Search NASA⌕ Search

SEARCH · Search NASA

Results for “Vulnerability Management”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 145 records · Page 8
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

A critical review of cyber-physical security for building automation systems

Modern Building Automation Systems (BASs), as the brain that enable the smartness of a smart building, often require increased connectivity both among system components as well as with outside entities, such as the cloud, to enable low-cost remote management, optimized automation via outsourced cloud analytics, and increased building-grid integrations. As smart buildings move towards open communication technologies, providing access to BASs through the building's intranet, or even remotely through the Internet, has become a common practice. However, increased connectivity and accessibility come with increased cyber security threats. BASs were historically developed as closed environments with limited cyber-security considerations. As a result, BASs in many buildings are vulnerable to cyber-attacks that may cause adverse consequences, such as occupant discomfort, excessive energy usage, and unexpected equipment downtime. Therefore, there is a strong need to advance the state-of-the-art in cyber-physical security for BASs and provide practical solutions for attack mitigation in buildings. However, an inclusive and systematic review of BAS vulnerabilities, potential cyber-attacks with impact assessment, detection & defense approaches, and cyber resilient control strategies is currently lacking in the literature. This review paper fills the gap by providing a comprehensive up-to-date review of cyber-physical security for BASs at three levels in commercial buildings: management level, automation level, and field level. The general BASs vulnerabilities and protocol-specific vulnerabilities for the four dominant BAS protocols (i.e., BACnet, KNX, LonWorks, and Modbus) are reviewed, followed by a discussion on four attack targets and seven potential attack scenarios. Furthermore, the impact of cyber-attacks on BASs is summarized as signal corruption, signal delaying, and signal blocking. The typical cyber-attack detection and defense approaches are identified at the three levels. Cyber resilient control strategies for BASs under attack are categorized into passive and active resilient control schemes. Open challenges and future opportunities are finally discussed.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Declining Reservoir Reliability and Increasing Reservoir Vulnerability: Long-Term Observations Reveal Longer and More Severe Periods of Low Reservoir Storage for Major United States Reservoirs

Hydrological drought is a pervasive and reoccurring challenge in managing water resources. Reservoirs are critical for lessening the impacts of drought on water available for many uses. We use a novel and generalized approach to identify periods of unusually low reservoir storage—via comparisons to operational rule curves and historical patterns—to investigate how droughts affect storage in 250 reservoirs across the conterminous U.S. (CONUS). We find that the maximum amount of water stored in reservoirs is decreasing, and that periods of unusually low storage are becoming longer, more severe, and more variable in (a) western and central CONUS reservoirs, and (b) reservoirs with primarily over-year storage. Results suggest that reservoir storage has become less reliable and more vulnerable to larger deviations from desired storage patterns. These changes have coincided with ongoing shifts to the hydroclimate of CONUS, and with sedimentation further reducing available reservoir storage.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2023

Innovative Strategies for Long-Term Monitoring of Complex Groundwater Plumes at DOE’s Legacy Sites (Workshop Report)

Most remaining Department of Energy (DOE) sites will require extended periods of institutional control, especially at complex groundwater sites where attenuation-based strategies have been implemented to facilitate closure. The current practice of monitoring—obtaining and analyzing contaminant concentration in groundwater samples at numerous wells—will account for a large portion of the projected life-cycle at these DOE sites unless a new approach is adopted. State-of-the-art technologies are being developed, including in situ sensors, geophysics, radiation mapping, numerical modeling and AI/ML. These technologies can optimize monitoring strategies in space and time, provide spatially extensive information at vulnerable regions and/or provide more continuous monitoring at lower cost. As part of DOE’s Office of Environmental Management (DOE-EM’s) efforts to advance long-term monitoring systems, an in-person/virtual hybrid workshop was hosted by Savannah River National Laboratory (SRNL) on January 24 and 25, 2023, in Augusta, Georgia. Because DOE-EM’s complex sites will eventually be transferred to DOE’s Office of Legacy Management (DOE-LM), representatives of DOE-LM were important participants in the workshop. The purpose of the workshop was to identify challenges and opportunities for deploying advanced technologies for long-term monitoring at DOE sites. The key questions during the workshop were: 1) the regulatory acceptance of replacing a process that traditionally has used laboratory sampling and analysis of groundwater samples, and 2) the application of this strategy to the southwestern arid sites that include many of the remaining DOE-EM and DOE-LM complex groundwater plumes. Characteristics common to most arid sites present both limitations and opportunities for advanced technologies. DOE-EM has funded a National Laboratory team from SRNL, Lawrence Berkeley National Laboratory (LBNL), and Pacific Northwest National Laboratory (PNNL) to establish the overarching framework of long-term monitoring by systematically combining advanced hardware and software technologies. This project is titled “Advanced Long-Term Environmental Monitoring Systems (ALTEMIS)” and is sponsored by the DOE-EM Technology Development Program. The multi-laboratory team is currently developing and testing innovative monitoring strategies, including the use of in situ groundwater sensors, geophysics, drone/satellite-based remote sensing, reactive transport modeling, and artificial intelligence/machine learning (AI/ML). The project’s demonstration testbed is at the Savannah River Site (SRS) F-Area Seepage Basins, where a well-characterized complex groundwater plume composed of uranium and other radionuclides is in the latter stages of remediation. The workshop included more than 70 participants, presentations, a field visit to F-Area, breakout working groups, and large group discussion. Participants developed recommendations on five topics: in situ sensors, spatially integrative tools, challenges to regulatory acceptance, AI/ML strategies, and transitioning sites to DOE-LM.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
NASA NTRS1989

