You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.2 Threat Analysis according to NIST Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders According to Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders, 5.2 Threat Analysis: The following subsections describe how the build architecture addresses the threats discussed in Section 3.5.

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain NIST Publications: according to NIST Security Architecture Design Process for Health Information Exchanges (HIEs) According to Security Architecture Design Process for Health Information Exchanges (HIEs), NIST Publications:: - SP 800-53 Rev. 3, Recommended Security Controls for Federal Information Systems and Organizations, security controls: AC-2, Account Management; IA-4, Identifier Management; IA-5, Authenticator Management. - SP 800-57, Part 1, Recommendation for Key Management - Part 1: General. - Draft SP 800-63 Rev. 1, Electronic Authentication Guideline.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Security Architecture Design Process for Health Information Exchanges (HIEs).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain How to Cite this NIST Technical Series Publication: according to NIST 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report According to 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report, How to Cite this NIST Technical Series Publication:: Guo Y, Licata J, Pillitteri V, Rekhi S, Beverly R, Yuan X, Bowman S, Gregg R, Key G, Hinton C, Reuther A, Adamson R, Warren A, Bangalore P, Deumens E, Farkas C (2023) 3 rd High-Performance Computing Security Workshop: Joint NIST-NSF Workshop Report. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8476. https://doi.org/10.6028/NIST.IR.8476

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does De-Identifying Government Datasets_ Techniques and Governance provide? (Section 138) ities in a dataset that could be used for re-identifying data subjects. They do not determine whether someone with intimate knowledge of a specific respondent can find that respondent in the database. The only way to protect a single specific individual perceived to be at high risk of re-identification is through data perturbation (e.g., noise addition) or information reduction (e.g., removing the observation altogether). 37 Although other documents that discuss de-identification use the term risk assessment to refer to a specific calculation of ambiguity using the k-anonymity de-identification model, this document uses the term risk assessment to refer to a much broader process. Specifically, risk assessment is defined as, 'The process of identifying, estimating, and prioritizing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. Part of risk management incorporates threat and vulnerability analyses and considers mitigations provided by security controls planned or in place. Synonymous with risk analysis' [149]. The key statistic calculated in re-identification studies is the conditional re-identification rate . This statistic is a proxy for disclosure risk. The rate is the number of confirmed links between the dataset and another dataset divided by the number of putative (suspected) links expressed as a percentage. If the conditional re-identification rate falls above an agreed upon threshold for any publication strata, it suggests that the data should not be released outside of a controlled environment. Re-identification studies are often an iterative process. If a re-identification study uncovers problems with the de-identified data, the data curator can engage with subject-matter experts, make changes to the dataset, and perform another re-identification study.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: De-Identifying Government Datasets_ Techniques and Governance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Role-Based Access Control : according to NIST Blockchain Networks_ Token Design and Management Overview According to Blockchain Networks_ Token Design and Management Overview, Role-Based Access Control :: In role-based access control (see NIST definition [65]), role assignation follows either a top-down approach, where privileged entities act as system owners and directly manage the roles, or a bottom-up approach, where roles are self-assigned by users with predefined conditions and time delays during which system owners may be allowed to cancel new role assignations. Roles are implemented through role manager smart contracts that are integrated with token factory contracts. Smart contract libraries that offer role-based access control have been developed, such as the Open-Zeppelin library [66]. It is also possible to implement roles in blockchains that follow the UTXO model by modifying the input and output parameters in the transaction format [67].

Explanation: NIST publication on credential and access management. Topics: access control, token. Contains security framework guidance for authentication systems. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.2 Adversarial Attacks according to NIST Security Analysis of First Responder Mobile and Wearable Devices According to Security Analysis of First Responder Mobile and Wearable Devices, 6.2 Adversarial Attacks: The following are attacks that exemplify a malicious external entity actively exploiting a vulnerability. Each attack identifies with an adversarial threat source.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Security Analysis of First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Supporting Roles according to Guide for Security-Focused Configuration Management of Information Systems? Supporting Roles: SAISO (if s/he is not the SecCM Program Manager); CIO; AO; SSO; SA; System/Software Developer

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Recovering from Ransomware and Other Destructive Events say about ACKNOWLEDGMENTS? According to Data Integrity_ Recovering from Ransomware and Other Destructive Events, ACKNOWLEDGMENTS: We are grateful to the following individuals for their generous contributions of expertise and time. | Name | Organization | |----------------|----------------------------| | Steve Petruzzo | GreenTec USA | | Steve Roberts | Hewlett Packard Enterprise | | Dave Larimer | IBM Corporation | | John Unthank | IBM Corporation | | Jim Wachhaus | Tripwire | | Donna Koschalk | Veeam Software Corporation | | Dewain Smith | Veeam Software Corporation | | Lisa Ignosci | Veeam Software Corporation | | Name | Organization | |-----------------|-----------------------| | Brian Abe | The MITRE Corporation | | Sarah Kinling | The MITRE Corporation | | Josh Klosterman | The MITRE Corporation | | Susan Urban | The MITRE Corporation | | Mary Yang | The MITRE Corporation | The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register. Respondents with relevant capabilities or product components were invited to sign a Cooperative Research and Development Agreement (CRADA) with NIST, allowing them to participate in a consortium to build this example solution. We worked with: | Technology Partner/Collaborator | Build Involvement | |-----------------------------------|----------------------------------------------------------| | GreenTec USA | GreenTec WORMdisk, v151228 | | Hewlett Packard Enterprise | HPE ArcSight ESM, v6.9.1 HPE ArcSight Connector, v7.4.0 | | IBM Corporation | IBM Spectrum Protect, v8.1.0 | | Tripwire | Tripwire Enterprise, v8.5 Tripwire Log Center, v7.2.4.80 | | Veeam Software Corporation | Veeam Availability Suite 9.5 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation say about Appendix A. PIV Data Model? (Part 16) According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation, Appendix A. PIV Data Model: 0xFE | LRC | 0 | Note that the optional MSCUID data element was deprecated in a previous version and eliminated in this version of SP 800-73. However, historic retired key management certificates 23 This is the recommended length. The certificate size can exceed the indicated length value. 24 The numeric values indicated in keysWithOnCardCerts and keysWithOffCardCerts are represented as unsigned binary integers. 