SEARCH · Search NASA

Results for “information security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 145 records · Page 8

All sources NASA NTRS DOE OSTI

NASA NTRS1991

Space Station Freedom environmental database system (FEDS) for MSFC testing

The Water Recovery Test (WRT) at Marshall Space Flight Center (MSFC) is the first demonstration of integrated water recovery systems for potable and hygiene water reuse as envisioned for Space Station Freedom (SSF). In order to satisfy the safety and health requirements placed on the SSF program and facilitate test data assessment, an extensive laboratory analysis database was established to provide a central archive and data retrieval function. The database is required to store analysis results for physical, chemical, and microbial parameters measured from water, air and surface samples collected at various locations throughout the test facility. The Oracle Relational Database Management System (RDBMS) was utilized to implement a secured on-line information system with the ECLSS WRT program as the foundation for this system. The database is supported on a VAX/VMS 8810 series mainframe and is accessible from the Marshall Information Network System (MINS). This paper summarizes the database requirements, system design, interfaces, and future enhancements.

Story, Gail S.↗

NASA NTRS2015

Technology Candidates for Air-to-Air and Air-to-Ground Data Exchange

Technology Candidates for Air-to-Air and Air-to-Ground Data Exchange is a two-year research effort to visualize the U. S. aviation industry at a point 50 years in the future, and to define potential communication solutions to meet those future data exchange needs. The research team, led by XCELAR, was tasked with identifying future National Airspace System (NAS) scenarios, determining requirements and functions (including gaps), investigating technical and business issues for air, ground, & air-to-ground interactions, and reporting on the results. The project was conducted under technical direction from NASA and in collaboration with XCELAR's partner, National Institute of Aerospace, and NASA technical representatives. Parallel efforts were initiated to define the information exchange functional needs of the future NAS, and specific communication link technologies to potentially serve those needs. Those efforts converged with the mapping of each identified future NAS function to potential enabling communication solutions; those solutions were then compared with, and ranked relative to, each other on a technical basis in a structured analysis process. The technical solutions emerging from that process were then assessed from a business case perspective to determine their viability from a real-world adoption and deployment standpoint. The results of that analysis produced a proposed set of future solutions and most promising candidate technologies. Gap analyses were conducted at two points in the process, the first examining technical factors, and the second as part of the business case analysis. In each case, no gaps or unmet needs were identified in applying the solutions evaluated to the requirements identified. The future communication solutions identified in the research comprise both specific link technologies and two enabling technologies that apply to most or all specific links. As a result, the research resulted in a new analysis approach, viewing the underlying architecture of ground-air and air-air communications as a whole, rather than as simple "link to function" paired solutions. For the business case analysis, a number of "reference architectures" were developed for both the future technologies and the current systems, based on three typical configurations of current aircraft. Current and future costs were assigned, and various comparisons made between the current and future architectures. In general, it was assumed that if a future architecture offers lower cost than the current typical architecture, while delivering equivalent or better performance, it is likely that the future solution will gain industry acceptance. Conversely, future architectures presenting higher costs than their current counterparts must present a compelling benefit case in other areas or risk a lack of industry acceptance. The business case analysis consistently indicated lower costs for the proposed future architectures, and in most cases, significantly so. The proposed future solutions were found to offer significantly greater functionality, flexibility, and growth potential over time, at lower cost, than current systems. This was true for overall, fleet-wide equipage for domestic and oceanic air carriers, as well as for single, General Aviation (GA) aircraft. The overall research results indicate that all identified requirements can be met by the proposed solutions with significant capacity for future growth. Results also illustrate that the majority of the future communication needs can be met using currently allocated aviation RF spectrum, if used in more effective ways than it is today. A combination of such optimized aviation-specific links and commercial communication systems meets all identified needs for the 50-year future and beyond, with the caveat that a new, overall function will be needed to manage all information exchange, individual links, security, cost, and other factors. This function was labeled "Delivery Manager" (DM) within this research. DM employs a distributed client/server architecture, for both airborne and ground communications architectures. Final research results included identifying the most promising candidate technologies for the future system, conclusions and recommendations, and identifying areas where further research should be considered.

