You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Strategies for Microservices-based Application Systems provide? (Section 21) re features in many deployments. As already stated, many of these features can be implemented either stand-alone or bundled together in architectural frameworks such as an API gateway or service mesh. Even within the API gateway, these features can be implemented through service composition or direct implementation within the code base. These features include but are not limited to authentication, access control, service discovery, load balancing, response caching, applicationaware health checks, and monitoring [2]. A brief description of these features [5] includes: - Authentication and access control: Authentication and access policy may vary depending on the type of APIs exposed by microservices-some may be public APIs; some may be private APIs; and some may be partner APIs, which are available only for business partners. - Service Discovery: In legacy distributed systems, there are multiple services configured to operate at designated locations (IP address and port number). In the microservicesbased application, the following scenario exists and calls for a robust service discovery mechanism: - a) There are a substantial number of services and many instances associated with each service with dynamically changing locations. - b) Each of the microservices may be implemented in VMs or as containers, which may be assigned dynamic IP addresses, especially when they are hosted in an Infrastructure as a Service (IAAS) or Software as a Service (SAAS) cloud service. - c) The number of instances associated with a service can vary based on the load fluctuations using features such as autoscaling. - Security monitoring and analytics - To detect attacks and identify factors for degradation of services (which may impact availability), it is necessary to monitor network traffic into and out of microservices with analytics capabilities in addition to routine logging features.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Security Strategies for Microservices-based Application Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Acronyms according to NIST Assessing Information Security Continuous Monitoring (ISCM) Programs_ Developing an ISCM Program Assessment According to Assessing Information Security Continuous Monitoring (ISCM) Programs_ Developing an ISCM Program Assessment, Acronyms: Selected acronyms and abbreviations used in this publication are defined below. | AO | Authorizing Official | |--------|--------------------------------------------------| | CISA | Cybersecurity and Infrastructure Security Agency | | CISO | Chief Information Security Officer | | CIO | Chief Information Officer | | CSF | Cybersecurity Framework | | FISMA | Federal Information Security Modernization Act | | ISCM | Information Security Continuous Monitoring | | ISSO | Information System Security Officer | | NCCoE | National Cybersecurity Center of Excellence | | NIST | National Institute of Standards and Technology | | NISTIR | NIST Interagency or Internal Report | | RE(f) | Risk Executive (function) | | RMF | Risk Management Framework | | OA | Ongoing Authorization | | OMB | Office of Management and Budget | | SAISO | Senior Agency Information Security Officer | | SIEM | Security Information and Event Management | | SISO | Senior Information Security Officer |

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Assessing Information Security Continuous Monitoring (ISCM) Programs_ Developing an ISCM Program Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SC-38 in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? (Part 2) Control SC-38: , and individuals that depend on systems containing cyber resources. This cyber risk arises in several ways. For example, cyber resources and the systems that incorporate those 104 See Section 2.1.3. APPENDIX C PAGE 82 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 1 6 0 v 2 r 1 I . NIST SP 800-160, VOL. 2, REV. 1 DEVELOPING CYBER-RESILIENT SYSTEMS _________________________________________________________________________________________________ resources are increasingly complex, so their behavior and properties in the presence of adversity (or even under expected levels of stress) can be difficult to predict. Software generally includes vulnerabilities and weaknesses, which can make it fragile and subject to exploitation by an adversary. Additionally, the presence of resources in cyberspace exposes them to cyber- attacks.105 Cyber resiliency solutions are intended to reduce the risk of depending on systems that contain cyber resources by reducing the extent of the harm from threat events,106 the likelihood of the occurrence of threat events, and the likelihood that threat events will cause harm.107 The risk model for cyber resiliency identifies the types of threat events and the classes of harm of interest to systems security engineers concerned with cyber resiliency. The extent of potential risk mitigation due to a cyber resiliency solution can be analyzed and assessed in the context of that risk model. The risk model for cyber resiliency builds on risk models for security, cybersecurity, resilience engineering, and survivability. However, the cyber resiliency risk model emphasizes the APT and the effects on missions and organizations of malicious cyber activities or of harm to systems that include cyber resources.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, adversary. Contains technical security guidance that could inform defensive posture. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation provide? (Section 158) -----------------------------|----------------------|------------------| | CR-1.3 | | The advertised route is initially evaluated as valid . The single ROA that had made the route valid is removed from the RPKI. There is another ROA that covers the route, but its maximum prefix length is less than the prefix length of the route, so the route is re- evaluated as invalid . | | | | CR-1.3.1 | | | IPv4 address type | SIDR- ROV- 1.3.1 | | CR-1.3.2 | | | IPv6 address type | SIDR- ROV- 1.3.2 | | CR-1.4 | | The advertised route is initially evaluated as valid . An ROA that had made the route valid is removed from the RPKI; there remains another ROA that matches the route, so the route still evaluates as valid .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to LTE Security say about 2 Overview of LTE Technology? (Part 2) According to Guide to LTE Security, 2 Overview of LTE Technology: development organization. Implementations of LTE networks are being deployed across the globe and installations continue to increase as the demand for high-speed mobile networks is constantly rising. Within Technical Specification (TS) 22.278 [9], 3GPP defines a number of high-level goals for LTE systems to meet, including: - Provide increased data speeds with decreased latency, - Build upon the security foundations of previous cellular systems, - Support interoperability between current and next generation cellular systems and other data networks, - Improve system performance while maintaining current quality of service, and - Maintain interoperability with legacy systems. The following sections explain the fundamental concepts of LTE technology and architecture, network protocols, and the evolution of the 3GPP security.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to LTE Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Technology Assessment_ Methods for Measuring the Level of Computer Security provide? (Section 130) <!-- image --> | | | CONCLUSION | EXPLANATION AUDIT | | | |------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-------------------------------|------------|------------| | Nl | Assess the eiFectiTe- ness of the separation of the EDP depart- ment from non-com- patible functions within the organiza- tion, and of the segre- gation of duties within the EDP | | Compensating audit procedures | | | | S'1-1 | There is a separation of the functions of (i) initiation and authorization of transactions ; (ii) recording of transac- tions; and (Hi) cus- tody of assets. | | Verification techniques | | | | Nl-2 | Access to critical forms is restricted to individuals respon- sible for the initiation fi<nctwn. | | | | | | Nl-3 | Access to the com- puter and computer files and programs is restricted to desig- nated employees. | | | | | | | Other | | | | | | N2 | Assess the methods used to ensure that only authorized data is processed and that input documents bear evidence of authoriza- tion and are reviewed by the control group for such evidence.