25 The offCardCertURL data element shall be present if keysWithOffCardCerts is greater than zero and shall be absent if both keysWithOnCardCerts and keysWithOffCardCerts are zero. The offCardCertURL may be present if keyWithOffCardCerts is zero but keysWithOnCardCerts is greater than zero. MAY still include the MSCUID element, so it is retained as an optional data element above. This applies to all of the retired key management key objects represented in Table 21 -Table 40 . Table 22. Retired X.509 Certificate for Key Management 2 | Retired X.509 Certificate for Key Management 2 | Retired X.509 Certificate for Key Management 2 | 0x1002 | 0x1002 | |--------------------------------------------------|--------------------------------------------------|----------|------------| | Data Element (TLV) | Tag | Type | Max. Bytes | | Certificate | 0x70 | Variable | 1856 26 | | CertInfo | 0x71 | Fixed | 1 | | MSCUID (Optional) | 0x72 | Variable | 38 | | Error Detection Code | 0xFE | LRC | 0 | Table 23.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges say about Organizations may experience challenges in their quest to meet mandatory RBT requirements.? According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges, Organizations may experience challenges in their quest to meet mandatory RBT requirements.: While many survey participants said that their organizations leverage learning management systems to automate the tracking of RBT completion, over a third are using a manual method like a spreadsheet, which can result in extra burden placed on staff. While most participants said that they do not experience challenges tracking completion, tracking contractor training was more challenging than tracking federal employee training, sometimes because current LMS may not be accessible to contract staff. Additionally, organizations were challenged in getting employees to complete training by the appointed deadline. This may be due to mandatory training overload, employee time constraints, or a lack of concrete consequences for not completing training (e.g., disabling accounts and network access). <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain CRL Distribution Points : according to NIST NIST Test Personal Identity Verification (PIV) Cards Version 2 According to NIST Test Personal Identity Verification (PIV) Cards Version 2, CRL Distribution Points :: ldap://smime2.nist.gov/cn=Test%20PIV-I%20RSA%202048- bit%20CA%20for%20Test%20PIV%20Cards%20v2,ou=Test%20CA,o=Test%20Certificat es%202020,c=US?certificateRevocationList;binary

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-06(05) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control AC-06(05): LEAST PRIVILEGE | PRIVILEGED ACCOUNTS ASSESSMENT OBJECTIVE: Determine if:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Control according to NIST_SP_800-53r5_Security_Privacy_Controls? Control: Track and document incidents.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AN-2011 in ANSI_NIST-ITL 1-2011 Requirements and Conformance Test Assertions? (Part 74) Control AN-2011: record consisting of header information. The second information item of this subfield (content record count / CRC) shall be the sum of the Type-2 through Type-99 records contained in this transaction. This number is also equal to 1 O 1 O 2 M 1 M 1.015- Occurrence 1.016- Occurrence 1.001- Record Header Count(1.015) LTE 1 Count(1.016) LTE 1 <See Requirement ID “Field: xx.001-Record Header”> t-2 NIEM- 1.001- Record Header ForEach(XElm(itl:PackageInformationRecord ) { {XElm(biom:RecordCategoryCode)} EQ ASCII(01) } 1 M 1.002-VER {1.002} EQ ASCII(0500) M 1.003- Subfields <See Requirement ID “Field: Type1-Subfield Occurrence” and “Field: xx.002-IDC”> t-2 1 M 1.003- Subfield1 REC {US_Subfield:1 in RS_Subfield:1 in 1.003} EQ 1 2 M 1.003- Subfield1 CRC {US_Subfield:2 in 1.003} EQ Count(Records in Transaction ST Type(Records) 59 B B X B B* B* Value the count of the remaining subfields of Field 1.003 Transaction content / CNT. The maximum value for CRC is 999. MO [2 to 99]) EQ 8.1.3, Table 19, Table 1 Field: 1.003- Transaction Content Subfield 2 REC Value Each of the remaining subfields of Field 1.003 Transaction content / CNT corresponds to a single Type-2 through Type-99 record contained in the transaction. Two information items shall comprise each of these subfields: The first information item (record category code / REC), shall contain a number chosen from the “record identifier” column of Table 1. Field: 1.003- Transaction Content Subfield 2 IDC Value Field: 1.003- Transaction Content Subfield 2 IDC Matches 8.1.3, Table 19 The second information item (information designation character / IDC) shall be an integer equal to or greater than zero and less than or equal to 99. See Section 7.3.1. 8.1.3, Table 19, 7.3.1 IDC references are stated in Type-1 Field 1.003 Transaction content / CNT and shall be used to relate information items in the CNT field of the Type-1 record to the other records in the transaction.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: ANSI_NIST-ITL 1-2011 Requirements and Conformance Test Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Understanding Stablecoin Technology and Related Security Considerations say about Fiat Currency-Backed? (Part 3) According to Understanding Stablecoin Technology and Related Security Considerations, Fiat Currency-Backed: rstand this, consider a stablecoin pegged to the U.S. dollar (USD). In this case, the stablecoin should be worth $1 USD. In the open market, however, the price will fluctuate due to supply and demand. Stability is achieved because if the stablecoin drops in price (say to $0.98), investors can buy the stablecoin at $0.98 on the open market and then immediately redeem it with the stablecoin issuer at the price of $1 (thereby earning $0.02 per coin bought). This purchasing of the stablecoin by investors will create demand, which will increase the price back to near $1. If the price increases from $1 (say to $1.02), then investors that already own the stablecoin can sell on the open market (making a profit of $0.02 per coin sold). These sales will increase supply, thus lowering the price. Nothing in this stability mechanism requires on-blockchain smart contract knowledge of pricing. Thus, fiat currency-backed stablecoins do not require interactions with oracles (entities that post trusted prices on blockchains) or need coin holders to vote on pricing information. An interesting feature of many fiat-backed stablecoins is that they may exist simultaneously on multiple blockchains. This is possible because the primary functionality of the stablecoin is not implemented on a blockchain. The reserve pool is kept off-blockchain and, thus, can support redemptions on all blockchains on which the coin is instantiated. Lastly, fiat-backed stablecoins are more amenable to being regulated by countries than their DeFi counterparts. This is because an off-blockchain managing company registered in a particular country typically exists. This company may be subject to financial regulation, thereby subjecting the stablecoin to regulation. Table 1 summarizes the typical characteristic settings for fiat-backed stablecoins. Table 1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Understanding Stablecoin Technology and Related Security Considerations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain · Watch for harmful pop-ups according to NIST Small Business Information Security_ The Fundamentals According to Small Business Information Security_ The Fundamentals, · Watch for harmful pop-ups: When connected to and using the Internet, do not respond to popup windows requesting that you click 'OK' for anything. Use a popup blocker and only allow popups on websites you trust. If a window pops up on your screen unexpectedly, DO NOT close the popup window, either by clicking 'okay' or by selecting the X in the upper right corner of the popup window, especially if the pop up is informing you that your system has a virus and suggesting you download a program to fix it. Do not respond to popup windows informing you that you have to download a new codec, driver, or special program for the web page you are visiting. Some of these popup windows are actually trying to trick you into clicking on 'OK' which will allow it to download and install spyware or other malware onto your computer. Be aware that some of these popup windows are programmed to interpret any mouse click anywhere on the window as an 'OK' and act accordingly. If you encounter this kind of pop-up window, disconnect from the network and force the browser to close (in Windows, hit 'ctrl + alt + del' and delete the browser from running tasks. In OSX, right-click the application in the bar and select 'force close'). You should save any files you have open and reboot the computer, then run your anti-virus software.