You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Engineering Trustworthy Secure Systems provide? (Section 10) Acronyms.................................................................................................47 | Appendix A. Acronyms.................................................................................................47 | | | Appendix B. Glossary | Appendix B. Glossary | ...................................................................................................49 | | Appendix C. Security Policy and Requirements | Appendix C. Security Policy and Requirements | ........................................................64 | | C.1. Security Policy | C.1. Security Policy | .........................................................................................................64 | | C.2. | Security Requirements | ............................................................................................65 | | C.3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does U.S. Department of Energy Risk Assessment Methodology say about GLOSSARY? (Part 26) According to U.S. Department of Energy Risk Assessment Methodology, GLOSSARY: ls) and applications programs, and routines which protect data handled by an ADP system and its resources. SPOOFING The deliberate act of inducing a user or a resource into taking an incorrect action. STAND ALONE, SINGLE-USER SYSTEM A system that is physically and electrically isolated from all other systems, and is intended to be used by one person at a time, with no data belonging to other users remaining in the system (e.g., a personal computer with removable storage media such as a floppy disk). SYNCHRONIZED CLOCKS Mechanism that may be used to provide "liveness" assurance in support of authentication. SYSTEM An assembly of computer hardware, software, or firmware configured for the purpose of classifying, sorting, calculating, computing, summarizing, transmitting and receiving, storing, controlling or receiving data with a minimum of human intervention. SYSTEM HIGH SECURITY MODE The mode of operation in which the computer system and all of its connected peripheral devices and remote terminals are protected in accordance with the requirements for the highest security level of material contained in the system at that time. All personnel having access to the system have a security clearance, but not a need-to-know, for all material then contained in the system. SYSTEM INTEGRITY The state that exists when there is complete assurance that under all conditions an ADP system is based on the logical correctness and reliability of the operating system, the logical completeness of the hardware and software that implement the protection mechanisms, and data integrity. SYSTEM SECURITY OFFICER (SSO) The person (s) responsible for ensuring thatsecurity is provided for and implemented throughout the life cycle of an AIS from the beginning of the concept development phase through its design, development, operation, maintenance, and secure disposal.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: U.S. Department of Energy Risk Assessment Methodology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for Media Sanitization say about optical disk? According to Guidelines for Media Sanitization, optical disk: A plastic disk that is read using an optical laser device.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Media Sanitization.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2009 Annual Report say about Securing the Domain Name System (DNS)? (Part 1) According to Computer Security Division 2009 Annual Report, Securing the Domain Name System (DNS): Securing the Domain Name System (DNS) The Domain Name System (DNS) is a global distributed system in which Internet addresses in mnemonic form such as http:// csrc.nist.gov are converted into the equivalent numeric Internet Protocol (IP) addresses such as 129.6.13.39. Certain servers throughout the world maintain the databases needed, as well as perform the translations. A DNS server that is performing a translation may communicate with other Internet DNS servers if it does not have the data needed to translate the address itself. As with other Internet-based systems, DNS is subject to several threats. To counter these threats, the Internet Engineering Task Force (IETF)-an international standards body-developed a set of specifications for securing DNS called DNS Security Extensions (DNSSEC) to provide origin authentication and data integrity for all responses from the DNS. In partnership with the Department of Homeland Security, NIST has been actively involved in promoting the deployment of DNSSEC since 2004. As part of this continuing effort, we published guidelines for DNSSEC deployment in NIST SP 800-81, Secure Domain Name System (DNS) Deployment Guide , in May 2006. This year, the first revision was begun (SP 800-81r1). The revision includes updated configuration and operational guidance based on lessons learned from early deployments. Some of these changes include: - Aligning cryptographic algorithm and key recommendations with NIST approved algorithms and key sizes; - Guidance on the use of Next Secure 3 (NSEC3) DNS Resource Record that presents authenticated denial of existence so as to minimize information leakage; and - Guidance on cryptographic algorithm rollover and DNSSEC deployment in split zones (e.g., firewall, Network Address Translation (NAT)) environments.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Building a Cybersecurity and Privacy Learning Program say about 1.6.2. Senior Leadership? (Part 2) According to Building a Cybersecurity and Privacy Learning Program, 1.6.2. Senior Leadership: being granted access to system resources Agencies and organizations should form a Senior Leadership Committee that meets regularly with CPLP managers to discuss strategy and provide resource support. The CPLP managers will provide the Senior Leadership Committee with regular reports on the CPLP's performance throughout the year. If there is an emerging risk or new threat that needs to be addressed in the CPLP, the Senior Leadership Committee can connect the learning team with operational teams and SMEs who can provide learning content and resources. Organizations may also include employee representatives as stakeholders in the Senior Leadership Committee to ensure that they have a voice in decision-making.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Building a Cybersecurity and Privacy Learning Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Wireless Infusion Pumps in Healthcare Delivery Organizations provide? (Section 5) ing number of infusion pumps connecting to networks, the vulnerabilities and risk factors become more critical, as they can expose the pump ecosystem to external attacks, compromises, or interference. SOLUTION The NCCoE has developed cybersecurity guidance, NIST Special Publication (SP) 1800-8: Securing Wireless Infusion Pumps, by using standards-based commercially available technologies and industry best practices to help HDOs strengthen the security of the wireless infusion pump ecosystem within healthcare facilities. This NIST cybersecurity publication provides best practices and detailed guidance on how to manage assets, protect against threats, and mitigate vulnerabilities by performing a questionnaire-based risk assessment. In addition, the security characteristics of the wireless infusion pump ecosystem are mapped to currently available cybersecurity standards and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. Based on our risk assessment findings, we apply security controls to the pump’s ecosystem to create a “defense-in-depth” solution for protecting infusion pumps and their surrounding systems against various risk factors. Ultimately, we show how biomedical, networking, and cybersecurity engineers and IT professionals can securely configure and deploy wireless infusion pumps to reduce cybersecurity risk. While the NCCoE used a suite of commercial products to address this challenge, this guide does not endorse these particular products, nor does it guarantee compliance with any regulatory initiatives. Your organization's information security experts should identify the products that will best integrate with your existing tools and IT system infrastructure. Your organization can adopt this solution or one that adheres to these guidelines in whole, or you can use this guide as a starting point for tailoring and implementing parts of a solution.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control BA-123 in Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio? (Part 32) Control BA-123: another risk refers to an outage of the customer help desk, there may need to be a third risk in the register that considers the likelihood and impact of an outage that affects both services at once. It is also important to identify cascading risks where one primary risk event may trigger a secondary and even a tertiary event. Analysis of the likelihood and impact of these first-, second-, and third-order risks is described in Sec. 3.3. During the threat modeling process, the practitioner needs to look out for and mitigate instances of cognitive bias. Some common issues of bias include: - Overconfidence - The tendency for stakeholders to be overly optimistic about risk scenarios (e.g., unreasonably low likelihood of a threat event, overstated benefits of an opportunity, exaggerated estimation of the ability to handle a threat) - Groupthink - Rendering decisions as a group about potential threat sources and threat events in a way that discourages creativity or individual responsibility - Following trends - Blindly following the latest hype or craze without a detailed analysis of the specific threats facing the organization - Availability bias - The tendency to focus on issues (such as threats) that come readily to mind because one has heard or read about them, perhaps in ways that are not representative of the actual likelihood of a threat event occurring and resulting in adverse impact ## 3.2.3. Determination of Exploitable and Susceptible Conditions The next key input to risk identification is understanding the potential conditions that enable a threat event to occur. It is important to consider all types of vulnerabilities in all assets, including people, facilities, and information. For this document, vulnerability is simply a condition that enables a threat event to occur. It could be an unpatched software flaw, a raw material limitation, a process that leads to human error, or a physical environmental condition (like a wooden structure being flammable).