SPAN security policies and guidelines

A guide is provided to system security with emphasis on requirements and guidelines that are necessary to maintain an acceptable level of security on the network. To have security for the network, each node on the network must be secure. Therefore, each system manager, must strictly adhere to the requirements and must consider implementing the guidelines discussed. There are areas of vulnerability within the operating system that may not be addressed. However, when a requirement or guideline is discussed, implementation techniques are included. Information related to computer and data security is discussed to provide information on implementation options. The information is presented as it relates to a VAX computer environment.

Sisson, Patricia L.↗
DOE OSTI2025

Infrastructure-Based Cooperative Perception at a Traffic Intersection: Overview and Challenges

Traffic intersections are crucial and challenging nodes in transportation networks where multiple lanes of vehicles and pedestrians converge. About one-quarter of traffic fatalities and about one-half of all traffic injuries in the United States happen at traffic intersections . Effective management of these intersections is important to ensure safety and efficiency of all users - vehicles, pedestrians, cyclists, and vulnerable road users (VRUs). With advancements in sensor perception technologies such as radar, light detection and ranging (lidar), and cameras, traffic intersections are developing into dynamic and data-rich environments. By using these data to create a real-time digital twin, we can enable real-time data-driven decision making and a range of applications such as sharing perception information to connected vehicles (CVs) and connected autonomous vehicles (CAVs), safety affirmative signaling, and curb optimizing to improve efficiency and enhance safety.This paper presents an overview of the concept and examines the challenges involved in implementing an infrastructure-based cooperative perception engine at a traffic intersection. In addition to outlining the physical components, this study also addresses important challenges involved in a multi-sensor system. We present results from deploying the National Renewable Energy Laboratory's (NREL's) Infrastructure Perception and Control (IPC) mobile trailer at a traffic intersection in the city of Colorado Springs, Colorado, USA that employed multiple radars and lidars to capture the data. This study provides necessary practical learning for the Cooperative Driving Automation (CDA) and traffic engineering communities for next-generation infrastructure-based cooperative perception that promises improvements in signal control for optimized traffic flow, among other applications, and documents findings for ongoing research and development efforts in other areas.

ADVANCED PROPULSION SYSTEMS,MATHEMATICS AND COMPUT↗
DOE OSTI2026

Persistence and potential of soil organic carbon in nature‐based climate solutions: A review of managed disturbances

Societal Impact Statement Implementing nature-based climate solutions is important for mitigating climate change, which is a global issue, but requires local adjustments in management practices. Using the association between soil carbon and minerals as a proxy for carbon persistence, we evaluated the effect of different management regimes on soil carbon sequestration and loss. We identified areas where management practices that increase carbon inputs should be prioritized and areas where management should focus on avoiding severe disturbances. Using this storage-potential-and-persistence framework to identify how to increase or maintain soil organic carbon storage locally will increase the effectiveness of nature-based climate solutions globally. Summary Increasing soil organic carbon storage could reduce the pace of climate change, but the longevity of this nature-based climate solution depends on the persistence of carbon in soils, not just the input rates into soils. We apply a framework for considering how soil carbon persistence—namely, via the association with minerals—sheds light on soil carbon sequestration. We review how management of disturbances, such as prescribed burning, forestry, and grazing, can change soil carbon storage, persistence, and potential. Past work demonstrated that management of disturbances can sequester soil carbon, but it remains unclear how the potential stabilization of that accrual and vulnerability to loss varies across disturbance types and geographies. We found that there is substantial geographical heterogeneity in the overlap among estimates of carbon accrual, disturbance occurrence, and potential stabilization: Fire-prone grasslands and intensively grazed rangelands occur in areas estimated to have high potential to store mineral-associated organic carbon, and studies also find that adjusted fire and grazing can promote mineral-associated organic carbon. Plantation forestry and burned area span large regions where particulate organic matter is the dominant form, and studies find that particulate organic carbon is disproportionately lost following intense wildfires and forest harvests. Thus, areas with high mineral-associated organic carbon deficits should be prioritized for practices that increase carbon inputs; whereas areas with high proportions of particulate organic carbon should be prioritized for practices that help to avoid severe disturbances. Taken together, the distribution of and changes in persistence mechanisms shed light on the durability of nature-based climate solutions.