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: rmf, fips, security control. General security reference material without sensitive content. Source: Small Business Information Security_ The Fundamentals.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Electronic Mail Security say about Administering the Mail Server? (Part 3) According to Guidelines on Electronic Mail Security, Administering the Mail Server: logs daily | | Completed | Action | |-------------|------------------------------------------------------------------------------------------------------------------------------------------------------| | | Review logs weekly (for more long-term trends) | | | Use automated log file analysis tool(s) | | | Mail server backups | | | Create a mail server backup policy | | | Back up mail server differentially or incrementally on a daily to weekly basis | | | Back up mail server fully on a weekly to monthly basis | | | Periodically archive backups | | | Recovering from a compromise | | | Report incident to organization's computer incident response capability | | | Isolate compromised system(s) or take other steps to contain attack so additional evidence can be collected | | | Consult, as appropriate, with management, legal counsel, and law enforcement expeditiously | | | Investigate similar hosts to determine if the attacker has also compromised other systems | | | Analyze the intrusion | | | Restore the system | | | Test system to ensure security | | | Reconnect system to network | | | Monitor system and network for signs that the attacker is attempting to access the system or network again | | | Document lessons learned |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.5.8.2 Security Considerations for IPv6 Tunnel Brokers according to NIST Guidelines for the Secure Deployment of IPv6 According to Guidelines for the Secure Deployment of IPv6, 6.5.8.2 Security Considerations for IPv6 Tunnel Brokers: Security must be a consideration for all the interactions between the tunnel broker and other entities: clients, tunnel servers, and the DNS. The appropriate security depends on how each of these interfaces is implemented: -  For HTTP clients, using SSL/TLS to protect the username and password seems appropriate. HTTP is a clear text protocol. When sending confidential information, an encrypted channel should be used. Organizations should choose implementations that are inherently more secure. For example, delivering lists of tunnel parameters is safer than downloading executable scripts that run on the client. -  SNMPv1 and SNMPv2 are clear text protocols. As such, they can disclose confidential information. SNMPv3 provides encryption but lags behind SNMPv1 and SNMPv2 in support and deployment. SNMP interfaces to tunnel servers should use IPsec or SNMP over SSH if SNMPv3 is not an option. Using this option will support confidentiality and integrity of the information passed on the channel. -  For DNS updates, either Secure Dynamic Update (RFC 3007, Secure Domain Name System (DNS) Dynamic Update ) or command scripts protected by SSH or IPsec could be used. -  If a host disconnects from the Internet and its IPv4 address is reallocated, the tunnel server may not find out about this and may keep forwarding IPv6 traffic to that address. -  Tunnel broker servers maintain state for each client. As such, they are susceptible to resource exhaustion attacks and other types of DOS attacks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Derived Personal Identity Verification (PIV) Credentials? (Part 68) Control AC-1: r successful PIV Card authentication, the kiosk transmits PIV Card information to the MyID CMS through secure transport, where a job is created to handle the second phase of issuance to the end point. Figure 5-10 Kiosk Workflow <!-- image --> The DPC issuance process requires the use of the Identity Agent mobile application or the self-service application to complete the workflow. In the case of an iOS or Android-based mobile device, the applicant launches the Identity Agent application and scans a QR code presented by the self-service kiosk. The QR code contains the information needed for the Identity Agent mobile application to communicate securely with the MyID CMS back end. After the MyID CMS has received and validated the OTP obtained from the scanned QR code, the Identity Agent creates containers and generates a key pair on the device by using a third-party FIPS 140-2-certified OpenSSL library for cryptographic services. The public key is transmitted to the Intercede MyID back end in the form of a PKCS #10 request. We configured our MyID back-end instance to run within a local Internet Information Services instance that uses a TLS end point. An implementer should consult NIST SP 800-52, Revision 1, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations for configuration guidance in this area [27]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ The authentication certificate request is then relayed to the Verizon Managed PKI. We used a test instance of the Verizon Managed PKI in this project; however, the production version for U.S. federal agencies has been granted an authority to operate (ATO) that requires a security controls assessment.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Software Asset Management say about 2.3 Assessment Objects Protected and Assessed by SWAM? (Part 7) According to Automation Support for Security Control Assessments_ Software Asset Management, 2.3 Assessment Objects Protected and Assessed by SWAM: bility issues. Mobile code is distinguished by the fact that rather than being loaded from the device's mass storage, it is loaded at the time of use from the larger network (typically via a website). The code is managed externally, and may change frequently, rendering the device incapable of computing a valid digital fingerprint for the mobile code, and thus requiring other means to validate the code. Requiring the mobile code to be digitally signed by a trusted source is one method employed to validate such code. Another option is to block all mobile code not from a trusted website. A key alternate method for addressing mobile code is covered in NIST SP 800-53 control SC-44 (Detonation Chamber). Because SC-44 is not selected in the NIST SP 800-53B low, moderate, or high baselines, it is not included in this NISTIR. However, detonation chambers are effective in protecting against malicious mobile code, including mobile code downloaded from a web site, as well as mobile code in e-mails and attachments. Malicious mobile code is addressed further in the NISTIR 8011 volume on the boundary management capability. Firmware is often considered to be a hybrid between hardware and software. For the purposes of this NISTIR, firmware is code stored in non-volatile memory that can be updated. The ability to update firmware allows hardware manufacturers great flexibility, reducing the need to replace hardware when issues are found or changes need to be made. Firmware that can be updated is subject to malicious code insertion, and thus needs protection under the SWAM capability. Generally, it is possible to compute a digital fingerprint for firmware. In addition, there are hardware mechanisms to validate firmware, such as the trusted platform module (TPM). Code in memory is harder to protect than other forms of software addressed in this volume. Because changes to code in memory are very hard to detect, such changes can be very stealthy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Card Technology Developments and Gap Analysis Interagency Report provide? (Section 