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2008 Annual Report say about Policy Machine? (Part 1) According to Computer Security Division 2008 Annual Report, Policy Machine: Policy Machine As a major component of any operating system or application, access control mechanisms come in a wide variety of forms, each with their individual attributes, functions, methods for configuring policy, and a tight coupling to a class of policies. A natural consequence of the deployment of many heterogeneous systems is a lack of interoperability. A lack of interoperability may not be a problem for systems that can adequately operate independently of one another, but access control mechanisms require interoperability to function efficiently. Users with vastly different credentials have a need to access resources protected under different mechanisms, and resources that are protected under different mechanisms differ vastly in their sensitivity and therefore accessibility. This lack of interoperability introduces significant privilege and identity management issues. Interoperation is one problem associated with today's access control operations. Another problem pertains to policy enforcement. Since the early days of shared computing, research programs have focused on creating access control models that support specific organization and resource sensitivity requirements. Of the numerous recognized access control policies, today's operating systems (Oss) are limited to the enforcement of instances of Discretionary Access Control (DAC) and simple variations of Role-Based Access Control (RBAC) policies, and to a far lesser extent, instances of Mandatory Access Control (MAC) policies. As a consequence, there are a number of important policies (orphan policies) that lack a commercially viable OS mechanism for their enforcement. Among these orphan policies is the need to combine arbitrary policies. To fill policy voids, policies are routinely accommodated through the implementation of access control mechanisms at the application level.

Explanation: NIST publication on credential and access management. Topics: access control, identity management, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2008 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.4 Objective 4 -User Compliance With External Requirements according to NIST Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls, 5.4 Objective 4 -User Compliance With External Requirements: In connection with all system related activities, users should undertake to assure compliance with all external system requirements, incuding: 1. Legal. 2. 2.. Regulatory. 3. Interagency and intraagency. 4. Internal and external auditor needs.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-15413 in Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations? (Part 303) Control PS-15413: isclosed financial information of public companies that trade on global stock markets. Upon discovery of the attack, ABC Company could face significant reputational harm due to the negative publicity. ABC Company's customers may engage in legal action against ABC Company as a result of their failure to appropriately patch known vulnerabilities in their software products. ## Mitigating Strategies ABC Company identified the following areas for improvement in order to enhance their secure software development practices and improve the confidence in their products: - Ensure that developers receive training on secure development practices and are instructed on the use of vulnerability tooling so that developed software is secure. - Ensure that reused system components - whether developed internally or open source - are evaluated as part of a standard process for known vulnerabilities (Ref. SA-15). - Maintain a system component inventory to aid in maintenance of the software product throughout its life cycle (Ref. CM-8). - Continuously monitor system components for vulnerabilities that arise, and ensure that appropriate processes are in place for expeditious remediation once a fix is available. Automate this process where possible (Ref. CA-7, RA-5). Table 13.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Subject according to NIST Test Personal Identity Verification (PIV) Cards Version 2? Subject: CN=Test Cardholder XII, ou=Test Agency, ou=Test Department, o=U.S. Government, c=US

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out say about INCIDENT RESPONSE TEAM? According to Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out, INCIDENT RESPONSE TEAM: - o Computer Security Act of 1987, (Pub. L 100-235) - o OMB Circular A-130, Appendix III, Security of Federal Automated Information Systems - o NIST SP 500-166, Computer Viruses and Related Threats: A Management Guide - o NIST SP 500-170, Management Guide to the Protection of Information Resources - o NIST SP, Establishing a Computer Security Incident Handling Capability, 1991 - o Organizing a Corporate Anti-Virus Effort, Alan Fedeli, 1991 - o Security Policy Handbook, P. Holbrook and J. Reynolds, 1991 - o Responding to Computer Security Incidents: Guidelines for Incident Handling, E.E, Schultz, D.S. Brown, and T.A. Longstaff, 1990

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain ABSTRACT according to NIST Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events According to Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events, ABSTRACT: Ransomware, destructive malware, insider threats, and even honest user mistakes present ongoing threats to organizations. Organizations' data, such as database records, system files, configurations, user files, applications, and customer data, are all potential targets of data corruption, modification, and destruction. Formulating a defense against these threats requires two things: a thorough knowledge of the assets within the enterprise, and the protection of these assets against the threat of data corruption and destruction. The NCCoE, in collaboration with members of the business community and vendors of cybersecurity solutions, has built an example solution to address these data integrity challenges. Multiple systems need to work together to identify and protect an organization's assets against the threat of corruption, modification, and destruction. This project explores methods to effectively identify assets (devices, data, and applications) that may become targets of data integrity attacks, as well as the vulnerabilities in the organization's system that facilitate these attacks. It also explores methods to protect these assets against data integrity attacks using backups, secure storage, integrity checking mechanisms, audit logs, vulnerability management, maintenance, and other potential solutions.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2010 Annual Report provide? (Section 160) ERO AA infrastructure includes Federal Emergency Response Officials (FEROs), State/Local/Tribal/Private Sector Emergency Response Officials (SLTP-EROs) and the FEMA Disaster Reserve Workforce (DRW). The system supports the establishment, conveyance and validation of Identity Credentials (ICs), Attribute Credentials (ATs) and Deployment Authorization Credentials (DAs). Apart from enumeration of the types of EROs and their associated author ity domains (called major players) and types of credentials, the conceptualization of the framework for ERO-AA infrastructure includes detailed description of various component services un der three major service classes: Credentialing Service Class, Iden tity Verification and Attribute Validation Service Class and Trust Federation Service Class. The framework is predicated upon the use of trusted tokens capable of supporting biometric as well as secret key based identity authentication. Dr. Ramaswamy Chandramouli mouli@nist.gov Ms.Teresa Schwarzhoff teresa.schwarzhoff@nist.gov Group: Systems and Emerging Technologies Security Research Web services are currently a preferred way to develop and pro vide complex services. This complexity arises due to the com position of new services and dynamically invoking existing services. These compositions create service inter-dependencies that can be misused for monetary or other gains. When a mis use is reported, investigators have to navigate through a collec tion of logs to recreate the attack. In order to facilitate that task, the report proposes creating forensics web services (FWS) that would securely maintain transactional records between other web services. These secure records can be re-linked to reproduce the transactional history by an independent agency. The report demonstrates the necessary components of a forensic frame work for web services and its success through a case study. Dr.