You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 33) Control HA-1: the Issuer at the Origin, and it doesn't have to be understood by the AC verifier at the Target site. See section 6 for a fuller discussion of this issue. trust for the access control decision making. When the PERMIS PDP is initialised, it is given the name of the trusted authority, and the ID of the policy to use (each policy has a globally unique identifier). PERMIS reads in the policy certificates from the authority's LDAP entry, checks their signatures, and keeps the one with the correct ID. It now has the correct trusted policy with which to make access control decisions. PERMIS thus forms a good basis for demonstrating the distributed management of trust with Shibboleth. ## 4.1 The PERMIS PDP Policy The PERMIS policy contains a list of trusted attribute authorities, the set of attributes they are trusted to assign, and the groups of users they can be assigned to. This is called the role allocation sub-policy (RAP). Attribute authorities can be distributed worldwide, and can be trusted to issue ACs to users from any domain, according to the RAP. When the PERMIS PDP is passed a set of attribute certificates by Shibboleth, it can determine from the RAP which are trusted to keep, and which should be discarded as untrusted. All the trusted attributes are extracted and stored for later access control decision making. The PERMIS policy also contains the set of targets that are being protected by this policy, the associated actions that can be performed on them (along with their parameters), and the attributes (or roles) that a user needs in order to be granted the access. In addition, constraints can be placed on these grants, such as, only between 9am and 5pm, or only if the user holds nonconflicting roles 3 , or only if the size is less than 3Mbytes etc. This is called the target access sub-policy (TAP).

Explanation: NIST publication on credential and access management. Topics: access control, pki, sso. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Federal S_MIME V3 Client Profile? (Part 8) Control HA-1: eiving Signed and Encrypted Messages | ........................................................... 9 | | 2.3.5 | Processing Return Receipts..................................................................................... | 9 | | 2.4 Certificate Processing ..................................................................................................... | 2.4 Certificate Processing ..................................................................................................... | 9 | | 2.4.1 | X.509 Certificate Processing .................................................................................. | 9 | | 2.4.2 | X.509 CRL Processing............................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Federal S_MIME V3 Client Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ST-1 in National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook? (Part 2) Control ST-1: 3. AVAILABILITY T ORDER FROM NATIONAL TECHNICAL INFORMATION SERVICE (NTIS), SPRINGFIELD,VA 22161. UNUMITED FOR OFFICIAL DISTRIBUTION. DO NOT RELEASE TO NATIONAL TECHNICAL INFORMATION SERVICE (NTIS). ORDER FROM SUPERINTENDENT OF DOCUMENTS, U.S. GOVERNMENT PRINTING OFFICE, WASHINGTON, DC 20402. 14. NUMBER OF PRINTED PAGES 106 15. PRICE A06

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i provide? (Section 155) to achieve this requirement is EAP-TLS with certificates on PIN or password-protected smart cards. Another approach is PEAP or EAP-TTLS with Generic Token Card (GTC) or possibly a biometric solution. | EAP authentication methods such as EAP-TLS, EAP-TTLS, EAP-FAST, and PEAP use certificates to authenticate the AS to the STA. One potential pitfall to this approach is that it enables an adversary to impersonate the WLAN infrastructure if that adversary can present a valid certificate, and if WLAN clients are not configured properly. It is common for a WLAN client to be configured by default to accept certificates signed by any certification authority (CA) for which it has a corresponding CA certificate. In most cases, a variety of third-party CA certificates are already installed on the client. This allows an attacker to impersonate the WLAN infrastructure successfully with an SSID and a valid certificate signed by any of the third-party CAs that the client recognizes. Once the attacker has tricked the client into associating with the bogus AP, it might be able to capture the authentication credentials needed to access the real infrastructure. In this scenario, the security of the RSN is circumvented simply as a result of having multiple CA certificates on the STA, which is a common configuration on many computers. To prevent this situation, STAs should be configured to authenticate to specific servers only, not just any server with a valid certificate. Ideally, servers should be identified by their fully qualified domain name (e.g., as1.xyzAgency.gov) so that the name listed in the AS's certificate can be compared with the name specified in the STA's configuration. STAs should also be configured to accept certificates only from the CA that signed the server certificates. With these two controls in place, the attacker would either have to breach the CA or get it to provide it a certificate with the same name as the authentication server.

