Q&A With Nicholas Ryan: Building the Foundation for Cyber Evaluations at Scale
Our energy systems are evolving quickly, and we urgently need new ways to safely explore and protect their future. However, because energy systems are critical resources, we do not want to disrupt them. We need a safe environment where we can test threat scenarios and solutions without impacting the grid.
To achieve that, the U.S. Department of Energy’s National Renewable Energy Laboratory (NREL) created the Advanced Research on Integrated Energy Systems (ARIES) cyber range that allows researchers and partners to study energy systems' interactions with and dependence on digital communication devices and networks.
During Cybersecurity Awareness Month, learn from Nicholas Ryan, an NREL cybersecurity researcher, about his contributions to NREL’s cyber range and how it is enabling researchers to create entire energy systems in a virtual world, unlocking our ability to safely explore cyber vulnerabilities, test mitigation strategies, and de-risk novel technologies.
What is a cyber range?
A cyber range is a collection of simulation tools and capabilities to provide an environment that facilitates cybersecurity research. You can think of it as a sandbox that hosts tool sets that researchers can leverage to answer important research questions about critical infrastructure.
What makes NREL’s cyber range unique?
The NREL cyber range is unique because it features a broad spectrum of tools and capabilities, unlike other existing cyber ranges. These tools and capabilities include automated, multidomain, cyber-physical visualizations and the ability to integrate hardware, such as wind turbines, into our simulations. With these capabilities, we can take a complex power system and visualize it in one view, allowing researchers to easily see the state of the entire system.
Another focus is on future distributed energy system challenges showing cyber-physical impacts at scale—for instance, the result of a cyberattack. Additionally, NREL’s cyber range is supported by industry partnerships, which play a key role in transitioning the applied research that we do in the range into market impact. The results that we conclude in our research can be implemented in the real world.
Building and expanding NREL’s cyber range has been, and continues to be, a collaborative effort. What are you currently working on in the cyber range?
Since I started, my main focus has been to add capabilities to Phenix—an orchestration platform that Sandia National Laboratories developed that enables rapid deployments of large-scale systems—to automate certain components within the experiments. I’m writing software to process files and automate the configuration for this orchestration platform to turn information about a power system into a deployable simulated environment.
More specifically, my role has been to support building an emulation library and scaling it to support larger models. As an example, you might have a power system model that represents an entire metropolitan area—so you would use the capabilities from the emulation library to represent the town, and then you can use the model as a sandbox for performing tests and evaluations.
The next push for the cyber range is to do full automation. Instead of having to manually configure all individual pieces of a cyber-physical power system environment, you could input configuration files, and it would automatically build simulations. It’s cool because it’s never been done before—at least not to this scale—so it’s leading-edge stuff.
How is the emulation library being used in NREL projects?
The emulation library is designed to be the information foundation for the ARIES cyber range. The emulation library creates, stores, and manages the information about assets that can be deployed in the cyber range. It’s essentially a database of knowledge about the range’s capabilities, which can be used to design and deploy our experiments for projects within NREL.
One project I’m working on looks at implementing cloud environments into power systems and seeing how it behaves and if there are any cyber implications. We hope that the results of that project will help define or help give guidance to industry partners for how they can best go about implementing cloud solutions in their environments. We can show them that we’ve run these experiments in NREL’s cyber range to prove out certain situations.
Why is it important to evaluate energy systems in a virtual environment? How does that translate to the real world?
Because energy systems are critical resources, we do not want to disrupt them. The biggest reason why it's important to evaluate them in a virtual environment is because it gives us a safe sandbox that we can use to test things in a repeatable way. If there's any disruption to these simulations, there's no real-world impact.
Further, because of this repeatability and the ability to model a wide range of power systems in our simulations, these environments give researchers the means to back their work with the scientific method.
Cybersecurity for energy systems is essential. What are the challenges or opportunities of working in such a crosscutting specialty?
From my perspective, the biggest challenge is that what we're doing has never really been done before. It’s very leading-edge, and there's a lot of challenges that come with that. I think the biggest one is that it can sometimes be difficult to find supporting research simply because it doesn't exist. As a software developer too, the software needs of the range don't yet exist in industry. We can't always pull from open-source code or industry code. We must implement these tools from scratch—it's trailblazing in a lot of ways.
How did you become interested in cybersecurity for energy systems? What led you to NREL?
I've always had a fascination with cybersecurity. But it was from starting at NREL that I realized the importance of energy systems and how critical they are to protect because of how big of an impact they would have if they were disrupted. The big thing that led me to NREL was its mission and the impact that this mission has on the real world. Traditionally, cybersecurity is applied to information technology infrastructure. While this benefits these companies, applying cybersecurity to critical infrastructure such as energy systems benefits everyone. It’s this aspect that has held my interest and grown my passion for cybersecurity in this space.
What do you enjoy most about working on NREL’s cyber range?
For me, it's the variety of work. I never thought I'd be doing something like this with a computer science degree. The nature of what I do is very interesting. I didn't even know this space existed as a career, so being able to work on these simulations, scale these systems, represent thousands of devices, and do these huge, complex simulations has been fascinating. I think the biggest one is working for an organization like NREL with the mission that it has. That has been the main driving force because of the real-world impact that my work has.
When people ask what you do, what do you say?
My elevator pitch is that I provide these simulation environments that researchers can use to make the energy systems we use more resilient. The reason why it's important is because of the impact that it has if something goes wrong. Natural hazards and human threats that affect grid reliability have the potential to affect everyone because of how reliant we are on electricity. Our society is built around this, and it's a core piece of our everyday lives, so if it’s interrupted, it can have significant negative impacts. Cybersecurity for energy systems is vital.
What do you do for fun outside of work?
When I'm not staring at screens all day, I like to do all the outdoor activities that Colorado has to offer. I'm very big into mountain biking—that's probably my sport of choice. Outside of that, I enjoy hiking, camping, and when it gets a little snowier, I like to ski. Really anything that gets me outside and exercising.
With connection to more than 20 MW of energy systems hardware, the cyber range provides one of the most advanced simulation environments for the evaluation of emerging threats, natural hazards, and impacts of energy disruption. Learn more about NREL’s ARIES cyber range, its advanced research capabilities, and its applications.