Communications↗

NASA NTRS2016

Empirical Analysis and Automated Classification of Security Bug Reports

With the ever expanding amount of sensitive data being placed into computer systems, the need for effective cybersecurity is of utmost importance. However, there is a shortage of detailed empirical studies of security vulnerabilities from which cybersecurity metrics and best practices could be determined. This thesis has two main research goals: (1) to explore the distribution and characteristics of security vulnerabilities based on the information provided in bug tracking systems and (2) to develop data analytics approaches for automatic classification of bug reports as security or non-security related. This work is based on using three NASA datasets as case studies. The empirical analysis showed that the majority of software vulnerabilities belong only to a small number of types. Addressing these types of vulnerabilities will consequently lead to cost efficient improvement of software security. Since this analysis requires labeling of each bug report in the bug tracking system, we explored using machine learning to automate the classification of each bug report as a security or non-security related (two-class classification), as well as each security related bug report as specific security type (multiclass classification). In addition to using supervised machine learning algorithms, a novel unsupervised machine learning approach is proposed. An ac- curacy of 92%, recall of 96%, precision of 92%, probability of false alarm of 4%, F-Score of 81% and G-Score of 90% were the best results achieved during two-class classification. Furthermore, an accuracy of 80%, recall of 80%, precision of 94%, and F-score of 85% were the best results achieved during multiclass classification.

Cybersecurity↗

NASA NTRSDate not supplied

Improving Drought Monitoring for the Middle East and North Africa Region via Data Assimilation Using the NASA Land Information System (LIS)

Food and water security become an increasingly pressing concern for countries within the Middle East and North Africa (MENA) region under climate change. Droughts are among the most important issues facing this region in both economic and social terms, which have become much more severe in recent decades. An effective drought monitoring and early warning system is, therefore, critical to support drought impact assessment and risk management. This presentation describes the effort to improve the simulation of hydrological conditions for such semi-arid environment by Noah Multi-parameterization Land Surface Model within the NASA Land Information System (LIS) via assimilating remotely sensed leaf area index and soil moisture in the presence of irrigation. Multi-source satellite evapotranspiration products are used to evaluate the model performance under the impact of the choice of met-forcings, the presence of irrigation and data assimilation. The improved model configuration is aimed to deliver a better soil moisture estimation for the composite drought indicator (CDI) for drought monitoring and to provide a better initial condition in support for hydrological drought forecasting.

Wanshu Nie↗

DOE OSTI2026

CONUS-wide Projected Flood Frequency and Uncertainty Estimates, Version 1.0

This dataset presents a large-ensemble of CONUS-wide projected flood frequency and uncertainty estimates across ~2.7 million NHDPlusV2 river reaches over the CONUS. The framework producing this dataset leverages a multi-model, uncertainty-aware modeling framework that allows evaluating shifts in flood frequences at the stream reach level across the CONUS. CONUS-wide ensemble streamflow projections generated from hydrologic simulations driven by downscaled and bias-corrected Coupled Model Intercomparison Project Phase 6 (CMIP6) outputs are used to derive these flood frequency and uncertainty estimates over the period 1980 - 2099. A spatially consistent regional L-moment algorithm is applied across clusters defined by the US Hydrologic Unit Code Subregions (HUC4s and HUC8s) and NHDPlusV2 stream orders to estimate flood frequencies. The dataset also includes at-site based flood estimates that allow for the comparison between local and regional approach-based estimates, assess projected changes, and characterize their uncertainties. For more reliable estimation of rare flood frequencies such as 500 and 1000-year return periods, super-ensemble based estimates are also included in the dataset. This dataset is derived to support the "Impact-Informed Dam Safety Risk Assessment for Securing Hydropower Assests" project for the US Department of Energy (DOE) Hydropower and Hydrokinetic Office (H2O). For further details, refer to Kao et al. (2022), Ghimire et al. (2023), Ghimire et al. (2025), and Hosking and Wallis (1997).

Ghimire, Ganesh [ORNL] (ORCID:0000000242843941)↗

NASA NTRS2017

Managing Cyber Risk: from the Ground to the Air and Beyond Out There

Experts from the aerospace sector with the focus of presenting current state-of-the-art in aviation cyber security and discussing major challenges, requirements, and developments. A variety of topics will be addressed by the panel, including: Aviation cyber security regulations, standards, and best practices Aviation information sharing and analysis challenges Aircraft systems and avionics cyber security challenges Airline and airport stakeholder cyber perspectives CNSATM cyber security challenges UAS cyber security and privacy requirements Military aviation cyber security issues in the NAS

Davis, Jerry L.↗

NASA NTRS2012

Analysis of CSIRT/SOC Incidents and Continuous Monitoring of Threats

Security Operations Centers (SOC) contain a wealth of data which, if properly classified and tagged upfront, can yield a wealth of real-time information about your organizations IT Security posture, risks, and threats. These include answers to relevant and actionable questions such as: What are our biggest threats? Who is attacking us and what do they want? What controls are working or not working? How effective was the new technology we just implemented? What is our ROI?