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, token. Contains security framework guidance for authentication systems. Source: Computer Security Division 2010 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Purpose of the Conference according to NIST Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974 According to Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974, Purpose of the Conference: The second of two national conferences on Privacy and Security in Computer Systems was held at the National Bureau of Standards on March 4-5, 1974, to continue the dialog in search of ways to safeguard confidential information in automated systems. The first conference, held in November, 1973, featured governmental spokesmen who described the nreds and problems of Federal, state and local agencies in protecting confidential and valuable data from loss or misuse while at the same time providing free access to information concerning the public's business.' The second conference provided the opportunity for persons or organizations to offer views and proposals on how these governmental issues might be resolved. The conference was attended by 376 persons: 265 from government and 111 from the private sector. The attendees represented four congressional offices, 36 Federal agencies, 23 states, six municipalities, 33 computer companies or consulting organizations, three trade associations, and 20 professional associations, universities and public interest groups. Total registration at both conferences was 886. In his welcoming remarks. Dr. Richard W. Roberts, Director, National Bureau of Standards, observed that this broad spectrum of interest was demonstrative recognition that all groups must work together in harnessing the highly automated information systems that serve so many areas of our society. Dr. Betsy Ancker-Johnson, Assistant Secretary for Science and Technology, Department of Commerce, noted that the President's February 23, 1974, statement on the American Right to Privacy accentuated the crucial nature of the privacy issue and the urgency of purpose represented by the conference objectives.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IR-7864 in The Common Misuse Scoring System (CMSS)_ Metrics for Software Feature Misuse Vulnerabilities? (Part 4) Control IR-7864: roduce a severity score for each vulnerability. CMSS enables organizations to make security decisions based on a standardized quantitative assessment of their vulnerability to software feature misuse. 1 2 3 ## Table of Contents | 1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: The Common Misuse Scoring System (CMSS)_ Metrics for Software Feature Misuse Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Securing Public Web Servers say about 7.5.1 SSL/TLS Capabilities? (Part 1) According to Guidelines on Securing Public Web Servers, 7.5.1 SSL/TLS Capabilities: 7.5.1 SSL/TLS Capabilities SSL/TLS provides the following capabilities to HTTP and other application layer protocols [SSL98]: - GLYPH<c=31,font=/IEIOAF+Webdings> Server AuthenticationSSL/TLS allows a Web client (user) to confirm a Web server's identity. SSL/TLS-enabled Web clients (browsers) can employ standard techniques of public key cryptography to check that a server's name and public key are contained in a valid certificate issued by a CA listed in the client's list of trusted CAs. This confirmation might be important if the user, for example, is sending a credit card number over the network and wants to confirm the receiving server's identity. - GLYPH<c=31,font=/IEIOAF+Webdings> Client AuthenticationSSL/TLS allows a Web server to confirm a user's identity using the same techniques as those used for server authentication by reversing the roles. SSL/TLS-enabled Web 49 Proper understanding of SSL and the information presented in this section requires at least a basic understanding of cryptographic algorithms, message digest functions, digital signatures, symmetric encryption algorithms, and asymmetric encryption algorithms. For an introduction to cryptography, see NIST SP 800-32, Introduction to Public Key Technology and the Federal PKI Infrastructure . For more information on transport layer security, see NIST SP 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations . Both of these documents can be found at http://csrc.nist.gov/publications/nistpubs/. 50 SSL versions before 3.0 are insecure and should not be used. 51 http://www.ietf.org/rfc/rfc2246.txt server software can confirm that a client's certificate is valid and was issued by a CA listed in the server's list of trusted CAs. 52 This confirmation might be important if the server, for example, is a bank that is sending confidential financial information to a customer and wants to confirm the recipient's identity.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Guidelines on Securing Public Web Servers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Securing Web Transactions_ TLS Server Certificate Management? (Part 380) Control HA-1: Create a New Notification, take the following steps: 4. When finished, click Save Changes. | Email Address | Enter the email address of the person to whom the audit log notifications are to be sent. | |-----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Division | In the drop-down, select the divisions whose account activity needs to be monitored. | | Notify me about | Check any of the following options: • Order Changes Alerts if any changes are made to certificate orders. • User Changes Alerts if any edits are made to any user accounts. • User Logins Alerts of all account logins. • Logins from Invalid IP Addresses Alerts if any account logins are made from invalid IP addresses. • Certificate Revocations Alerts to all certificates are revocations. | The designated individual should start receiving the selected audit log notifications. ## Notification Management Typically, notifications are not strictly required when utilizing Venafi to manage certificates, as expiring certificates are renewed automatically (or not) based on configured policy within Venafi. However, it is beneficial to configure renewal notifications within CertCentral. ## 2.3.3.4.1 Account Notifications Before sending email from an account, assign an email address to receive a copy of any message sent (e.g., approval notifications). Configure renewal notifications and add default renewal messages that include renewal notifications. <!-- image --> ## 2.3.3.4.2 Set Up Email Notification Accounts 1. In the CertCentral account's sidebar menu, click Settings > Notifications. 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings provide? (Section 318) instability and may cause severe network performance problems. Studies of BGP have considered convergence [10, 20, 34] and possible optimizations to control and accelerate it [11, 19, 21, 23, 30, 38]. Because BGP is central to Internet functionality and is vulnerable to malicious actors, we need to secure the information that BGP distributes. We consider each component: - GLYPH<15> Origin authentication considers whether the originating AS really controls a claimed IP address range. - GLYPH<15> Path authentication considers whether a claimed path to reach some IP prefix is in fact valid. The dominant security solution, Secure BGP (SBGP) [17] focuses on the Update messages. The first step of S-BGP is to set up public key infrastructures to help establish the authenticity of the involved parties. S-BGP uses X.509 [12] public key certificates and puts BGPrelated information into certificate extensions. Speakers digitally sign the Update messages they announce to peers; with these X.509 certificates, recipients can verify the signatures to authenticate the received routes. More specifically, each speaker uses address attestations (AAs) for origin authentication, and route attestations (RAs) for path authentication. Figure 1: Sketch of the S-BGP PKIs. <!-- image --> To enable validation of attestations, S-BGP proposes two X.509 public key infrastructures. The first PKI contains certificates to authenticate the owners of portions of the IP address space . The second PKI is to authenticate BGP speakers, ASes, and the owners of ASes. Figure 1 illustrates the structures of these PKIs. Both PKIs are hierarchies rooted at ICANN [15]. ICANN issues itself selfsigned certificates and further issues certificates to the the first tier of organizations, typically Regional Internet Registries (RIRs) such as ARIN, RIPE, APNIC, and LACNIC. PSfrag replacements ASes, and BGP speakers. The AS number authentication is similar to address allocation authentication.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2009 Annual Report provide? (Section 89) er development. NIST has initiated the development of CTSs for selected international versions of biometric data interchange formats. The associated sample data will also be generated. Research is planned on the need for the development of additional CTSs to test implementations of new biometric technical interface standards being developed. NIST will also research the adaptation of existing modules to our architecture. The detailed analysis of the base standards that are the target of our CTS development has already led to a number of technical contributions towards the development of national and international biometric standards taking place in INCITS and JTC 1/SC37 (e.g., finger minutiae and finger image standards, conformance testing methodology standards). The Biometric Consortium (BC), co-chaired by NIST and NSA, serves as a focal point for research, development, testing, evaluation, and application of biometric-based personal identification/ verification technology. The BC's primary function is to organize and host an annual conference, which enables federal government participants to engage in exchanges with national and international participants on topics such as biometric technologies for defense, homeland security, identity management, border crossing and electronic commerce. The 2009 conference, co-sponsored by NIST, NSA, DHS, DoD Biometrics Task Force, the National Institute of Justice (NIJ), GSA, the Volpe National Transportation Systems Center, and the Armed Forces Communications and Electronics Association (AFCEA), was held September 22-24. It addressed the important role that biometrics can play in the identification and verification of individuals in government and commercial applications worldwide.