142) reader from supplier A should also work with cards from supplier B, C and D. For us in the access control industry and the contactless card industry at large, there is some room to play here I guess. Interoperability can be achieved by licensing the IC technology. That is integrating the IC customer needs in the card form factor. Interoperability: Chip level - If the reliance on a single IC technology or chip operating system is acceptable, then interoperable systems are available. And that would typically be available through a licensing scheme. My impression though is that that's not acceptable. However, if a large entity were to select a single system from a single technology, then these systems are available. Interoperability: Reader level - Also available are interoperable contactless card systems that will work with different IC suppliers that are built around multiple chip technologies by incorporating these different technologies into a single reader. A good example of that is the reader currently available through Cubic Transportation Systems. They've incorporated the Go Card technology and Mifare. I believe they also have the capability to read 14443 Type A and Type B. Plus, I'm not sure, but I think 15693 may be on the way or is currently available, the ISO standard 15693. These are not common reader platforms probably because of the cost. You have to put many things inside it to make it work including the firmware to make everything work together. Interoperability: Card Operating System level - Interoperability of card ICs from different manufacturers that have a microprocessor can also be achieved through the use of a common operating system. Even to the point where it's certainly technically feasible to port the operating systems from the contact card world to a contactless card IC. The protocol obviously, the transmission protocol, has to be different.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Card Technology Developments and Gap Analysis Interagency Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i say about 2.2.1 Ad Hoc Mode? (Part 2) According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i, 2.2.1 Ad Hoc Mode: ctions cheaply, quickly, and easily with minimal hardware and user maintenance. In practice, many different types of ad hoc networks are possible, and the IEEE 802.11 specification allows all of them. Since it does not give the details of how to form a network, but rather only how to establish the links in a network, ad hoc mode as specified by 802.11 is incomplete for any particular use. This means that different products built on it typically are not interoperable, because there has not yet been standardization on any of these possible networks. An ad hoc network can be created for many reasons, such as allowing the sharing of files or the rapid exchange of e-mail. However, an ad hoc WLAN cannot communicate with external networks. A further complication is that an ad hoc network can interfere with the operation of an AP-based infrastructure mode network (see next section) that exists within the same wireless space. Figure 2-2. IEEE 802.11 Infrastructure Mode <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Securing Property Management Systems? (Part 27) Control AM-1: , the PMS accepts a reservation, reconciles the bill, and closes out the reservation while never exposing any data to unauthorized access. Further, the reservation data is editable in a secure manner. In this PMS reference design, all reservations are manually entered directly into the PMS and not supplied by an external CRS. ## 4.2.2 Use Case 2: Authorized User Access In Use Case 2, only authorized users can connect to their authorized devices. They are not able to gain access to devices that might enable them to escalate their privileges within the PMS reference design or conduct any unauthorized lateral movements. The access control platform in the PMS reference design allows users to connect only to the systems for which they are authorized based on their role as a hotel guest, hotel staff, or system administrator. The action of inputting or modifying a reservation requires an authorized hotel staff user to authenticate to gain access to the PMS. ## 4.2.3 Use Case 3: Secure Credit Card Transaction In Use Case 3, a credit card transaction is securely conducted. The hotel guest credit card transaction is tokenized before introduction to the PMS. Credit card data is consumed only by the payment solution application (PSA) and is immediately tokenized. The PSA function to validate the guest credit card data with a third-party payment processor is not included in the PMS reference design. The validated credit card data token is sent from the PSA to the PMS. The token is used again at checkout when the bill is paid, with only the token sent from the PMS to the PSA. ## 4.2.4 Use Case 4: Secure Interaction of Ancillary Hotel System with PMS In Use Case 4, the PMS securely interacts with a physical access control system, specifically a door lock and room-key encoder. The physical access control server is a door lock/room-key system that requires connectivity to the PMS.

Explanation: NIST publication on credential and access management. Topics: access control, token, sso. Contains security framework guidance for authentication systems. Source: Securing Property Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Criticality Analysis Process Model_ Prioritizing Systems and Components provide? (Section 74) | | Related processes outside of criticality analysis | [CSF] - (ID.AM-1, 2, 4) Asset Management [NIST SP 800-39] - (3.1) Framing Risk [NIST SP 800-160] - (3.4.3) System Requirements Definition Process [NIST SP 800-160] - (3.4.4) Architecture Definition Process [NIST SP 800-161] - (2.2.1) Frame | | Sub-process ID | C.3 | |-------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Sub-process name | Identify Interactions, Intersections, Connections, and Dependencies Within the Critical Workflow Path | | Sub-process description | This sub-process identifies the interactions, intersections, connections, and dependencies between functions and between systems/subsystems.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, csf, fips. General security reference material without sensitive content. Source: Criticality Analysis Process Model_ Prioritizing Systems and Components.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Notional Supply Chain Risk Management Practices for Federal Information Systems say about 4.6.1 Acquirer - Programmatic Activities? (Part 2) According to Notional Supply Chain Risk Management Practices for Federal Information Systems, 4.6.1 Acquirer - Programmatic Activities: could be mitigated through diversifying elements or the supply chain). - b. Identify cases where a customized, rather than standard configuration may be more appropriate to reduce risks of compromise. - f) Establish organizational procedures that require design processes to address protective or corrective options which either avoid mission interruption or permit graceful degradation of the system should the system be attacked or compromised. - g) Require integrators and suppliers to deliver elements and element processes with commercially reasonable security configurations and designs to limit access and exposure. - h) Establish comprehensive testing policy and procedures. - i) Require that the system's operational environment protect the system both physically and logically. Include applicable system integration and custom code extension in use as part of the upgrade and maintenance efforts in system operation requirements. - j) Develop and implement an approach for handling and processing reported supply chain anomalies. Require the separation of duties for people and organizations as well as the separation of functions for supply chain elements and element processes. - k) Require redundancy and diversity throughout the supply chain and document the benefits, risks, costs, and contingency plans to respond to supply chain risks resulting in decisions to reduce diversity and redundancy or alternatives in availability of supply chain elements or element processes. - l) Use threat assessment techniques and information to determine if the proposed design alternatives meet defensive design criteria. - m) Use threat analysis techniques (such as threat modeling) to examine the element's design vulnerabilities. - n) Model, simulate, test, and evaluate the supply chain risks prior to decisions to limit the diversity of system/elements or suppliers. - o) Avoid use of secondary market elements unless no other sources exist.