fire↗
DOE OSTI2026

Mechanical characterization of Bi-2212 composite winding pack samples for high-field superconducting magnet design

Bi₂Sr₂CaCu₂O8−x (Bi-2212) multi-filament round wire is a high-temperature superconductor (HTS) capable of carrying high transport currents, which makes it suitable for high-field magnet applications. However, its weak Ag–Mg sheath leaves it vulnerable to mechanical stress, posing challenges for high-field magnet design. To better understand and improve mechanical stress management in Bi-2212 winding packs, we conducted an experimental study evaluating the axial stress–strain behavior of five winding pack configurations with varying insulation materials, reinforcement strategies, and construction quality. Using uniaxial tensile testing at 77 K, we measured Young’s modulus and Poisson’s ratio for each composition. Our results show that pure alumina braid insulation and co-wind reinforcements significantly enhance stiffness compared to aluminosilicate braids, with more than 2.5 times increased winding pack Young’s modulus. Rule of mixtures analysis further quantified the contribution of non-wire composite components to overall stiffness. These findings highlight the critical role of insulation material selection and reinforcement design in optimizing Bi-2212 coil performance under stress, providing a foundation for improved mechanical models and more reliable high-field HTS magnet designs.

Bi-2212 magnet↗
DOE OSTI2024

Lamellar: A Rust-based Asynchronous Tasking and PGAS Runtime for High Performance Computing

Cybersecurity is one of the largest concerns in modern computing, impacting and dictating how governments, private corporations, and individuals interact with and live in an increasingly digital world. The NSA has recently released a memo [ 1] on “Software Memory Safety” where they highlight that both Microsoft and Google have stated around 70% of software vulnerabilities were due to memory safety issues. Although languages such as C and C++ provide freedom and flexibility with memory management, guaran- teeing safety falls mostly on the developer. The NSA recommends using “memory safe” languages whenever possible. In this paper we introduce Lamellar, an asynchronous tasking and PGAS HPC runtime written in Rust, one such "memory safe" language. We describe the entire Lamellar stack, from network interfaces to high- level abstractions such as distributed LamellarArrays and Active Messages. We conclude by showing comparable performance to legacy PGAS runtimes (e.g. OpenSHMEM) on a subset of the BALE kernel suite while maintaining strong memory safety principles.

HPC Software Systems, Rust Programming Language, P↗
DOE OSTI2025

Templates for Risk Informed Assurance with Curvature Embeddings (TRACE)

We investigate recovery of geometric structure from networks embedded in manifolds with spatially varying curvature, extending the constant-curvature framework of Lubold et al. (2023). Our work supports cascade risk assessment in critical infrastructure through the Templates for Risk-informed Assurance with Curvature Embeddings (TRACE) framework. Simulations on a bi-modal Gaussian surface show that constant-curvature methods yield weighted averages shaped by clique patterns, while hierarchical clustering identifies distinct regimes. Localized estimation, however, reveals boundary contamination in transitional regions. To address heterogeneity, we develop distance metrics for graphs with edge and node features, proving their metric validity, and validate them via deterministic graph generation from canonical tilings. We further propose a diffusion-based anomaly detection approach that treats networks as glued manifolds, using curvature discontinuities to detect structural anomalies. Employing the carré-du-champ operator and scalar curvature, we achieve robust anomaly discrimination, demonstrated on the Singapore Water Treatment (SWaT) dataset with joint network-traffic and sensor features. Integration with TRACE reveals how curvature shapes cascade dynamics: positive curvature impedes, while negative curvature accelerates propagation. This geometric perspective provides interpretable risk metrics and visualization tools for critical infrastructure managers. While full validation remains ongoing, our contributions establish a rigorous foundation for geometric analysis of network resilience and cascade vulnerability.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

A Risk Assessment Framework for Cyber-Physical Security in Distribution Grids with Grid-Edge DERs

