Cyber-Informed Engineering (CIE) will build tools for high-level implementation, and embed CIE into curriculum, design standards, certification and curriculum accreditation.

CIE is the result of constant evaluation of engineers and technical staff not capitalizing on opportunities within the early design lifecycle of engineered systems to reduce cyber risk. Instead, cybersecurity mitigations were added at the late-stage of testing and operational deployment by cybersecurity specialists without the engineer’s deep awareness of the critical functions performed by the engineered system and the key hazards it could face.

This late-stage mitigation of risk leaves gaps which an ever-advancing adversary is well aware of.  CIE provides a framework for a change in philosophy and engineering practices to proactively secure existing digital infrastructure and build new systems designed to withstand the modern and future cyber-adversary.

DOE National Cyber-Informed Engineering Strategy

DOE cyberinformed engineering strategy

The U.S. Department of Energy’s (DOE) National Cyber-Informed Engineering (CIE) Strategy seeks to guide energy sector efforts to incorporate cybersecurity practices into the design life cycle of engineered systems to reduce cyber risk.

Pursuant to congressional direction, the CESER-led Securing Energy Infrastructure Executive Task Force (SEI ETF) developed the National CIE Strategy, building on foundational work developed at Idaho National Laboratory.


I applaud the hard work of the Securing Energy Infrastructure Executive Task Force, CESER’s Cheri Caddy, and the entire CESER team for building on the great CIE work done by Idaho National Laboratory under the tremendous leadership by Zach Tudor, CISSP, NACD.DC.

Puesh Kumar, Director, Office of Cybersecurity, Energy Security, and Emergency Response, U.S. Department of Energy

CIE Community of Practice

The Community of Practice (COP) quarterly meetings will start April 2023. The following two sub-groups meet monthly:

University Implementation
3rd Wednesday at 11 AM EST (starts Wednesday, February 15, 2023)

Developing Tools
4th Wednesday at 11 AM EST (starts Wednesday, February 22, 2023)

CIE is the WHAT and CCE is a HOW

The Department of Energy (DOE) and INL have developed a framework to guide the application of cybersecurity principles across the engineering design lifecycle. The Cyber-Informed Engineering (CIE) framework and body of knowledge drives the inclusion of cybersecurity as a foundational element of risk management for engineering of functions aided by digital technology. Consequence-Driven Cyber-Informed Engineering (CCE) is a rigorous process for applying CIE’s core principles to a specific organization, facility, or mission by identifying their most critical functions, methods and means an adversary would likely use to manipulate or compromise them, and determining the most effective means of removing or mitigating those risks.

CIE emphasizes “engineering out” potential risk in key areas, as well as ensuring resiliency and response maturity within the design of the engineered system. The following CIE framework shows some of the key focus areas and how the relate to the CCE Methodology. CCE walks an organization through core components of CIE in CCE’s 4-phase process to evaluate and remove or mitigate weaknesses in their critical functions.

cyber-informed engineering

Papers

Reducing the Cyber Threat to Digital Systems

INL Cyber Informed Engineering - 2017

Fermilab Colloquium - 2016

The Need for Cyber-informed Engineering Expertise for Nuclear Research Reactors

Presentations

Resilience Week 2020 - CIE

RSA Conference 2019 - Engineering Out the Cyber-Risk

CIE - Domestic Nuclear Cyber

Additional Resources

In this section we have listed supporting papers and presentations to the CIE foundations. In addition, there is supplemental information on complimentary and supporting efforts to the program.

iStock  scaled

 

 

Reducing the Cyber Threat to Digital Systems

Written by Nuclear Threat Initiative (NTI) staff with the assistance of Michael Assante, Robert Anderson and Rob Hoffman

Cyber threats are increasingly one of the major threat facing governments and industrial facility operators. One of the foundational issues that makes protection from such attacks increasingly difficult is the complexity of today’s networks and systems.

INL Cyber Informed Engineering - 2017

INL Report by Robert Anderson, Jacob Benjamin, Virginia Wright, Luis Quinones, Jonathan Paz

Published March 2017

A continuing challenge for engineers who utilize digital systems is to understand the impact of cyber-attacks across the entire product and program lifecycle. This is a challenge due to the evolving nature of cyber threats that may impact the design, development, deployment, and operational phases of all systems. Cyber Informed Engineering is the process by which engineers are made aware of both how to use their engineering knowledge to positively impact the cyber security in the processes by which they architect and design components and the services and security of the components themselves.

Cyber Informed Engineering, March 2017 PDF

Fermilab Colloquium - 2016

Published June 2016

Written by Virginia Wright

Cyber informed engineering (CIE) is a body of knowledge and methodologies to characterize and mitigate risks presented by the introduction of digital technology in this formerly analog environment, focused on the application of traditional engineering techniques informed by an awareness of cyber-security threat and mitigation methods. This talk will describe how managers and engineers can participate in mitigating cyber-security risk in engineering projects throughout the design and installation life cycle.

The Need for Cyber-informed Engineering Expertise for Nuclear Research Reactors

International Conference on Research Reactors: Safe Management and Effective Utilization, 2015

Written by Rob Anderson and Joseph Price

This paper examines the need for cyber-informed engineering practices that encompass the entire engineering life cycle. Cyber-informed engineering, as referenced in this paper, is the inclusion of cybersecurity into the engineering process. This paper addresses several attributes of this process and the long-term goal of developing additional cyber-safety basis analysis and trust principles. With a culture of free information-sharing exchanges, and potentially a lack of security expertise, new risk analysis and design methodologies need to be developed to address this rapidly evolving (cyber) threatscape.

need for cyber informed engineering

Resilience Week 2020 - CIE

Resilience Week CIE Presentation
by Virginia Wright

October 19-23, 2020

Resilience Week

RSA Conference 2019 - Engineering Out the Cyber-Risk

Better Securing the Now and the Next: Applying Engineering Base Principles to Achieve Demonstrably Better Cybersecurity

March 4, 2019
Presented by Andy Bochman and Virginia Wright

CIE - Domestic Nuclear Cyber

An introduction of CIE and how it pertains to nuclear energy and cybersecurity.

By Virginia Wright

nhs Methodology

Contacts

Cyber-Informed Engineering Program Team

Cyber-Informed Engineering (CIE)

 

Email: cie@inl.gov

INL Media Contact

Ethan Huffman

Phone: 208-526-5015

Email: ethan.huffman@inl.gov