic, ecological, technological, historical, and political challenges, exacerbated by increasing severe weather like flooding and tornado events. The state’s legacy of underinvestment in critical energy infrastructure, particularly in rural areas and vulnerable floodplains, have stressed an aging grid, creating long-lasting disruptions in electric service during weather-related outages. Effective emergency management and preparedness is further hampered by a lack of coordination across local, county, and regional scales. Using the TASTI-GRID platform and partnership with Oak Ridge National Laboratory (ORNL), Mississippi is developing a comprehensive regional resilience strategy to overcome energy security and reliability challenges, mitigating the impacts of natural hazards, and positioning Mississippi as a resilient and premier destination for residents, businesses, and economic development.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2026

Commercial integration of advanced nuclear energy with Artificial Intelligence (AI): Possible implications

The integration of advanced nuclear technologies (both fission and fusion) with artificial intelligence (AI) presents unprecedented national security challenges and opportunities. As fusion energy approaches commercial viability alongside advanced Small Modular Reactors (SMRs), their integration with AI and Artificial General Intelligence (AGI) systems could fundamentally transform the global energy and AI landscapes — two pillars of national security. This document briefly examines how AI could accelerate nuclear energy development and deployment while altering existing power structures, a lot could be done to deepen the discussions. Simultaneously, it observes how nuclear-powered AI may expedite advances toward AGI and beyond. These issues are deeply interconnected and thus need to be examined as a whole and more comprehensively than what’s being summarized here. For instance, AI-powered autonomous operation of nuclear facilities could reduce human error but introduce new cybersecurity vulnerabilities and uncertainties. Further investigation would also address how AI-enhanced nuclear technologies might complicate proliferation concerns through advanced fuel cycle management, nuclear materials production and safeguard. The strategic advantage gained by first entities achieving successful AI-nuclear integration could reshape global and national security framework. Timely analysis of these implications may be crucial for policymakers seeking to harness these technologies' benefits while effectively mitigating their potential risks.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗

DOE OSTI2020

Infrastructure and Metocean Technology

Research Problem: Changes in the ocean environment (i.e., mudslides or burial from subsea currents, strong weather events or natural fluctuations) have been linked to billions of dollars of impacts. These events can have a significant effect on the success and longevity of offshore infrastructure, as well as affect safety and cost during exploration and production activities.Research Approach: (1) Determine current state of knowledge regarding hazardous metocean and bathymetric conditions, and data availability regarding these conditions and historic events. (2) EY19 -Evaluate if Ml/AI model can be developed to better identify current hazardous metocean and bathymetric conditions. (3) EY 20 + -develop, train, and test ML/AI model to identify current conditions and forecast changes and vulnerability that may impact offshore infrastructure and operations. Benefit: Improved characterization of seabed related hazards in the offshore environment will help to manage and minimize costs and risks during drilling and production operations, and help prevent catastrophic incidents.

Duran, Rodrigo↗

DOE OSTI2022

Development of a vadose zone advanced monitoring system: Tools to assess groundwater vulnerability

Performing repeat pore-fluid sampling over long time-scales can provide valuable information on unsaturated zone contaminants and their potential flux to ground water. This information can be used to manage groundwater remedies and identify contaminants that need to be sequestered in the vadose zone to minimize flux to ground water. Pore-water samples are commonly used to obtain contaminant concentrations within the vadose zone, but existing methods are limited as they only provide a single sample at one location and time. The vadose zone advanced monitoring system (VZAMS) has been designed to integrate multiple technologies into a single down-borehole system that allows for sampling of pore fluids (liquid and gas) to provide information about contamination and hydraulic conditions at multiple depths (~0.3-m intervals) within a cased borehole. Testing has been completed at the laboratory scale to verify the sampling elements of VZAMS, including geochemical testing for representative contaminants known to exist at the Hanford Site, located in southeastern Washington State. Physical tests focused on the ability of the sampler to draw fluid under unsaturated conditions. Initial geochemical testing showed that the stainless steel material used with the porous cuff may affect the sampled concentrations of redox-sensitive contaminants under very dry conditions. Additional laboratory testing demonstrated that the VZAMS components are able to collect representative samples for substances of interest under expected field conditions. In this paper, the design and functionality of a novel instrument are demonstrated in support of subsequent testing in the field.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2023

