You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cloud Computing Synopsis and Recommendations say about 4.4 The On-site Community Cloud Scenario? (Part 2) According to Cloud Computing Synopsis and Recommendations, 4.4 The On-site Community Cloud Scenario: l using a standard such as XACML [Mos05], or following a security model such as role-based access control [Fer92] or attribute-based access control [Kar09]) might be used to express sharing policies. Besides controlling access to resources, identity management [Oid11, Rag08, Oix10] is important in this scenario since clients from multiple participant organizations access a common pool of resources. As with the on-site private cloud and the outsourced private cloud, although the general statements remain true for the on-site community scenario, the on-site community cloud scenario also allows for a more detailed understanding of some of the general statements as well as additional statements that organizations considering the use of an on-site community cloud should consider: -  Network Dependency (on-site community). As with the on-site private scenario, where the organization spans multiple sites, the consumers in an on-site community cloud need to either provision controlled inter-site communication links or use cryptography over a less controlled communications media (such as the public Internet). The reliability and security of the community cloud will depend on the reliability and security of the communication links. Dedicated leased network connections can also be used to support enhanced performance, reliability, and security. In the on-site community case, in addition, care should be taken to understand the actual dependencies between member organizations since there are multiple organizations participating and any subset of them could suffer a cloud infrastructure failure (e.g., going offline). Additionally, local clouds will probably need to be taken offline for maintenance at various times and therefore two-way communication in advance among the community members is essential to achieving a clear understanding of the service levels that they offer to one another and require from one another. -  Consumers still need IT skills (on-site-community).

Explanation: NIST publication on credential and access management. Topics: access control, identity management. Contains security framework guidance for authentication systems. Source: Cloud Computing Synopsis and Recommendations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does General Procedures for Registering Computer Security Objects say about Table of Contents? (Part 4) According to General Procedures for Registering Computer Security Objects, Table of Contents: | C.1.3 Tag-Specific Information | 13 | | C.1.4 Security Object Usage | Rules and Handling Instructions 14 | | C.2 Security Tag Registration Rules | 14 | | C.2.1 Special Rules for Bit | Map Tags 15 | | C.2.2 Special Rules for Enumerated Tags | 15 | | C.2.3 Special Rules for Range Tags | 15 | | C.2.4 Special Rules for Free Form Tags | 15 | 1.0

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: General Procedures for Registering Computer Security Objects.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out say about APPENDIX H: SAMPLE TEXT ON ENVIRONMENT CONSIDERATIONS FOR SOWs? (Part 2) According to Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out, APPENDIX H: SAMPLE TEXT ON ENVIRONMENT CONSIDERATIONS FOR SOWs: ive, physical, environmental, and telecommunications safeguards; - o statement on the continuity of operation of all information systems that support mission-essential/critical organization functions. This section should also cover the location, source, and contact for any other information that the Contractor may need to know in order to perform the tasks in the SOW. This includes the results of any previous audits, reviews, studies, certifications, analyses, etc. that address the computer security of the system(s) for which the SOW applies. <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AN-2011 in Requirements and Conformance Test Assertions for ANSI_NIST-ITL 1-2011 Record Type 18 - DNA Record? (Part 9) Control AN-2011: demonstrate that products meet the technical requirements specified in the standards.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Requirements and Conformance Test Assertions for ANSI_NIST-ITL 1-2011 Record Type 18 - DNA Record.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-15413 in Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations? (Part 424) Control PS-15413: orking Group (v3), August 2021, This report leveraged the 2015 version of the NIST SP 800-161. | Threat Sources | Threat | Examples | |--------------------------------|--------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Systemic Economic Risks | Business failure of a key supplier leads to supply chain disruption | Economic risks stem from threats to the financial viability of suppliers and the potential impact to the supply chain resulting from the failure of a key supplier. Other threats to the supply chain that result in economic risks include vulnerabilities to cost volatility, reliance on single-source suppliers, the cost to swap out suspect vendors, and resource constraints due to company size.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-6 in NIST_SP_800-37r2_Risk_Management_Framework? (Part 318) Control AM-6: being managed by an ongoing authorization process). ## REAUTHORIZATION Reauthorization actions occur at the discretion of the authorizing official in accordance with federal or organizational policy. 156 If a reauthorization action is required, organizations maximize the use of security and privacy risk information produced as part of the continuous monitoring processes currently in effect. Reauthorization actions, if initiated, can be either time-driven or event-driven. Time-driven reauthorizations occur when the authorization termination date is reached (if one is specified). If the system is under ongoing authorization, 157 a time-driven reauthorization may not be necessary. However, if the continuous monitoring program is not sufficiently comprehensive to fully support ongoing authorization, a maximum authorization period can be specified by the authorizing official. Authorization termination dates are guided and informed by federal and organizational policies and by the requirements of authorizing officials. Under ongoing authorization, a reauthorization may be necessary if an event occurs that produces risk above the acceptable organizational risk tolerance. A reauthorization may be warranted, for example, if there is a breach/incident or failure of or significant problems with the continuous monitoring program. Reauthorization actions may necessitate a review of and changes to the continuous monitoring strategy which may in turn, affect ongoing authorization. For security and privacy assessments associated with reauthorization, organizations leverage security and privacy information generated by the continuous monitoring program and fill in gaps with manual assessments. Organizations may supplement automatically-generated assessment information with manually-generated information in situations where an increased level of assurance is needed.