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technology Assessment_ Methods for Measuring the Level of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Voice Over IP Systems say about A.3 Availability and Denial of Service? According to Security Considerations for Voice Over IP Systems, A.3 Availability and Denial of Service: Availability refers to the notion that information and services be available for use when needed. Availability is the most obvious risk for a switch. Attacks exploiting vulnerabilities in the switch software or protocols may lead to deterioration or even denial of service or functionality of the switch. For example: if unauthorized access can be established to any branch of the communication channel (such as a CCS link or a TCP/IP link), it may be possible to flood the link with bogus messages causing severe deterioration (possibly denial) of service. A voice over IP system may have additional vulnerabilities with Internet connections. Because intrusion detection systems fail to intercept a significant percentage of Internet based attacks, attackers may be able to bring down VOIP systems by exploiting weaknesses in Internet protocols and services. Any network may be vulnerable to denial of service attacks, simply by overloading the capacity of the system. With VOIP the problem may be especially severe, because of its sensitivity to packet loss or delay.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Trustworthy Email provide? (Section 80) hing, spear phishing). | Loss of reputation, valid email from enterprise may be blocked as possible spam/phishing attack. | UBE and/or email containing malicious links or attachments may be delivered. Users may inadvertently divulge sensitive information or PII. | Deployment of domain-based authentication techniques (see Section 4). Use of digital signatures over email (see Section 6). DNS Blacklists (see Section 7). | | Email modified in transit. | Leak of sensitive information or PII. | Leak of sensitive information, altered message may contain malicious information. | Use of TLS to encrypt email transfer between servers (see Section 5). Use of end-to-end email encryption and/or digital signatures (see Section 7). Use of DKIM to id entify message mods (see Section 4.5). | | Disclosure of sensitive information (e.g., PII) via monitoring and capturing of email traffic . | Leak of sensitive information or PII. | Leak of sensitive information. | Use of TLS to encrypt email transfer between servers (see Section 5). Use of end-to-end email encryption (see Section 7). | | Disclosure of metadata of email messages. | Possible privacy violation. | Possible privacy violation. | Use of TLS to encrypt email transfer between servers (see Section 5).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Security for Full Virtualization Technologies say about 5.3 Implementation? (Part 1) According to Guide to Security for Full Virtualization Technologies, 5.3 Implementation: 5.3 Implementation After the virtualization solution has been designed, the next step is to implement and test a prototype of the design before putting the solution into production. Aspects of the solution that should be evaluated include the following: -  Physical to Virtual Conversion. Existing servers and desktops may need to be migrated to guest OSs. Most hypervisors provide tools for doing this quickly and automatically. It is important to verify that the tools are compatible with the OSs running on the physical and the virtual machines. There 4 For more information on incident handling, see NIST SP 800-61 Revision 1, Computer Security Incident Handling Guide . may also be problems with loading the guest OS (e.g., boot device errors) or communicating properly with the hypervisor. -  Introspection. Determine whether the virtualization solution gives the necessary capability to monitor security events occurring within the guest OSs. If not, deploying additional security monitoring, such as with security devices, may need to be added and tested before the overall system is deployed. -  Authentication. Authentication is required at each of the appropriate solution layers and cannot be readily compromised or circumvented. If token-based authentication is needed in virtualized systems, test whether or not the tokens work in the emulated hardware. -  Connectivity. Users can connect to all of the resources that they are permitted to and cannot connect to any other resources. Each traffic flow is protected, if necessary, in accordance with the organization's established requirements. -  Applications. The virtualization solution does not interfere with the use of applications or servers within the guest OSs. -  Networking. The internal networking offered by the virtualization solution can be configured to conform to the organization's security policy. This includes the ability to monitor communications between guest OSs and to block particular types of traffic.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Guide to Security for Full Virtualization Technologies.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide for Security-Focused Configuration Management of Information Systems? (Part 115) Control ES-1: 800-167] | Sedgewick A, Souppaya MP, Scarfone KA (2015) Guide to Application Whitelisting. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-167. | | [SP 800-171] | Ross RS, Dempsey KL, Viscuso P, Riddle M, Guissanie G (2016) Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-171, Rev. 1, Includes updates as of June 7, 2018. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | [SP 800-171A] | Ross RS, Dempsey KL, Pillitteri VY (2018) Assessing Security Requirements for Controlled Unclassified Information. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-171A. | |-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [SP 800-175B] | Barker EB (2016) Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-175B.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 1 – General say about 3 Security Services? According to Recommendation for Key Management_ Part 1 – General, 3 Security Services: Cryptography may be used to provide or support several basic security services: confidentiality, identity authentication, integrity authentication, source authentication, authorization, and nonrepudiation. These services may also be required to protect a key and other key information related to that key. In addition, there are other cryptographic and non-cryptographic mechanisms that are used to support these security services. In general, a single cryptographic mechanism may provide more than one service (e.g., the use of digital signatures can provide integrity authentication and source authentication) but not all services.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RC-20 in Blockchain Networks_ Token Design and Management Overview? (Part 42) Control RC-20: taries with a multi-signature contract. ## 4.2 Transaction Submission Transaction submission is either open to anyone or restricted to particular privileged users or roles via multilevel permissions. Access control can be implemented at the smart contract layer using conditions on function calls to accept or reject transactions according to protocol-defined rules or directly in the blockchain protocol at the base layer. As discussed in Section 2.1.3, token owners can give approvals and special authorizations to let other accounts submit transactions that directly affect their tokens. These authorizations can take the form of capability-based delegations to particular accounts or keys issued with specific usage conditions (e.g., spending limits). Such approval and authorization mechanisms can be used to implement payment requests, such as for pull payments and split payments , in which a group of users accepts a common payment request. Additionally, payment protocols can be designed to send payment acknowledgments and provide refund addresses [61]. Note that off-chain messaging schemes are generally needed to enable incoming and outgoing payment notifications. ## 4.2.1 Meta Transactions Signing transactions is free but submitting and broadcasting them on the blockchain can involve fees or tips with users bidding for storage (i.e., to get their transactions included on the blockchain). Those fees can depend on how data intensive transactions are. There may also be transaction fees at the smart contract layer, depending on the protocol. Meta transactions (or fee delegation ) make it possible for transaction fees to be paid by third parties on behalf of users. Similar to prepaid 'transaction envelopes,' this enables users to submit fee-free transactions . Thus, users do not have to own protocol-native tokens of a given token-based network to interact with it.