Incremental Threshold Scheme Enabled IoT Group Key Management

Cyber landscape evolves rapidly. Internet of Things (IoT) and Edge Computing (EC) have rapidly become an integral part of the modern computing infrastructure. It is expected that there will be more than 50 billion active and connected IoT devices by 2025 [1]. Pervasive IoT/EC creates unprecedented opportunities bridging the gap between previously segregated cyber and physical spaces. However, this progress also brings along new security challenges. IoT devices typically have limited computation, communication, and storage resources. This leads to security architecture designs such as using symmetric keys for group communication. While secure and efficient in stable network settings, symmetric key solutions are ill-adapted for IoT's highly dynamic device mobility behavior and frequent group membership turnover. Whenever IoT members leave a group, the known symmetric keys cannot be made forgotten, posing a serious vulnerability. This leads to frequent re-groupings that require expensive re-authentication, key regeneration, and key redistribution in order to maintain IoT/EC security. We present a novel symmetric key management framework that integrate an Incremental Threshold Scheme (ITS) cryptographical function into communication protocol's key rotation mechanism to allow for secure and efficient symmetric key communication group member node revocation. This ITS-enabled key management framework alleviates the need of frequent and expensive re-grouping and re-keying needed by today's large and dynamic IoT/EC operations. We further applied this ITS-enabled key management framework to a distributed IoT/EC-integrated publish and subscribe framework for applicability validation.

Li, Mingyan↗

DOE OSTI2025

Establishing nationwide power system vulnerability index across US counties using interpretable machine learning

Power outages have become increasingly frequent, intense, and prolonged in the US due to climate change, aging electrical grids, and rising energy demand. However, largely due to the absence of granular spatiotemporal outage data, we lack data-driven evidence and analytics-based metrics to quantify power system vulnerability. This limitation has hindered the ability to effectively evaluate and address vulnerability to power outages in US communities. Here, in this work, we collected ∼179 million power outage records at 15-min intervals across 3022 US contiguous counties (96.15 % of the area) from 2014 to 2023. We developed a power system vulnerability assessment framework based on three dimensions (intensity, frequency, and duration) and applied interpretable machine learning models (XGBoost and SHAP) to compute Power System Vulnerability Index (PSVI) at the county level. Our analysis reveals a consistent increase in power system vulnerability across the US counties over the past decade. We identified 318 counties across 45 states as hotspots for high power system vulnerability, particularly in the West Coast (California and Washington), the East Coast (Florida and the Northeast area), the Great Lakes megalopolis (Chicago-Detroit metropolitan areas), and the Gulf of Mexico (Texas). Our heterogeneity analysis indicates that urban counties and those located along regional transmission boundaries tend to exhibit significantly higher vulnerability. Our results highlight the significance of the proposed PSVI for evaluating the vulnerability of communities to power outages. The findings underscore the widespread and pervasive impact of power outages across the country and offer crucial insights to support infrastructure operators, policymakers, and emergency managers in formulating policies and programs aimed at enhancing the resilience of the US power infrastructure.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

The Design and Evaluation of Zero Trust Architecture for Electric Vehicle Charging Infrastructure: EVs @ Scale Series on EV Charging Station Cybersecurity