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ID-19 in Securing Telehealth Remote Patient Monitoring Ecosystem? (Part 9) Control ID-19: O engages with a telehealth platform provider that is a separate entity from the HDO and patient. The telehealth platform provider manages a distinct infrastructure, applications, and set of services. The telehealth platform provider coordinates with the HDO to provision, configure, and deploy the RPM components to the patient home and assures secure communication between the patient and clinician. The NCCoE analyzed RPM ecosystem risk factors by applying methods described in the NIST Risk Management Framework. The NCCoE also leveraged the NIST Cybersecurity Framework, NIST Privacy Framework, and other relevant standards to identify measures to safeguard the ecosystem. In collaboration with healthcare, technology, and telehealth partners, the NCCoE built an RPM ecosystem in a laboratory environment to explore methods to improve the cybersecurity of an RPM. Technology solutions alone may not be sufficient to maintain privacy and security controls on external environments. This practice guide notes the application of people, process, and technology as necessary to implement a holistic risk mitigation strategy. This practice guide's benefits include helping organizations assure the confidentiality, integrity, and availability of an RPM solution, enhancing patient privacy and limiting HDO risk when implementing an RPM solution. ## KEYWORDS access control; authentication; authorization; behavioral analytics; cloud storage; data privacy; data security; encryption; HDO; healthcare; healthcare delivery organization; remote patient monitoring; RPM; telehealth; zero trust ## ACKNOWLEDGMENTS We are grateful to the following individuals for their generous contributions of expertise and time.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Hash Standard (SHS) say about 3.1 Bit Strings and Integers? (Part 1) According to Secure Hash Standard (SHS), 3.1 Bit Strings and Integers: 3.1 Bit Strings and Integers The following terminology related to bit strings and integers will be used. 1. A hex digit is an element of the set { 0, 1,…, 9, a,…, f }. A hex digit is the representation of a 4-bit string. For example, the hex digit ' 7 ' represents the 4-bit string ' 0111 ', and the hex digit ' a ' represents the 4-bit string ' 1010 '. 2. A word is a w -bit string that may be represented as a sequence of hex digits. To convert a word to hex digits, each 4-bit string is converted to its hex digit equivalent, as described in (1) above. For example, the 32-bit string 1010 0001 0000 0011 1111 1110 0010 0011 can be expressed as ' a103fe23 ', and the 64-bit string ``` 1010 0001 0000 0011 1111 1110 0010 0011 0011 0010 1110 1111 0011 0000 0001 1010 ``` can be expressed as ' a103fe2332ef301a '. Throughout this specification, the 'big-endian' convention is used when expressing both 32- and 64-bit words, so that within each word, the most significant bit is stored in the left-most bit position. 3. An integer may be represented as a word or pair of words. A word representation of the message length,  , in bits, is required for the padding techniques of Sec. 5.1. An integer between 0 and 2 32 -1 inclusive may be represented as a 32-bit word. The least significant four bits of the integer are represented by the right-most hex digit of the word representation. For example, the integer 291=2 8 + 2 5 + 2 1 + 2 0 =256+32+2+1 is represented by the hex word ' 00000123' . The same holds true for an integer between 0 and 2 64 -1 inclusive , which may be represented as a 64-bit word. If Z is an integer, 0  Z < 2 64 , then Z =2 32 X + Y , where 0  X < 2 32 and 0  Y < 2 32 . Since X and Y can be represented as 32-bit words x and y , respectively, the integer Z can be represented as the pair of words ( x , y ). This property is used for SHA-1, SHA224 and SHA-256.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Hash Standard (SHS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Viewing Detailed Analyzer Data according to NIST Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events, Viewing Detailed Analyzer Data: 1. The desired field data can be exported to either a .csv or Microsoft Excel format, by clicking on the Export button in the details tab. 2. Charts can be added or removed using the Charts dropdown menu near the top of the analyzer. 3. Any data in the Field List on the right side can be added to or removed from the view and will be automatically incorporated into its relevant rows or columns. 4. The entire view format can be exported as a .json file from the Open View option. <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PM-8200 in Cell Phone Forensic Tools_ an Overview and Analysis Update? (Part 114) Control PM-8200: Table 25: Results Matrix | | Device | Device | Device | Device | Device | Device | |-----------------------------|---------------|-----------------|--------------|---------------|------------|-------------| | Scenario | Ericsson T68i | Motorola MPX220 | Motorola V66 | Motorola V300 | Nokia 6200 | Nokia 6610i | | Connectivity and Retrieval | Meet | Meet | Meet | Meet | Meet | Meet | | PIM Applications | Below | Below | Below | Below | Below | Below | | Dialed/Received Phone Calls | Below | Below | Below | Below | Below | Below | | SMS/MMS Messaging | Below | Below | Below | Below | Below | Below | | | Device | Device | Device | Device | Device | Device | |---------------------------------|---------------|-----------------|--------------|---------------|------------|-------------| | Scenario | Ericsson T68i | Motorola MPX220 | Motorola V66 | Motorola V300 | Nokia 6200 | Nokia 6610i | | Internet Messaging | Miss | Below | NA | Below | NA | NA | | Web Applications | Miss | Miss | NA | Miss | Miss | Miss | | Text File Formats | NA | Miss | NA | Miss | Miss | Miss | | Graphics File Formats | Miss | Below |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IP-002 in Guidelines for Smart Grid Cybersecurity? (Part 244) Control IP-002: s, but there is a question about how a root organization becomes a root organization, how they verify the identity for those requiring certificates, and even what identity actually means for a device. 4.2.2.2 Single Sign On Many smart grid components, such as wireless devices (e.g., AMI), are low-processing-power devices with wireless interface (e.g., Zigbee) and are often connected to the backhaul networks with low bandwidth links. These components are typically equipped with 4 kB to 12 kB of RAM and 64 kB to 256 kB of flash memory. The link characteristics can also vary, depending upon the wireless radio features, such as the sleeping or idle mode of operation. For example, the advanced metering system may periodically be awakened and synced with the network to save power, rather than remain always active. Additional device requirements include (1) the support of multi-hop networks using mesh topology (e.g., to extend the backhaul reach back), and (2) support of multiple link layer technologies. Advanced meters can also be used for other purposes besides simple metering data. For example, ANS C12.22 [§4.4-17] allows using advanced meters peering via relay or concentrators. Other 235 applications should be able to run simultaneously on a single meter. For security requirements, each application needs to be authenticated and needs to preserve the integrity of the data provided to the system (e.g., billing system). In such scenarios, the protocol overhead and performance must be optimized, and performance must be taken into account for these low- processing power components. From a key management perspective, optimization on the amount of exchanges and the footprint to execute peer authentication, key establishment, key update, and key deletion have to be considered for each communication layer and protocol that is used by smart grid components that need to be secured.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector? (Part 183) Control AC-1: | NIST SP 800-53 Rev. 5 | |--------------------------------------------|-------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------| | | | manufacturer's supporting entities.  Providing communications and documentation detailing how to perform recommended local and/or remote maintenance activities.  Providing the details necessary to enable IoT device customers to monitor onsite and offsite IoT device maintenance activities.  Providing the details necessary for maintaining records for nonlocal IoT device maintenance and diagnostic activities.  