Explanation: NIST publication on credential and access management. Topics: authentication, token, sso. Contains security framework guidance for authentication systems. Source: Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Threat Analysis on UOCAVA Voting Systems provide? (Section 121) fficial offices have too few resources (e.g. bandwidth, servers) to handle legitimate traffic. Election official offices have too few resources (e.g., bandwidth, servers) to handle legitimate traffic. | Network Operators Election Officials Network Operators Election Officials | Low Low | High High | Avail-High Avail-High | IR-4, IR-5 IR-4, IR-5 | | Sensitive personal information or ballot selections are intercepted between the voter and election official on the Internet. Sensitive personal information or ballot selections are intercepted between the voter and election official on the Internet. | Hostile Organizations Network Operators Hostile Organizations Network Operators | High High | Low Low | Confid.-Mod Confid.-Mod | PE-4, SC-9, SC-12, SC-13 PE-4, SC-9, SC-12, SC-13 | | Voted ballots are modified while being transmitted to the election official (e.g. on e-mail servers) Voted ballots are modified while being transmitted to the election official (e.g.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Threat Analysis on UOCAVA Voting Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to Computer Security Division 2015 Annual Report? http: //www.nist.gov/itl/csd/biometrics/biocta\_download. cfm

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2015 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Biometric Match-on-Card Feasibility Report provide? (Section 44) ecurity objectives without reader-to-smart-card authentication or associated key management infrastructure. These security objectives are aligned with the high-level security objectives of FIPS 201-1. They protect both the integrity of the biometric authentication transaction and the privacy of the cardholder's biometric data, while avoiding the potential cost of reader authentication key management. The Device Under Test (DUT) shall be a smart card having ISO/IEC 7810 physical and mechanical characteristics. The Device Under test shall be capable of contact (via ISO/IEC 7816-3 methods, consistent with NIST SP800-73-1) and contactless (via ISO/IEC 14443 methods, consistent with NIST SP800-73-1). Preferably, the DUT is listed on the General Services Administration (GSA) HSPD-12 Approved Product List, and modified only by the addition of BMOC firmware. The DUT may also be a type of smart card not on the GSA Approved Product List (APL). In this case, NIST will determine if the DUT could host a PIV card-application at reasonable development cost, and if so, the DUT will be tested. The DUT may not have an NPIVP or a Cryptographic Module Validation Program (CMVP) certificate. In this case, NIST will determine if the DUT could pass NPIVP and CMVP testing at reasonable development cost, and if so, the DUT will be tested. The DUT should perform a Biometric Match-On-Card authentication transaction and meet the security objectives described in Section D.2. The biometric matching algorithm on the DUT should demonstrate accuracy meeting the criteria of SP800-76-1 Section 8.10 by testing in either the NIST MINEX II or Ongoing MINEX activity. (Note: accuracy testing may run concurrently with performance and security testing.) The fingerprint sample template sent from the reader to the DUT should be represented following either ISO 19794-2 finger minutiae card or ANSI 378 format. Any extensions or options must be fully documented in the submitted protocol documentation.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Secure Biometric Match-on-Card Feasibility Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Understanding Stablecoin Technology and Related Security Considerations say about Table of Contents? (Part 6) According to Understanding Stablecoin Technology and Related Security Considerations, Table of Contents: | Insufficient Reserves.................................................................................................37 | | | 7.1.2. | Reserve Type Mismatch ...........................................................................................38 | | | | Stablecoin Manager Actions........................................................................................38 | | | 7.2.1. | Account Denylisting | ..................................................................................................38 | | 7.2.2. | Managing Organization Dissolution ..........................................................................38 | | | 7.2.3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Understanding Stablecoin Technology and Related Security Considerations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to NIST Test Personal Identity Verification (PIV) Cards Version 2? http: //smime2.nist.gov/PIVTest2/RSA2048IssuingCA.crl