Explanation: NIST publication on credential and access management. Topics: access control, authorization, token. Contains security framework guidance for authentication systems. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Summary according to NIST 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, Summary: The security design, implementation and deployment considerations of CDC's Public Health Information Network Messaging System (PHINMS) were discussed herein.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories say about 4.6 Uses of Categorization Information? (Part 1) According to Guide for Mapping Types of Information and Information Systems to Security Categories, 4.6 Uses of Categorization Information: 4.6 Uses of Categorization Information The results of system security categorization can and should be used by, or made available to, appropriate agency personnel to support agency activities including: - Business Impact Analysis (BIA): Agency personnel should consider the cross-utilization of security categorization and BIA information in the performance of each activity. Their common objectives enable agencies to mutually draw from them, thus, providing checks and balances to ensure accuracy for each information system. Conflicting information and anomalous conditions, such as a low availability impact and a BIA three-hour recovery time objective, should trigger a reevaluation by the mission and data owners. - Capital Planning and Investment Control (CPIC) and Enterprise Architecture (EA): Just as no IT investment should be made without a business-approved architecture, 21 the security categorization that begins the security life cycle is a business-enabling activity directly feeding the enterprise architecture and CPIC processes for new investments, as well as migration and upgrade decisions. Specifically, the security categorization can provide a firm basis for justifying certain capital expenditures and also can provide analytical input to avoid unnecessary investments. - System Design: Understanding and designing the system architecture with varying information sensitivity levels in mind may assist in achieving economies of scale with security services and protection through common security zones within the enterprise. For example, an information system containing privacy information may be located in one security zone with other information systems containing similar sensitive information. Each zone may have varying levels of security. For instance, the more critical zones may require 3-factor authentication where the open area may only require normal access controls.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Guide for Mapping Types of Information and Information Systems to Security Categories.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog say about (VMG) Vulnerability Management Options? (Part 5) According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog, (VMG) Vulnerability Management Options: | | [FIPS-140] | National Institute of Standards and Technology (2002) Security Requirements for Cryptographic Modules. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 140-3. https://doi.org/10.6028/NIST.FIPS.140-3 | | [FIPS-180] | National Institute of Standards and Technology (2015) Secure Hash Standard (SHS). (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 180-4. https://doi.org/10.6028/NIST.FIPS.180-4 | | [FIPS-201] | National Institute of Standards and Technology (2013) Personal Identity Verification (PIV) of Federal Employees and Contractors. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 201-2. https://doi.org/10.6028/NIST.FIPS.201-2 | | [FIPS-202] | National Institute of Standards and Technology (2015) SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 202.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments say about 1.4 Logical Architecture Summary? (Part 1) According to Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments, 1.4 Logical Architecture Summary: 1.4 Logical Architecture Summary At a high level, the trusted cloud architecture has three main pieces: a private cloud hosted at the NCCoE, an instance of the public IBM Cloud Secure Virtualization (ICSV), and an Internet Protocol Security (IPsec) virtual private network (VPN) that connects the two clouds to form a hybrid cloud. The private on-premises cloud at the NCCoE consists of the following components: -  Hardware Security Module (HSM) for storing keys by Gemalto -  server, storage, and networking hardware by Dell EMC -  Intel processors in the Dell EMC servers -  compute, storage, and network virtualization capabilities by VMware -  asset tagging and policy enforcement, workload and storage encryption, and data scanning by HyTrust -  multifactor authentication, network traffic monitoring, and dashboard and reporting by RSA The ICSV instance consists of the following components: -  IBM-provisioned servers with Intel processors -  compute, storage, network virtualization with VMware components -  asset tagging and policy enforcement, and workload and storage encryption with HyTrust components The IPSec VPN established between the two clouds allows them to be part of the same management domain, so that each component can be managed and utilized in the same fashion, which creates one hybrid cloud. The workloads can be shifted or live-migrated between the two sites. Figure 1-1 shows the high-level architecture. It depicts the four main components that comprise the build: -  HSM component : This build utilizes HSMs to store sensitive keys within the environment. -  Management component : Identical functional management components are instantiated within each cloud instance. At a minimum, each management component includes VMware running the virtualization stack, HyTrust providing the asset tagging policy enforcement aspect, and RSA providing network-visibility, dashboard, and reporting capabilities.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control UM-1 in A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification? (Part 49) Control UM-1: Strengths for TWIC Authentication Use Cases We now assign intrinsic authentication strengths (in terms of the number and type of verified bindings) to TWICAuthentication Use Cases based on SCIV-ALM. In order to accomplish this, we examine the protocols involved in each Authentication Use Case and map them directly to the primitive authentication mechanisms of our methodology and their associated verified bindings (along with their types) as shown in Table B.3 below. This approach is possible because of the granularity of description of each TWIC Authentication Use Case in the TWIC specification document. Table B.3.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements provide? (Section 52) information available about the proposed IoT device. Figure 6 shows how information about an IoT device will flow into the updated risk assessment of the system in which the IoT device is integrated. The resulting updated risk assessment may require the organization to allocate new security controls to the information system to effectively manage the anticipated risk. The organization may identify certain security controls that apply to the IoT device, or that must be provided by the IoT device specifically. Ultimately, it is important for organizations to identify all security controls required to reduce information system risk to an acceptable level. Section 3.3 will focus on using the identified security controls to determine the technical and non-technical capabilities needed from the IoT device and/or other system elements. Figure 6: Effects on Risk Assessment due to IoT Device Informs the Risk Assessment of the Entire System. <!-- image --> Device cybersecurity requirements should be based on the security capabilities and security requirements of the system and organization while also accounting for considerations like those highlighted in Section 3.1 and updates to the system risk assessment that may be necessary as discussed in Section 3.2. Figure 7 below illustrates this process and how it will draw on the considerations and guidance from the prior sections to inform the device cybersecurity requirements. Figure 7: Organizations Can Gather Information to Update the System Risk Assessment and Determine Device Cybersecurity Requirements <!-- image --> Determining IoT device cybersecurity requirements may be challenging for some use cases. To assist organizations in selecting IoT device cybersecurity requirements, this section presents several NIST publications and resources.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control MP-08(03) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control MP-08(03): MEDIA DOWNGRADING | CONTROLLED UNCLASSIFIED INFORMATION ASSESSMENT OBJECTIVE: Determine if:

