Search NASA⌕ Search

SEARCH · Search NASA

Results for “SECURITY MANAGEMENT”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

1. Physical Security Engineering by Design for Nuclear Facilities; 2. Nuclear Power Plant Site Security Management – A Security Strategy; 3. The UAE Women in Nuclear Energy Security

1. Security by design, or SeBD, is a comprehensive approach that integrates the physical protection system of a nuclear plant into every stage of its existence. This includes planning, designing, constructing, commissioning, and operating the facility, using a combination of analytical, physical, technological, and procedural measures. Essentially, SeBD involves intentionally applying and incorporating security into all aspects of design and operation throughout the entire lifecycle of a facility. By implementing this methodology throughout various phases such as program development, process implementation, staff training and procedures management in conjunction with plant equipment, facilities can be optimized to minimize security risks without compromising functional design requirements. This ultimately improves the overall security posture of the site and reduces the need for costly modifications or additional security resources post-design. 2. A site security strategy is a living document that is revised on a periodic or event-driven basis, ensuring that site security operations and corresponding procedures provide long-term, effective protection for the entire nuclear power plant (NPP) site. A site security strategy aims to mitigate threats across the entire NPP site via in-depth defense approaches and mutual support; therefore, if a layer is omitted or altered, then the effect across all layers must be re-evaluated. Therefore, the aim of the site security strategy is to provide an appropriate, scalable security regime that deters, denies, delays, and detects incidents and, equally importantly, reassures legitimate users and the regulator that due diligence and regulatory compliance have been achieved, ensuring that the site is safe and secure. Robust access control for vehicles and pedestrians is at the heart of the strategy. Vehicle and pedestrian searching and screening are seen as the strongest mitigation methods against vehicle- and pedestrian-borne attacks. The security strategy must also be supported through comprehensive staff training and the development of robust processes, procedures, and planning. If all these measures are to be effective, then training must be implemented during each phase of construction, partial operation/commissioning, and full operation. No single element of site security is completely isolated from the influence of other elements. Ideally, consideration of all key elements will result in a security strategy that is integrated and proportional to the threat and that does not over specify individual security solutions through the application of isolated measures but rather applies a holistic, all-encompassing approach. 3. When women enter the labor force, numerous positive outcomes emerge, including increased GDP, educational gains, and decreased maternal mortality. Despite these benefits, women's employment rates and equality vary significantly worldwide as does support for women in the workforce. This paper will explore the multifaceted benefits of women's employment, the factors influencing labor force participation rates, and the urgency to achieve gender equality as outlined in the 2015 United Nations Sustainable Development Goals (SDGs). It will then examine the emerging presence of women in the traditionally male-dominated nuclear field, specifically within the United Arab Emirates (UAE) as a testament to their resilience and determination to break social norms and advance gender equality.

Zineddin, Dr. Z.↗
NASA NTRS2004

Security Management and Safeguards Office

The Security Management and Safeguards Office at NASA is here to keep the people working in a safe environment. They also are here to protect the buildings and documents from sabotage, espionage, and theft. During the summer of 2004, I worked with Richard Soppet in Physical Security. While I was working here I helped out with updating the map that we currently use at NASA Glenn Research Center, attended meetings for homeland security, worked with the security guards and the locksmith. The meetings that I attended for homeland security talked about how to protect ourselves before something happened, they told us to always be on the guard and look for anything suspicious, and the different ways that terrorist groups operate. When I was with the security guards I was taught how to check someone into the base, showed how to use a radar gun, observed a security guard make a traffic stop for training and was with them while they patrolled NASA Glenn Research Center to make sure things were running smooth and no one was in danger. When I was with the lock smith I was taught how to make keys and locks for the employees here at NASA. The lock smith also showed me that he had inventory cabinets of files that show how many keys were out to people and who currently has access to the rooms that they keys were made for. I also helped out the open house at NASA Glenn Research Center. I helped out by showing the Army Reserves, and Brook Park's SWAT team where all the main events were going to take place a week before the open house was going to begin. Then during the open house I helped out by making sure people had there IDS, checked through there bags, and handed out a map to them that showed where the different activities were going to take place. So the main job here at NASA Glenn Research Center for the Security Management and Safeguards Office is to make sure that nothing is stolen, sabotaged, and espionaged. Also most importantly make sure all the employees here at NASA are in a safe environment.