Providing the details necessary to implement management and operational controls for IoT device maintenance personnel and associated authorizations, and record-keeping of maintenance organizations and personnel.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Stateless Hash-Based Digital Signature Standard say about 3. Overview of the SLH-DSA Signature Scheme? (Part 1) According to Stateless Hash-Based Digital Signature Standard, 3. Overview of the SLH-DSA Signature Scheme: 3. Overview of the SLH-DSA Signature Scheme SLH-DSA is a stateless hash-based signature scheme that is constructed using other hash-based signature schemes as components: (1) a few-time signature scheme, forest of random subsets (FORS), and (2) a multi-time signature scheme, the eXtended Merkle Signature Scheme (XMSS). XMSS is constructed using the hash-based one-time signature scheme Winternitz One-Time 2 Signature Plus (WOTS + ) as a component. Conceptually, an SLH-DSA key pair consists of a very large set of FORS key pairs. 3 The few-time signature scheme FORS allows each key pair to safely sign a small number of messages. An SLH-DSA signature is created by computing a randomized hash of the message, using part of the resulting message digest to pseudorandomly select a FORS key, and signing the remaining part of the message digest with that key. An SLH-DSA signature consists of the FORS signature and the information that authenticates the FORS public key. The authentication information is created using XMSS signatures. XMSS is a multi-time signature scheme that is created using a combination of WOTS + one-time signatures and Merkle hash trees [13]. An XMSS key consists of 2 ℎ ′ WOTS + keys and can sign 2 ℎ ′ messages. The WOTS + public keys are formed into a Merkle hash tree, and the root of the tree is the XMSS public key. (The Merkle hash tree formed from the WOTS + keys is also referred to as an XMSS tree.) An XMSS signature consists of a WOTS + signature and an authentication path within the Merkle hash tree for the WOTS + public key. In Figure 1, triangles represent XMSS trees, squares represent the WOTS + public keys, and circles represent the interior nodes of the hash tree. Within an XMSS tree, the square and circles that are filled in represent the authentication path for the WOTS + public key needed to verify the signature. The authentication information for a FORS public key is a hypertree signature.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Stateless Hash-Based Digital Signature Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management say about 2.2.4 Determining Potential Impact? (Part 1) According to Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, 2.2.4 Determining Potential Impact: 2.2.4 Determining Potential Impact The final prerequisite for creating a practical list of risk scenarios for the risk register is the determination of the potential impact of the threats and vulnerabilities described above. The section below describes the completion of part D of the CSRM Risk Description column (Figure 11.) Figure 11: Adverse Impact Inclusion in Risk Scenario Identification (Part D) <!-- image --> Discovery activities throughout Section 2.2 may have already highlighted potential adverse impacts to explore. Description of the impact is a key element for enterprise stakeholders and represents the connection between cybersecurity risks and the enterprise objectives that would be affected by those risks. Reviewing the key enterprise objectives, as identified in scoping, and 26 Information about the NIST SCAP is available at https://csrc.nist.gov/projects/security-content-automation-protocol/. 27 More information about the DHS AWARE scoring method is available at armed with a broad list of potential threats and vulnerabilities, personnel can develop a list of realistic scenarios. While some types of impact may not be immediately apparent, the long-term effects can be significant. For example, consider a situation where a criminal has gained unauthorized access to an enterprise system and has exfiltrated a large amount of confidential data. If that criminal is cautious, there may not be any disruption of operations. In fact, sometimes cyber criminals actually try to improve the health of a victim's technology to ensure that it will be available for their malicious activity. In this case, the system may seem to be working fine - even better than ever - and then later, the enterprise realizes that a catastrophic loss has occurred. Notably, impact scenarios can be considered as a continuum rather than as a binary state.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Telehealth Remote Patient Monitoring Ecosystem say about C-6 Vulnerabilities? (Part 1) According to Securing Telehealth Remote Patient Monitoring Ecosystem, C-6 Vulnerabilities: C-6 Vulnerabilities Below is a customized application on identifying vulnerabilities that aggregates vulnerabilities identified in NIST SP 800-30 Revision 1 [9]. As noted in the document, a vulnerability is a deficiency or weakness that a threat source may exploit, resulting in a threat event. The document further describes that vulnerabilities may exist in a broader context, i.e., that they may be found in organizational governance structures, external relationships, and mission/business processes. The following table enumerates those vulnerabilities, using a holistic approach, and represents those vulnerabilities that this project identified and for which it offers guidance. For further description, readers should reference NIST SP 800-30 Revision 1 [9]. Table C-8 Vulnerability Taxonomy | Vulnerability Description | Vulnerability Severity | Predisposing Condition | Pervasiveness of Predisposing Condition | |---------------------------------------------|--------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------| | out-of-date software | high | Systems may not have patches deployed in a timely fashion, or software may not be validated to assure that applications may operate appropriately should the underlying operating system receive new updates.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services say about 4.1.6. Supply Chain Risk Management Category? (Part 4) According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services, 4.1.6. Supply Chain Risk Management Category: 5 PM-9, RA-3, SR-2, SR-3, SR-5, SR-6 USG FRP 1.7 | | Identify Supply | Applicability to PNT | References (PNT Specific) | |-----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------| | Chain Risk Management Subcategory | about the PNT system and introduce hardware, software, or firmware that could cause the disruption or manipulation of the PNT data as well as any dependencies that may be easier to subvert.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Overview and Considerations of Access Control Based on Attribute Encryption say about 1. Introduction? (Part 2) According to Overview and Considerations of Access Control Based on Attribute Encryption, 1. Introduction: traditional PKE schemes, which allows it to be an efficient and flexible attribute-based access control method. The main features of ABE access control include: - A one-to-many authorization scheme. - Fine-grained access control based on user (i.e., subject) attributes or resource (i.e., object) attributes. - Message sending without obtaining public-key certificates from public-key infrastructure. - Data decryption without evaluating permissions from access control policy. - Collusion-resistance so that a user who holds multiple keys cannot combine different keys to access data that are only allowed to be accessed by one key. These fine-grained and collusion-resistant features support the physical resources and performance demands of systems like the cloud, the Internet of Things (IoT), disrupt-tolerant networks, wireless sensor networks, mobile ad hoc networks, and public search service systems [ELT][SW]. This document is organized as follows: - Section 1 is the introduction. - Section 2 provides an overview of the fundamental theories that ABE is built on, including elliptic-curve cryptography, bilinear pairing, and bilinear pairing for elliptic curve cryptography. - Section 3 introduces identity-based encryption (IBE). - Section 4 illustrates ABE algorithms for Ciphertext-Policy Attribute-Based Encryption (CP-ABE) and Key-Policy Attribute-Based Encryption (KP-ABE). - Section 5 describes considerations for the applications of ABE from the perspectives of security, performance, access control policies, and support models. - Section 6 is the conclusion. - Appendix A identifies changes that have been made to this publication.