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain pe of the Single Finger View Record shall be either 0 or 2. AS05.02.14: The Impression Ty according to NIST PIV Data Model Test Guidelines According to PIV Data Model Test Guidelines, pe of the Single Finger View Record shall be either 0 or 2. AS05.02.14: The Impression Ty: VE05.02.14.01: The vendor shall specify if the live or non-live scane images were used. TE05.02.14.01: The tester shall verify the value is either 0 or 2 and is consistent with vendor reporting.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-06(05) in Assessing Security Requirements for Controlled Unclassified Information? (Part 6) Control AC-06(05): d with individuals are discovered. A.03.01.01.g.01: account managers and designated personnel or roles are notified within <A.03.01.01.ODP[02]: time period> when accounts are no longer required. A.03.01.01.g.02: account managers and designated personnel or roles are notified within <A.03.01.01.ODP[03]: time period> when users are terminated or transferred. A.03.01.01.g.03: account managers and designated personnel or roles are notified within <A.03.01.01.ODP[04]: time period> when system usage or the need-to-know changes for an individual. A.03.01.01.h: users are required to log out of the system after <A.03.01.01.ODP[05]: time period> of expected inactivity or when the following circumstances occur: <A.03.01.01.ODP[06]: circumstances> .

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Security Considerations for Voice Over IP Systems? (Part 22) Control HA-1: nals and events in media streams is the same in MEGACO as in MGCP. - -The concept of packages containing event and signal definitions that permits easy extension to the protocol is borrowed from MGCP. - -The MEGACO specification for transport of messages over UDP is the same as specified in MGCP. The three-way-handshake and the computation of retransmission timers described in MGCP are also described within the ALF definition specified in Annex E of MEGACO. MEGACO/H.248 introduces several enhancements compared with MGCP, including the following: - -Support of multimedia and multipoint conferencing enhanced services - -Improved syntax for more efficient semantic message processing - -TCP and UDP transport options - -Allows either text or binary encoding (to support IETF and ITU-T approach) - -Formalized extension process for enhanced functionality - -Expanded definition of packages MEGACO is described as Gateway Control Protocol Version 1 within the RFC 3525. ## 6.2.2 System Architecture MEGACO/H.248 (see Figure 8) has basically the same architecture as MGCP. MEGACO/H.248 commands are similar to MGCP commands. However, the \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ protocol models are quite different. MEGACO specifies a media gateway connection model that has two entities: Terminations (source or sink for (one or more) media streams), and context (grouping of terminations connected in a call). In contrast, MGCP uses the following two entities: Endpoints (source or sink of data), and Connection: (association between two endpoints). Taking a multipoint conference as an example, MEGACO simplifies the connection setup by adding terminations to a context, whereas MGCP has to establish several connections to the conference server. The context in this scenario may cover multiple media streams for enhanced multimedia services.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations say about 03.04.12 System and Component Configuration for High-Risk Areas? According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, 03.04.12 System and Component Configuration for High-Risk Areas: - a. Issue systems or system components with the following configurations to individuals traveling to high-risk locations: [ Assignment: organization-defined system configurations ]. - b. Apply the following security requirements to the systems or components when the individuals return from travel: [ Assignment: organization-defined security requirements ]. NIST SP 800-171r3 May 2024

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Block Cipher Modes of Operation_ Methods for Format-Preserving Encryption say about Abstract? According to Recommendation for Block Cipher Modes of Operation_ Methods for Format-Preserving Encryption, Abstract: This Recommendation specifies two methods, called FF1 and FF3, for format-preserving encryption. Both of these methods are modes of operation for an underlying, approved symmetric-key block cipher algorithm.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Block Cipher Modes of Operation_ Methods for Format-Preserving Encryption.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.11 RISK ASSESSMENT according to NIST Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171, 3.11 RISK ASSESSMENT: Enhanced Security Requirements - 3.11.1e Employ [ Assignment: organization-defined sources of threat intelligence ] as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-5 in Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control? (Part 60) Control PD-5: uipment that interfaces with the space segment and third-party partners. In the hosted payload scenario, third-party partnerships between the PCC and the MOCvary widely and are coordinated in advance. | Protect: Awareness and Training Category The organization's personnel and partners are provided cybersecurity awareness education and trained to perform their cybersecurity-related duties and responsibilities consistent with related policies, procedures, and agreements. The awareness and training category is not unique to the satellite industry. The focus is on privileged users who operate, monitor, and maintain equipment that interfaces with the space segment and third-party partners. In the hosted payload scenario, third-party partnerships between the PCC and the MOCvary widely and are coordinated in advance. | Protect: Awareness and Training Category The organization's personnel and partners are provided cybersecurity awareness education and trained to perform their cybersecurity-related duties and responsibilities consistent with related policies, procedures, and agreements. The awareness and training category is not unique to the satellite industry. The focus is on privileged users who operate, monitor, and maintain equipment that interfaces with the space segment and third-party partners. In the hosted payload scenario, third-party partnerships between the PCC and the MOCvary widely and are coordinated in advance. | | PR.AT-1 : All users are informed and trained. | Organizations should provide awareness education and training for all ground segment personnel for the bus and payload.