Wang, John↗

NASA NTRS2013

IT Security Support for Spaceport Command and Control System

During the fall 2013 semester, I worked at the Kennedy Space Center as an IT Security Intern in support of the Spaceport Command and Control System under the guidance of the IT Security Lead Engineer. Some of my responsibilities included assisting with security plan documentation collection, system hardware and software inventory, and malicious code and malware scanning. Throughout the semester, I had the opportunity to work on a wide range of security related projects. However, there are three projects in particular that stand out. The first project I completed was updating a large interactive spreadsheet that details the SANS Institutes Top 20 Critical Security Controls. My task was to add in all of the new commercial of the shelf (COTS) software listed on the SANS website that can be used to meet their Top 20 controls. In total, there are 153 unique security tools listed by SANS that meet one or more of their 20 controls. My second project was the creation of a database that will allow my mentor to keep track of the work done by the contractors that report to him in a more efficient manner by recording events as they occur throughout the quarter. Lastly, I expanded upon a security assessment of the Linux machines being used on center that I began last semester. To do this, I used a vulnerability and configuration tool that scans hosts remotely through the network and presents the user with an abundance of information detailing each machines configuration. The experience I gained from working on each of these projects has been invaluable, and I look forward to returning in the spring semester to continue working with the IT Security team.

computer security↗

NASA NTRS1993

NASA Information Resources Management Long Range Plan, FY 1994-1998

Table of Contents: Introduction; Agency 5-Year IRM Investment Projections; Program Specific IRM Activities by Program Office; Major IRM Program Accomplishments for FY 1992; Information Collection Budget; Summary of Computer Security Plans; and Appendix: Acronym List.

LONG RANGE PLANNING↗

NASA NTRS1994

Information Resources Management Long Range Plan, FY 1995-1999

Table of Contents: Introduction; Agency 5-Year IRM Investment Projections; Major IRM Program Accomplishments for FY 1993; Information Collection Budget; Summary of Computer Security Plans; Appendix: Acronym List.

NASA↗

NASA NTRS1989

SPAN security policies and guidelines

A guide is provided to system security with emphasis on requirements and guidelines that are necessary to maintain an acceptable level of security on the network. To have security for the network, each node on the network must be secure. Therefore, each system manager, must strictly adhere to the requirements and must consider implementing the guidelines discussed. There are areas of vulnerability within the operating system that may not be addressed. However, when a requirement or guideline is discussed, implementation techniques are included. Information related to computer and data security is discussed to provide information on implementation options. The information is presented as it relates to a VAX computer environment.

Sisson, Patricia L.↗

DOE OSTI2025

Open Source Intelligence for Cybersecurity Events via Twitter Data

Open-Source Intelligence (OSINT) is largely regarded as a necessary component for cybersecurity intelligence gathering to secure network systems. With the advancement of artificial intelligence (AI) and increasing usage of social media, like Twitter, we have a unique opportunity to obtain and aggregate information from social media. In this study, we propose an AI-based scheme capable of automatically pulling information from Twitter, filtering out security-irrelevant tweets, performing natural language analysis to correlate the tweets about each cybersecurity event (e.g., a malware campaign), and validating the information. This scheme has many applications, such as providing a means for security operators to gain insight into ongoing events and helping them prioritize vulnerabilities to deal with. To give examples of the possible uses, we present three case studies demonstrating the event discovery and investigation processes. We also examine the potential of OSINT for identifying the network protocols associated with specific events, which can aid in the mitigation procedures by informing operators if the vulnerability is exploitable given their system’s network configurations.

Dale, Dakota↗

DOE OSTI2024

Small Modular Reactor and Microreactor Security-by-Design Lessons Learned: Integrated PPS Designs

U.S. nuclear power facilities face increasing challenges in meeting dynamic security requirements caused by evolving and expanding threats while keeping costs reasonable to make nuclear energy competitive. The past approach has often included implementing security features after a facility has been designed and without attention to optimization, which can lead to cost overruns. Incorporating security into the design process can provide robust, cost-effective, and sufficient physical protection systems. The purpose of this report is to capture lessons learned by the Advanced Reactor Safeguards and Security (ARSS) program that may be beneficial for other advanced and small modular reactor (SMR) vendors to use when developing security systems and postures. This report will capture relevant information that can be used in the security-by-design (SeBD) process for SMR and microreactor vendors.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2025

AI-based Cyber Event OSINT via Twitter Data

Dale, Dakota↗

NASA NTRS2017

Security Vulnerability Profiles of NASA Mission Software: Empirical Analysis of Security Related Bug Reports

