Search NASA⌕ Search

SEARCH · Search NASA

Results for “Vulnerability Research”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Vulnerability Research Development Program Guide v.1

SAND2021-15515 O The Vulnerability Research Development Program (VRDP) Guide is a training program developed to help general purpose computer science staff become independently capable vulnerability researchers. VRDP Guide is both a course description and curriculum for the program. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Salim, Nasser↗
DOE OSTI2023

CROWBAR: Natively Fuzzing Trusted Applications Using ARM CoreSight

Abstract Trusted execution environments (TEE) are deployed on many platforms to provide both confidentiality and integrity, and their extensive use offers a secure environment for privacy-sensitive operations. Despite TEE prevalence in the smartphone and tablet market, vulnerability research into TEE security is relatively rare. This is, in part, due to the strong isolation guarantees provided by its implementation. In this paper, we propose a hardware assisted fuzzing framework, CROWBAR, that bypasses TEE isolation to natively evaluate trusted applications (TAs) on mobile devices by leveraging ARM CoreSight components. CROWBAR performs feedback-driven fuzzing on commercial, closed source TAs while running in a TEE protected environment. We implement CROWBAR on 2 prototype commercial-off-the-shelf (COTS) smartphones and one development board, finding 3 unique crashes in 5 closed source TAs that are previously unreported in the TrustZone fuzzing literature.

Shan, Haoqi↗
NASA NTRS2016

Cyber Security for the Spaceport Command and Control System: Vulnerability Management and Compliance Analysis

With the rapid development of the Internet, the number of malicious threats to organizations is continually increasing. In June of 2015, the United States Office of Personnel Management (OPM) had a data breach resulting in the compromise of millions of government employee records. The National Aeronautics and Space Administration (NASA) is not exempt from these attacks. Cyber security is becoming a critical facet to the discussion of moving forward with projects. The Spaceport Command and Control System (SCCS) project at the Kennedy Space Center (KSC) aims to develop the launch control system for the next generation launch vehicle in the coming decades. There are many ways to increase the security of the network it uses, from vulnerability management to ensuring operating system images are compliant with securely configured baselines recommended by the United States Government.

Cyber Security↗
NASA NTRS2005

NASA's Research in Aircraft Vulnerability Mitigation

Since its inception in 1958, the National Aeronautics and Space Administration s (NASA) role in civil aeronautics has been to develop high-risk, high-payoff technologies to meet critical national aviation challenges. Following the events of Sept. 11, 2001, NASA recognized that it now shared the responsibility for improving homeland security. The NASA Strategic Plan was modified to include requirements to enable a more secure air transportation system by investing in technologies and collaborating with other agencies, industry, and academia. NASA is conducting research to develop and advance innovative and commercially viable technologies that will reduce the vulnerability of aircraft to threats or hostile actions, and identify and inform users of potential vulnerabilities in a timely manner. Presented in this paper are research plans and preliminary status for mitigating the effects of damage due to direct attacks on civil transport aircraft. The NASA approach to mitigation includes: preventing loss of an aircraft due to a hit from man-portable air defense systems; developing fuel system technologies that prevent or minimize in-flight vulnerability to small arms or other projectiles; providing protection from electromagnetic energy attacks by detecting directed energy threats to aircraft and on/off-board systems; and minimizing the damage due to high-energy attacks (explosions and fire) by developing advanced lightweight, damage-resistant composites and structural concepts. An approach to preventing aircraft from being used as weapons of mass destruction will also be discussed.

Allen, Cheryl L.↗
NASA NTRS1991

An overview of computer viruses in a research environment

The threat of attack by computer viruses is in reality a very small part of a much more general threat, specifically threats aimed at subverting computer security. Here, computer viruses are examined as a malicious logic in a research and development environment. A relation is drawn between the viruses and various models of security and integrity. Current research techniques aimed at controlling the threats posed to computer systems by threatening viruses in particular and malicious logic in general are examined. Finally, a brief examination of the vulnerabilities of research and development systems that malicious logic and computer viruses may exploit is undertaken.