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 2017 NIST_ITL Cybersecurity Program Annual Report provide? (Section 208) rea of work is focused on evolving security automation specifications to integrate with existing transport protocols to provide for the secure, interoperable exchange of security automation data. Additional work is focused on evolving security metrics and providing consensus guidance on security automation approaches. Through the definition and adoption of security automation standards and guidelines, IT vendors will be able to provide standardized security solutions to their customers. These solutions support continuous monitoring and automated, dynamic network defense capabilities, based on the analysis of data from operational and security data sources and the collective action of security components. Additionally, CSD is working with the vulnerability community to enable the automated analysis of metrics such as the Common Vulnerability Scoring System (CVSS), establishing a baseline of the minimum information needed to properly inform the vulnerability management process, and facilitating the sharing of vulnerability information across language barriers. To assist in this work, a public draft of NISTIR 8138, Vulnerability Description Ontology (VDO): A Framework for Characterizing Vulnerabilities, was created to foster a conversation and collect feedback on the best mechanisms to improve the degree of automation within vulnerability management processes. CSD is planning to develop this document iteratively by releasing additional drafts in FY 2018 to ensure participation from as many stakeholders in the vulnerability community as possible. Security automation standardization work has been focused in three areas: the evolution and international adoption of the Security Content Automation Protocol (SCAP), the development of software asset management standards to support operational and cybersecurity use cases, and the development of security automation consensus standards.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, continuous monitoring. General security reference material without sensitive content. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog say about Reports on Computer Systems Technology? According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog, Reports on Computer Systems Technology: The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management_ Part 1 – General provide? (Section 261) Measures necessary to mitigate the consequences of a suspected unauthorized access to protected data or processes and to reduce the probability or frequency of future compromises should be undertaken. Where secret (symmetric) keys or private (asymmetric) keys are used to protect only a single entity's local information or communications between a single pair of entities, the compromise recovery process can be relatively simple and inexpensive. Damage assessment and mitigation measures are often local matters. On the other hand, when a key is shared by or affects a large number of entities, damage can be widespread, and recovery is both complex and expensive. Some examples of keys, the compromise of which might be particularly difficult or expensive to recover from, include the following: 1. A CA's private signature key, especially if it is used to sign a root certificate in a publickey infrastructure; 2. A symmetric key-wrapping key shared by a large number of entities; 3. A master/key-derivation key used in the derivation of keys by a large number of entities; 4. A symmetric data-encryption key used to encrypt data in a large distributed database; 5. A symmetric key shared by a large number of communications network participants; and 6. A key used to protect a large number of stored keys. In all of these cases, a large number of key owners or relying parties (e.g., all parties authorized to use the secret key of a symmetric-key algorithm or the public key of an asymmetric-key algorithm) need to be immediately notified of the compromise. The inclusion of the key identifier on a Compromised Key List (CKL) or the certificate serial number on a Certificate Revocation List (CRL) to be published at a later date might not be sufficient. This means that a list of (the most likely) affected entities might need to be maintained, and a means for communicating the news of a compromise would be required.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations say about Abstract? According to Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations, Abstract: Transport Layer Security (TLS) provides mechanisms to protect data during electronic dissemination across the Internet. This Special Publication provides guidance to the selection and configuration of TLS protocol implementations while making effective use of Federal Information Processing Standards (FIPS) and NIST-recommended cryptographic algorithms. It requires that TLS 1.2 configured with FIPS-based cipher suites be supported by all government TLS servers and clients and requires support for TLS 1.3 by January 1, 2024. This Special Publication also provides guidance on certificates and TLS extensions that impact security.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management_ Part 1 – General provide? (Section 271) orkin MJ (2012) Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-38F. | | | https://doi.org/10.6028/NIST.SP.800-38F | |-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | SP800-56A | https://doi.org/10.6028/NIST.SP.800-52r2 Barker EB, Chen L, Roginsky A, Vassilev A, Davis R (2018) Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-56A, Rev. 3. | | SP800-56B | Barker EB, Chen L, Roginsky A, Vassilev A, Davis R, Simon S (2019) Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-56B, Rev. 2. https://doi.org/10.6028/NIST.SP.800-56Br2 | | SP800-56C | Barker EB, Chen L, Davis R (2018) Recommendation for Key-Derivation Methods in Key-Establishment Schemes. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800- 56C, Rev. 1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Data Confidentiality_ Detect, Respond to, and Recover from Data Breaches provide? (Section 43) ough there may be clues as to its existence - a user with account troubles and traffic going to a domain name very similar to the organization's domain might be enough to send up red flags if noticed. Regardless, the organization will need to deal with a privileged user account being used to download malware and hold the confidentiality of sensitive files ransom. | | Detect | The Monitoring capability for this scenario includes network monitoring, which can detect unauthorized data exfiltration out of the network and any irregular access or changes to existing data. Any exfiltration or data encryption actions would also be included in logs forwarded to the tools used for Reporting and Logging capabilities. | | Respond | The Mitigation capability for this scenario will allow for rapid disabling and secure re-enabling of compromised accounts once the relevant member accounts are detected. The Reporting capability is designed to quickly notify security teams of necessary actions, such as isolating the system from the network and securing any data not yet attacked by the ransomware. | |-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Recover | The scenario build doesn't possess any technical capabilities for literal recovery of the stolen data, as the scenario predicates the data has already been successfully stolen, but the Logging capabilities should allow a detailed review of what was taken. This will allow for post-incident review of security flaws and notification of anyone inside or outside the organization affected by the security breach.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Confidentiality_ Detect, Respond to, and Recover from Data Breaches.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Extension: according to NIST COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0 According to COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0, Extension:: FAU\_GEN.1-CSPP.3 When the TSF provides application support it shall support an application program interface (API) that allows a privileged application to append data to the security audit trail or to an application-specified alternative security audit trail. Refinement: See text in FAU\_GEN.1.1 and FAU\_GEN.1.2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Section 183) | Examples: policies, plans, procedures, system requirements, designs. | | Objects | Mechanisms | Examples: functionality implemented in hardware, software, firmware. | Examples: functionality implemented in hardware, software, firmware. | | Objects | Activities | Examples: system operations, administration, management, exercises. | Examples: system operations, administration, management, exercises. | | Attributes | Depth | Addresses the rigor of and level of detail in the examination process. | Addresses the rigor of and level of detail in the examination process.