Explanation: NIST publication on credential and access management. Topics: identity management, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for Securing Radio Frequency Identification (RFID) Systems say about 1.1 Authority? According to Guidelines for Securing Radio Frequency Identification (RFID) Systems, 1.1 Authority: The National Institute of Standards and Technology (NIST) developed this document in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets; but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), 'Securing Agency Information Systems,' as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III. These guidelines have been prepared for use by Federal agencies. They may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright, though attribution is desired. Nothing in this document should be taken to contradict standards and guidance made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority, nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Telehealth Remote Patient Monitoring Ecosystem provide? (Section 242) |  Ability to detect unauthorized hardware and software components. |  Providing details for how to establish unique identification for each IoT device associated with the system and critical system components within which it is used.  Providing IoT device customers with the details necessary to establish and implement unique identification for each IoT device associated with the system and critical system components within which it is used.  Providing IoT device customers with the details necessary to require unique identifiers for each IoT device associated with the system and critical system | 45 C.F.R. §§ 164.308(a)(1)(ii)(A) 164.308(a)(4)(ii)(A) 164.308(a)(7)(ii)(E) 164.308(b) 164.310(d) 164.310(d)(2)(iii) | | ID.AM-2: Software platforms and applications within the organization are inventoried. |  Ability to identify software loaded on the IoT device based on IoT device identity.  Ability to detect unauthorized hardware and software components. | N/A | 45 C.F.R. §§ 164.308(a)(1)(ii)(A) 164.308(a)(7)(ii)(E) | | ID.AM-4: External information systems are catalogued. | N/A |  Providing documentation detailing all the cloud services used to support the IoT device. | 45 C.F.R.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control WE-1272 in Metrics and Methodology for Hardware Security Constructs? (Part 14) Control WE-1272: | 0 | 0 | 0 | 2 | | CWE-1191 | 0 | 0 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 5 | | CWE-1231 | 0 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 2 | | CWE-1233 | 0 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 2 | | CWE-1274 | 0 | 0 | 0 | 0 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 5 | | CWE-1260 | 0 | 0 | 0 | 0 | 1 | 1 | 0 | 1 | 1 | 0 | 0 | 4 | | CWE-1240 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 2 | | CWE-1256 | 0 | 0 | 0 | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 1 | 3 | | Threat

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Metrics and Methodology for Hardware Security Constructs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2015 Annual Report provide? (Section 93) etworking. The conference continues to be a valuable forum for individuals from government, industry, and academia who are involved with information systems/ cybersecurity workforce development. Attendees gain insights regarding information security awareness, training, education, certification, and professionalization. Attendees also learn of ongoing and planned training and education programs and cybersecurity initiatives. It provides NIST the opportunity to provide assistance to departments and agencies as they work to meet their FISMA responsibilities. The FISSEA website provides links to the Conference Program, and also links to presentations (http:/ /csrc.nist. gov/fissea). The next conference will be held at NIST on March 15-16, 2016. http:/ /csrc.nist.gov/fissea Ms. Patricia Toth (301) 975-5140 Ms. Peggy Himes (301) 975-2489 peggy.himes@nist.gov patricia.toth@nist.gov Since the inception of this Advisory Board in 1987, the Information Security and Privacy Advisory Board (ISPAB) has successfully renewed its charter with proper authority every two years. The Board plays a central and unique role in providing the government with expert advice concerning information security and privacy issues that may affect federal information systems. Title III of the E-Government Act of 2002 reaffirmed the need for this Board by giving it an additional responsibility: to thoroughly review all of the proposed information technology standards and guidelines developed under Section 20 of the National Institute of Standards and Technology Act (15 U.S. Code (U.S.C.) 278g3), as amended. The ISPAB is a federal advisory committee with specific statutory objectives to identify emerging managerial, technical, administrative, and physical safeguard issues related to information security and privacy. The Board was originally created by the Computer Security Act of 1987 (P.L.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2015 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain <IssuerIdentificationNumber>: according to NIST Representation of PIV Chain-of-Trust for Import and Export According to Representation of PIV Chain-of-Trust for Import and Export, <IssuerIdentificationNumber>:: This element is optional and if used occurs only once. The element consist of six characters for the department code, four characters for the agency code, and a five-digit number that uniquely identifies the issuing facility within the department or agency. The <IssuerIdentificationNumber> element is the value for Zone 2B on the back of the PIV Card. The data is provided in an xs:string format.