Integration of inverter-based distributed energy resources (DERs) is reshaping the landscape of distribution grids to fulfill the socioeconomic, environmental, and sustainability goals. Addressing the technological challenges of DER grid integration requires an adaptive communication layer for efficient DER management and control. This transition has given rise to a cyberphysical system (CPS) architecture within the distribution system, causing new vulnerabilities for cyberphysical attacks. To better address potential threats, this paper presents a comprehensive risk assessment framework for cyberphysical security in distribution grids with grid-edge DERs. The framework incorporates a detailed CPS model accounting for dynamic DER characteristics within the distribution grid. It identifies vulnerabilities in DER communication systems, models attack scenarios, and addresses communication latency crucial for inverter control timescales. Subsequently, the quantification of attack impacts employs an attack probability model including both the vulnerability and criticality of cyber components. The proposed risk assessment framework was validated through testing on the modified IEEE 13-node and 123-node test feeders.

cyberattack↗
NASA NTRS2019

Radiation Hardness Assurance: Evolving for NewSpace

During the past decade, numerous small satellites have been launched into space, with dramatically expanded dependence on advanced commercial-off-the-shelf (COTS) technologies and systems required for mission success. While the radiation effects vulnerabilities of small satellites are the same as those of their larger, traditional relatives, revised approaches are needed for risk management because of differences in technical requirements and programmatic resources. While moving to COTS components and systems may reduce direct costs and procurement lead times, it undermines many cost-reduction strategies used for conventional radiation hardness assurance (RHA). Limited resources are accompanied by a lack of radiation testing and analysis, which can pose significant risks - or worse, be neglected altogether. Small satellites have benefited from short mission durations in low Earth orbits with respect to their radiation response, but as mission objectives grow and become reliant on advanced technologies operating for longer and in harsher environments, requirements need to reflect the changing scope without hindering developers that provide new capabilities.

Radiation Hardness Assurance (RHA)↗
NASA NTRS2019

Radiation Hardness Assurance: Evolving for NewSpace

During the past decade, numerous small satellites have been launched into space, with dramatically expanded dependence on advanced commercial-off-the-shelf (COTS) technologies and systems required for mission success. While the radiation effects vulnerabilities of small satellites are the same as those of their larger, traditional relatives, revised approaches are needed for risk management because of differences in technical requirements and programmatic resources. While moving to COTS components and systems may reduce direct costs and procurement lead times, it undermines many cost-reduction strategies used for conventional radiation hardness assurance (RHA). Limited resources are accompanied by a lack of radiation testing and analysis, which can pose significant risks—or worse, be neglected altogether. Small satellites have benefited from short mission durations in low Earth orbits with respect to their radiation response, but as mission objectives grow and become reliant on advanced technologies operating for longer and in harsher environments, requirements need to reflect the changing scope without hindering developers that provide new capabilities.

Radiation Hardness Assurance (RHA)↗
DOE OSTI2022

Vulnerability Research Development Program Guide v.1

SAND2021-15515 O The Vulnerability Research Development Program (VRDP) Guide is a training program developed to help general purpose computer science staff become independently capable vulnerability researchers. VRDP Guide is both a course description and curriculum for the program. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Salim, Nasser↗
NASA NTRSDate not supplied

Developing a Cybersecurity Architecture for Extensible Traffic Management (xTM)

This paper explores the development of a cybersecurity architecture tailored for Extensible Traffic Management (xTM) to address emerging challenges in managing diverse aerial vehicles within the National Airspace System (NAS). Driven by technological advances and the rise of uncrewed aerial systems (UAS), urban air mobility (UAM), and high-altitude traffic (ETM), the NAS is undergoing a paradigm shift. Traditional air traffic management, reliant on traditional Federal Aviation Administration (FAA) control, will give way to decentralized coordination among autonomous and semi-autonomous systems. The proposed xTM Security Architecture, designed as a high-level framework, focuses on ensuring the confidentiality, integrity, and availability of data and operations in this evolving ecosystem. Utilizing threat modeling, the research identifies potential risks across key flight phases, operations and use cases to offer security control recommendations. Key objectives include analyzing interactions between novel airspace entrants and existing NAS traffic, cataloging vulnerabilities, and developing mitigative strategies to ensure safety, operational stability, and secure data exchanges. This research lays the groundwork for regulatory and industry adaptation, providing critical insights into managing cybersecurity risks in this complex, multi-domain environment.