Bishop, Matt↗
NASA NTRS2021

Perspectives on flood forecast-based early action and opportunities for Earth observations

This paper seeks to identify opportunities to integrate Earth observations (EO) into flood forecast-based early action and propose future directions for research and collaboration between EO and humanitarian communities. Forecast-based early action (FbA) is an approach to shift disaster response toward anticipation to mitigate impacts to at-risk communities; however, timely and accurate information is needed in the development of data-based triggers and thresholds for action. Therefore, this paper considers the readiness of a wide range of EO for flood monitoring and forecasting in the design, operations, and evaluation phases of FbA. The most significant opportunities for EO to inform FbA efforts lie in the design and evaluation phases, as EO can aid in the development of impact-based triggers. The EO products most readily applicable include precipitation, streamflow estimates, and exposure mapping, and those requiring the greatest amount of further research include vulnerability and impact assessments. This paper identifies collaboration opportunities for the EO and humanitarian communities to create tailored products, such as overlays combining flood extents with exposure maps. Such collaboration opportunities can be fostered by open data sharing, data verification efforts, and incentives for supporting boundary organizations capable of enabling the use of EO for FbA.

disasters↗
DOE OSTI2019

A Surety Engineering Framework and Process to Address Ethical Legal and Social Issues for Artificial Intelligence

The ethical, legal, and social issues (ELSI) surrounding Artificial Intelligence (AI) can have as great of an impact on the technologies’ success as technical issues such as safety, reliability, and security. Addressing these risks can counter potential program failures, legal and ethical battles, constraints to scientific research, and product vulnerabilities. This paper presents a surety engineering framework and process that can be applied to AI to identify and address technical, ethical, legal and societal risks. Extending sound engineering practices to incorporate a method to “engineer” ELSI can offer the scientific rigor required to significantly reduce the risk of AI vulnerabilities. Modeling the specification, design, evaluation and quality/risk indicators for AI provides a foundation for a risk-informed decision process that can benefit researchers and stakeholders alike as they use it to critically examine both substantial and intangible risks.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Assessing mean climate change signals in the global CORDEX-CORE ensemble

The new Coordinated Output for Regional Evaluations (CORDEX-CORE) ensemble provides high-resolution, consistent regional climate change projections for the major inhabited areas of the world. It serves as a solid scientific basis for further research related to vulnerability, impact, adaptation and climate services in addition to existing CORDEX simulations. The aim of this study is to investigate and document the climate change information provided by the CORDEX-CORE simulation ensemble, as a part of the World Climate Research Programme (WCRP) CORDEX community. An overview of the annual and monthly mean climate change information in selected regions in different CORDEX domains is presented for temperature and precipitation, providing the foundation for detailed follow-up studies and applications. Initially, two regional climate models (RCMs), REMO and RegCM were used to downscale global climate model output. The driving simulations by AR5 global climate models (AR5-GCMs) were selected to cover the spread of high, medium, and low equilibrium climate sensitivity at a global scale. The CORDEX-CORE ensemble has doubled the spatial resolution compared to the previously existing CORDEX simulations in most of the regions (25 $\,\mathrm {km}$ (0.22 $^{\circ }$ /jats:inline-formula>) versus 50 $\,\mathrm {km}$ (0.44 $^{\circ }$ )) leading to a potentially improved representation of, e.g., physical processes in the RCMs. The analysis focuses on changes in the IPCC physical climate reference regions. The results show a general reasonable representation of the spread of the temperature and precipitation climate change signals of the AR5-GCMs by the CORDEX-CORE simulations in the investigated regions in all CORDEX domains by mostly covering the AR5 interquartile range of climate change signals. The simulated CORDEX-CORE monthly climate change signals mostly follow the AR5-GCMs, although for specific regions they show a different change in the course of the year compared to the AR5-GCMs, especially for RCP8.5, which needs to be investigated further in region specific process studies.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2024