Implementing a zero trust architecture can significantly bolster the security of electric vehicle (EV) charging infrastructure. EV charging infrastructure includes numerous networked interfaces, each of which can present potential vulnerabilities. When these vulnerabilities are exploited, they can compromise the entire system, leading to severe operational and security risks. Zero trust is a security model that operates on the principle of "never trust, always verify," which helps manage the attack surface and limit the scope of any potential compromises. Fundamentally, this model ensures that no entity, whether inside or outside the network, is trusted by default. The design principles of zero trust include continuous verification, strict deny-by-default access controls, and micro-segmentation. Continuous verification ensures that every request is thoroughly checked, regardless of its origin. Strict access controls enforce the principle of least privilege, allowing users and devices only the minimum necessary access to perform their functions. Micro-segmentation involves dividing the network into smaller, isolated segments to prevent lateral movement in case of a breach. In the context of EV charging infrastructure, zero trust can be implemented through various strategies. For example, multi-factor authentication (MFA) can be required for engineers to access the management interfaces and control systems of charging stations. Real-time monitoring and analysis of network traffic can help detect and respond to anomalies. Systems that do not need to communicate with each other can be micro-segmented to enhance security. All communications should adhere to predefined policies to be permitted. Additionally, encrypting communications can protect sensitive information exchanged between chargers and management systems. This paper presents a zero trust architecture specifically designed for EV charging infrastructure. Implementing zero trust not only mitigates risks but also builds a resilient infrastructure capable of withstanding and quickly recovering from cyber threats. The architecture addresses six defined security objectives. A comprehensive test plan is developed to assess the architecture against these objectives, and the results of the evaluation are reported. This approach is essential for maintaining the reliability and integrity of EV charging services in an increasingly interconnected and vulnerable digital landscape. This is the first in a planned series of papers exploring the implementation of zero trust in EV charging infrastructure. Each paper will delve into different aspects and applications of zero trust, highlighting how various work processes and requirements can lead to distinct architectural designs. These architectures will be tailored to address specific security challenges and operational needs within the EV charging ecosystem, ensuring a robust and adaptable security framework.

33 ADVANCED PROPULSION SYSTEMS↗

DOE OSTI2023

Community Resilience Indicator Analysis: Commonly Used Indicators from Peer-Reviewed Research (Updated for Research Published 2003-2021)

In 2017, FEMA’s National Integration Center (NIC) Technical Assistance (TA) Branch identified a need to establish a data-driven basis for prioritizing locations for TA investment and guiding local emergency management planning. To achieve this goal, FEMA tasked Argonne National Laboratory (Argonne) with identifying commonly used indicators of community resilience across the landscape of published peer-reviewed research. FEMA and Argonne completed the first Community Resilience Indicator Analysis (CRIA) in 2018 and repeated the process in 2022. The CRIA process begins with a literature review and cataloguing of published peer-reviewed assessment methodologies on social vulnerability and community resilience. The literature review findings are then filtered by inclusion criteria established by the CRIA research team to ensure the methodologies are: (1) Quantitative, (2) Data and methodology are publicly available, (3) Calculated at the county level or lower, (4) Examine generalized hazard risk (rather than a singular hazard), and (5) Focused on pre-disaster community conditions. After this, the research team identifies the commonly used indicators across these methodologies and selects the best data source for each indicator. Finally, the research team bins the data for visual display, conducts a correlation analysis and creates a composite index, the FEMA Community Resilience Index (FEMA CRI). In 2018, the CRIA identified eight resilience and vulnerability assessment methodologies and 20 commonly used indicators (indicators used in three or more of the eight methodologies). The FEMA CRI in 2018 was created from these 20 indicators and was produced for at the county level. The 2022 CRIA updated the literature review to expand the list of methodologies examined and followed the same process, resulting in an analysis of 14 methodologies published between 2003 and 2021 and 22 indicators identified as commonly used (indicators used in five or more of the 14 methodologies). In 2022, the research team produced the FEMA CRI at the county and the census tract levels. To make the CRIA data more accessible and more actionable, each individual indicator and the FEMA CRI is binned and included in FEMA’s Resilience Analysis and Planning Tool (RAPT). RAPT enables emergency managers and community partners to quickly visualize relative differences in potential resilience by county, tribe and census tract. By reviewing the data for each of these 22 indicators individually, emergency managers can gain insights for targeted outreach strategies, planning, mitigation investments and response and recovery operations. Communities, regional governments and others can use this data to better understand potential challenges to resilience. As the social science field of examining and validating indicators of resilience evolves, FEMA will update RAPT to provide emergency managers and community partners with additional data and tools to inform planning, mitigation, response and recovery. It is important to understand that the role of the emergency manager is not to change or to “improve” the data, but to plan appropriately for the community characteristics reflected in the data. These datasets are community characteristics that researchers have identified as important considerations for resilience. For example, people with disabilities may have greater challenges to be resilient to disasters. If a community has a high population of people with disabilities, the emergency manager(s) may need to create tailored preparedness outreach programs and strategies to ensure those residents have support if evacuation is necessary. Rather than label these indicators as an absolute measure of resilience, FEMA considers “potential challenges to resilience” a better frame to understand these indicators. Everyone is vulnerable to disasters. While scholars theorize that certain characteristics may make an individual or a household more socially vulnerable, the data does not reflect measures that individuals and/or communities have taken to address potential challenges, such as emergency management planning and outreach or household preparedness measures. To aid emergency managers in understanding how to use these indicators, calling them potential challenges to resilience supports a more positive and strategic application of the data in all phases of emergency management.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2025