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Overview and Considerations of Access Control Based on Attribute Encryption.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings say about 3 Disadvantages of a SEM approach? According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, 3 Disadvantages of a SEM approach: One of the drawbacks of SEM approach is that it is vulnerable to Denial-ofService (DoS) attacks, as pointed in [3]. There are three types of DoS attack:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? https: //nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-147B.pdf.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Considerations for Voice Over IP Systems provide? (Section 113) lay protection for the RTP traffic as well as RTCP (Real-time Transport Control Protocol). SRTP was being standardized at the IETF in the AVT working group. It was released as RFC 3711 in March 2004. SRTP provides a framework for encryption and message authentication of RTP and RTCP streams. SRTP can achieve high throughput and low packet expansion. SRTP is independent of a specific RTP stack implementation and of a specific key management standard, but Multimedia Internet Keying (MIKEY) has been designed to work with SRTP. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ AES in counter mode is the default algorithm, if encryption is desired. AES-f8 mode is an option for UMTS applications. The pre-defined authentication transform is HMAC-SHA1. The default session authentication key-length is 160 bits, the default authentication tag length is 80 bits. The key derivation function is AES in counter mode with a 128-bit master key from the key management. Interface for hardware-crypto support (e.g. IP phones). In comparison to the security options for RTP there are some advantages to using SRTP. The advantages over the RTP standard security and also over the H.235 security for media stream data are listed below. - Confidentiality for RTP as well as for RTCP by encryption of the respective payloads; - Integrity for the entire RTP and RTCP packets, together with replay protection; - The possibility to refresh the session keys periodically, which limits the amount of cipher text produced by a fixed key, available for an adversary to cryptanalyze; - An extensible framework that permits upgrading with new cryptographic algorithms; - A secure session key derivation with a pseudo-random function at both ends; - The usage of salting keys to protect against pre-computation attacks; - Security for unicast and multicast RTP applications.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Telehealth Remote Patient Monitoring Ecosystem say about E-2 Device Capabilities Supporting Functional Evaluations? (Part 5) According to Securing Telehealth Remote Patient Monitoring Ecosystem, E-2 Device Capabilities Supporting Functional Evaluations: ID.RA-1 ID.RA-4 ID.RA-5 ID.RA-6 | |  Providing training and awareness information to IoT device customers that describe newly identified vulnerabilities and threats (such as zero-day malware) for the associated IoT device.  Providing the details necessary for the installation of IoT devices and associated systems security-relevant software updates within an organizationally defined time period from the vendor release of the updates.  Providing education describing the operational impacts of the anti-malware activities on mission critical processes in the system where the IoT device is used.  Providing education explaining the responsibilities of IoT device customers to perform their own risk assessments, using information provided by the manufacturer, to determine the risks the IoT device will bring into the IoT device customer's systems. | | RPM-3 Identity Management, Authentication, and |  Ability to uniquely identify the IoT device logically.  Ability to uniquely identify a remote IoT device. |  Providing details for how to establish unique identification for each IoT device associated with the system and critical system components within which it is used. | .

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, zero-day. Contains technical security guidance that could inform defensive posture. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.3.4 Generic Container Provider Virtual Machine Card Edge Interface according to NIST Government Smart Card Interoperability Specification, Version 2.1 According to Government Smart Card Interoperability Specification, Version 2.1, 5.3.4 Generic Container Provider Virtual Machine Card Edge Interface: Table 5-22 shows the Generic Container Provider VM APDUs. As described in Chapter 8, containers accessed by these APDUs are split into two buffers: a TL buffer containing Tag and associated Length values, and a V buffer containing the values identified by the corresponding Tags and Lengths. Table 5-22: Generic Container VM APDUs | Card Function | CLA | INS | P1 | P2 | L c | Data | L e | |-----------------|------------|-------|-------|-------|-------|---------------------------------|-------| | READ BUFFER | 0x80 | 0x52 | Off/H | Off/L | 0x02 | Buffer and number bytes to read | - | | UPDATE BUFFER | 0x80, 0x84 | 0x58 | Off/H | Off/L | L c | Buffer and data to update | - |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1. Introduction according to NIST Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, 1. Introduction: Executive Order (EO) 13556 [1] established a government-wide program to standardize the way the executive branch handles Controlled Unclassified Information (CUI). 1 EO 13556 required that the CUI program emphasize openness, transparency, and uniformity of government-wide practices and that the program implementation take place in a manner consistent with Office of Management and Budget (OMB) policies and National Institute of Standards and Technology (NIST) standards and guidelines. As the CUI program Executive Agent, the National Archives and Records Administration (NARA) provides information, guidance, policy, and requirements on handling CUI [4]. This includes approved CUI categories and descriptions, the basis for safeguarding and dissemination controls, and procedures for the use of CUI. 2 The CUI federal regulation [5] provides guidance to federal agencies on the designation, safeguarding, marking, dissemination, decontrolling, and disposition of CUI; establishes self-inspection and oversight requirements; and delineates other facets of the program. The CUI regulation requires federal agencies that use federal information systems 3 to process, store, or transmit CUI to comply with NIST standards and guidelines. The responsibility of federal agencies to protect CUI does not change when such information is shared with nonfederal organizations. 4 Therefore, a similar level of protection is needed when CUI is processed, stored, or transmitted by nonfederal organizations using nonfederal systems. 5 To maintain a consistent level of protection, the security requirements for safeguarding CUI in nonfederal systems and organizations must comply with Federal Information Processing Standards (FIPS 199) publication [6] and FIPS 200 [7]. The requirements are derived from the controls in NIST Special Publication (SP) 800-53 [8].