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Representation of PIV Chain-of-Trust for Import and Export.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Survey Findings according to NIST Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST According to Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST, Survey Findings: Although all of the scientists interviewed keep some form of research notebooks, their notekeeping practices and styles vary. The majority of them keep a combination of handwritten notes and electronic notes. Most scientists consider notekeeping to be solely for documenting important research progress, procedures and results. Presently, security and legal concerns are not considered a major issue, although this may change in the future. The most important requirement that was expressed for an ERN is ease of use. Information must be entered in an effortless manner and must be cost-effective in order for the ERN to be acceptable to the scientists and managers. Basically, the ERN must do everything that a pencil and paper can do, with value-added. Writing and drawing in a paper-based notebook will be replaced by an ERN system with textand image-processing capabilities, and possibly with a scanner as well. The tools for making different types of notebook entries must be provided and integrated so that it is possible to link different objects together and still allow the retrieval of a specific object if desired. Each committed entry should be signed by the author using digital signature technology. The signed entry should also be sent to an independent time-stamping server in order to obtain an official time-stamp.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does ANSI_NIST-ITL 1-2011 Requirements and Conformance Test Assertions provide? (Section 178) gle image. This field is mandatory if an image has been stitched, and the value shall be set to 'Y'. Otherwise, this field shall not appear in the record. Reserved for future useonly by ANSI/NIST-ITL. D 14.027-SIF Conditional <See Requirement ID: “Field: 14.027-Stitched Image Flag Dependent”> - 14.028, 14.029 Reserved <See Requirement ID: “Field: Type14- CondCode>. 8.14.27, Table 67 <Table 67 lists the value constraints for DMM.> 1 O 14.030- DMM {14.030} MO ASCII(CONTROLLED, ASSISTED, OBSERVED, UNATTENDED, UNKNOWN) 8.14.28, Table 67 <Table 67 lists the value constraints for FAP.> 1 O 14.031-FAP {14.031} MO [10, 20, 30, 40, 45, 50, 60] Table 67 Reserved for future useonly by ANSI/NIST-ITL. Table 67 User Defined Fields Table 67 Reserved for future useonly by ANSI/NIST-ITL. 8.14.30, Table 67 8.14.31, Table 67 This is an optional field, listing the operations performed on the original source in order to prepare it for inclusion in a biometric record type. See Section 7.4.1. This is an optional field. See Section 7.7.1.1. - - - 14.032 to 14.199 Reserved 14.200 to 14.900- User Defined 14.901- Reserved <See Requirement ID: “Field: Type14- CondCode>. TRUE <See Requirement ID: “Field: Type14- CondCode>. O 14.902- ANN-Value <See Requirement ID: “Field: xx.902-ANN” >. O 14.903-DUI <See Requirement ID: “Field: Device ID” >. t-2 Value 8.14.32, This is an optional field. See Section O 14.904- <See Requirement ID: “Field: Make Model” >. t-2 131 t-2 t-2 t-2 t-2 t-2 B B B 14.904- Make/Mode l/Serial Number Value Field: 14.905, 14.994- Reserved Field: 14.995- Associated Context Value Field: 14.996- Hash Value Field: 14.997- Source Representati on Value Field: 14.998- Geographic Sample Acquisition Location Value Field: 14.999- Image Data Valid Table 67 7.7.1.2. MMS Value Table 67 Reserved for future useonly by ANSI/NIST-ITL. - 14.905, 14.994- Reserved <See Requirement ID: “Field: Type14- CondCode>.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: ANSI_NIST-ITL 1-2011 Requirements and Conformance Test Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DS-2 in Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? (Part 67) Control DS-2: - Connecting to 192.168.20.117:80... connected. HTTP request sent, awaiting response... 200 OK Length: 10701 (10K) [text/html] Saving to: ‘index.html.12’ 0K .......... 100% 6.05M=0.002s 2019-07-10 18:59:40 (6.05 MB/s) - ‘index.html.12’ saved [10701/10701] (approved): --2019-07-10 18:55:39-- Connecting to 192.168.20.197:80... connected. HTTP request sent, awaiting response... 200 OK NIST SP 1800-15D: Securing Small-Business and Home Internet of Things Devices 160 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 Test Case Field Description Length: 10701 (10K) [text/html] Saving to: ‘index.html.8’ 0K .......... 100% 2.03M=0.005s 2019-07-10 18:55:40 (2.03 MB/s) - ‘index.html.8’ saved [10701/10701] (approved): --2019-07-10 18:59:21-- Connecting to 192.168.20.183:80... connected. HTTP request sent, awaiting response... 200 OK Length: 10701 (10K) [text/html] Saving to: ‘index.html.10’ 0K .......... 100% 17.6M=0.001s 2019-07-10 18:59:21 (17.6 MB/s) - ‘index.html.10’ saved [10701/10701] Procedure 5 (from laptop to pi): [mud@localhost ~]$ wget 192.168.20.222 --2019-07-10 19:03:17-- Connecting to 192.168.20.222:80... failed: Connection refused. Procedure 6 (from device): http://www.facebook.com (unapproved): --2019-07-10 19:17:39-- https://www.facebook.com/ Resolving www.facebook.com (www.facebook.com)... 31.13.71.36, 2a03:2880:f112:83:face:b00c:0:25de NIST SP 1800-15D: Securing Small-Business and Home Internet of Things Devices 161 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 Test Case Field Description Connecting to www.facebook.com (www.facebook.com)|31.13.71.36|:443... failed: Connection refused. Connecting to www.facebook.com (www.facebook.com)|2a03:2880:f112:83:face:b00c:0:25de|:4 43...