Machine Learning Prediction of Tritium‐Helium Groundwater Ages in the Central Valley, California, USA

Abstract Groundwater ages provides insight into recharge rates, flow velocities, and vulnerability to contaminants. The ability to predict groundwater ages based on more accessible parameters via Machine Learning (ML) would advance our ability to guide sustainable management of groundwater resources. In this study, ML models were trained and tested on a large data set of tritium concentrations and tritium‐helium groundwater ages from the California Central Valley, a large groundwater basin with complex land use, irrigation, and water management practices. The ML models were trained on 63 features, including location, well construction information, landscape characteristics, and climate variables, water chemistry, and stable isotopes. The Bagging regressor method can accurately classify (F1‐score = 0.91) groundwater samples as either modern or pre‐modern whereas the accuracy of the ML prediction of continuous tritium‐helium groundwater ages is limited and explains only of the variability in this data set. In general, ML groundwater age prediction relies mostly on features related to (a) the source of groundwater recharge, (b) contaminant history, (c) aquifer materials, (d) well construction, and (e) geochemical reactions along flow paths.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2021

Evolution and Trends of Industrial Control System Cyber Incidents since 2017

The industrial control systems (ICSs) that manage our critical infrastructure are increasingly converging with corporate networks and the Internet as technology and businesses prioritize digital connectivity. These connections make them more vulnerable and available to malicious cyber actors who traditionally targeted the companies’ more public-facing information technology (IT) networks. This paper will review select publicly reported cyber incidents to highlight the continued and growing threat to ICS devices and operational technology (OT) environments. It will summarize the incident and when available, will provide information on the cyber actors, the vulnerabilities they exploited, and any publications the U.S. Government (USG) provided in response. Data belonging to the Department of Homeland Security (DHS) will be used to highlight quantitative trends concerning ICS incidents. This paper builds on “History of Industrial Control System Cyber Incidents” (Hemsley & Fisher 2018), a paper that highlighted select noteworthy threats and incidents to ICS systems up to 2017. This paper will similarly review select incidents occurring after the last previously reviewed incident, Triton/HatMan, December 2017, and will note ICS incident trends including IT/OT convergence and advances in cyber-threat actors’ capabilities in observed in the examined incidents.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2021

Microbial Community Shifts Reflect Losses of Native Soil Carbon with Pyrogenic and Fresh Organic Matter Additions and Are Greatest in Low-Carbon Soils