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Personal Identity Verification (PIV) of Federal Employees and Contractors provide? (Section 57) ocedure, for example by authenticating the cardholder with an associated derived PIV credential or by confirming reset via email to the on-record government-issued email address. The remote PIN reset operation SHALL satisfy the requirements for remote, postissuance updates specified in Section 2.9.2. Regardless of the PIN reset procedure used, the chosen PIN SHALL meet the activation requirements specified in Section 4.3.1. Both fingerprints used for OCC SHALL be replaced during an OCC reset. OCC reset MAY be performed in person at an issuing facility or a supervised remote identity proofing station: When OCC reset is performed in person at the issuing facility, before the reset, the issuer SHALL perform a biometric verification of the cardholder to the biometric data records in the PIV enrollment record. 16 If the biometric verification decision is negative or no alternative biometric data records are available, the cardholder SHALL provide the PIV Card to be reset and another primary identity source document (as specified in Section 2.7). An attending operator SHALL inspect these and compare the cardholder with the electronic facial image retrieved from the enrollment data record and the photograph printed on the PIV Card. OCC reset at a supervised remote identity proofing station combines the assurance of an in-person reset with the convenience of a kiosk reset. All protections and requirements of Section 2.7.1 SHALL be observed during the procedure. The 16 If OCC is being reset due to epidermal damage on a specific finger, it may be prudent to perform the biometric comparison with a different finger or different biometric characteristic.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Personal Identity Verification (PIV) of Federal Employees and Contractors.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Guidelines for Smart Grid Cybersecurity? (Part 464) Control SI-11: create a communications network between end systems at customer premises (including meters, gateways, and other equipment) and diverse business and operational systems of utilities and third parties. AMI systems provide the technology to allow the exchange of information between customer end systems and those other utility and Third Party systems. In order to protect this critical infrastructure, end-to-end security must be provided across the AMI systems, encompassing the customer end systems as well as the utility and Third Party systems that are interfaced to the AMI systems. Scenario Description This use case describes a batch instruction send to meters as a multicast transaction in an open loop situation. The open loop situation means that Advanced metering Infrastructure (AMI) Head End System (HES) does not expect a response for each packet sent to a meter. A Utility requires actions from a set of meters, which may or may not result in a change to the power state of the grid. These include at least meter reading, and certain configuration changes. The meter Reading and Control (MRC) determines the need to send batch instructions to more than one meter. MRC looks up the meter associated with the customer and then instructs the Advanced metering Infrastructure (AMI) Head End system (HES) to queue up and execute the instructions. The AMI Head End can determine the instruction needs to be split into packets, schedules the sending of the packets and continues to send the packets to the meters until all instruction packets have been sent. The meter(s) receive the instruction(s) and determines if the instruction is permitted. After execution, the meter(s) send the instruction result to the HES. The HES will then send the instruction result to the MRC. If the instruction result is energy usage information, the MRC will then forward the energy usage information onto the meter Data Management System (MDMS).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i? (Part 151) Control ES-1: Questions for Identifying an Appropriate EAP Method | Question | Analysis | |----------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Does the WLAN solution need to support guest users?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Guideline #3: Configure the Recording of Events in a Log according to NIST Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems According to Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems, Guideline #3: Configure the Recording of Events in a Log: A log of cybersecurity-relevant activities that is stored in another location can help identify the factors that led to an unexpected event, recover from the compromise, and determine how to prevent such compromises in the future. Logs should contain information about the operation of the smart inverter (e.g., normal or anomalous values of system parameters) when an event is detected and enable reviewers to understand the chain of events with a degree of fidelity. Event logging supports troubleshooting for smart-inverter issues as well as responses to cyber events. In addition to system parameters, logs should also contain cybersecurity-relevant information, such as: - Creation or removal of user accounts - Successful and unsuccessful user authentication, including the identity associated with the authentication - Changes to smart-inverter configuration settings, including previous and new values and the identity of the user or system making changes to enabled/disabled features, assigned user roles, and role permissions - Enabling previously disabled features - Records of software and firmware updates, including how the update was initiated (e.g., by a user, automatically), the source of the update, and any update integrity information (e.g., checksums, hashes) - Communications events, such as network connections or loss of connectivity - Actions performed directly from the smartinverter's control panel As shown in Fig. 5, logging capabilities should be configured and enabled by the installer during solar energy system setup. During operations and maintenance, the owner or maintenance technician should verify that information is being collected and stored in logs as intended. Fig. 5. Guideline #3 life cycle phase <!-- image -->

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AU-2 in Hardware-Enabled Security_ Container Platform Security Prototype? (Part 5) Control AU-2: X | X | X | | | | | | | | | PR.IP-3 | | | | | | X | X | X | | | | | | | PR.IP-5 | | PR.IP-12 | | | | | | | | | | X | X | X | | | X | | X | | | | | X | X | X | | | | PR.PT-1 | | RS.MI-1 | | | | | | | | | | X | X | X | | | RS.MI-2 | | | | | | | | | | | X | X | | ## Appendix F-Acronyms and Other Abbreviations Selected acronyms and abbreviations used in the report are defined below.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Hardware-Enabled Security_ Container Platform Security Prototype.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Personal Identity Verification (PIV) of Federal Employees and Contractors say about Match? According to Personal Identity Verification (PIV) of Federal Employees and Contractors, Match: . Comparison decision stating that the biometric probe(s) and the biometric reference are from the same source. Match is a possible result of a Comparison . The opposite of a match is a non-match. SOURCE: [ISO 2382-37, adapted]


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case provide? (Section 94) ct X Asset Criticality The resulting risk score (1 to 100) is then used for determining the overall risk level (adapted from NIST SP 800-30 30 ) which is utilize for prioritizing remediation efforts. | Risk Level | Description | Risk Score | |--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------| | Very High | Very high risk means that the identified vulnerability could be expected to have multiple severe or catastrophic adverse effects on organizational operations, organizational assets, or individuals. | 96 to100 | | High | High risk means that the identified vulnerability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. | 80 to 95 | | Medium | Moderate risk means that the identified vulnerability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. | 21 to 79 | | Low | Low risk means that the identified vulnerability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. | 5 to 20 | | Very Low | Very low risk means that the identified vulnerability could be expected to have a negligible adverse effect on organizational operations, organizational assets, or individuals. | 0 to 4 | The resulting risk information is then entered into the risk management log for tracking and for coordinating remediation.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Study of OSI Key Management say about 9.8.1 Algorithm choice? According to A Study of OSI Key Management, 9.8.1 Algorithm choice: There are three different possibilities for two KMSAs to establish the algorithms to use: - The KMSAs have a priori agreements; - The KMSAs have prior agreements but need to initialize cryptographic variables; - The KMSAs negotiate about the algorithms to use. The protocol uses the Kirq and Kirs PDUs to establish the algorithms. ``` Kirq ::= SEQUENCE { protocolVersion ProtocolVersion, secServGrpProp [0] IMPLICIT SecServGrpProp OPTIONAL, keyEchGrpProp CHOICE { [1] IMPLICIT AsymmKeyExchGrpProp, [2] IMPLICrT SymmKeyExchGrpProp } OPTIONAL } ``` - Kirs ::= SEQUENCE { stateResult StateResult, protocolVersion ProtocolVersion, secServGipAcc [0] IMPLICIT SecServGrpAcc OPTIONAL keyEchGrpAcc CHOICE { [1] IMPLICIT AsyminKeyExchGipAcc, [2] IMPLICrr SymmKeyExchGrpAcc } OPTIONAL) SecServGrpProp ::= SEQUENCE { confAlgs SEQUENCE OF Algorithmidentifier, icvAlgs SEQUENCE OF Algorithmidentifier) SecServGrpAcc ::= SEQUENCE { confAlg Algorithmidentifier, icvAlg Algorithmidentifier) - AsymmKeyExchGrpProp ::= SEQUENCE { keyExchMethods SEQUENCE OF Algorithmidentifier - possibly more declarations have to be put in) AsymmKeyExchGrpAcc ::= SEQUENCE { keyExchMethod Algorithmidentifier - possibly more declarations have to be put in)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of OSI Key Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Section 126) | x | | | CM-8(2) | System Component Inventory Automated Maintenance | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ TABLE C-5: IDENTIFICATION AND AUTHENTICATION REQUIREMENT MAPPINGS | | SECURITY REQUIREMENTS | Defense-in-Depth Protection Strategy | Defense-in-Depth Protection Strategy | Defense-in-Depth Protection Strategy | NIST SP 800-53 Relevant Security Controls | NIST SP 800-53 Relevant Security Controls | |--------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------|----------------------------------------|----------------------------------------|---------------------------------------------|----------------------------------------------------------------------------------------------| | | | PRA | DLO | CRS | | | | 3.5.1e | Identify and authenticate [ Assignment: organization- defined systems and system components ] before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does U.S. Department of Justice Simplified Risk Analysis Guidelines say about 6. STEP 2. AIS SECURITY INFORMATION .? According to U.S. Department of Justice Simplified Risk Analysis Guidelines, 6. STEP 2. AIS SECURITY INFORMATION .: - a. In Step 2 of the risk analysis, security related information for the AIS or application is obtained and documented. The system security measures in effect are identified and documented with a brief evaluation of their effectiveness. Security measures are required even if nonsensitive information is processed to protect the equipment and integrity of the data. However, central to the determination of the need for additional security measures is the type of information processed, whether classified (National Security Information) , sensitive (Limited Official Use) or nonsensitive information, and the threats to this information. This information is important in determining which minimum security requirements are applicable. The Appendix contains a list of the factors that should be carefully considered during this step, including a list of security measures (Table 2) and application system data sensitivity and criticality considerations (Table 3 and Work Form 5) - b. This step also requires an accurate documentation of the security policies, procedures, and countermeasures currently in effect for the AIS. The security measures in place should include administrative procedures, software and hardware security controls, physical security access controls, personnel security controls, and a security awareness program as listed in Table 2 The current security control environment is important due to its impact on the evaluation of the need for additional security measures. - c. The person conducting the risk analysis should also obtain information on the impact of data disclosure, modification, destruction, and disruption of processing on the component's ability to meet mission objectives. The information obtained during Step 2 should be documented using Work Forms 2, 3, 4, and 5. Additional information required by this step includes the number and geographical disparity of AIS users, the frequency of use of the system, and the method of accessing the system.