Bewley, Nathaniel M.↗
NASA NTRS1983

Guidelines for developing NASA (National Aeronautics and Space Administration) ADP security risk management plans

This report presents guidance to NASA Computer security officials for developing ADP security risk management plans. The six components of the risk management process are identified and discussed. Guidance is presented on how to manage security risks that have been identified during a risk analysis performed at a data processing facility or during the security evaluation of an application system.

Tompkins, F. G.↗
NASA NTRS1991

The Management and Security Expert (MASE)

The Management and Security Expert (MASE) is a distributed expert system that monitors the operating systems and applications of a network. It is capable of gleaning the information provided by the different operating systems in order to optimize hardware and software performance; recognize potential hardware and/or software failure, and either repair the problem before it becomes an emergency, or notify the systems manager of the problem; and monitor applications and known security holes for indications of an intruder or virus. MASE can eradicate much of the guess work of system management.

Miller, Mark D.↗
NASA NTRS2004

Security Risks: Management and Mitigation in the Software Life Cycle

A formal approach to managing and mitigating security risks in the software life cycle is requisite to developing software that has a higher degree of assurance that it is free of security defects which pose risk to the computing environment and the organization. Due to its criticality, security should be integrated as a formal approach in the software life cycle. Both a software security checklist and assessment tools should be incorporated into this life cycle process and integrated with a security risk assessment and mitigation tool. The current research at JPL addresses these areas through the development of a Sotfware Security Assessment Instrument (SSAI) and integrating it with a Defect Detection and Prevention (DDP) risk management tool.

securiy↗
NASA NTRS2003

Managing information technology security risk

Information Technology (IT) Security Risk Management is a critical task for the organization to protect against the loss of confidentiality, integrity and availability of IT resources. As systems bgecome more complex and diverse and and attacks from intrusions and malicious content increase, it is becoming increasingly difficult to manage IT security risk. This paper describes a two-pronged approach in addressing IT security risk and risk management in the organization: 1) an institutional enterprise appraoch, and 2) a project life cycle approach.

security toolset↗
NASA NTRS2017

Augmenting Space Technology Program Management with Secure Cloud & Mobile Services

The National Aeronautics and Space Administration (NASA) Game Changing Development (GCD) program manages technology projects across all NASA centers and reports to NASA headquarters regularly on progress. Program stakeholders expect an up-to-date, accurate status and often have questions about the program's portfolio that requires a timely response. Historically, reporting, data collection, and analysis were done with manual processes that were inefficient and prone to error. To address these issues, GCD set out to develop a new business automation solution. In doing this, the program wanted to leverage the latest information technology platforms and decided to utilize traditional systems along with new cloud-based web services and gaming technology for a novel and interactive user environment. The team also set out to develop a mobile solution for anytime information access. This paper discusses a solution to these challenging goals and how the GCD team succeeded in developing and deploying such a system. The architecture and approach taken has proven to be effective and robust and can serve as a model for others looking to develop secure interactive mobile business solutions for government or enterprise business automation.

Hodson, Robert F.↗
NASA NTRS1990

Management of the Space Physics Analysis Network (SPAN)

Here, the purpose is to define the operational management structure and to delineate the responsibilities of key Space Physics Analysis Network (SPAN) individuals. The management structure must take into account the large NASA and ESA science research community by giving them a major voice in the operation of the system. Appropriate NASA and ESA interfaces must be provided so that there will be adequate communications facilities available when needed. Responsibilities are delineated for the Advisory Committee, the Steering Committee, the Project Scientist, the Project Manager, the SPAN Security Manager, the Internetwork Manager, the Network Operations Manager, the Remote Site Manager, and others.