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Publication History according to NIST Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile, Publication History: Approved by the NIST Editorial Review Board on 2025-03-25 Supersedes NIST SP 800-61r2 (August 2012) https://doi.org/10.6028/NIST.SP.800-61r2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, csf, fips. General security reference material without sensitive content. Source: Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Trademark Information according to NIST Guidelines for Access Control System Evaluation Metrics According to Guidelines for Access Control System Evaluation Metrics, Trademark Information: All registered trademarks or trademarks belong to their respective organizations.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Access Control System Evaluation Metrics.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective say about Notes on Figure 1 Examples of Cybersecurity SDOs? According to Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective, Notes on Figure 1 Examples of Cybersecurity SDOs: The following Figure 1 illustrates some of the SDOs that have developed cybersecurity standards, in which Federal agencies have had some level of participation. This figure is not intended to be all inclusive. Federal agency participation in these SDOs is driven by each agency's mission and objectives. A brief description of these SDOs, including a few specific subgroups, is given after Figure 1. In addition, based upon history, it is anticipated that other relevant SDOs will appear in the future. Figure 1: Examples of Cybersecurity SDOs <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Policy Machine_ Features, Architecture, and Specification provide? (Section 93) e authority granted to every user through the previous association. Prohibitions are illustrated similarly to associations, but with a different style and orientation of connector. This prohibition denies the user from creating messages within its own inbox, slightly overriding the system-wide authority to create messages in any inbox. -  The association between ID u2 and In u2 allows the user to delete messages from its own inbox. -  To create and delete messages within the containers Out ui, Draft ui, and Trash ui, an association granting such authorization is needed between ID u2 and each of those containers. A few improvements can be made to the current policy specification. For example, a user can update a copy of a sent message residing in its outbox, which can bring about an unwanted inconsistency from what was actually sent. To avoid this situation, the policy can be revised via an obligation that prevents alterations to messages in the user's outbox, once they are written to it. The obligation presumes that draft messages are composed in the sender's drafts folder, and when ready to be sent, copied over in their entirety to newly created message objects in the sender's outbox, before being deleted from the drafts folder. The following obligation accomplishes the write-once restriction through the creation of a user prohibition: Similarly, the current policy allows a user to update messages that it has posted to another user's inbox or messages that other users have posted there. The policy can be extended slightly with an obligation to prevent any alterations to a message after it is initially written to an inbox.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Policy Machine_ Features, Architecture, and Specification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2011 Annual Report provide? (Section 49) sign Principles subgroup continues the work of identifying bottom-up problems and design considerations developed by the former Bottom-up, Vulnerability, and Cryptography and Key Management subgroups. - The High-Level Requirements subgroup addresses the procedural and technical security requirements of the Smart Grid to be addressed by stakeholders in Smart Grid security. To create the initial set of security requirements in NISTIR 7628 v1.0, this subgroup adapted industry-accepted security source documents for the Smart Grid. - The Privacy subgroup continues to investigate privacy concerns between utilities, consumers, and non-utility third parties. - The Standards subgroup assesses standards and other documents with respect to the cybersecurity and privacy requirements from NISTIR 7628. These assessments are performed on the standards contained in the SP 1108, Framework and Roadmap for Smart Grid Interoperability Standards, or in support of the Priority Action Plans (PAPs). - The Testing and Certification subgroup establishes guidance and methodologies for cybersecurity testing of Smart Grid systems, subsystems, and components. Future work includes working with the SGIP - the Committees, the Domain Expert Working Groups, and the Priority Action Plans - to integrate cybersecurity into their work efforts. Collaboration will continue with the Department of Energy and the North American Electric Reliability Corporation to produce a cybersecurity risk management process document for the electricity sector. Reviewing and updating NISTIR 7628, if needed, will occur in early 2012. Developing a virtual test environment for the National Electrical Manufacturers Association's AMI upgradeability standard and creating an assessment guide for assessing the high-level cybersecurity requirements contained in NISTIR 7628 are also slated for the next year.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Securing Radio Frequency Identification (RFID) Systems provide? (Section 201) At this point, the tags may no longer be in the possession of the organization that issued them, but they may still store identifiers or other data that could reveal PII | | # | Federal CIO Council Control Family | Definition | RFID Considerations | |-----|------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | though either direct or indirect means.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, control family, security control. General security reference material without sensitive content. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in 2016 NIST_ITL Cybersecurity Program Annual Report? (Part 72) Control HA-3: unications. ## Part n e r s h i p s External Projects. The TIG funds external projects, including a pilot program that impacted more than 6.7 million individuals in its first four years. These projects aim to catalyze the marketplace to begin developing solutions aligned with the guiding principles. The marketplace is currently transitioning from broad market issues to targeting specific gaps and market impediments as the identity ecosystem matures. The pilots develop and deploy technology, models, and frameworks that wouldn't otherwise exist in the marketplace. In FY 2016, the pilot programs made remarkable progress; the 24 projects include more than 170 partner organizations across 12 sectorsincluding the development or deployment of 14 multi-factor authentication solutions. Over the course of the fiscal year, six new pilots were launched (including five supporting state services and one driving federated identity in healthcare) (See https:/ /www.nist.gov/itl/tig/pilot-projects). Figure 27: NIST employs four primary tactics: partnerships, publications, market intelligence, and communications <!-- image --> Identity Ecosystem Framework. The privatelyled Identity Ecosystem Steering Group (IDESG) laid the groundwork for better digital identity transactions with the release of the Identity Ecosystem Framework (IDEF) in early FY 2016. The IDEF lays a foundation for the Identity Ecosystem by providing a baseline set of requirements that define how to execute transactions involving digital identity that puts users at the center by aligning with the four guiding principles, continually improving online commerce, the efficiency of digital services, and online interactions (see http:/ /www.idesg.org/News-Events/Press-Releases/ ID/74/Identity-Ecosystem-Framework-Released-CreatingUnprecedented-Rules-of-the-Road-for-Online-Identity). Strategic partners.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor. Contains security framework guidance for authentication systems. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector say about D.9.3.1 Configuration? According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector, D.9.3.1 Configuration: -  Behavior Anomaly Detection: Dragos - Configured to receive packet streams from DMZ, Testbed LAN, Supervisory LAN, and Control LAN. -  File Integrity Checking: ForceField - PI Server is configured to use ForceField drive.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain ASSESSMENT OBJECTIVE according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, ASSESSMENT OBJECTIVE: Determine if: A.03.04.04.a: changes to the system are analyzed to determine potential security impacts prior to change implementation. A.03.04.04.b: the security requirements for the system continue to be satisfied after the system changes have been implemented.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector provide? (Section 270) provide data security safeguards for medical images. The Azure solution provides data-at-rest encryption and, through a combination of access control and encryption, provides data security assurance. The NCCoE lab used several different solutions to address data-in-transit encryption. As described in Section 2.6.2, DigiCert PKI, the lab implemented SSL/TLS encryption using DigiCert-issued certificates. Communications between modalities and clinical systems are secured using HIP, as described in Section 2.7.3, Tempered Networks Identity Defined Networking (IDN). Microsoft Azure is a cloud service provider that provides storage and encryption for unstructured data in a remote location separate from the HDO environment. This project used an Azure blob storage account as a remote archive for medical images managed by the VNA. For more information on configuring Azure Storage accounts, including recommended security practices, visit Microsoft's Azure Blob Storage Documentation [13]. To proceed with the following steps, a Microsoft Storage account needs to be established. 1. From a web browser, navigate to https://portal.azure.com/. 2. Log in to the Microsoft account. 3. On the home screen, click Create a resource. 4. Type storage account into the search bar, then click Storage account. 5. On the Storage Account screen, click the Create button. A new screen will appear that requires information to be populated, found in the Basics tab. When complete, click the Next: Networking button. Populate the Basics information using the following values: <!-- image --> <!-- image --> - a. On the Subscription field, select Enterprise from the pull-down menu. - b. Navigate to the Resource Group field . Select the corresponding r esource group. If one is not available, create a new resource group. - c. Navigate to the Storage Account Name field. From the pull-down menu, select the storage account name that had previously been created. - d. Navigate to the Location field.