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 336) s: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification (PIV) card or the Department of Defense (DoD) Common Access Card (CAC). In addition to authenticating users at the system level (i.e., at logon), organizations may employ authentication mechanisms at the application level, at their discretion, to provide increased security. Regardless of the type of access (i.e., local, network, remote), privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can add additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access. Related Controls: AC-5, AC-6. (2) IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | MULTI-FACTOR AUTHENTICATION TO NON-PRIVILEGED ACCOUNTS CHAPTER THREE PAGE 132 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ Implement multi-factor authentication for access to non-privileged accounts. Discussion: Multi-factor authentication requires the use of two or more different factors to achieve authentication.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor. Contains security framework guidance for authentication systems. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.1 Assumptions and Limitations according to NIST Data Integrity_ Recovering from Ransomware and Other Destructive Events According to Data Integrity_ Recovering from Ransomware and Other Destructive Events, 6.1 Assumptions and Limitations: The security characteristic evaluation has several limitations: -  It is not a comprehensive test of all security components, nor is it a red team exercise. -  It cannot identify all weaknesses. -  It does not include the lab infrastructure. It is assumed that devices are hardened. Testing these devices would reveal only weaknesses in implementation that would not be relevant to those adopting this reference architecture.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: ransomware, red team. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Secure Web Services? (Part 128) Control ES-1: ation into the registry. The publishing is restricted, so publishers must be authenticated. Authentication can be performed using a username/password combination, SAML, Kerberos, or some other method. - An inquiry API provides read-only access to the registry. The inquiry API allows Web services to search for organization details, services offered, and binding information for the services. This API is usually publicly accessible. In UDDI v2, the inquiry API does not support authentication, but in UDDI v3, authentication can be required for inquiries-limiting access to the registry only to trusted Web services. - UDDI v3 introduces a new subscription API that provides notifications about additions or updates to the registry. The subscription API is also restricted, requiring authentication by the registry. In addition to the SOAP-based APIs, many implementations of UDDI registries provide a Web interface for publishing to and searching the registry. Because this is not part of the UDDI standard and is not implemented by all UDDI registry vendors, these UDDI Web interfaces are not covered in this guide. ## 3.9.3 Secure Access to the Registry As described in Section 3.9.2, some portions of the UDDI API require authentication. SOAP over HTTPS is usually required to make certain that publisher credentials cannot be intercepted during transmission. In addition, all publishers should be designated as Tier 1 publishers. In UDDI v2, Tier 1 publishers have defined restrictions for what services they can publish to the registry. In a private registry, these restrictions can vary based on the needs of the organization. In contrast, the specification does not require restrictions on a Tier 2 publisher. Some UDDI registries provide the ability to restrict publishers' activities at the account level, which provides some control over Tier 2 publishers. UDDI v3 provides the ability to define policies, which provide finer control over publishers than the Tier model available in v2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Can Great Seneca Accounting stop someone from turning on a camera or microphone? according to NIST Mobile Device Security_ Bring Your Own Device (BYOD) According to Mobile Device Security_ Bring Your Own Device (BYOD), Can Great Seneca Accounting stop someone from turning on a camera or microphone?: Malicious actors with access (authorized or unauthorized) to device sensors (microphone, camera, gyroscope, Global Positioning System receiver, and radios) can use them to conduct surveillance. It may be directed at the user, as when tracking the device location, or it may be applied more generally, as when recording any nearby sounds. Captured sensor data may be immediately useful to a malicious actor, such as a recording of an executive meeting. Alternatively, the attacker may analyze the data in isolation or in combination with other data to yield sensitive information. For example, a malicious actor can use audio recordings of on-device or proximate activity to probabilistically determine user inputs to touchscreens and keyboards, essentially turning the device into a remote keylogger.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations say about A.2.9. FAMILY: IDENTIFICATION AND AUTHENTICATION? According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, A.2.9. FAMILY: IDENTIFICATION AND AUTHENTICATION: [FIPS200] specifies the Identification and Authentication minimum security requirement as follows: Organizations must identify information system users, processes acting on behalf of users, or devices and authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. NIST SP 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations, expands the identification and authentication control family to include the identification and authentication of components in addition to individuals (users) and processes acting on behalf of individuals within the supply chain network. Identification and authentication are critical to C-SCRM because they provide for the traceability of individuals, processes acting on behalf of individuals, and specific systems/components in an enterprise's supply chain network. Identification and authentication are required to appropriately manage cybersecurity risks throughout the supply chain to both reduce the risk of supply chain cybersecurity compromise and to generate evidence in case of supply chain cybersecurity compromise. [FIPS200]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, control family. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EP-67 in Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)? (Part 57) Control EP-67: modification, loss, and destruction. Keys shall not be stored in the Cloud, but maintained by the cloud consumer or trusted key management provider. Key management and key usage are separated duties. Page 462, Sections under category 10 | | | IEEE 1363- 2000 | IEEE | traditional public-key cryptography | Approved Standard | Cryptographic Techniques: Techniques and mechanisms and their associated standards are used to provide: confidentiality; entity authentication; non-repudiation; key management; data integrity; trust worthy data platforms; message authentication; and digital signatures.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) say about Table G.2: Controls and Assessment Procedures for Derived PIV Credential Issuers (DPCIs)? (Part 17) According to Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI), Table G.2: Controls and Assessment Procedures for Derived PIV Credential Issuers (DPCIs): | DPCI | Commonly accepted security readiness measures | | IAT = Organizational Preparedness | IAT = Organizational Preparedness | IAT = Organizational Preparedness | IAT = Organizational Preparedness | IAT = Organizational Preparedness | |-------------------------------------|-------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------|-----------------------------------------------| | Authorization Focus Area | Identifier | Issuer Control | Applicability | Source | | | FP(DC)-8 | All pre-personalized removable (non-embedded) hardware cryptographic tokens (e.g., SD Card, UICC, USB) received from token vendors are received only by authorized personnel who ensure that these tokens are stored, handled and disposed off securely at the issuing facility.