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Notional Supply Chain Risk Management Practices for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to SIMfill Use and Development provide? (Section 44) ion='1.0' encoding='UTF-8'?> <mf> <df_telecom> <ef_raw></ef_raw> <ef_adn></ef_adn> </df_telecom> </mf> ``` EF\_ADN {10.5.1} is used to specify the abbreviated dialing number (i.e., the phone book). It takes two different subnodes, which can be mixed and repeated arbitrarily: - GLYPH<c=31,font=/GHDCGG+Webdings> "contact": A contact contains a set of information, as described below. - GLYPH<c=31,font=/GHDCGG+Webdings> "empty": Used to insert an empty record in the file. The subnode "contact" has three or four subnodes: - GLYPH<c=31,font=/GHDCGG+Webdings> "description": The name of the contact. It is a string that can be encoded either in the default GSM 7-bit alphabet or in UCS2. To specify which encoding to use, one can set the XML attribute "enc" to "default" for 7-bit encoding or "ucs2" for UCS2 encoding. If no encoding is explicitly specified, the 7-bit encoding is used by default. - GLYPH<c=31,font=/GHDCGG+Webdings> "address": Contains the phone number information of the contact, as described below. - GLYPH<c=31,font=/GHDCGG+Webdings> "capability": Index pointing to a record of EF\_CCP. It take a decimal number between 0 and 255. This subnode is optional. - GLYPH<c=31,font=/GHDCGG+Webdings> "extension": The index of additional data that are stored in EF\_EXT1 (see the example below). It takes a decimal number between 0 and 255. This subnode is optional. The subnode "address" takes three subnodes: - GLYPH<c=31,font=/GHDCGG+Webdings> "ton": The Type of Number. The possible values are listed below. - GLYPH<c=31,font=/GHDCGG+Webdings> "npi": Numbering Plan Identifier. The possible values are listed below. - GLYPH<c=31,font=/GHDCGG+Webdings> "number": The phone number of the contact. It takes a 0- to 20-digit decimal number.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to SIMfill Use and Development.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PL-2 in Assessing Security and Privacy Controls in Information Systems and Organizations? (Part 10) Control PL-2: ganization and can be accepted. Conversely, system owners or common control providers may decide that certain findings marked as “other than satisfied” are significant and require remediation actions. In all cases, the organization reviews each assessment finding of “other than satisfied” and applies its judgment with regard to the severity of the finding and whether it is significant enough to warrant further investigation or remedial action.47 Senior leadership involvement in the mitigation process may be necessary to ensure that the organization’s resources are effectively allocated in accordance with organizational priorities, provide resources first to the systems that support the most critical and sensitive missions for the organization, or correct the deficiencies that pose the greatest degree of risk. Ultimately, the assessment findings and any subsequent response actions (informed by the updated risk assessment) trigger updates to the key artifacts used by authorizing officials to determine the security and privacy risks of the system and its suitability for authorization to operate. The artifacts include security plans and privacy plans, security assessment reports and privacy assessment reports, and the respective plans of action and milestones. 47 Potential risk response actions include risk acceptance, risk mitigation, risk rejection, and risk transfer/sharing. [SP 800-39] provides guidance on risk response actions from a risk management perspective. CHAPTER THREE PAGE 33 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 A r 5 . I NIST SP 800-53A REV.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about Test? According to Assessing Security Requirements for Controlled Unclassified Information, Test: [SELECT FROM: processes for intrusion detection and system monitoring; mechanisms for supporting or implementing system monitoring capabilities; mechanisms for supporting or implementing intrusion detection and system monitoring capabilities; mechanisms for supporting or implementing the monitoring of inbound and outbound communications traffic]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings? (Part 73) Control PD-12: ice: 1. The Workstation's login program uses the system's PAM library to request authentication of the user. 2. The system's PAM library passes on the authentication request to a pam\_krb5 module. 3. The pam\_krb5 module has been configured to attempt to authenticate the user via the pkinit extension to the krb5 authentication protocol which allows the user to prove his identity using x509 credentials rather than the traditional Kerberos shared secret(password). 4. The system's krb5.conf specifies the use of an openssl engine module called myproxy\_engine to acquire the x509 credentials. 5. The myproxy\_engine module prompts the user for his password using a prompter function which has been passed by reference all the way down the call stack from the original PAM aware application(in this case login.) 6. The myproxy\_engine module generates a public/private keypair, and a certificate request. 7. The certificate request is then sent to the myproxy server along with the users username, and password as part of a myproxy protocol get request. The myproxy protocol uses the SSL/TLS protocol both to verify the authenticity of the myproxy server,(you don't want to send a valid password to the wrong server) and to ensure the privacy of the exchange. 8. Upon receiving the get command, the myproxy server uses the pam libraries on it's system to attempt to authenticate the user. 9. The pam libraries on the myproxy system pass the authentication request on to a pam\_radius module which uses the RADIUS protocol to a locally trusted RADIUS server. This RADIUS server may verify the validity of the password locally, or forward the request on to a federated system such as Eduroam. 10. If the RADIUS server confirms the validity of the user's password, the myproxy server then creates a short lived certificate for that user, and signs it using locally accessible CA credentials(possible stored on a smart card or similar crypto system.) 11.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 900) entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. An unauthorized copy or substitute that has been identified, marked, and/or altered by a source other than the item's legally authorized source and has been misrepresented to be an authorized item of the legally authorized source. Actions, devices, procedures, techniques, or other measures that reduce the vulnerability of a system. Synonymous with security controls and safeguards. An unintended or unauthorized intra-system channel that enables two cooperating entities to transfer information in a way that violates the system's security policy but does not exceed the entities' access authorizations. covert channel analysis [CNSSI 4009] Determination of the extent to which the security policy model and subsequent lower-level program descriptions may allow unauthorized access to information. covert storage channel [CNSSI 4009] covert timing channel [CNSSI 4009, Adapted] credential [SP 800-63-3] critical infrastructure [USA PATRIOT] A system feature that enables one system entity to signal information to another entity by directly or indirectly writing to a storage location that is later directly or indirectly read by the second entity. A system feature that enables one system entity to signal information to another by modulating its own use of a system resource in such a way as to affect system response time observed by the second entity.