ABSTRACT Soil organic carbon (SOC) plays an important role in regulating global climate change, carbon and nutrient cycling in soils, and soil moisture. Organic matter (OM) additions to soils can affect the rate at which SOC is mineralized by microbes, with potentially important effects on SOC stocks. Understanding how pyrogenic organic matter (PyOM) affects the cycling of native SOC (nSOC) and the soil microbes responsible for these effects is important for fire-affected ecosystems as well as for biochar-amended systems. We used an incubation trial with five different soils from National Ecological Observatory Network sites across the United States and 13 C-labeled 350°C corn stover PyOM and fresh corn stover OM to trace nSOC-derived CO 2 emissions with and without PyOM and OM amendments. We used high-throughput sequencing of rRNA genes to characterize bacterial, archaeal, and fungal communities and their responses to PyOM and OM in soils that were previously stored at −80°C. We found that the effects of amendments on nSOC-derived CO 2 reflected the unamended soil C status, where relative increases in C mineralization were greatest in low-C soils. OM additions produced much greater effects on nSOC-CO 2 emissions than PyOM additions. Furthermore, the magnitude of the microbial community composition change mirrored the magnitude of increases in nSOC-CO 2 , indicating that a specific subset of microbes was likely responsible for the observed changes in nSOC mineralization. However, PyOM responders differed across soils and did not necessarily reflect a common “charosphere.” Overall, this study suggests that soils that already have low SOC may be particularly vulnerable to short-term increases in SOC loss with OM or PyOM additions. IMPORTANCE Soil organic matter (SOM) has an important role in global climate change, carbon and nutrient cycling in soils, and soil moisture dynamics. Understanding the processes that affect SOM stocks is important for managing these functions. Recently, understanding how fire-affected organic matter (or “pyrogenic” organic matter [PyOM]) affects existing SOM stocks has become increasingly important, due to both changing fire regimes and interest in “biochar,” pyrogenic organic matter that is produced intentionally for carbon management or as an agricultural soil amendment. We found that soils with less SOM were more prone to increased losses with PyOM (and fresh organic matter) additions and that soil microbial communities changed more in soils that also had greater SOM losses with PyOM additions. This suggests that soils that already have low SOM content may be particularly vulnerable to short-term increases in SOM loss and that a subset of the soil microbial community is likely responsible for these effects.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2026

Exploring Wildfire & Energy data toward State Prioritization Index (WESPI)

Energy infrastructure can both induce and suffer risks from wildfires ranging from direct damage to energy assets such as substations and power lines to Public Safety Power Shutoffs. Recent wildfire events underscore the need for data-driven approaches that help states and utilities proactively plan for wildfire risk. Existing national tools such as Federal Emergency Management Agency (FEMA)’s National Risk Index (NRI) are valuable for community hazard planning. However, they are less suited for energy infrastructure, as they emphasize population and building exposure rather than system vulnerabilities. In this paper, we explore relationships between energy and wildfire data and present a Wildfire-Energy State Prioritization Index (WESPI). Our methodology combines data from the US Forest Service’s Fire Simulation (FSIM) dataset with energy resilience metrics, historical fire incidents, and geospatial data on transmission lines and fire stations. Correlation analyses suggest that FSIM burn probability is more strongly associated with power outage metrics (ρ = 0.32) than NRI wildfire frequency, and counties with a greater density of fire stations experience more frequent, but less intense wildfires. We further leverage data for burn probability, transmission line density, and fire station density to develop a Wildfire-Energy State Prioritization Index (WESPI) to highlight counties where wildfire hazard, infrastructure exposure, and limited suppression capacity converge. The index provides a consistent, scalable framework for state energy offices and utilities to screen counties for vegetation management, optimization of outage management system deployment, and to inform wildfire mitigation plans.

Critical infrastructure↗

DOE OSTI2020

Cybersecurity Resiliency of Marine Renewable Energy Systems-Part 1: Identifying Cybersecurity Vulnerabilities and Determining Risk

Technology innovation, market demand, and the potential impacts of a changing climate are driving the marine renewable energy (MRE) industry to develop market-ready systems to provide low-carbon electricity for emerging, off-grid markets. The advanced operational and information technology devices used in MRE systems create a pathway for a cyber threat actor to gain unauthorized access to data or disrupt operation. To improve the resiliency of MRE systems as a predictable, affordable, and reliable source of energy from oceans and rivers, guidance was developed for an end users' organization that describes a framework for identifying and managing cybersecurity risk. The development of the cybersecurity guidance is based on standards described in the Risk Management Framework and Cybersecurity Framework developed by the National Institute of Standards and Technology (NIST). This paper is the first of a two-part series that describes an approach to determine the cybersecurity risk for MRE systems based on assessing potential cyber threats, identifying vulnerabilities (people, processes, and technology, including physical and operational environment), and evaluating the consequences a cyberattack would have on operation of the MRE system and impact on end users' mission and business objectives. MRE developers and stakeholders can use this approach to assess their current cybersecurity risk posture to incorporate appropriate cybersecurity controls to reduce the consequences and impacts from a cyberattack on MRE systems. This approach can be refined further as MRE systems are deployed and operational configurations are available.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2025

Soil Carbon Saturation: What Do We Really Know?