Explanation: NIST publication on credential and access management. Topics: authorization, token. Contains security framework guidance for authentication systems. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings say about 6th Annual PKI R&D Workshop - Proceedings? According to 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings, 6th Annual PKI R&D Workshop - Proceedings: Figure 4 Admin UI for trust level management <!-- image --> may be desirable to have a common set of trust levels across multiple institutions, however, so that a client or a service can interpret the trust level associated with a CA correctly. In that case, a standard for trust levels should be accepted by the community and made available in a common repository or distributed to each GTS instance. Note that having a common set of trust levels does not require each GTS instance to assign the same trust level to the same CA. A GTS instance may assign a higher level of trust to a CA than another GTS instance. However, a common set of trust levels allows a client to interpret the trust level assigned by each GTS instance correctly and determine whether or not to trust the corresponding CA.

Explanation: NIST publication on credential and access management. Topics: pki, sso. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TG-005 in Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS)? (Part 200) Control TG-005: 1155 Sixteenth St., NW., Washington, DC 20056. Building Science Series -Disseminates technical information developed at the Institute on building materials, components, systems, and whole structures. The series presents research results, test methods, and performance criteria related to the structural and environmental functions and the durability and safety characteristics of building elements and systems. Technical Notes -Studies or reports which are complete in themselves but restrictive in their treatment of a subject. Analogous to monographs but not so comprehensive in scope or definitive in treatment of the subject area. Often serve as a vehicle for final reports of work performed at NIST under the sponsorship of other government agencies. Voluntary Product Standards -Developed under procedures published by the Department of Commerce in Part 10, Title 15, of the Code of Federal Regulations. The standards establish nationally recognized requirements for products, and provide all concerned interests with a basis for common understanding of the characteristics of the products. NIST administers this program as a supplement to the activities of the private sector standardizing organizations. Consumer Information Series -Practical information, based on NIST research and experience, covering areas of interest to the consumer. Easily understandable language and illustrations provide useful background knowledge for shopping in today's technological marketplace. Order the above NISTpublications from: Superintendent of Documents, Government Printing Office, Washington, DC 20402. Federal Information Processing Standards Publications (FIPS PUB)Publications in this series collectively constitute the Federal Information Processing Standards Register. The Register serves as the official source of information in the Federal Government regarding standards issued by NIST pursuant to the Federal Property and Administrative Services Act of 1949 as amended.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Hardware Security Failure Scenarios_ Potential Hardware Weaknesses say about CWE References? (Part 9) According to Hardware Security Failure Scenarios_ Potential Hardware Weaknesses, CWE References: https://cwe.mitre.org/data/definitions/1274.html - [CWE-1276] Fern N (2020) CWE-1276: Hardware Child Block Incorrectly Connected to Parent System. (The MITRE Corporation). Submission date 2020-02-24. Available at https://cwe.mitre.org/data/definitions/1276.html - [CWE-1277] Wortman PA (2020) CWE-1277: Firmware Not Updateable. (The MITRE Corporation). Submission date 2020-02-24. Available at https://cwe.mitre.org/data/definitions/1277.html - [CWE-1278] Fern N (2020) CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques. (The MITRE Corporation). Submission date 2020-02-24. Available at https://cwe.mitre.org/data/definitions/1278.html - [CWE-1279] Kanuparthi A, Khattri H, Manna PK, Mangipudi NKV (2020) CWE-1279: Cryptographic Operations are run Before Supporting Units are Ready. (The MITRE Corporation). Submission date 2020-02-24. Available at https://cwe.mitre.org/data/definitions/1279.html - [CWE-1280] Kanuparthi A, Khattri H, Manna PK, Mangipudi NKV (2020) CWE-1280: Access Control Check Implemented After Asset is Accessed. (The MITRE Corporation). Submission date 2020-02-24. Available at https://cwe.mitre.org/data/definitions/1280.html - [CWE-1281] Fern N (2020) CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior. (The MITRE Corporation). Submission date 2020-02-24. Available at https://cwe.mitre.org/data/definitions/1281.html - [CWE-1282] Fern N (2020) CWE-1282: Assumed-Immutable Data is Stored in Writable Memory. (The MITRE Corporation). Submission date 2020-02-24. Available at https://cwe.mitre.org/data/definitions/1282.html - [CWE-1283] Kanuparthi A, Khattri H, Manna PK, Mangipudi NKV (2020) CWE-1283: Mutable Attestation or Measurement Reporting Data. (The MITRE Corporation). Submission date 2020-02-24. Available at https://cwe.mitre.org/data/definitions/1283.html - [CWE-1290] Kanuparthi A, Khattri H, Manna PK (2020) CWE-1290: Incorrect Decoding of Security Identifiers .

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Hardware Security Failure Scenarios_ Potential Hardware Weaknesses.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Note according to Domain Name System-Based Electronic Mail Security? Note: Thunderbird automatically adds other people's S/MIME certificates to the Other People's tab of a user's Certificate Manager when he or she receives from them a digitally signed message with a valid signature and with an S/MIME certificate issued by a recognized and trusted CA. CA certificates that appear in Thunderbird's Authorities tab are recognized, and may also be trusted. CA certificates that do not appear in that tab are considered unrecognized . An S/MIME certificate that was issued by an unrecognized CA will not be automatically added to the Other People's tab of the user's Certificate Manager. If the user attempts to manually import an S/MIME certificate that was issued by an unrecognized CA, nothing will happen--literally. Thunderbird will not even display an error dialog. It will just not import the S/MIME certificate. This is generally not a problem when receiving an S/MIME certificate that was issued by a trusted CA, but could be a problem for a certificate that was issued by an unrecognized or untrusted CA, or for a certificate that is self-signed (i.e., it has no CA other than itself). So, before a user can import an S/MIME certificate that is issued by an unrecognized CA or is self-signed, he or she must first acquire and import the certificate for the issuing CA. In the case of a self-signed certificate, a .cer file needs to be acquired from the individual whose certificate the user wishes to add.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 7.2 Securing DNS Software according to NIST Secure Domain Name System (DNS) Deployment Guide According to Secure Domain Name System (DNS) Deployment Guide, 7.2 Securing DNS Software: Protection approaches for DNS software include choice of appropriate version, installation of patches, running it with restricted privileges, restricting other applications in the execution environment, dedicating instances for each function, controlling the set of hosts where software is installed, placement within the network, and limiting information exposure by logical/physical partitioning of zone file data or running two name server software instances for different client classes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Domain Name System (DNS) Deployment Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.2.5. Compromise of Shared L7 Proxy (TR-5) according to NIST Service Mesh Proxy Models for Cloud-Native Applications According to Service Mesh Proxy Models for Cloud-Native Applications, 5.2.5. Compromise of Shared L7 Proxy (TR-5): Threat Description : A co-tenant exploits an L7 traffic processing vulnerability in a shared proxy and affects the confidentiality, integrity, or availability of traffic to and from another workload that runs on the same node. Proxy Function Impacted : By limiting the per-node functionality to L4 processing, the attack surface is significantly reduced. Impact Score = 1 : The application workload itself is unaffected. The proxy is a separate deployment. As long as the L7 proxy is not shared with the compromised application, there is no impact. Likelihood Score = 1 : The likelihood is as likely as in TR-4 (see Sec. 5.2.4).