A full-scope, high-fidelity simulator-based hardware-in-the-loop testbed for comprehensive nuclear power plant cybersecurity research

Nuclear power plant (NPP) cybersecurity research often relies on hardware-in-the-loop (HIL) testbeds that integrate real hardware components into simulated environments. These testbeds allow researchers to identify vulnerabilities, evaluate attack impacts, and test security measures in a controlled setting. Furthermore, previous HIL testbeds lacked fidelity to accurately represent real nuclear systems, limiting the scope of cybersecurity analysis. This study presents the creation of a HIL testbed, devised upon a full-scope, high-fidelity NPP simulator, to facilitate realistic and comprehensive cybersecurity research. To demonstrate its capabilities, the control logic for the steam generator water level was migrated from the simulator to an external programmable logic controller. As a practical application of the developed testbed, supply chain attack scenarios were simulated by injecting malicious code into the controller logic, and the effects of manipulating sensor inputs and control commands were observed. While this HIL testbed provides more detailed simulations, enhanced realism, and wider applicability compared to other options utilizing a less complex simulator, it is also more intricate and costly. For this reason, we include a detailed comparison with some alternative architectures to aid fellow researchers and practitioners in the selection of a suitable HIL architecture based on specific research objectives.

47 OTHER INSTRUMENTATION↗
DOE OSTI2023

Progress and outlook of Sn–Pb mixed perovskite solar cells

Abstract Organic–inorganic hybrid perovskites have revolutionized solar cell research owing to their excellent material properties. Most previous research has been done on Pb-based perovskites. Recently, efforts to discover a Pb-free or Pb-less perovskite material with an ideal bandgap ranging 1.1–1.3 eV have led researchers to investigate Sn–Pb mixed perovskites. Sn–Pb mixed perovskites have a bandgap of ~ 1.25 eV, which is suitable for high-efficiency single-junction and perovskite/perovskite tandem solar cells. Moreover, the Pb content of Sn–Pb mixed perovskites is 50–60% lower than that of Pb-based perovskites, partially mitigating the Pb toxicity issue. However, incorporating Sn 2+ into the crystal structure also causes various drawbacks, such as inhomogeneous thin film morphologies, easy oxidation of Sn 2+ , and more vulnerable surface properties. Researchers have made substantial progress in addressing these challenges through improvements in compositional design, structural optimization, precursor design, and surface treatments. In this review, we provide a comprehensive overview of the progress in Sn–Pb mixed perovskite solar cells. Furthermore, we analyze the key variables and trends as well as provide an outlook for future directions in the research on Sn–Pb mixed perovskites. Graphical Abstract

14 SOLAR ENERGY↗
DOE OSTI2024

A new data-driven map predicts substantial undocumented peatland areas in Amazonia

Tropical peatlands are among the most carbon-dense terrestrial ecosystems yet recorded. Collectively, they comprise a large but highly uncertain reservoir of the global carbon cycle, with wide-ranging estimates of their global area (441 025–1700 000 km 2 ) and below-ground carbon storage (105–288 Pg C). Substantial gaps remain in our understanding of peatland distribution in some key regions, including most of tropical South America. Here we compile 2413 ground reference points in and around Amazonian peatlands and use them alongside a stack of remote sensing products in a random forest model to generate the first field-data-driven model of peatland distribution across the Amazon basin. Our model predicts a total Amazonian peatland extent of 251 015 km 2 (95th percentile confidence interval: 128 671–373 359), greater than that of the Congo basin, but around 30% smaller than a recent model-derived estimate of peatland area across Amazonia. The model performs relatively well against point observations but spatial gaps in the ground reference dataset mean that model uncertainty remains high, particularly in parts of Brazil and Bolivia. For example, we predict significant peatland areas in northern Peru with relatively high confidence, while peatland areas in the Rio Negro basin and adjacent south-western Orinoco basin which have previously been predicted to hold Campinarana or white sand forests, are predicted with greater uncertainty. Similarly, we predict large areas of peatlands in Bolivia, surprisingly given the strong climatic seasonality found over most of the country. Very little field data exists with which to quantitatively assess the accuracy of our map in these regions. Data gaps such as these should be a high priority for new field sampling. This new map can facilitate future research into the vulnerability of peatlands to climate change and anthropogenic impacts, which is likely to vary spatially across the Amazon basin.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Module-OT: A Hardware Security Module for Operational Technology