Green, James L.↗
NASA NTRS2015

An Overview of SBIR Phase 2 Communications Technology and Development

Technological innovation is the overall focus of NASA's Small Business Innovation Research (SBIR) program. The program invests in the development of innovative concepts and technologies to help NASA's mission directorates address critical research and development needs for agency projects. This report highlights innovative SBIR Phase II projects from 2007-2012 specifically addressing areas in Communications Technology and Development which is one of six core competencies at NASA Glenn Research Center. There are eighteen technologies featured with emphasis on a wide spectrum of applications such as with a security-enhanced autonomous network management, secure communications using on-demand single photons, cognitive software-defined radio, spacesuit audio systems, multiband photonic phased-array antenna, and much more. Each article in this booklet describes an innovation, technical objective, and highlights NASA commercial and industrial applications. This report serves as an opportunity for NASA personnel including engineers, researchers, and program managers to learn of NASA SBIR's capabilities that might be crosscutting into this technology area. As the result, it would cause collaborations and partnerships between the small companies and NASA Programs and Projects resulting in benefit to both SBIR companies and NASA.

secure communications software defined radio anten↗
NASA NTRS2014

MAVEN Information Security Governance, Risk Management, and Compliance (GRC): Lessons Learned

As the first interplanetary mission managed by the NASA Goddard Space Flight Center, the Mars Atmosphere and Volatile EvolutioN (MAVEN) had three IT security goals for its ground system: COMPLIANCE, (IT) RISK REDUCTION, and COST REDUCTION. In a multiorganizational environment in which government, industry and academia work together in support of the ground system and mission operations, information security governance, risk management, and compliance (GRC) becomes a challenge as each component of the ground system has and follows its own set of IT security requirements. These requirements are not necessarily the same or even similar to each other's, making the auditing of the ground system security a challenging feat. A combination of standards-based information security management based on the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF), due diligence by the Mission's leadership, and effective collaboration among all elements of the ground system enabled MAVEN to successfully meet NASA's requirements for IT security, and therefore meet Federal Information Security Management Act (FISMA) mandate on the Agency. Throughout the implementation of GRC on MAVEN during the early stages of the mission development, the Project faced many challenges some of which have been identified in this paper. The purpose of this paper is to document these challenges, and provide a brief analysis of the lessons MAVEN learned. The historical information documented herein, derived from an internal pre-launch lessons learned analysis, can be used by current and future missions and organizations implementing and auditing GRC.

FISMA↗
NASA NTRS2004

Emergency Response Manual

Safety and security is very important at NASA. The Security Management and Safeguards Office goal is ensure safety and security for all NASA Lewis and Plum Brook Station visitors and workers. The office protects against theft, sabotage, malicious damage, espionage, and other threats or acts of violence. There are three types of security at NASA: physical, IT, and personnel. IT is concerned with sensitive and classified information and computers. Physical security includes the officers who check visitors and workers in and patrol the facility. Personnel security is concerned with background checks during hiring. During my internship, I met people from and gained knowledge about all three types of security. I primarily worked with Dr. Richard Soppet in physical security. During my experience with physical security, I observed and worked with many aspects of it. I attended various security meetings at both NASA Lewis and Plum Brook. The meetings were about homeland security and other improvements that will be made to both facilities. I also spent time with a locksmith. The locksmith makes copies of keys and unlocks doors for people who need them. I rode around in a security vehicle with an officer as he patrolled. I also observed the officer make a search of a visitor s vehicle. All visitors vehicles are searched upon entering NASA. I spent time and observed in the dispatch office. The officer answers calls and sends out officers when needed. The officer also monitors the security cameras. My primary task was completing an emergency response manual. This manual would assist local law enforcement and fire agencies in case of an emergency. The manual has pictures and descriptions of the buildings. It also contains the information about hazards inside of the buildings. This information will be very helpul to law enforcement so that when called upon during an emergency, they will not create an even bigger problem with collateral damage.

Barnett, Traci M.↗
NASA NTRS2016

Tailoring NIST Security Controls for the Ground System: Selection and Implementation -- Recommendations for Information System Owners