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Service Mesh Proxy Models for Cloud-Native Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach say about 4.2.1 Introduction? (Part 2) According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach, 4.2.1 Introduction: potential audit coverage for each AIS developmental phase. The modules each contain the following segments: 1. Audit participation - Brief introduction of the phase and relevant audit involvement. 2. Primary audit objectives - Overall purpose for audit coverage during phase. 3. Overview - Description of the phase and its AIS life cycle matrix responsibilities and deliverables. 4. Audit survey - Initial background analysis and pertinent survey technique(s). 5. Customized audit objectives - AIS phase developments impacting scope of subsequent audit coverage. 6. Detailed audit testing - Specific audit objectives, tests, and techniques. 7. Assessment of audit results - Analyses for developing and reporting phase audit test results and planning future AIS audit coverage. 8. Questionnaires/Matrices - Tools for soliciting and assimilating pertinent phase information.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about Integrity? According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Integrity: The integrity impact level is based on the specific mission and the data supporting that mission, not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of higher education information would have, at most, a limited adverse effect on agency operations, agency assets, or individuals. Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and/or public confidence in the agency, but the damage to the mission would usually be limited Special Factors Affecting Integrity Impact Determination : Exceptions that might result in more serious consequences are based on the mission supported by the higher education activity (e.g., undetected modification of weapons training information at a service academy where the modification could result in harm to the student or other individuals). In such cases, the impact is determined by the information associated with the supported mission. This can result in assignment of a moderate or high impact level to such information. Recommended Integrity Impact Level: The provisional integrity impact level recommended for higher education information is low .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2010 Annual Report say about Internet Security? (Part 2) According to Computer Security Division 2010 Annual Report, Internet Security: and the root zone distributor. CSD continues its collaboration with the Advanced Network Technologies Division to support the development of security enhancements for routing protocols. The goal of this work is to develop protocols that allow for the validation of Internet routing information in order to prevent attacks against the infrastructure that are intended to misroute Internet traffic or cause denial of service. Other ongoing activities are focused on key management and cryptographic agility to support the authentication of routing components (e.g., to support the Border Gateway Protocol). Contacts: Mr. William Polk (301) 975-3348 william.polk@nist.gov Dr. David Cooper (301) 975-3194 david.cooper@nist.gov

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Computer Security Division 2010 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Virtual Network Configuration for Virtual Machine (VM) Protection provide? (Section 29) ng availability, so any network configuration for achieving this can be looked upon as an integral part of network-based protection for VMs. This section discusses options for configuring these paths. The physical network configuration in a data center is largely unaffected by the presence of virtualized hosts, except for some tasks such as VLAN configuration of ports in the physical switches connecting to the virtualized hosts, and configuration of the associated links as trunk links. The configuration options discussed in this section relating to network path redundancy for VMs are confined to the virtual network inside the virtualized hosts including their pNICs. The virtual network configuration features provided in most hypervisor offerings involve a combination of load balancing and failover policy options. From a network path redundancy perspective, only failover policy options are of interest. Hypervisor offerings provide a configuration feature called network interface card (NIC) teaming. NIC teaming allows administrators to combine multiple pNICs into a NIC team for NIC failover capabilities in a virtualized host. 1 The members of the NIC team are connected to the different uplink ports of the same virtual switch. Failover capability requires at least two pNICs in the NIC team. One of them can be configured as 'active' and the other as 'standby'. If an active pNIC fails or traffic fails to flow through it, the traffic will start flowing (or be routed) through the standby pNIC, thus maintaining continuity of network traffic flow from all VMs connected to that virtual switch. This type of configuration is also called active-passive NIC bonding . Some hypervisor offerings allow NIC teaming functionality to be defined at the VM level. A NIC teaming feature at the VM level enables administrators to create a NIC team using vNICs of a VM.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Virtual Network Configuration for Virtual Machine (VM) Protection.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: For example, if the MTTF for a system component is 100 days and the MTTF

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Framework for Designing Cryptographic Key Management Systems say about Appendix B: Glossary of Terms? (Part 14) According to A Framework for Designing Cryptographic Key Management Systems, Appendix B: Glossary of Terms: ents so as to provide assurance that the key and its metadata are properly associated, originate from a particular source, have not been modified, and have been protected from unauthorized disclosure. | | Unlinkability | Assurance that two or more related events in an information processing system cannot be associated with each other in CKMS-supported communications. | | Unobservability | Assurance that an observer is unable to identify or make inferences about the parties involved in a transaction in CKMS- supported communications. | | User | An individual authorized by an organization and its policies to use an information system, one or more of its applications, its security procedures and services, and a supporting CKMS. | | Validate | To test cryptographic parameters or modules and confirm the test results to obtain assurance that the tested implementation is appropriate for use. | | Validity Period | The lifespan of a public key certificate. | SP 800-130 August 2013

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: A Framework for Designing Cryptographic Key Management Systems.