Increased penetration levels of renewable energy and other types of distributed energy resources (DERs) on the modern electric grid-combined with technological advancements for electric system monitoring and control-introduce new cyberattack vectors and increase the cyberattack surface of energy systems. According to the IEEE Std. 1547-2018, DERs must use Modbus, Distributed Network Protocol 3 (DNP3), or Smart Energy Profile 2.0 (SEP2) as their communication protocol. Previous research identified several vulnerabilities and security breaches in each one of these communication protocols; despite this, existing standards for DERs do not recommend cybersecurity measures. In order to reduce vulnerabilities in power distribution systems, this paper presents a novel open-source hardware security module that improves both information and operational security to better protect data and communications on the distribution grid. The security hardware is called “module for operational technology,” or simply Module-OT, and it has been validated and tested in an emulated distribution system application. Module-OT is integrated within a communication system in the transport layer of the Open Systems Interconnection (OSI) model. It improves system security through encryption, authentication, authorization, certificate management, and user access control. The main advancement of Module-OT is the addition of hardware cryptographic acceleration that improves the overall communication performance in terms of end-to-end latency.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗
DOE OSTI2021

Best Practices for Timing Attack Mitigation

GPS signals play essential roles in the electric subsector by providing precision timing used to synchronize and record measurements from a range of equipment. However, previous research has demonstrated that GPS signals can be spoofed or jammed relatively easily in order to interfere with timing-reliant equipment. This document outlines utility best practices for mitigating against timing attacks in the electric subsector based on an assessment of the difficulty and impact of realistic timing attacks and testing of the effectiveness of technologies capable of mitigating them. This analysis builds on research establishing the vulnerability of GPS-reliant timing equipment to jamming and spoofing by elaborating the difficulty, consequences, and mitigations for timing attacks that adversaries might realistically attempt. While timing attacks are relatively low-cost, low-sophistication, and capable of systemic consequences in the electric subsector, they can be effectively mitigated through well-targeted and diverse mitigations.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Improving the Cyber Resiliency and Security Posture of Public Power (Final Report)

The key objective of Improving the Cyber Resiliency and Security Posture of Public Power (Project) was to develop a culture of cyber resiliency and security within the public power community. The relative smaller size and unique structure of community-owned electric utilities can sometimes present challenges in immediate recognition of threats and the escalation of potential incidents. The Project offered targeted education, coordination, capability building, and resources to help the public power community better understand, install, and implement cyber and physical resiliency and security systems. The American Public Power Association (APPA) accelerated efforts to develop resources for and with the public power community to understand and implement resiliency, cybersecurity and cyber-physical solutions, including refining and improving the adoption of advanced control concepts. The Project consisted of four major multi-pronged tasks which included: 1) Advance cyber resiliency and security assessments; 2) Conduct, evaluate, and use the results of onsite vulnerability assessments; 3) Research, evaluate, deploy, and integrate both commercial and pre-commercial security technologies; and 4) Research, evaluate, and implement information sharing mechanisms.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2019

Multifactor Experiment and Model Integration to Determine the Regional Vulnerability of Permafrost Carbon to Climate Change. Final report