Explanation: NIST publication on credential and access management. Topics: access control, pki. Contains security framework guidance for authentication systems. Source: Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Smart Card Technology_ New Methods for Computer Access Control say about 6.2 The NBS Biometric Smart Card Access Control System? (Part 2) According to Smart Card Technology_ New Methods for Computer Access Control, 6.2 The NBS Biometric Smart Card Access Control System: number, the identification number of the smart card, and an indication of whether the user's identity is confirmed or rejected. This access control record is encrypted using DES and sent to the host. The host decrypts the record and checks that it is not a playback of a previous record, and then grants or denies access, depending on the information in the record. Files of access control records can be maintained by the host computer as an audit trail for the system. At any time, the last user's fingerprint resident in the fingerprint verification device may be printed out upon request.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Smart Card Technology_ New Methods for Computer Access Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls say about 3.1 Targets? (Part 2) According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls, 3.1 Targets: to modification. We also considered the distinction between analog and digital data. However, this distinction appears to exist primarily in communication links and is not relevant to "remote sites". - 3.1.1.3 Sensitivity : The vulnerability of the data varies with its inherent sensitivity. This inherent sensitivity is a function of quantity, context, age and degree of analysis. - o Quantity : The sensitivity of data increases with quantity along an "S" shaped turve, i.e., the sensitivity increases more slowly with quantity for large quantities. This is because large quantities of data start to look like noise (forest and trees effect). - o Context : The sensitivity of data varies with its context. It tends to increase along an exponential step function with the number of distinct associations such that "employee number" and "salary" taken together are significantly more sensitive than either alone and adding "name" increases the sensitivity by an order of magnitude. - o Interpretation : The sensitivity of data increases with the degree of analysis or interpretation such that raw data is less sensitive than organized data which is less sensitive than the conclusions which may be drawn which are less sensitive than the plans of action. - ° Age : In general, the sensitivity of data decreases with age. However, there are exceptions. - 3.1.1.4 Kind or Use: Three kinds of data were identified. They are user or application data, system or control data, such as security tables, and programs or procedures. There was considerable discussion in the group as to whether or not to treat data and programs separately or together. The majority felt that programs are substantively different from other data and that it would be misleading to treat them together. This author contended that from the perspective of vulnerabilities, programs were the same as other data.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6 Certificate Revocation Lists according to NIST Report of the NIST Workshop on Digital Signature Certificate Management, December 10-11, 1992 According to Report of the NIST Workshop on Digital Signature Certificate Management, December 10-11, 1992, 6 Certificate Revocation Lists: The following "hot list" format is based on that of Internet RFC 1114, with the addition of a reason code. CertificateRevocationList :: signature issuer lastUpdate nextUpdate revokedCertificates

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the NIST Workshop on Digital Signature Certificate Management, December 10-11, 1992.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is This publication is available free of charge from according to Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Cybersecurity Framework Manufacturing Profile? (Part 68) Control AC-1: esides. Physical access controls may include, for example, lists of authorized individuals, identity credentials, escort requirements, guards, fences, turnstiles, locks, monitoring of facility access. | PE-Family, PE-8 | | | | | Moderate | | | | | PR.AC-2 | Protect power equipment, power cabling, network cabling, and network access interfaces for the manufacturing system from accidental damage, disruption, and physical tampering. Ensure availability and integrity of wireless systems, especially safety related systems. Employ redundant and physically separated power systems for critical manufacturing operations. | PE-9 (1) | | | | | High | | | | | | Control physical access to the manufacturing system in addition to the physical access for the facility.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: Permitting authorized individuals to make changes to system logging enables

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST_SP_800-207_Zero_Trust_Architecture say about 3.3 Trust Algorithm? (Part 3) According to NIST_SP_800-207_Zero_Trust_Architecture, 3.3 Trust Algorithm: ocesses that utilize the data (i.e., those responsible for the mission). - Threat intelligence: This is an information feed or feeds about general threats and active malware operating on the internet. This could also include specific information about communication seen from the device that may be suspect (such as queries for possible malware command and control nodes). These feeds can be external services or internal scans and discoveries and can include attack signatures and mitigations. This is the only component that will most likely be under the control of a service rather than the enterprise. The weight of importance for each data source may be a proprietary algorithm or may be configured by the enterprise. These weight values can be used to reflect the importance of the data source to an enterprise. The final determination is then passed to the PA for execution. The PA's job is to configure the necessary PEPs to enable authorized communication. Depending on how the ZTA is deployed, this may involve sending authentication results and connection configuration information to gateways and agents or resource portals. PAs may also place a hold or pause on a communication session to reauthenticate and reauthorize the connection in accordance with policy requirements. The PA is also responsible for issuing the command to terminate the connection based on policy (e.g., after a time-out, when the workflow has been completed, due to a security alert).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-207_Zero_Trust_Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Attribute-based Access Control for Microservices-based Applications using a Service Mesh say about 1.6 Organization of This Document? According to Attribute-based Access Control for Microservices-based Applications using a Service Mesh, 1.6 Organization of This Document: The organization of this document is as follows: - Section 2 provides an overview of a microservices-based application, its security requirements, a brief description of the overall architecture of reference platform for orchestration and resource management of microservices-based applications and the reference service mesh platform. The latter two are used as examples to illustrate the building blocks involved in the deployment recommendations. - Section 3 outlines the advantages of ABAC for the application environment and describes the functional architecture for two of the standard ABAC representations. - Section 4 discusses the building blocks of the authentication and authorization framework, the requirements and recommendations for configuration of policies that are required in the reference orchestration and resource management platform and in the reference service mesh platform for implementing the framework. The recommendations span mechanisms for supporting both end user and service level authentication and authorization policies. The minimal set of policy elements needed in authorization policies are also outlined. - Section 5 discusses some architectural features of the framework such as functionality of a reference monitor, supporting infrastructure, advantages as an ABAC implementation, and enforcement alternatives. - Section 6 provides summary and conclusions.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Attribute-based Access Control for Microservices-based Applications using a Service Mesh.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Page 4, Figure 3 - Suggested Modification/Correction according to NIST A Report on the Privilege (Access) Management Workshop According to A Report on the Privilege (Access) Management Workshop, Page 4, Figure 3 - Suggested Modification/Correction: 'To answer the question, 'Where does privilege management fit in this view?' the suggested modification/correction is to include a taxonomy in place of Figure 3 to show the relationships between identity, credential, access, privilege, attribute, policy, and metadata management and access control. <!-- image --> Privilege management should be used to refer to the management of entity permissions that correlate to attributes and the applicable policies. (More info on this in the next comment.) Metadata management would include the characteristics of resources (i.e., data, files, applications) to which access is controlled. Access control would be the calculations and execution of permissions defined in privilege management.' [Editor: The proffered figure is a good representation of logical relationships, while Figure 3 in this document shows functional relationships. As an aside, the labels 'Policy Decision Point' and 'Policy Enforcement Point' should probably be 'Access Control Decision' and 'Access Control Enforcement' to be consistent with the earlier comment. In any case, the proffered figure is an excellent adjunct to those in the body of this document. The statements following 'Privilege should be used to refer to the management of entity permissions . . .' represent a departure from the view of privilege management taken in this document. As Anil Ramcharan has suggested in his comment, there is more information on this in the next comment, where we will address the issue. [Editor: The figure and caption in the body of the NISTIR that Anil Ramcharan has referred to are as follows (reproduced here for the convenience of the reader): Figure 3. Authentication Management and Privilege Management <!-- image --> -end of Editor comment.]