The National Aeronautics and Space Administration (NASA) invests millions of dollars in spacecraft and ground system development, and in mission operations in the pursuit of scientific knowledge of the universe. In recent years, NASA sent a probe to Mars to study the Red Planet's upper atmosphere, obtained high resolution images of Pluto, and it is currently preparing to find new exoplanets, rendezvous with an asteroid, and bring a sample of the asteroid back to Earth for analysis. The success of these missions is enabled by mission assurance. In turn, mission assurance is backed by information assurance. The information systems supporting NASA missions must be reliable as well as secure. NASA - like every other U.S. Federal Government agency - is required to manage the security of its information systems according to federal mandates, the most prominent being the Federal Information Security Management Act (FISMA) of 2002 and the legislative updates that followed it. Like the management of enterprise information technology (IT), federal information security management takes a "one-size fits all" approach for protecting IT systems. While this approach works for most organizations, it does not effectively translate into security of highly specialized systems such as those supporting NASA missions. These systems include command and control (C&C) systems, spacecraft and instrument simulators, and other elements comprising the ground segment. They must be carefully configured, monitored and maintained, sometimes for several years past the missions' initially planned life expectancy, to ensure the ground system is protected and remains operational without any compromise of its confidentiality, integrity and availability. Enterprise policies, processes, procedures and products, if not effectively tailored to meet mission requirements, may not offer the needed security for protecting the information system, and they may even become disruptive to mission operations. Certain protective measures for the general enterprise may not be as efficient within the ground segment. This is what the authors have concluded through observations and analysis of patterns identified from the various security assessments performed on NASA missions such as MAVEN, OSIRIS-REx, New Horizons and TESS, to name a few. The security audits confirmed that the framework for managing information system security developed by the National Institute of Standards and Technology (NIST) for the federal government, and adopted by NASA, is indeed effective. However, the selection of the technical, operational and management security controls offered by the NIST model - and how they are implemented - does not always fit the nature and the environment where the ground system operates in even though there is no apparent impact on mission success. The authors observed that unfit controls, that is, controls that are not necessarily applicable or sufficiently effective in protecting the mission systems, are often selected to facilitate compliance with security requirements and organizational expectations even if the selected controls offer minimum or non-existent protection. This paper identifies some of the standard security controls that can in fact protect the ground system, and which of them offer little or no benefit at all. It offers multiple scenarios from real security audits in which the controls are not effective without, of course, disclosing any sensitive information about the missions assessed. In addition to selection and implementation of controls, the paper also discusses potential impact of recent legislation such as the Federal Information Security Modernization Act (FISMA) of 2014 - aimed at the enterprise - on the ground system, and offers other recommendations to Information System Owners (ISOs).

GOVERNANCE↗
NASA NTRS2004

Data processing pipeline with transaction-oriented data sharing

This paper makes three contributions to the area of modern science data processing systems. First, the paper describes the science data processing pipeline, developed at the Multi-mission Image Processing Lab of JPL, for transforming raw space data into high quality image data and automating the distribution of data using a high-performance file transaction service. File Exchange Interface is the file transaction service developed MIPL. Second, it presents the FEI component architecture in the are of file transaction management, security,a nd file integrity verfication. Finally, the paper presents the federated model for the FEI service to demonstrate how to create a pool of file trasaction services to support load balancing and service fallover, and simplify service management.

science data processing↗
NASA NTRS2012

Autonomous Information Unit for Fine-Grain Data Access Control and Information Protection in a Net-Centric System

As communication and networking technologies advance, networks will become highly complex and heterogeneous, interconnecting different network domains. There is a need to provide user authentication and data protection in order to further facilitate critical mission operations, especially in the tactical and mission-critical net-centric networking environment. The Autonomous Information Unit (AIU) technology was designed to provide the fine-grain data access and user control in a net-centric system-testing environment to meet these objectives. The AIU is a fundamental capability designed to enable fine-grain data access and user control in the cross-domain networking environments, where an AIU is composed of the mission data, metadata, and policy. An AIU provides a mechanism to establish trust among deployed AIUs based on recombining shared secrets, authentication and verify users with a username, X.509 certificate, enclave information, and classification level. AIU achieves data protection through (1) splitting data into multiple information pieces using the Shamir's secret sharing algorithm, (2) encrypting each individual information piece using military-grade AES-256 encryption, and (3) randomizing the position of the encrypted data based on the unbiased and memory efficient in-place Fisher-Yates shuffle method. Therefore, it becomes virtually impossible for attackers to compromise data since attackers need to obtain all distributed information as well as the encryption key and the random seeds to properly arrange the data. In addition, since policy can be associated with data in the AIU, different user access and data control strategies can be included. The AIU technology can greatly enhance information assurance and security management in the bandwidth-limited and ad hoc net-centric environments. In addition, AIU technology can be applicable to general complex network domains and applications where distributed user authentication and data protection are necessary. AIU achieves fine-grain data access and user control, reducing the security risk significantly, simplifying the complexity of various security operations, and providing the high information assurance across different network domains.