UAM↗
NASA NTRS2011

Risk Assessment Overview

Risk assessment is used in many industries to identify and manage risks. Initially developed for use on aeronautical and nuclear systems, risk assessment has been applied to transportation, chemical, computer, financial, and security systems among others. It is used to gain an understanding of the weaknesses or vulnerabilities in a system so modification can be made to increase operability, efficiency, and safety and to reduce failure and down-time. Risk assessment results are primary inputs to risk-informed decision making; where risk information including uncertainty is used along with other pertinent information to assist management in the decision-making process. Therefore, to be useful, a risk assessment must be directed at specific objectives. As the world embraces the globalization of trade and manufacturing, understanding the associated risk become important to decision making. Applying risk assessment techniques to a global system of development, manufacturing, and transportation can provide insight into how the system can fail, the likelihood of system failure and the consequences of system failure. The risk assessment can identify those elements that contribute most to risk and identify measures to prevent and mitigate failures, disruptions, and damaging outcomes. In addition, risk associated with public and environment impact can be identified. The risk insights gained can be applied to making decisions concerning suitable development and manufacturing locations, supply chains, and transportation strategies. While risk assessment has been mostly applied to mechanical and electrical systems, the concepts and techniques can be applied across other systems and activities. This paper provides a basic overview of the development of a risk assessment.

Prassinos, Peter G.↗
NASA NTRS2023

Climate and Human Impacts on Hydrological Processes and Flood Risk in Southern Louisiana

Satellite observations of coastal Louisiana indicate an overall land loss over recent decades, which could be attributed to climate and human-induced factors, including sea level rise (SLR). Climate induced hydrological change (CHC) has impacted the way flood control structures are used, altering the spatiotemporal water distribution. Based on “what-if” scenarios, we determine relative impacts of SLR and CHC on increased flood risk over southern Louisiana and examine the role of water management, via flood control structures, in mitigating flood risk over the region. Our findings show that CHC has increased flood risk over the past 28 years. The number of affected people increases as extreme hydrological events become more exceptional. Water management reduces flood risk to urban areas and croplands, especially during exceptional hydrological events. For example, currently (i.e., 2016-2020 period), CHC-induced flooding puts an additional 73km2 of cropland under flood risk at least half of the time (median flood event) and 65km2 once a year (annual flood event), when compared to a past period (1993-1997). A ten- to twenty-fold increase relative to SLR-induced flooding. CHC also increases population vulnerability in southern Louisiana to flooding; additional 9900 residents currently live under flood risk at least half of the time, and that number increases to 27,400 for annual flood events. Residents vulnerable to SLR induced flooding is lower (6000 and 3300 residents, respectively). Conclusions are that CHC is a major factor that should be accounted for flood resilience and that water management interventions can mitigate risks to human life and activities.

Augusto Getirana↗
NASA NTRS2017

NASA Earth Observations Informing Energy Management Decision Making

The Energy Sector is experiencing increasing impacts from severe weather and shifting climatic trends, as well as facing a changing political climate, adding uncertainty for stakeholders as they make short- and long-term planning investments. Climate changes such as prolonged extreme heat and drought (leading to wildfire spread, for example), sea level rise, and extreme storms are changing the ways that utilities operate. Energy infrastructure located in coastal or flood-prone areas faces inundation risks, such as damage to energy facilities. The use of renewable energy resources is increasing, requiring more information about their intermittency and spatial patterns. In light of these challenges, public and private stakeholders have collaborated to identify potential data sources, tools, and programmatic ideas. For example, utilities across the country are using cutting-edge technology and data to plan for and adapt to these changes. In the Federal Government, NASA has invested in preliminary work to identify needs and opportunities for satellite data in energy sector application, and the Department of Energy has similarly brought together stakeholders to understand the landscape of climate vulnerability and resilience for utilities and others. However, have these efforts improved community-scale resilience and adaptation efforts? Further, some communities are more vulnerable to climate change and infrastructure impacts than others. This session has two goals. First, panelists seek to share existing and ongoing efforts related to energy management. Second, the session seeks to engage with attendees via group knowledge exchange to connect national energy management efforts to local practice for increased community resilience.

Eckman, Richard↗
DOE OSTI2025

Cybersecurity and Infrastructure Security Agency (CISA) Infrastructure Security Division (ISD) Assessment Prioritization Project

The Cybersecurity and Infrastructure Security Agency’s Infrastructure Security Division (CISA ISD) manages a diverse portfolio of assessments across the nation’s critical infrastructure sectors. These assessments—ranging in type, scope, and complexity—are essential for identifying vulnerabilities and strengthening national security. However, the wide variation in assessment offerings and the increasing demand for limited resources have highlighted the need for a transparent, structured approach to prioritizing assessment activities. To address this challenge, CISA ISD partnered with Lawrence Livermore National Laboratory (LLNL) to review current assessment methodologies, analyze existing prioritization practices, and develop a comprehensive, national-security-focused prioritization framework. This report summarizes the project’s approach, key findings, and actionable recommendations for enhancing ISD’s assessment program.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