SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
This paper discusses the development of a security assessment instrument for the software development and maintenance life cycle.
This paper discusses development of a security assessment instrument for the software development and maintenance life cycle. The assessment instrument is a collection of tools and procedures to support development of secure software.
Explore the source record for details and available documents.
This work-in-progress paper proposes a design methodology that addresses the complexity and heterogeneity of cyber-physical systems (CPS) while simultaneously proving resilient control logic and security properties. The design methodology involves a formal methods-based approach by translating the complex control logic and security properties of a water flow CPS into timed automata. Timed automata are a formal model that describes system behaviors and properties using mathematics-based logic languages with precision. Due to the semantics that are used in developing the formal models, verification techniques, such as theorem proving and model checking, are used to mathematically prove the specifications and security properties of the CPS. This work-in-progress paper aims to highlight the need for formalizing plant models by creating a timed automata of the physical portions of the water flow CPS. Extending the time automata with control logic, network security, and privacy control processes is investigated. The final model will be formally verified to prove the design specifications of the water flow CPS to ensure efficacy and security.
Implementing a zero trust architecture can significantly bolster the security of electric vehicle (EV) charging infrastructure. EV charging infrastructure includes numerous networked interfaces, each of which can present potential vulnerabilities. When these vulnerabilities are exploited, they can compromise the entire system, leading to severe operational and security risks. Zero trust is a security model that operates on the principle of "never trust, always verify," which helps manage the attack surface and limit the scope of any potential compromises. Fundamentally, this model ensures that no entity, whether inside or outside the network, is trusted by default. The design principles of zero trust include continuous verification, strict deny-by-default access controls, and micro-segmentation. Continuous verification ensures that every request is thoroughly checked, regardless of its origin. Strict access controls enforce the principle of least privilege, allowing users and devices only the minimum necessary access to perform their functions. Micro-segmentation involves dividing the network into smaller, isolated segments to prevent lateral movement in case of a breach. In the context of EV charging infrastructure, zero trust can be implemented through various strategies. For example, multi-factor authentication (MFA) can be required for engineers to access the management interfaces and control systems of charging stations. Real-time monitoring and analysis of network traffic can help detect and respond to anomalies. Systems that do not need to communicate with each other can be micro-segmented to enhance security. All communications should adhere to predefined policies to be permitted. Additionally, encrypting communications can protect sensitive information exchanged between chargers and management systems. This paper presents a zero trust architecture specifically designed for EV charging infrastructure. Implementing zero trust not only mitigates risks but also builds a resilient infrastructure capable of withstanding and quickly recovering from cyber threats. The architecture addresses six defined security objectives. A comprehensive test plan is developed to assess the architecture against these objectives, and the results of the evaluation are reported. This approach is essential for maintaining the reliability and integrity of EV charging services in an increasingly interconnected and vulnerable digital landscape. This is the first in a planned series of papers exploring the implementation of zero trust in EV charging infrastructure. Each paper will delve into different aspects and applications of zero trust, highlighting how various work processes and requirements can lead to distinct architectural designs. These architectures will be tailored to address specific security challenges and operational needs within the EV charging ecosystem, ensuring a robust and adaptable security framework.
Newport News Nuclear BWXT-Los Alamos, LLC (N3B) collects samples in support of the U.S. Department of Energy's (DOE) Office of Environmental Management (EM) Los Alamos Legacy Cleanup Contract (LLCC). N3B receives and reviews over 1.6 million sample data points annually in support of various ongoing environmental monitoring and remediation projects of the LLCC. N3B must demonstrate and document that reported external analytical laboratory data produced for the LLCC are of sufficient quality to fulfill their intended purpose and to support defensible decision making as described in EPA QA/G4 Guidance for the Data Quality Objectives Process 1994. In 2018, N3B assumed management of the LLCC along with the Environmental Information Management (EIM) database that contains all historical and current environmental data associated with the LLCC. The entire EIM database is shared between N3B, Triad National Security, LLC (Triad), and New Mexico Environment Department (NMED). These three parties jointly manage the database, its configuration, and changes / updates. All environmental data that are entered into EIM are updated and available, on a daily basis, in the linked public database Intellus New Mexico (Intellus). The quality and defensibility of the environmental data generated from sampling activities is a key component of an effective remediation process. Providing quality data is accomplished through a data assessment process that includes examination, verification, and validation. Examination is the assessment of completeness of the deliverables, identification of any reporting errors, and determining the usability of the data based on the laboratory's evaluation of its data as described in the case narrative received with the data. Verification consists of an evaluation of the Electronic Data Deliverables (EDD) data report to determine the extent to which the external analytical laboratories met method and contract-specific quality control and reporting requirements. Validation consists of determining the data quality and the extent to which the external analytical laboratories accurately and completely reported all sample and quality control results and satisfied all contract requirements. EIM contains an automatic Data Validation Module which performs automated data review (DVM ADR). DVM ADR is a tool to assist in the validation process. When DVM ADR is used in conjunction with manual examination of sample data packages, the combination of the two will meet and exceed the requirements of verification. N3B recognized an opportunity for process improvement, focusing on DVM ADR configuration and enhancements in EIM. Testing EIM's configuration provided proof of the DVM ADR's capabilities and flexibility to accurately perform routine data checks based on analytical methods and regulatory requirements. In addition, the DVM ADR module was improved through enhancements for all analytes, particularly upgrades for radiochemistry data. Extensive testing of the DVM ADR module occurred using EDDs from actual laboratory analyses on the EIM testing site. During this process, N3B manipulated EDD information to verify that the actual outcomes matched the expected outcomes. The results of this testing were shared with the database architects, and configuration improvements were identified to address these results. During this process, N3B identified that the radiochemical DVM ADR capabilities were underutilized, and so enhanced the DVM ADR functionality with respect to radioanalytical assessment. N3B environmental data uploads to Intellus on a daily basis from EIM, once the analytical data undergoes examination and verification. As such, it is important to have a high level of confidence in the quality and defensibility of the data. The process of manual examination, along with the DVM ADR, in conjunction with full validation of a percentage the data specified through the Data Quality Objectives greatly increases efficiency of data review and confidence level of the quality of the data, and gives the project managers, governmental offices, and the public expedited access to high-quality data. (authors)