Explanation: NIST publication discussing classified information handling. References: classified, national security. Contains guidance on protecting sensitive government information. Source: U.S. Department of Justice Simplified Risk Analysis Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification say about 4.8 Secret Shared Between Card Issuer and Physical Token? (Part 2) According to A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification, 4.8 Secret Shared Between Card Issuer and Physical Token: ings established by each of them and the primitive authentication mechanisms that verifies each of those bindings that are discussed in Sec. 4.2 through Sec. 4.8 above are summarized in Table 1 below. Table 1: Smart Card Objects, Bindings and Verifying Authentication Mechanisms | Card Object Name - Description | Binding Established/Embodied | Primitive Authentication Mechanism (verifying the bindings) | |-----------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|------------------------------------------------------------------------------------------------| | Card Holder Unique Identifier (CHUID) Object- An Object containing the Unique Person Identifier that is usually digitally signed by the Card Issuer | Card Issuer - Person Identifier Binding (Strong) | PUM-1: Person Identifier's origin and integrity checked using its associated digital signature | | Card Authentication Certificate | Card Issuer - Token Secret | PUM-2.1 : Establishing Trust in | | Object - A digital certificate issued by a CA trusted by Card Issuer that attests to the presence of a cryptographic secret held by the token.

Explanation: NIST publication on credential and access management. Topics: authentication, token, sso. Contains security framework guidance for authentication systems. Source: A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AN-2013 in Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet? (Part 169) Control AN-2013: | | | | subfield which contains a minimum of one information item. | 1 | 1.007-DAI- InfoItemCou nt | EQ ( Count(InfoItemsIn(SubFld(1.007.1))), Int(1) ) | | M-Fld(1.007) | | | | T | | RT1.39 - Fie | 8.1.7, | This mandatory field shall contain the | 1 | 1.007-DAI- | ReturnResult | | M-Fld(1.007) | | | | B | | Req. # - ID | Ref. in Base Std. | Requirement Summary | L e v e l | Assertion ID | Test Assertion | N o t e s | Imp.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NSTIC Pilots_ Catalyzing the Identity Ecosystem provide? (Section 56) er that promotes confidence, privacy, choice, and innovation. 67 See '2015-NIST=NSTIC-02,' Grants.gov, March 26, 2015, available at http://www.grants.gov/web/grants/view-opportunity.html?oppId=275464. AAAE American Association of Airport Executives AAMVA The American Association of Motor Vehicle Administrators ACT-IAC American Council for Technology - Industry Advisory Council AP Attribute provider AXN Attribute Exchange Network COI Community of interest COPPA Children's Online Privacy Protection Act COTS Commercial off the shelf CSDII The Cross Sector Digital Identity Initiative CSP Credential Service Provider DHS Department of Homeland Security DMV Department of Motor Vehicles FFO Federal funding opportunity FICAM Federal Identity and Access Management FIPS Federal information processing standards FNS Food and Nutrition Services FTC Federal Trade Commission FY Fiscal Year GP Guiding Principles GSA General Services Administration GTRI Georgia Tech Research Institute IDESG Identity Ecosystem Steering Group IDEF Identity Ecosystem Framework IdP Identity provider ITL Information Technology Laboratory KBA Knowledge-based authentication LoA Level of assurance MFA Multi-factor authentication NCRIC Northern California Regional Intelligence Center NIEF National Identity Exchange Federation NIST National Institute of Standards and Technology NSTIC National Strategy for Trusted Identities in Cyberspace NPO National Program Office OIDC OpenID Connect OMB Office of Management and Budget PDS Personal Data Store PIV Personal Identity Verification PKI Public key infrastructure PRIVO Privacy Vaults Online RNS Resilient Network Systems RP Relying party SAML Security Assertion Markup Language SCC Standards Coordination Committee SP Special Publication TFP Trust framework provider TFS Trust Framework Solutions TSCP Transglobal Secure Collaboration Participation, Inc.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, mfa. Contains security framework guidance for authentication systems. Source: NSTIC Pilots_ Catalyzing the Identity Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-140 in Computer Security Division 2003 Annual Report? (Part 8) Control PS-140: Their IP-based infrastructures enable operators to control who can-and cannot-use the network. Another influential element in the ongoing Internet-telephony evolution is the VoIP gateway. As these gateways evolve from PC-based platforms to robust embedded systems, each will be able to handle hundreds of simultaneous calls. Consequently, corporations may deploy large numbers of them in an effort to reduce the expenses associated with high-volume voice, fax, and videoconferencing traffic. The economics of placing all trafficdata, voice, and video-over an IP-based network may pull companies in this direction, simply because IP will act as a unifying agent, regardless of the underlying architecture (i.e., leased lines, frame relay, or Asynchronous Transfer Mode (ATM)) of an organization's network. VoIP presents challenges from several dimensions. They are: the technology of call processing, a need to interface with legacy PBX (private branch exchange) systems, making the existing security solutions fit into the VoIP environment, and security for the new applications enabled by the switchover to VoIP from legacy voice systems. NIST is looking into security issues arising from each of these dimensions and plans to develop assurance metrics and testing methodologies for several VoIP configurations. To achieve these goals, we also plan to leverage the large knowledgebase already available for various types of attacks against IP components and entities like routers, web servers, domain name servers, and so on. Contact: Dr. Ramaswamy Chandramouli (301) 975-5013 chandramouli@nist.gov ## AUTOMATED SECURITY TESTING I ndependent security functional testing of a product is very rarely performed in many security evaluations due to cost and technical complexity, except in the case of high assurance products.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2003 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AN-2011 in ANSI_NIST-ITL 1-2011 Requirements and Conformance Test Assertions? (Part 181) Control AN-2011: 11- Compressio n Algorithm Metadata 8.15.11, Table 69, 7.7.9.1 For each of these fields, the entry corresponds to the appropriate Label entry in Table 12: Field 15.011: Compression algorithm / CGA. 1 M 15.011-CGA {15.011} MO [ASCII(NONE, JPEGB, JPEGL, JP2, JP2L, PNG, WSQ)] 8.15.11, Table 69 <The CGA is verified by checking the image metadata for the compression type signature if compression is used.