Managing soils to increase organic carbon storage presents a potential opportunity to mitigate and adapt to global change challenges, while providing numerous co-benefits and ecosystem services. However, soils differ widely in their potential for carbon sequestration, and knowledge of biophysical limits to carbon accumulation may aid in informing priority regions. Consequently, there is great interest in assessing whether soils exhibit a maximum capacity for storing organic carbon, particularly within organo–mineral associations given the finite nature of reactive minerals in a soil. While the concept of soil carbon saturation has existed for over 25 years, recent studies have argued for and against its importance. Here, we summarize the conceptual understanding of soil carbon saturation at both micro- and macro-scales, define key terminology, and address common concerns and misconceptions. We review methods used to quantify soil carbon saturation, highlighting the theory and potential caveats of each approach. Critically, we explore the utility of the principles of soil carbon saturation for informing carbon accumulation, vulnerability to loss, and representations in process-based models. We highlight key knowledge gaps and propose next steps for furthering our mechanistic understanding of soil carbon saturation and its implications for soil management.

Environmental sciences↗

DOE OSTI2022

EVSE Cybersecurity and Resilience

Consequence-driven Cybersecurity Analysis for Extreme Fast Charging Electric Vehicle Infrastructure Electric vehicle (EV) development and associated charging infrastructure are expected to advance rapidly. Thirty percent of all global vehicle sales may be EVs and hybrid EVs by 2025, and they will rely on increasingly sophisticated strategies for grid integration. Next-generation EV charging infrastructure is expected to include interconnected renewable resources, such as photovoltaic (PV) arrays and battery storage systems, along with grid-edge devices. Although distributed energy resources (DERs) are useful in several ways, such as peak shaving at high demand times and backup supply for added resilience, the integration of vehicle charging and DERs could create more avenues for cyberattack. Physical and/or remote access to EV charging station components, including charge ports, power electronics, controllers, and local generation (e.g., PV and energy storage) could be paths to cause power fluctuations, leading to altered operations at the charging station, escalated privileges to administrative systems, exfiltration of financial information (including personally identifiable information), and reduced grid stability. One compromised EV supply equipment component can open the door to a variety of exploitable vulnerabilities. Cloud computing and mobile application control have the potential to expand the threat surface to non-repudiation and firmware integrity challenges. Vendor clouds have access to hundreds of chargers, and if compromised, can scale the attack surface exponentially. The high power and voltage levels of xFC infrastructure (e.g., 400 kW at 1000- V DC) increase the hazards and ability to impact the grid and vehicles more than lower-power charging systems. Legacy communications systems and protocols could also put EV infrastructure at risk of cyberattacks requiring a robust patch management process. Communications networks link EVs and chargers to several stakeholders - including charging station operators, grid operators, vendors/manufacturers, and aggregators - who have both physical and network access to share information for control, monitoring, and analytics. Information in these networks that is vulnerable to compromise includes the state of charge, charging duration, payment information, electricity price, and load control. Analyzing and prioritizing these interconnections risks could help address cybersecurity related to data leakage and manipulation.

charging↗

DOE OSTI2025

BESS Digital Assurance, Supply Chain Risk Management, and Emerging Regulation Session Two

The TADA BESS Supply Chain Workshops are designed to equip participants with the knowledge and tools necessary to address the evolving challenges at the intersection of battery energy storage systems (BESS), cybersecurity, and supply chain vulnerabilities. The workshops emphasize the application of Cyber-Informed Engineering (CIE) principles using INL’s procurement guide and the CIE-BAT tool. Attendees will develop risk-based security strategies and actionable compliance roadmaps tailored to their BESS projects. Additionally, the program fosters a collaborative network of practitioners and provides guidance on navigating emerging regulatory requirements, including FEOC rules under the OBBB framework, to assess and enhance organizational readiness. A comprehensive exploration of BESS cybersecurity supply chain risks, systematic vendor risk assessment through the BESS Procurement Guide, and practical application of the INL SCRM Chatbot for enhanced supply chain resilience. This is Session 2 of 3. (Full Version)

25 - ENERGY STORAGE↗