The major research goal of this project was to understand and quantify the fate of carbon stored in permafrost ecosystems using a combination of field and laboratory experiments to measure and model isotope ratios and carbon fluxes in a tundra ecosystem exposed to experimental warming. Field measurements centered on a two-factor experimental warming to increase air and soil temperatures alone, and in combination, at a tundra field site in Alaska. A second manipulation of water table was embedded within the warming treatment such that both major environmental factors (temperature, moisture) controlling ecosystem carbon dynamics were experimentally altered. The experiment was interfaced with modeling activities using both data assimilation and forward modeling approaches. Models were used to make forecasts of ecosystem carbon dynamics beyond the time frame and environmental space of the experiment itself. These results were linked with ongoing synthesis and model intercomparison activities through the Permafrost Carbon Network, which led to additional synthesis publications as a result of collaboration and data sharing from this project. As key outcomes, this project has produced new papers published in the peer-reviewed literature, archived datasets used for model-data intercomparisons, trained graduate students and postdoctoral researchers, and has raised awareness about the vulnerability of permafrost carbon to a wider audience.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

Vulnerability and resilience of urban energy ecosystems to extreme climate events: A systematic review and perspectives

We reviewed the present studies on the vulnerability and resilience of the energy ecosystem (most parts of the energy ecosystem), considering extreme climate events. This study revealed that the increased interactions formed during the transformation of the energy landscape into an ecosystem could notably increase the vulnerability of the energy infrastructure. Such complex ecosystem cannot be assessed using the present state of the art models used by the energy system modelers. Therefore, this study introduces a novel analogy known as the COVID analogy to understand the propagation of disruption within and beyond the energy ecosystem and organized the present state of the art based on the COVID analogy. The analogy helps to categorize the vulnerability of the energy infrastructure into three stages. The study revealed that although there are many publications covering the vulnerability and resilience of the energy infrastructure, considering extreme climate events, the majority are focused on the direct impact of extreme climate on the energy ecosystem. In addition, most of the studies do not consider the impact of future climate variations during this assessment. The propagation of disruptions was assessed mainly for wildfires and hurricanes. Further, there is a clear research gap in considering vulnerability assessment for interconnected energy infrastructure. Here, the transformation of energy systems into a complex ecosystem notably increases the complexity, making it difficult to assess vulnerability and resilience. A shift from a centralized to decentralized modeling architecture could be beneficial when considering the complexities brought by that transformation. Hybrid models consisting of both physical and data-driven machine learning techniques could also be beneficial in this context.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2020

Assessing the exposure of three diving bird species to offshore wind areas on the U.S. Atlantic Outer Continental Shelf using satellite telemetry

Abstract Aim The United States Atlantic Outer Continental Shelf (OCS) has considerable offshore wind energy potential. Capturing that resource is part of a broader effort to reduce CO 2 emissions. While few turbines have been constructed in U.S. waters, over a dozen currently planned offshore wind projects have the potential to displace marine birds, potentially leading to effective habitat loss. We focused on three diving birds identified in Europe to be vulnerable to displacement. Our research aimed to determine their potential exposure to areas designated or proposed for offshore wind development along the Atlantic OCS. Methods Satellite tracking technology was used to determine the spatial and temporal use and movement patterns of Surf Scoters ( Melanitta perspicillata ), Red‐throated Loons ( Gavia stellata ) and Northern Gannets ( Morus bassanus ), and calculate their exposure to each offshore wind area. We tagged 236 adults in 2012–2015 on the Atlantic OCS from New Jersey to North Carolina; an additional 147 birds tagged in previous tracking studies were integrated into our analyses. Tracking data were analysed in two‐week intervals using dynamic Brownian bridge movement models to develop composite spatial utilization distributions. For each species, these distributions were then used to calculate the spatio‐temporal exposure to each offshore wind area. Results Surf Scoters and Red‐throated Loons were exposed to offshore wind areas almost exclusively during migration because these species were distributed among coastal and inshore waters during winter months. In contrast, Northern Gannets ranged over a much larger area, reaching farther offshore and south in winter, thus exhibited the greatest exposure to extant offshore wind areas. Conclusions Results of this study provide better understanding of how diving birds use current and potential future offshore wind areas on the Atlantic OCS, and can inform permitting, risk assessment and pre‐ and post‐construction impact assessments of offshore energy infrastructure.

Stenhouse, Iain J.↗