> 2 M IF {15.011} EQ ASCII(JPEGB) OR ASCII(JPEGL) THEN Present(SOI -JPEG,JPEGL) 15.011- CGAMetad ata JPEGB,JPEG L 2 M 15.011-CGA Metadata JP2, JP2L 2 M 15.011-CGA Metadata PNG IF {15.011} EQ ASCII(JP2) OR ASCII(JP2L) THEN Present(SigBox) IF {15.011} EQ ASCII(PNG) THEN Present(PNGSig) 2 M 15.011-CGA IF {15.011} EQ ASCII(WSQ20) THEN 142 t-12 t-11 t-12 t-11 t-12 t-98 t-11 t-11 t-11 t-11 B B B B B B B B B B Field: 15.012-Bits Per Pixel Value Field: 15.012- Bits Per Pixel Metadata 8.15.12, Table 69, 7.7.8.6 8.15.12, Table 69 This field shall contain an entry of “8” for normal grayscale values of “0” to “255”. Any entry in this field greater than “8” shall represent a grayscale pixel with increased proportion. <The BPX is verified by checking the image metadata for the compression type signature if compression is used.> Metadata WSQ Present(SOI-WSQ) M 15.012-BPX <See Requirement ID “Field: Image BPX Value” > t-2 2 M 15.012-BPX Metadata JPEGB,JPEG L 2 M 15.012-BPX Metadata JP2, JP2L {15.012} EQ {BPX-JPEG, JPEGL} {15.012} EQ {BPX-JP2,JP2L} 2 M 15.012-BPX {15.012} EQ {BPX-PNG} Metadata PNG 15.012-BPX Metadata WSQ <Not Tested.> Field: 15.013- Friction Ridge Generalized Position Value Field: 15.014, 15.015- Reserved Field: 15.016- Scanned Horizontal Pixel Scale Value Field: 15.017- Scanned Vertical Pixel Scale Value Field: 15.018, 15.019- See Section 7.7.4.2 for details.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: ANSI_NIST-ITL 1-2011 Requirements and Conformance Test Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is cpe according to Common Platform Enumeration_ Naming Specification Version 2.3? cpe: /a:hp:openview_network_manager:7.51::~~~linux~~

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Platform Enumeration_ Naming Specification Version 2.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition say about TABLE OF CONTENTS? (Part 14) According to Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition, TABLE OF CONTENTS: | ....................................................................................................... 24 | | 4.14.2 | Performance................................................................................................ 24 | | 4.14.3 | Discussion................................................................................................... 24 | | Conclusion and the Final | Round................................................................................... 24 | References .............................................................................................................................. 25

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-16 in Assessing Security and Privacy Controls in Information Systems and Organizations? Control AC-16: SECURITY AND PRIVACY ATTRIBUTES

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case say about Highlighted Performance Impacts? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case, Highlighted Performance Impacts: No performance measurement experiments were performed for the use of the Graylog due to its typical installation and usage location (i.e., external to the manufacturing system).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet provide? (Section 143) | | RT1.14 - Fie ld: 1.003- FRC-Value | 8.1.3 | The first information item (first record category code / FRC) within this subfield shall be '1'. This indicates that the first record in the transaction is a Type-1 record consisting of header information | 1 | 1.003-FRC- Value | EQ ( {InfoI(1.003.FRC)}, Int(1) ) | | M- InfoI(1.003.F RC) | | | | B | | RT1.15 - Fie ld: 1.003- FRC- CharType | 8.1, Table 22, 8 | Section 8.1 and Table 22 specify the Character Type for each field. Numeric values shall not contain leading zeros unless indicated by the standard text.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Benefits according to Security Guidance for First Responder Mobile and Wearable Devices? Benefits: Complete defense against wireless attacks may be a challenge to the public safety organization but utilizing the concepts of defense-in-depth, proper user training and situational awareness may greatly reduce the chances of a Wi-Fi attack. The benefits of user training also improve overall security posture within the public safety organization. Individuals that receive cybersecurity briefings often reconsider their actions when utilizing technology.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Guidance for First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-09 in A Report on the Privilege (Access) Management Workshop? (Part 36) Control AM-09: ust be capable of enabling compliance with the Federal Information Security Management Act (FISMA), the Health Insurance Portability and Accountability Act (HIPAA), and Sarbanes Oxley (SOX) standards. -  The expression of policy in digital form must support reconciliation of policies in a federated environment. Federated organizations need to have the protections on their data enforced by member organizations that they share their data with. For example, a person might be disallowed from accessing the contents of a file by the owning organization, but might still be able to gain access to the file's contents indirectly through another organization unless policies have been reconciled. As noted earlier, XACML may fall short in this regard. Other languages, such as Attempto, Semantic Web, and RuleML should be assessed for their suitability to address the reconciliation issue. -  Harmonization of the attributes used in shared or intersecting policies among organizations may not be easy to achieve, or it may not be feasible to harmonize all of those attributes. Automated support for harmonization and a method for dealing with attributes that cannot be harmonized are needed. -  Federated data base management systems are within the state of the practice. In theory, they could provide capability for managing and accessing attributes at the enterprise level. However, their greater capabilities can involve high cost and complexity of administration and management. A product study would benefit organizations attempting to implement enterprise-level access control systems; the study should determine whether vendor offerings, such as federated directories, could directly meet the need. -  Research is needed to address the issues associated with multiple values of attributes having the same name. Although a complete solution may not be possible, improvements to the current situation should be possible.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: A Report on the Privilege (Access) Management Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RA-5 in Automation Support for Security Control Assessments_ Software Vulnerability Management? (Part 20) Control RA-5: th [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems related to this control item might be the cause of the defect; i.e., ... | |------------------------------|----------------------|-----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | RA-5(e){1} | VUL-F01 | Vulnerable Software | …the presence of software vulnerabilities (CVEs or equivalent). | | RA-5(e){1} | VUL-L01 | Poor coding practices | …the presence of software with poor coding practices (CWEs or equivalent). | 32 As written, defect checks VUL-F01 and VUL-L01 assume that there is an automated dashboard to which personnel or roles designated for sharing vulnerability scanning information already have access. To be more thorough, the organization could verify that: 1) the dashboard displays scan results, 2) the organization-defined personnel or roles have access, and/or 3) the organization-defined personnel or roles are using the access. Such verifications could be done either manually or through automation, in each case by comparing what is desired (sharing information on vulnerability scan results with the organization-defined personnel or roles) to what is observed (whether the information is actually shared and reviewed by defined personnel or roles). ## 3.3.3.7 Control Item SI-2(a): FLAW REMEDIATION ## Control Item Text Control: The organization: - a.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Vulnerability Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 7.2 User Authentication Tokens" according to NIST Security for Dial-Up Lines According to Security for Dial-Up Lines, 7.2 User Authentication Tokens": The first group of devices belonging to the two-end challenge-response approach perform highly secure authentication of system users. Ihe ten devices falling