NASA develops, runs, and maintains software systems for which security is of vital importance. Therefore, it is becoming an imperative to develop secure systems and extend the current software assurance capabilities to cover information assurance and cybersecurity concerns of NASA missions. The results presented in this report are based on the information provided in the issue tracking systems of one ground mission and one flight mission. The extracted data were used to create three datasets: Ground mission IVV issues, Flight mission IVV issues, and Flight mission Developers issues. In each dataset, we identified the software bugs that are security related and classified them in specific security classes. This information was then used to create the security vulnerability profiles (i.e., to determine how, why, where, and when the security vulnerabilities were introduced) and explore the existence of common trends. The main findings of our work include:- Code related security issues dominated both the Ground and Flight mission IVV security issues, with 95 and 92, respectively. Therefore, enforcing secure coding practices and verification and validation focused on coding errors would be cost effective ways to improve mission's security. (Flight mission Developers issues dataset did not contain data in the Issue Category.)- In both the Ground and Flight mission IVV issues datasets, the majority of security issues (i.e., 91 and 85, respectively) were introduced in the Implementation phase. In most cases, the phase in which the issues were found was the same as the phase in which they were introduced. The most security related issues of the Flight mission Developers issues dataset were found during Code Implementation, Build Integration, and Build Verification; the data on the phase in which these issues were introduced were not available for this dataset.- The location of security related issues, as the location of software issues in general, followed the Pareto principle. Specifically, for all three datasets, from 86 to 88 the security related issues were located in two to four subsystems.- The severity levels of most security issues were moderate, in all three datasets.- Out of 21 primary security classes, five dominated: Exception Management, Memory Access, Other, Risky Values, and Unused Entities. Together, these classes contributed from around 80 to 90 of all security issues in each dataset. This again proves the Pareto principle of uneven distribution of security issues, in this case across CWE classes, and supports the fact that addressing these dominant security classes provides the most cost efficient way to improve missions' security. The findings presented in this report uncovered the security vulnerability profiles and identified the common trends and dominant classes of security issues, which in turn can be used to select the most efficient secure design and coding best practices compiled by the part of the SARP project team associated with the NASA's Johnson Space Center. In addition, these findings provide valuable input to the NASA IVV initiative aimed at identification of the two 25 CWEs of ground and flight missions.

vulnerability↗

NASA NTRS2015

Manual Asset Inventory: NASA Kennedy Space Center

The National Aeronautics and Aerospace Administration (NASA) relies in the security and protection of the information and information systems to know the devices that are connected to the Agency networks whether these are business, mission, research, or engineering devices. The Agency uses different Information Technology resources in order to do this process automatically, however, there are some devices that need to be reported manually. As a result of this, every month the Agency distributes among its Information System Owners (ISOs) the Manual Asset Inventory, a document that consists of a Microsoft Excel spreadsheet with twenty field descriptions cells that has to be filled out by the ISO of every Security Plan in the Center [fifty three in total] and uploaded into the IT Security Enterprise Data Warehouse (ITSEC-EDW).

Presentation↗

DOE OSTI2026

Topology-Dependent Performance of Free-Space Photonic Quantum Networks Under Noise

Photonic quantum communication enables secure and high-fidelity information transfer beyond classical limits, with direct relevance to emerging quantum networks operating in free-space environments. While physical-layer models of depolarizing noise, Gamma–Gamma turbulence statistics, entanglement swapping, and decoy-state QKD security bounds are individually well established, prior work typically treats these components in isolation or under fixed network assumptions. In this work, we develop a unified topology-aware analytical framework that simultaneously integrates free-space optical link budgets, turbulence-induced visibility degradation, depolarizing qubit noise, multi-hop entanglement cascade dynamics, teleportation fidelity thresholds, CHSH nonlocality certification, and asymptotic decoy-state secret key rate bounds across star, mesh, and ring graph structures. Rather than introducing new physical channel models, we demonstrate that identical physical links exhibit fundamentally different end-to-end performance once embedded within different network topologies. Mesh architectures minimize visibility cascade through hop-count reduction but incur quadratic hardware scaling. Star topologies minimize link count but concentrate noise and synchronization overhead at the hub. Ring configurations offer linear hardware scaling with multiplicative fidelity degradation. The results establish topology as a first-order design parameter in near-term free-space quantum networks operating without full quantum repeater infrastructures. While motivated by distributed multi-agent architectures, the framework applies broadly to terrestrial, airborne, and satellite-assisted photonic quantum communication systems.

QKD↗

NASA NTRS1995

COSPO/CENDI Industry Day Conference

The conference's objective was to provide a forum where government information managers and industry information technology experts could have an open exchange and discuss their respective needs and compare them to the available, or soon to be available, solutions. Technical summaries and points of contact are provided for the following sessions: secure products, protocols, and encryption; information providers; electronic document management and publishing; information indexing, discovery, and retrieval (IIDR); automated language translators; IIDR - natural language capabilities; IIDR - advanced technologies; IIDR - distributed heterogeneous and large database support; and communications - speed, bandwidth, and wireless.

Source record↗