Chow, Edward T.↗
NASA NTRS2014

IT Security Support for the Spaceport Command Control System Development

My job title is IT Security support for the Spaceport Command & Control System Development. As a cyber‐security analyst it is my job to ensure NASA's information stays safe from cyber threats, such as, viruses, malware and denial-of-service attacks by establishing and enforcing system access controls. Security is very important in the world of technology and it is used everywhere from personal computers to giant networks ran by Government agencies worldwide. Without constant monitoring analysis, businesses, public organizations and government agencies are vulnerable to potential harmful infiltration of their computer information system. It is my responsibility to ensure authorized access by examining improper access, reporting violations, revoke access, monitor information request by new programming and recommend improvements. My department oversees the Launch Control System and networks. An audit will be conducted for the LCS based on compliance with the Federal Information Security Management Act (FISMA) and The National Institute of Standards and Technology (NIST). I recently finished analyzing the SANS top 20 critical controls to give cost effective recommendations on various software and hardware products for compliance. Upon my completion of this internship, I will have successfully completed my duties as well as gain knowledge that will be helpful to my career in the future as a Cyber Security Analyst.

IT Security↗
NASA NTRS2016

Information Management Platform for Data Analytics and Aggregation (IMPALA) System Design Document

The System Design document tracks the design activities that are performed to guide the integration, installation, verification, and acceptance testing of the IMPALA Platform. The inputs to the design document are derived from the activities recorded in Tasks 1 through 6 of the Statement of Work (SOW), with the proposed technical solution being the completion of Phase 1-A. With the documentation of the architecture of the IMPALA Platform and the installation steps taken, the SDD will be a living document, capturing the details about capability enhancements and system improvements to the IMPALA Platform to provide users in development of accurate and precise analytical models. The IMPALA Platform infrastructure team, data architecture team, system integration team, security management team, project manager, NASA data scientists and users are the intended audience of this document. The IMPALA Platform is an assembly of commercial-off-the-shelf (COTS) products installed on an Apache-Hadoop platform. User interface details for the COTS products will be sourced from the COTS tools vendor documentation. The SDD is a focused explanation of the inputs, design steps, and projected outcomes of every design activity for the IMPALA Platform through installation and validation.

Carnell, Andrew↗
NASA NTRS2003

Transferring Knowledge from Observations and Models to Decision Makers: An Overview and Challenges

Over the last 25 years, a tremendous progress has been made in the Earth science space-based remote sensing observations, technologies and algorithms. Such advancements have improved the predictability by providing lead-time and accuracy of forecast in weather, climate, natural hazards, and natural resources. It has further reduced or bounded the overall uncertainties by partially improving our understanding of planet Earth as an integrated system that is governed by non-linear and chaotic behavior. Many countries such US, European Community, Japan, China and others have invested billions of dollars in developing and launching space-based assets in the low earth (LEO) and geostationary (GEO) orbits. However, the wealth of this scientific knowledge that has potential of extracting monumental socio-economic benefits from such large investments have been slow in reaching to public and decision makers. For instance, there are a number of areas such as energy forecasting, aviation safety, agricultural competitiveness, disaster management, security, air quality and public health can directly take advantage. Nevertheless, we all live in a global economy that depends on access to the best available Earth Science information for all inhabitants of this planet. This paper surveys and examines a number such applications in terms of their architecture, maturity and economic applicability as they apply to the societal needs. A detailed analysis is also presented of various challenges and issues that pertain to a number of areas such as: (1) difficulties in making a speedy transition of data and information from observations and models to relevant Decision Support Systems (DSS) or tools, (2) data and models inter-operability issues, (3) limitations of spatial, spectral and temporal resolution, (4) communication limitations as dictated by the availability of image processing and data compression techniques. Additionally, the most critical element amongst all is the organizational and management boundaries that must be resolved at local, state, national and international levels to implement and realize free flow of such vital information. This paper also makes attempts to address this topic and discuss possible approaches to deal with this quandary.

Habib, Shahid↗