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Security for Dial-Up Lines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation provide? (Section 41) V Card Application data object names in the CardApplicationURL in the CCC of the PIV Card Application, the NIST RID ('A0 00 00 03 08') SHALL be used and the card application type SHALL be set to '00'. Each of the data objects in the PIV Card Application has been provided with a BER-TLV tag and an ASN.1 OID from the NIST personal identity verification arc. These object identifier assignments are given in Table 3 . 10 The exception does not apply to the BIT Group template, the Discovery Object, or the Application Property Template (APT) since these objects use interindustry tags from ISO/IEC 7816-6. A data object SHALL be identified on the PIV client-application programming interface using its OID. An object identifier on the PIV client-application programming interface SHALL be a dotdelimited string of the integer components of the OID. For example, the representation of the OID of the CHUID on the PIV client-application programming interface is '2.16.840.1.101.3.7.2.48.0.' A data object SHALL be identified on the PIV Card Application card command interface using its BER-TLV tag. For example, the CHUID is identified on the card command interface to the PIV Card Application by the three-byte identifier '5FC102'. Table 2 lists the ACRs of the thirty-six PIV Card Application data objects. Table 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security provide? (Section 41) anaged only from trusted hosts by authorized administrators. VPN gateways and portals can run many services and applications, such as firewalls, antimalware software, and intrusion detection software. Organizations should carefully consider the security of any solutions that involve running a remote access server on the same host as other services and applications. Such solutions may offer benefits, such as equipment cost savings, but a compromise of any one of the services or applications could permit an attacker to compromise the entire remote access server. Placing the remote access server on a separate, dedicated host reduces the likelihood of a remote access server compromise and limits its potential impact. Using a separate host may also be advisable if the remote access server is likely to place other services and applications at significantly increased risk. An organization should also consider using multiple remote access solutions if its remote access users have vastly different security needs, such as one group accessing typical low-risk resources and another group accessing mission-critical confidential data. The security of stored data is another important consideration for remote access server security. For portal servers that may temporarily store sensitive user data, wiping such data from the server as soon as it is no longer needed can reduce the potential impact of a compromise of the server. The need to wipe sensitive data from remote access servers should be determined based on a risk assessment. Major factors organizations should consider when determining where to place a remote access server include the following: -  Device Performance. Remote access services can be computationally intensive, primarily because of encryption and decryption. Providing remote access services from a device that also provides other services may put too high of a load on the server during peak usage, causing service disruptions.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-03(06) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control CM-03(06): CONFIGURATION CHANGE CONTROL | CRYPTOGRAPHY MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation say about Appendix C. PIV Algorithm Identifier Discovery? According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation, Appendix C. PIV Algorithm Identifier Discovery: Relying parties interact with many PIV Cards with the same native key type implemented by different key sizes and algorithms. 34 For example, a relying party performing the authentication mechanism described in Appendix B.1.2 CAN expect to perform a challenge and response cryptographic authentication with a 3072-bit or a 2048-bit RSA key or an ECDSA (Curve P-256 or Curve P-384) key. This appendix describes recommended procedures for key size and algorithm discovery (PIV algorithm ID discovery) to facilitate cryptographic authentication initiated by the relying party to make appropriate decisions for granting access to logical networks and systems as well as physical access control systems. The discovery procedure is defined in terms of asymmetric and symmetric cryptographic authentication.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Standard Security Label for GOSIP_ an Invitational Workshop provide? (Section 58) ntermediaries to validate that communications between two end systems is authorized. This decision is based on a combination of knowledge of the end systems and the values in the CLNP Security Option. [The Blacker Front End (BFE) is one example of such a trusted device.] These devices may receive CLNP PDUs which are in range for the intermediate device^ but are either not within the accredited range for the source or the destination. In the former case, · the PDU should be treated as described in Paragraph 6.6. In the latter case, a CLNP Error Report PDU should be sent to the originating CLNP entity. The first octet of the Reason for Discard parameter should be set to 1101 0010. This code indicates to the originating CLNP entity that communication with the end system is administratively prohibited (refer to Table 6.1) The security range of the interface on which the reply will be sent determines whether a reply is allowed and at what security level it should be sent ( Presentation "Security Labels at the Transport Layer' Slides) , Wayne A. Jansen (NIST) m t'ir- % i» :, - m ' a* -^-i' J A « 5 . ,^:^Ssit<3 > slM pm^ rf«'i 3»''<)|iwii;iv 4 »' '••t**,'»>» '''-*^-'''!K 5fc i , , W'-: ^#is*s^iiir ^:T:W ' V:€'*:"' i .'* J. J .:./"T; 4i i-U' 'il^^fa-, c ^ CO?J Act ;jl« \^«n .' mtyit 1 * 01^15 uwp Id: % • 1 **' int«irae^laiXeMJi^' ,trid ' aysted^ iOt W^nwi^i %UCh ; A' rfi^-. Cup^tecijrity ^U '•ruicfi ith*a r \_\_ aire rio;^^i '#^:fcin4".' ^ tvr. " TT&iri'iS^'^ -»m0~ -s-pn, . ^ iragi ^ wl;, #til^i4 Th- hill \_X. yJ - '5^:' 13}'' ^1i<M3i ,^w' i B«i'i v vi'. y 'V ' k;, : R«6:4 ^'.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Standard Security Label for GOSIP_ an Invitational Workshop.