Explanation: NIST publication discussing classified information handling. References: classified, cui. Contains guidance on protecting sensitive government information. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Intrusion Detection and Prevention Systems (IDPS)? (Part 94) Control ES-1: es (device detection, service enumeration, limited vulnerability scanning). It also does not address technologies based on the IEEE 802.11n WLAN standard, which as of late 2006 has not been finalized. It is expected that the recommendations in this section should generally be applicable to wireless IDPS technologies for IEEE 802.11n-based WLANs. 26 For more information on the IEEE 802.11 standards and other aspects of wireless network security, see NIST SP 800-97, Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i, and NIST SP 800-48, Wireless Network Security: 802.11, Bluetooth and Handheld Devices (http://csrc.nist.gov/publications/nistpubs/index.html). 27 For more information on the Wi-Fi Alliance, visit their Web site at with the ratification of the IEEE 802.11i amendment, the Wi-Fi Alliance introduced WPA2, its term for interoperable equipment that is capable of supporting IEEE 802.11i requirements. WPA2 offers stronger security controls than either WPA or WEP. ## 5.1.2 WLAN Components IEEE 802.11 WLANs have two fundamental architectural components: - GLYPH<c=31,font=/HHCKCL+Webdings> Station (STA). A STA is a wireless endpoint device. Typical examples of STAs are laptop computers, personal digital assistants (PDA), mobile phones, and other consumer electronic devices with IEEE 802.11 capabilities. - GLYPH<c=31,font=/HHCKCL+Webdings> Access Point (AP). 28 An AP logically connects STAs with a distribution system (DS), which is typically an organization's wired infrastructure. The DS is the means by which STAs can communicate with the organization's wired LANs and external networks such as the Internet. Figure 5-1 shows an example of how APs, STAs, and DSs are related. Figure 5-1. Wireless LAN Architecture Example <!-- image --> Some WLANs also use wireless switches. A wireless switch is a device that acts as an intermediary between APs and the DS.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE) say about Glossary? (Part 2) According to Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE), Glossary: an install applications onto the device. | | Demilitarized Zone (DMZ) | An interface on a routing firewall that is similar to the interfaces found on the firewall's protected side. Traffic moving between the DMZ and other interfaces on the protected side of the firewall still goes through the firewall and can have firewall protection policies applied [6]. | | Derived Personal Identity Verification (PIV) | A credential issued based on proof of possession and control of the PIV Card, so as not to duplicate the identity proofing process as defined in [SP 800-63-2]. A Derived PIV Credential token is a hardware or software-based token that contains the Derived PIV Credential [7]. | | Hypertext Transfer Protocol (HTTP) | A standard method for communication between clients and Web servers [8]. | | Hypertext Transfer Protocol Secure (HTTPS) | HTTP transmitted over TLS [9]. | | Internet Protocol (IP) addresses | Standard protocol for transmission of data from source to destinations in packet-switched communications networks and interconnected systems of such networks [10]. | |----------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Lightweight Directory Access Protocol (LDAP) | The Lightweight Directory Access Protocol, or LDAP, is a directory access protocol. In this document, LDAP refers to the protocol defined by RFC 1777, which is also known as LDAP V2. LDAP V2 describes unauthenticated retrieval mechanisms [11].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations say about REFERENCES? According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, REFERENCES: Source Control: CM-03 Supporting Publications: SP 800-124 [28], SP 800-128 [41] NIST SP 800-171r3 May 2024

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain List of Figures according to NIST IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements According to IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements, List of Figures: | Figure 1: Visualization of the System and Environment ..................................................4 | |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Figure 2: Information Security Requirements Integration to the Element Level...............7 | | Figure 3: Role of Device Cybersecurity and Non-Technical Supporting Capabilities in Satisfying Security Capabilities and Requirements..................................................9 | | Figure 4: Organizations Can Use this Section to Identify IoT Device Cybersecurity Requirements.........................................................................................................12 | | Figure 5: Steps to Updating a Risk Model and Risk Assessment using New Information about an IoT Device. ..............................................................................................19 | | Figure 6: Effects on Risk Assessment due to IoT Device Informs the Risk Assessment of the Entire System...............................................................................................22 | | Figure 7: Organizations Can Gather Information to Update the System Risk Assessment and Determine Device Cybersecurity Requirements..............................................23 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Audience according to NIST Integrating Cybersecurity and Enterprise Risk Management (ERM) According to Integrating Cybersecurity and Enterprise Risk Management (ERM), Audience: The primary audience for this publication includes both federal government and non-federal government cybersecurity professionals at all levels who understand cybersecurity but may be unfamiliar with the details of enterprise risk management (ERM). The secondary audience includes both federal and non-federal government corporate officers, high-level executives, ERM officers and staff members, and others who understand ERM but may be unfamiliar with the details of cybersecurity. All readers are expected to gain an improved understanding of how cybersecurity risk management (CSRM) and ERM complement and relate to each other as well as the benefits of integrating their use.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Integrating Cybersecurity and Enterprise Risk Management (ERM).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services provide? (Section 11) ......................53 | | | 4.3.2. | Security Continuous Monitoring Category.............................................................56 | | | 4.3.3. | Detection Processes Category..............................................................................61 | | | | Respond Function | .....................................................................................................63 | | 4.4.1. | Response Planning Category ...............................................................................64 | | | 4.4.2. | Communications Category....................................................................................65 | | | 4.4.3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain CONTACTS: according to NIST 2016 NIST_ITL Cybersecurity Program Annual Report According to 2016 NIST_ITL Cybersecurity Program Annual Report, CONTACTS:: Mr. Jim Foti Mr. Patrick O'Reilly (301) 975-8018 (301) 975-4751 james.foti@nist.gov patrick.oreilly@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Attribute Metadata_ A Proposed Schema for Evaluating Federated Attributes say about Authorization? According to Attribute Metadata_ A Proposed Schema for Evaluating Federated Attributes, Authorization: The decision to permit or deny a subject access to resources (e.g., network, data, application, services) based on the evaluation of access control policies.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Attribute Metadata_ A Proposed Schema for Evaluating Federated Attributes.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 2016 NIST_ITL Cybersecurity Program Annual Report provide? (Section 149) eir cryptographic algorithm implementations. The suite of validation tests for each algorithm ensures the repeatability of tests and the equivalency of results across the testing laboratories. There are several types of validation tests, all designed to satisfy the testing requirements of the cryptographic algorithms and their specifications. These include, but are not limited to, Known-Answer Tests, Monte Carlo Tests, and Multi-Block Message Tests. The Known-Answer Tests are designed to examine the individual components of the algorithm by supplying known values to the variables and verifying the expected result. Negative testing is also performed by supplying known incorrect values to assure that the implementation recognizes values that are not allowed. The Monte Carlo Test is designed to exercise the entire implementation-under-test (IUT). This test is designed to detect the presence of implementation flaws that are not detected with the controlled input of the Known-Answer Tests. The types of implementation flaws detected by this validation test include pointer problems, insufficient allocation of space, improper error handling, and incorrect behavior of the IUT. The Multi-Block Message Test (MMT) is designed to test the ability of the implementation to process multi-block messages, which requires the chaining of information from one block to the next. During the last few years, the CSD Cryptographic Technology Group (CTG) has expanded its publications to contain not only the algorithm's specifications, but also requirements for an algorithm's use. Many of these usage requirements do not fall within the scope of the CAVP, because the CAVP focuses on the correctness of the instructions within the algorithm's boundary.