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Information Security Handbook_ A Guide for Managers? (Part 135) Control PD-12: ystem resources. All federal systems have some level of sensitivity and require protection as part of good management practice. The protection of a system must be documented in a system security plan. The completion of system security plans is a requirement of the OMB Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources , and Title III of the E-Government Act, FISMA. For the plans to adequately reflect the protection of the resources, a senior management official must authorize a system to process information or operate. This authorization provides an important quality control. By authorizing processing in a system, the manager accepts its associated risk. Management authorization should be based on an assessment of management, operational, and technical controls. Since the system security plan establishes and documents the security controls, it should form the basis for the authorization, supplemented by the assessment report and the POA&Ms. In addition, a periodic review of controls should also contribute to future authorizations. Reauthorization should occur prior to a significant change in processing, but at least every three years. ------------------------------------------------- ## Website: www.csrc.nist.gov ## References: Public Law 107-347 [H.R. 2458], The E-Government Act of 2002, Title III of this Act is the Federal Information Security Management Act of 2002 (FISMA) , December 17, 2002. Office of Management and Budget Circular A-130, Management of Federal Information Resources , November 2000. Federal Information Processing Standard 199, Standards for Security Categorization of Federal Information and Information Systems , February 2004. Federal Information Processing Standard 200 , Minimum Security Requirements for Federal Information and Information Systems, March 2006.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EN-18 in Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007? (Part 97) Control EN-18: | 3 | | 14.012- ConfirmedBPX | 19.1.12 | Field 14.012 shall contain the number of bits used to represent a pixel. | 2 | M | 14.012-JPEGB- JPEGL-CBPX | {14.012} EQ {BPX} | 3 | | 14.012- ConfirmedBPX | 19.1.12 | Field 14.012 shall contain the number of bits used to represent a pixel. | 2 | M | 14.012-JP2-JP2L- CBPX | IF {4 th parameter of Image Header box} NEQ '255', THEN {14.012} EQ {BPX} | 3 | | 14.012- ConfirmedBPX | 19.1.12 | Field 14.012 shall contain the number of bits used to represent a pixel. | 2 | M | 14.012-PNG-CBPX | {14.012} EQ {BPX} | 3 | | 14.012- ConfirmedBPX | 19.1.12 | Field 14.012 shall contain the number of bits used to represent a pixel. | 2 | M | 14.012-WSQ-CBPX | No Implementation | 4 | | Table_12_Subfields | 19.1.13 | The field value shall be selected from Table 12.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Government Smart Card Interoperability Specification, Version 2.1? (Part 46) Control HA-1: eter shall be in ASCII hexadecimal format. unAIDLen: AID value length in bytes. TagArray: An array containing the list of tags for the selected container. ## punNbTags: Number of tags in TagArray . Return Codes: ``` BSI_OK BSI_BAD_HANDLE BSI_SC_LOCKED BSI_BAD_AID BSI_BAD_PARAM BSI_CARD_REMOVED BSI_NO_CARDSERVICE BSI_ACCESS_DENIED BSI_INSUFFICIENT_BUFFER BSI_UNKNOWN_ERROR ``` ## Discovery Mode: Parameters: hCard: Card connection handle from gscBsiUtilConnect (). uszAID: Target container AID value. unAIDLen: AID value length in bytes. TagArray: Set to NULL. punNbTags: Number of tags which would be contained in a resulting TagArray . Return Codes: ``` BSI_OK BSI_BAD_HANDLE BSI_SC_LOCKED BSI_BAD_AID BSI_BAD_PARAM BSI_CARD_REMOVED BSI_NO_CARDSERVICE BSI_ACCESS_DENIED BSI_UNKNOWN_ERROR ``` ## E.5.5 gscBsiGcReadValue() Purpose: Returns the Value associated with the specified Tag. ``` Prototype: ``` Parameters: Return Codes: ## Discovery Mode: Parameters: hCard: Card connection handle from gscBsiUtilConnect (). uszAID: Target container AID value. unAIDLen: AID value length in bytes. ``` unsigned long IN UTILCardHandle IN unsigned char * IN unsigned long IN GCtag INOUT unsigned char * INOUT unsigned long * ); gscBsiGcReadValue ( hCard , uszAID , unAIDLen , ucTag , uszValue , punValueLen ``` hCard: uszAID: unAIDLen: ucTag: uszValue: Card connection handle from gscBsiUtilConnect() . Target container AID value. The parameter shall be in ASCII hexadecimal format. AID value length in bytes. Tag value of data item to read. Value associated with the specified tag. The caller must allocate the buffer. punValueLen: Size of the buffer allocated by the caller to hold the returned Value (input). Size of the Value returned (output).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Required Test Procedures: according to NIST Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements According to Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements, Required Test Procedures:: SCAP.T.3010.1: The tester SHALL import a known valid XCCDF component content without <xccdf:Profile> elements that is part of SCAP data streams for the target platform into the vendor product and execute it according to the product operation instructions provided by the vendor. The tester will inspect the product output ensuring XCCDF components are compliant with the XCCDF specification. SCAP.T.3010.2: The tester SHALL validate the resulting XCCDF component results within an SCAP result data stream output using the SCAPVal utility. This validation MUST NOT produce any validation errors. SCAP.T.3010.3: The tester SHALL compare the product results to the expected results ensuring that all the results match the expected results. SCAP.R.3100: For all CCE IDs in the SCAP source data stream, the product SHALL correctly display the CCE ID with its associated XCCDF Rule in the product output. SCAP Capability:  ACS  CVE  OCIL Required Vendor Information: SCAP.V.3100.1: The vendor SHALL provide instructions on where the XCCDF Rules and their associated CCE IDs can be visually inspected within the product output.