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: A Report on the Privilege (Access) Management Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Section 146) ement to relevant sub-tier contractors. Departments and agencies should refer to Appendix F to implement this guidance in accordance with Executive Order 14028, Improving the Nation's Cybersecurity . - Level(s): 2, 3 - Control Enhancement(s): - (8) ACCESS ENFORCEMENT | REVOCATION OF ACCESS AUTHORIZATIONS Supplemental C-SCRM Guidance: Prompt revocation is critical to ensure that suppliers, developers, system integrators, external system service providers, and other ICT/OT-related service providers who no longer require access or who abuse or violate their access privilege are not able to access an enterprise's system. Enterprises should include in their agreements a requirement for contractors and sub-tier contractors to immediately return access credentials (e.g., tokens, PIV or CAC cards, etc.) to the enterprise. Enterprises must also have processes in place to promptly process the revocation of access authorizations. For example, in a 'badge flipping' situation, a contract is transferred from one system integrator enterprise to another with the same personnel supporting the contract. In that situation, the enterprise should disable the existing accounts, retire the old credentials, establish new accounts, and issue completely new credentials. - Level(s): 2, 3 - (9) ACCESS ENFORCEMENT | CONTROLLED RELEASE Supplemental C-SCRM Guidance: Information about the supply chain should be controlled for release between the enterprise and third parties. Information may be exchanged between the enterprise and its suppliers, developers, system integrators, external system service providers, and other ICT/OT-related service providers. The controlled release of enterprise information protects against risks associated with disclosure.

Explanation: NIST publication on credential and access management. Topics: authorization, token, sso. Contains security framework guidance for authentication systems. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings provide? (Section 278) with exceptions such as invalid signatures or to ensure that the signed contents is the same as previously sent (since it's within the client's control, a malicious user may change it). - Usable ID enumeration: This filter is triggered by the 'send-usable-ids' command. First, it forces the request to become a POST (even if the browser has sent it as a GET or HEAD). Kapanga then builds a body with a list of PEM-encoded ultimately trusted certificates it has. This is extremely useful because the site can know in advance which identities we can assume, inform the user which ones are acceptable or not and help the user select an appropriate one for login or registration, reducing the likelihood of frustrating failures. The webmasters we have been working with point this particular feature as the one that mostly contributes for the overall user acceptance - it makes it viable to make helpful web-based certificate enrollment/registration system almost as simple as traditional name+password+cookie methods, as shown in Figure 7. <!-- image --> Figure 6: The HTTPS Logon filterset in a client authentication scenario. In (a) the user directs the web browser to an HTTP URL containing the command for adding the site to the Encryption Domain. As Kapanga was engaged to the browser, the request is actually sent over HTTPS because the command parser filter is executed early in the filter chain. Thus, when the request reaches the HTTPS Logon filter, the site address and port is already in the Encryption Domain. In (b), the site has requested client authentication and Kapanga asks the user which certificate he/she wants to use and the passphrase of its associated private key. Unlike Internet Explorer, Kapanga doesn't show expired, revoked or altogether untrusted certificate, nor has a 'remember password' checbox to ruin the whole security of the process.

Explanation: NIST publication on credential and access management. Topics: authentication, pki, sso. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2013 Annual Report? (Part 30) Control HA-3: conference, ' Safeguarding Health Information: Building Assurance through HIPAA Security ,' in May 2013 at the Ronald Reagan Building and International Trade Center in Washington, D.C. The conference offered important sessions that focused on broad topics of interest to the healthcare and health IT security community. Over 600 in-person and virtual attendees from federal, state, and local governments, academia, HIPAA-covered entities and business associates, industry groups, and vendors heard from, and interacted with, healthcare, security, and privacy experts on technologies and methodologies for safeguarding health information and for implementing the requirements of the HIPAA Security Rule. Presentations covered a variety of current topics including: -  Updates on the OCR privacy, security, and breach notification audit program -  Patient and provider identity management, HIPAA requirements in cloud and mobile environments -  HIPAA rule changes affecting breach notification and HIPAA security -  Cybersecurity Framework for improving critical infrastructure cybersecurity -  Health IT activities at the National Cybersecurity Center of Excellence -  Methods for managing insider threat -  Tools available to manage security settings on end-user devices The keynote address was delivered by Eric Dishman, Fellow and General Manager of the Health Strategy & Solutions Group at Intel. In FY 2014, NIST plans to issue a draft revision to Special Publication (SP) 800-66, An Introductory Resource Guide for Implementing the HIPAA Security Rule . As part of its continued outreach efforts, NIST also plans to co-host the seventh annual Safeguarding Health Information conference with OCR. ## Contact: Mr.

Explanation: NIST publication on credential and access management. Topics: identity management, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2013 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Engineering Trustworthy Secure Systems provide? (Section 308) tisfactorily progressing in consideration of project security aspects. - PM-2.3 Act to redirect projects that can be expected to progress satisfactorily with appropriate security-informed redirection. References: [4] [86] [100] - PM-3.1 Where agreements permit, act to cancel or suspend projects whose security-driven disadvantages or security-driven risks to the organization outweigh the benefits of continued investments. - PM-3.2 After completion of the agreement for the security aspects of products or services, act to close the projects. Note : Closure is accomplished in accordance with organizational security policies, procedures, and the agreement. References: [4] [86] [100] The purpose of the Human Resource Management process is to provide the organization with necessary human resources and to maintain their competencies in a manner consistent with strategic needs. Reprinted with permission from IEEE, Copyright IEEE 2015, All rights reserved. - -Define the security criteria for necessary human resources, and maintain their competencies in a manner consistent with strategic needs. - -Security-relevant skills required by projects are identified. Personnel with necessary security skills are provided to projects. NIST SP 800-160v1r1 November 2022 - -Security-relevant skills of personnel are developed, maintained, or enhanced. - -Security-relevant personnel conflicts are resolved. HR-1.1 Identify the security-relevant skills needed based on current and expected projects. HR-1.2 Identify and record the security-relevant skills of personnel. References: [4] [86] [100] [132] [109] [133] HR-2.1 Establish a plan for developing security-relevant skills. Note: Security-relevant skills include core and specialty competencies. HR-2.2 Obtain security-relevant training, education, or mentoring resources. HR-2.3 Provide planned security-relevant skills development. HR-2.4 Maintain records of security-relevant skills development.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.