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Specification for Asset Reporting Format 1.1 say about 2.2 Acronyms? (Part 2) According to Specification for Asset Reporting Format 1.1, 2.2 Acronyms: | ARF | Asset Reporting Format | |--------|-----------------------------------------------------| | DISA | Defense Information Systems Agency | | DoD | Department of Defense | | FISMA | Federal Information Security Management Act | | FTP | File Transport Protocol | | HIPAA | Health Insurance Portability and Accountability Act | | HTTP | Hypertext Transport Protocol | | IETF | Internet Engineering Task Force | | IR | Interagency Report | | IT | Information Technology | | ITL | Information Technology Laboratory | | NIST | National Institute of Standards and Technology | | NSA | National Security Agency | | OCIL | Open Checklist Interactive Language | | OVAL | Open Vulnerability and Assessment Language | | PCI | Payment Card Industry | | RFC | Request for Comment | | SCAP | Security Content Automation Protocol | | SCG | Security Configuration Guide | | SOX | Sarbanes-Oxley | | STIG | Security Technical Implementation Guide | | TCP/IP | Transmission Control Protocol/Internet Protocol | | URI | Universal Resource Identifier | | URL | Universal Resource Locator | |-------|-------------------------------------------------------| | W3C | World Wide Web Consortium | | XCCDF | eXtensible Configuration Checklist Description Format | |

Explanation: NIST publication discussing classified information handling. References: national security, defense information. Contains guidance on protecting sensitive government information. Source: Specification for Asset Reporting Format 1.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Internet of Things (IoT) Cybersecurity Colloquium_ A NIST Workshop Proceedings provide? (Section 15) d - A full-lifecycle approach to identity is needed to govern access to things on the Internet. Most IoT devices are controlled by traditional identity solutions - most commonly username and password. Because bad actors frequently leverage weak identity management practices to access devices, it is necessary to take a full-lifecycle approach to identity management in the IoT - that is, considering cybersecurity and privacy in every stage of the device lifecycle, from design to deployment to retirement. Furthermore, these devices often come hard-coded with default passwords that cannot be changed. Analysis of recent attacks reveals that the scale of distributed denial-of-service (DDoS) attacks has rapidly increased in recent years. IoT devices are frequently leveraged in these attacks. According to the speakers, there are two types of DDoS attacks: one is a large volume of attacks against the service itself, and the other is a reflection attack where traffic is sent towards a targeted service. This rise is driven, in part, by profitability: this takes the form of bad actors using devices for attacks on individuals' banking information, as well as people who hire bad actors for espionage and to cause chaos, often making payments with bitcoin and stolen credit cards. There were also discussions on the role of patching. While patching is important for ongoing device cybersecurity, it is not sufficient. There are too many exploits for patching alone to work, and there is concern about running out of time and money before bad actors do, given how quickly IoT changes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Internet of Things (IoT) Cybersecurity Colloquium_ A NIST Workshop Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cloud Computing Synopsis and Recommendations provide? (Section 159) ric Jul, Christian Limpach, Ian Pratt, Andrew Warfield, "Live Migration of Virtual Machines," Proceedings of the 2nd Symposium on Networked Systems Design and Implementation, May 2-4, 2005, Boston MA. | | [Cho06] | Frederick Chong and Gianpaolo Carraro, "Architecture Strategies for Catching the Long Tail," Microsoft Corporation, April 2006. http://msdn.microsoft.com/en- us/library/aa479069.aspx. | | [Com88] | Douglas Comer, "Internetworking with TCP/IP Principles, Protocols, and Architectures," Prentice-Hall, Inc., 1988, ISBN 0-13-470154-2. | | [Dea04] | Jeffrey Dean and Sanjay Ghemawat, "MapReduce: Simplified Data Processing on Large Clusters," Proceedings of the 6'th USENIX Symposium on Operating Systems Design and Implementation, Dec. 6-8, 2004, San Francisco, CA. | | [Die08] | T. Dierks and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2,' 2008, IETF RFC 5246, | - [Dja11] Django Software Foundation, "django The Web framework for perfectionists with deadlines," 2011, http://www.djangoproject.com. - [DMT09] Distributed Management Task Force, "Open Virtualization Format Specification, Version 1.0.0", 2009, online: - [Eps99] Jeremy Epstein, "Architecture and Concepts of the ARGuE Guard," Proceedings of the 1999 Annual Computer Security Applications Conference, Dec. 6-10, 1999, Phoenix, Arizona. - [Fed10] CIO Council, "Proposed Security Assessment and Authorization for U.S. Government Cloud Computing, Draft version 0.96, Nov. 2010. Online: www.FedRAMP.gov. - [Fer92] David F. Ferraiolo and D.R. Kuhn, "Role Based Access Control," Proceedings of the 15th National Computer Security Conference, Oct 13-16, 1992, pp. 554-563. - [Gar05] Jesse James Garrett, "Ajax: A New Approach to Web Applications," 2005,

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Cloud Computing Synopsis and Recommendations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD) provide? (Section 141) ts devices from accessing external domains and IP addresses that are associated with known current cybersecurity threats. Figure 7-2 depicts a detailed view of Build 2’s threat-signaling architecture. As shown, GCA’s Quad9 threat agent and Quad9 MUD manager (which are both part of Q9Thrt) are integrated into the Yikes! router to support threat signaling. Additionally, the Yikes! router requires the use of several external components to support threat signaling: Quad9 DNS service, which receives threat information feeds from a variety of threat intelligence services; Quad9 threat API, which confirms a threat as well as NIST SP 1800-15B: Securing Small-Business and Home Internet of Things Devices 87 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 information regarding how to find the threat MUD file for that threat; and the ThreatSTOP threat MUD file server, which provides the threat MUD file for the threat. Figure 7-2 Threat-Signaling Logical Architecture–Build 2 The messages that are exchanged among architectural components to support threat signaling are depicted by arrows and numbered in sequence in Figure 7-2. The result of this message flow is to protect a local device from connecting to a domain that has been identified as unsafe by a threat intelligence service from which Quad9 DNS service receives information which, in this case, is ThreatSTOP. As depicted in Figure 7-2, the steps are as follows:  A local device (which may or may not be an IoT device and may or may not be MUD-capable) sends a DNS resolution request to its local DNS service, which is hosted on the Yikes! router (step 1).  If the local DNS service cannot resolve the request itself, it will forward the request to the Quad9 DNS service (step 2).  The Quad9 DNS service will return a DNS response to the Yikes! router’s local DNS service.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Platform Firmware Resiliency Guidelines say about 2. Trusted Platform Module (TPM)? According to Platform Firmware Resiliency Guidelines, 2. Trusted Platform Module (TPM): A TPM [4] is a security coprocessor capable of securely storing and using cryptographic keys and measurements of the state of the platform. These capabilities can be used, among other things, to secure data stored on the system, provide a strong device identity, and to attest the state of the system. While not all platforms include or make use of a TPM, on any system in which a TPM is included and used, its firmware must be protected given its criticality in helping ensure the trustworthiness of the platform. TPMs also contain non-volatile memory storage which may contain critical data and, if so, must be protected. TPM's can be either discrete hardware devices, or may be realized in

