Everyday life depends on a robust infrastructure network that provides access to running water, communications technology and electricity, among other basic necessities. The experts who keep our national infrastructure secure and resilient also need a strong network to share their knowledge and train the next generation of professionals capable of solving complex infrastructure challenges. This means finding ways to bring government, academia and the private sector together. One way is through sabbaticals that temporarily place professors in our national labs.
Daniel Cole, an associate professor at the University of Pittsburgh, partnered with the Idaho National Laboratory (INL) in 2024 to study transformative approaches that increase effective and efficient security and resilience for America’s power systems and other critical infrastructure. For nearly a year, Cole worked alongside INL researchers to learn and improve the cybersecurity of industrial control systems that manage essential services such as electricity, transportation, supply chains and water quality.
This collaboration enhanced Cole’s understanding of how to ensure critical functions during cyberattacks or exposed vulnerabilities. He also built partnerships that will help develop the next generation of experts dedicated to protecting the nation’s critical infrastructure. These sabbaticals with INL are available to others in academia and contribute to solving the nation’s most complex problems.
Engineering legacy
Cole grew up in a family of engineers — his father and two brothers are all engineers. As an acclaimed control systems engineer, he has mentored and developed the next generation of engineers. He created the SHURE-Grid program at the University of Pittsburgh in 2023. SHURE-Grid is a summer program that provides an opportunity for students from various fields to explore the intersection of cybersecurity and the energy grid. The program enabled students to work closely with INL experts.
Over 12 weeks, participants learned about the power grid’s significance and developed recommendations to protect it from cyberattacks. SHURE-Grid’s interdisciplinary nature included meetings with cybersecurity and IT professionals, culminating in students presenting their findings to Department of Energy employees.
Cole’s engineering perspective and expertise often led him to identify a recurring gap in the nation’s critical power systems infrastructure: assessing cyber vulnerabilities. He saw the benefits of an increasingly digitized world but also the need to address the increased vulnerabilities that come with the higher efficiency of digitized industrial control systems.
More than data
Cole’s partnership with INL highlights a crucial aspect of cybersecurity that is often overlooked. When people think of cybersecurity, they tend to focus on digitized data protection. However, critical infrastructure cybersecurity, also known as operational technology cybersecurity, encompasses much more. It involves safeguarding the industrial control systems that manage critical assets like utilities, communications technology and transportation. Protecting these systems, especially their critical functions, is vital for maintaining many of the services consumers use daily and take for granted, making infrastructure cybersecurity an indispensable aspect of our modern world.
“The main approach we have now is what I would call traditional information technology cybersecurity, and the fact of the matter is there’s lots of operational technology,” Cole said. “The computers and devices that run our machines are a whole different class of thing. It’s more than just securing data: it’s securing physical devices and machines.”
A novel approach
Cole’s partnership with INL allowed him to collaborate with the team behind Cyber-Informed Engineering (CIE), a methodology developed at INL that integrates cybersecurity considerations into the design and operation of critical infrastructure systems.
By embedding cybersecurity principles into systems from the outset, CIE aims to “engineer out” potential cyber risks, enhancing the resilience and security of essential services. This proactive approach addresses vulnerabilities inherent in digital technologies, ensuring systems remain robust against cyber threats throughout their life cycle.
“I think (CIE) can have a huge impact in terms of how we can improve OT security and industrial control systems,” Cole said.
CIE is particularly critical for power systems, where disruptions can lead to significant economic impact and even loss of life. With industrial control systems increasingly relying on digital technologies, cybersecurity must be integrated into the entire life cycle of critical infrastructure.
One way Cole supported CIE was by expanding on INL’s formal methods research. Formal methods are techniques that use mathematical models to test complex systems. This approach enhances a system’s reliability beyond traditional testing. Formal methods are gaining traction in safety-critical systems because their rigor and precision help identify exploitable weaknesses and vulnerabilities before they can cause harm.
During his sabbatical, Cole worked with INL experts to enhance his understanding of CIE and formal methods, and how to leverage both to protect critical infrastructure. He also continued mentoring students, some already involved with INL and others from different universities as well. This included Robert Lois, a Pitt graduate student who had been working with INL on a Laboratory Directed Research and Development (LDRD) project.
LDRD is a vital program that enables INL to support potentially high-value research and development projects. These projects foster creativity and stimulate the exploration of new scientific and technological frontiers, often leading to novel solutions to complex problems. In Cole’s case, collaborating with Lois and others on an LDRD project had additional benefits. By expanding formal methods research, Cole gained deeper insights. He now has students working on formal methods projects that he can expertly guide.
Future impact
Partnering with INL allowed Cole to integrate CIE cybersecurity practices into his work, enhancing his expertise and helping him teach the resilience of industrial control systems to a new generation of experts. The resulting impact will be a generation of engineers who are better equipped to defend against threats to our nation’s critical infrastructure. This impact is not lost on Cole, who expressed deep appreciation for the freedom INL provided him to explore new avenues of research. It allowed Cole to carry knowledge and ideas back to the University of Pittsburgh and it also enriched INL by introducing fresh perspectives.
The experience will lead to impactful research and potentially new collaborative projects, Cole said, highlighting the broader influence of his time at INL. He said his sabbatical provided value that extends beyond immediate program objectives and contributes to further advancements in science and technology.
“My collaboration with INL was invaluable for two reasons,” Cole said. “It enriched INL’s research by introducing outside viewpoints to what they’re already doing, and it also allowed me to bring cutting-edge knowledge back to my institution and my students, shaping the next generation of experts in a critical field.”
Learn more about INL’s national security mission and explore collaboration opportunities at inl.gov/national-security/.
