Consequence-driven Cyber-informed Engineering (CCE)

TECHNOLOGY LICENSING OPPORTUNITY -- This is not a procurement Consequence-driven Cyber-informed Engineering (CCE) For critical infrastructure utility companies who are dissatisfied with the current security of utilities. This technology is a methodology that substantially increasing security by identifying risk and plausible cyber-attack paths. Opportunity: Idaho National Laboratory (INL), managed and operated by Battelle Energy Alliance, LLC (BEA), is offering the opportunity to enter into a license and/or collaborative research agreement to commercialize CCE. Overview: CCE is a methodology for removing significant, high-impact cyber risk from operational technology processes. Conventional solutions are typically designed to function in information technology environments and have been only partially adapted to industrial networks. CCE can substantially impact the security of major critical infrastructure. It can identify risk and illuminate specific plausible cyber-attack paths to manipulate key devices. Description: Researchers at INL have developed Consequence-driven Cyber-informed Engineering (CCE), a methodology for removing significant, high-impact “cyber risk” from operational technology (OT) processes by engineering, or re-engineering, different approaches for performing processes that involve greatly reduced reliance on automated and digital technologies. The CCE methodology provides both private and public organizations with the steps required to examine their own environments for high-impact events/risks; identify implementation of key devices and components that facilitate that risk; illuminate specific plausible cyber-attack paths to manipulate these devices; and develop concrete mitigations, protections, and tripwires to address the high-consequence risk. Benefits: Benefits include: Substantially increased security Identifies the critical functionality of a control system Identifies the applicability of an attack scenario against this functionality across the enterprise Identifies additional insight regarding threat Identifies key technical context for the organization Identifies specific recommendations to harden the system and operations against sophisticated adversarial attack/manipulation Applications: Applications include: Critical infrastructure utility companies Water Electric Energy Nuclear Facilities Defense Critical infrastructure training institutes Development Status: TRL 7. Full-scale prototype. IP Status: US Patent Application No. 16/290,511, “Consequence Driven Cyber Informed Engineering and Related Systems and Methods,” BEA Docket No. BA-967. INL is seeking to license the above intellectual property to a company with a demonstrated ability to bring such inventions to the market. Exclusive rights in defined fields of use may be available. Please visit Technology Deployment’s website at https://inl.gov/inl-initiatives/technology-deployment for more information on working with INL and the industrial partnering and technology transfer process. Companies interested in learning more about this licensing opportunity should contact Jon Cook at [email protected] or 208-526-2261.