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Platform Firmware Resiliency Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AA-05 in Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems? (Part 7) Control AA-05: ----------|--------------------| | 1 | CVE- 2019- 19229 | admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal. | 4-Dec-19 | V3.1: 6.5 MEDIUM | | 2 | CVE- 2019- 19228 | Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account is stored in the /tmp/web_users.conf file. | 4-Dec-19 | V3.1: 9.8 CRITICAL | | 3 | CVE- 2018- 12927 | Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/index/1 URI. | 28-Jun-18 | V3.0: 7.5 HIGH | | 4 | CVE- 2018- 12735 | SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inverter_info.htm or english_main.htm URI. | 25-Jun-18 | V3.0: 7.5 HIGH | | 5 | CVE- 2017- 9863 | ** DISPUTED ** An issue was discovered in SMA Solar Technology products. If a user simultaneously has Sunny Explorer running and visits a malicious host, cross-site request forgery can be used to change settings in the inverters (for example, issuing a POST request to change the user password). All Sunny Explorer settings available to the authenticated user are also available to the attacker. (In some cases, this also includes changing settings that the user has no access to.) This may result in complete compromise of the device. NOTE: The vendor reports that exploitation is unlikely because Sunny Explorer is used only rarely. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, cve-. Contains technical security guidance that could inform defensive posture. Source: Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines on PDA Forensics provide? (Section 6) ....................................................... | 3 | | 2. | BACKGROUND.................................................................................................................... 4 | BACKGROUND.................................................................................................................... 4 | | 2.1 | DEVICE CHARACTERISTICS .............................................................................................. | 4 | | 2.2 | PALM OS........................................................................................................................... | 6 | | 2.3 | POCKET PC.......................................................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on PDA Forensics.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain (1) Active Association according to NIST A Formal Description of the SDNS Security Protocol at Layer 4 (SP4) According to A Formal Description of the SDNS Security Protocol at Layer 4 (SP4), (1) Active Association: - (a) active association identifier -the name of this active association instance. - (b) local address designator -the local address of an association pair. - (c) peer address designator -the peer address of an association pair. - (d) initiated by - determines which end-system sets the direction indicator as the initiator (local or peer). - (e) status -the status of the association (partially complete, usable, etc.). - (f) local credentials -the credentials used to establish this association. - (g) peer credentials -the peer entities' credentials used to establish this association. - (h) local key identifier -the identifier of the traffic key used for this association. - (i) peer key identifier -the peer entities identifier for the traffic key used for this association.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Formal Description of the SDNS Security Protocol at Layer 4 (SP4).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain D.2.2. Binary Curves in Short-Weierstrass Form according to NIST Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters According to Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters, D.2.2. Binary Curves in Short-Weierstrass Form: Point compression for binary curves in short-Weierstrass form is defined as follows:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide? (Section 52) The integrity of the code in the repository can be trusted such that it can be used for further updates. | | | 5.1.3 Integrity of Evidence Generation During Software Updates (To provide assurance to acquirers that the software they get is legitimate, steps are taken to protect the integrity of evidence generation tasks) | 1. The framework should provide protection against all known attacks on the tasks performed by the software update systems, such as metadata (hash) generation, the signing process, the management of signing keys, the integrity of the authority performing the signing, key validation, and signature verification. 2. The framework should provide a means to minimize the impact of key compromise by supporting roles with multiple keys and threshold or quorum trust (with the exception of minimally trusted roles designed to use a single key). The compromise of roles that use highly- vulnerable keys should have minimal impact. Therefore, online keys (i.e., keys used in an automated fashion) must not be used for any role that clients ultimately trust for files they may install [11]. When keys are online, exceptional care should be taken in caring for them, such as storing them in an HSM and only allowing their use if the artifacts being signed pass the policy defined in Sec. 5.1.1. 3. The framework must be flexible enough to meet the needs of a wide variety of software update systems. 4. The framework must be easy to integrate | Provide a Mechanism for Verifying Software Release Integrity (PS.2): Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Card Technology Developments and Gap Analysis Interagency Report provide? (Section 55) ents. If so, please state what the technologies are, and why they were rejected. - b. Did you encounter integration and/or interoperability issues? 3. Have you performed a Business Case Analysis? - a. If yes, is it open to the public and available on your web site? Please list resource. - b. What are the main cost drivers for your card application? 4. What are the current Card Technology Requirements? - a. Please describe the text that's required to be displayed on your cards. Include such details as how many characters are required, font requirements, maximum lengths, character size requirements, etc. - b. If you use different color backgrounds or borders for different employee/contractor designations, please list these requirements. - c. If a photograph is required to be displayed on your card, please discuss your minimum/maximum size, color, and resolution requirements? - d. Are there requirements to print on the front and/or back of your cards? If so, please state the requirements. - e. If there is a requirement for other biometric imagery to appear on the card, please describe the minimum/maximum size and resolution requirements. - f. For any requirements of storing digital biometric data on the card, please discuss your minimum data capacity and storage format requirements. - g. If a barcode is included on your card for identity/transaction cards, what are your quantitative and format requirements? - h. If holographic images are displayed on your cards, what are the size and format requirements? - i. For requirements dealing with general storage of digital data on the cards, what are your minimum data capacity, minimum storage and retrieval access time, and data storage format requirements? - j. What are your data format and form factor requirements for an installed base of or other basis for preference for magnetic storage (e.g., magnetic stripe)? - k.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Card Technology Developments and Gap Analysis Interagency Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Secure Deployment of IPv6 provide? (Section 23) | Unknown Aspects .................................................................................... | 4-26 | | 4.5 | Jumbograms ........................................................................................................4-27 | Jumbograms ........................................................................................................4-27 | | | | 4.5.1 | Specification Overview............................................................................. | 4-27 | | | 4.5.2 | Security Ramifications..............................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Section 80) ement in the successful execution of the RMF. The requirements are defined early in the SDLC in collaboration with the senior leaders and are integrated into the acquisition and procurement processes. For example, organizations can use the [SP 800-160 v1] life cycle-based systems engineering process to define an initial set of security and privacy requirements, which in turn, can be used to select a set of controls* to satisfy the requirements. The requirements or the controls can be stated in the Request for Proposal or other contractual agreement when organizations acquire systems, system components, or services. Requirements can also be added throughout the life cycle, such as with the agile development methodology where new features are continuously deployed. The NIST Cybersecurity Framework [NIST CSF] (i.e., Core, Profiles) can also be used to identify, align, and deconflict security requirements and to subsequently inform the selection of security controls for an organization. Cybersecurity Framework Profiles can provide a link between cybersecurity activities and organizational mission/business objectives, which supports riskbased decision-making throughout the RMF. While Profiles may be used as a starting point to inform control selection and tailoring activities, further evaluation is needed to ensure the appropriate controls are selected. Some organizations may choose to use the Cybersecurity Framework in concert with the NIST Systems Security Engineering publications-identifying, aligning, and deconflicting requirements across a sector, an industry, or an organization-and subsequently employing a systems engineering approach to further refine the requirements and obtain trustworthy secure solutions to help protect the organization's operations, assets, individuals. * See Section 2.3 for specific guidance on privacy control selection and managing privacy risk.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, csf, risk management framework. General security reference material without sensitive content. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.