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-1 in Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers? (Part 55) Control CM-1: | Description | Show that the MFA example implementation can determine that a purchase is lower risk and therefore does not require additional U2F authentication. | | Associated Test Cases | CR 1 | | Associated Cybersecurity Framework Subcategories | ID.RA-4, ID.RA-5, PR.AC-7 | | Preconditions | (CR 1.a) RSA, StrongKey, and Magento capabilities are implemented and operational in the lab environment. Yubico FIDO U2F authenticator is registered to a purchaser account on the e-commerce platform. The purchase dollar-amount threshold has been set to determine when U2F authentication is activated. | | Procedure | The returning purchaser logs into the e-commerce platform's website with their customer ID and password and initiates and completes a lower-risk purchase that does not require U2F use by the returning purchaser. | | Expected Results | (CR 1) The MFA example implementation determines that U2F authentication is not needed. (CR 1.a) U2F authentication with Yubico (CR 1.a.1) is not activated because the purchase dollar-amount is below the set threshold.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa, sso. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1 say about 1.3. Summary of Changes since Version 1.0? (Part 1) According to Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1, 1.3. Summary of Changes since Version 1.0: 1.3. Summary of Changes since Version 1.0 XCCDF 1.0 received some review and critique after its release in January 2005. Most of the additions and changes in 1.1 come directly from suggestions by users and potential users. The list below gives the major changes; other differences are noted in the text. - Persistent/standard identifiers - To foster standardization and re-use of XCCDF rules, community members suggested that Rule objects bear long-term, globally unique identifiers. Support for identifiers, along with the scheme or organizations which assigns them, is now part of the Rule object. - Versioning - To foster re-use of XCCDF rules, and to allow more precise tracking of benchmark results over time, Benchmarks, Rules, and Profiles all support a version number. The version number now supports a timestamp, too. - Severity - Rules can not support a severity level: info, low, medium, and high. Severity levels can be adjusted via Profiles. - Signatures - Each object that can be a standalone XCCDF documents can have an XML digital signature: Benchmark, Group, Rule, Value, Profile, and TestResult. - Rule result enhancements - Added the override property for rule-result members of the TestResult object. Clarified the use of different rule result status values in scoring, and added several new rule result status values. Added better instance details, for multiply-instantiated rules. - Enhancements for remediation - Added several minor enhancements to the Rule's properties for automated and interactive remediation (fix and fixtext elements). - Interactive Value tailoring - Added the 'interactive' property to Value objects; it gives a benchmark checking tool a hint that it should solicit a new value prior to each application of the benchmark. Added the 'interfaceHint' property to allow the author to suggest a UI model to the tool. - Scoring models - Added the notion of multiple scoring models and described two new models.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2015 Annual Report say about Conference Papers? (Part 1) According to Computer Security Division 2015 Annual Report, Conference Papers: Conference Papers J. Boyar and M. Find, 'Constructive Relationships Between Algebraic Thickness and Normality,' 20th International 1 0 2 Symposium on Fundamentals of Computation Theory (FCT 2015), Gdańsk, Poland, August 17-19, 2015. In Lecture Notes in Computer Science 9210, Fundamentals of Computation Theory, A. Kosowski and I. Walukiewicz, eds., Berlin: Springer International, 2015, pp. 106-117. doi: 10.1007/978-3-319-22177-9\_9. We study the relationship between two measures of Boolean functions; 'algebraic thickness' and 'normality'. For a function f , the algebraic thickness is a variant of the 'sparsity', the number of nonzero coefficients in the unique F 2 polynomial representing f , and the normality is the largest dimension of an affine subspace on which f is constant. We show that for 0 < ε < 2, any function with algebraic thickness n 3ε is constant on some affine subspace of dimension Ω( n ε /2 ) . Furthermore, we give an algorithm for finding such a subspace. This is at most a factor of Θ( √ n ) from the best guaranteed, and when restricted to the technique used, is at most a factor of Θ( √ logn ) from the best guaranteed. We also show that a concrete function, majority, has algebraic thickness Ω( 2 n 1/6 ) . R. Chandramouli, 'Analysis of Network Segmentation Techniques in Cloud Data Centers,' 2015 International Conference on Grid & Cloud Computing and Applications (GCA '15), Las Vegas, Nevada, United States, July 27-30, 2015, pp. 64-70. Cloud Data centers are predominantly made up of Virtualized hosts. The networking infrastructure in a cloud (virtualized) data center, therefore, consists of the combination of a physical IP network (data center fabric) and the virtual network residing in virtualized hosts.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cryptographic Key Management Workshop Summary -- June 8-9, 2009 say about 4. Summary of Comments Received Subsequent to Workshop? (Part 1) According to Cryptographic Key Management Workshop Summary -- June 8-9, 2009, 4. Summary of Comments Received Subsequent to Workshop: 4. Summary of Comments Received Subsequent to Workshop NIST created an Email address and a WebLog 6 (Blog) to facilitate discussion among participants regarding cryptographic key management subsequent to the workshop and to disseminate new information to the workshop participants and other interested parties. Five initial questions (A through E) were posted on the blog in order to initiate discussion. Each question had multiple sub-questions. This is a summary of the comments or responses received from the public. Question A dealt with leap-ahead technologies. A comment was received from Stephen Lange Ranzini who thought that an on-demand Federated Identity Management System, based on the Liberty Alliance's Identity Assurance Framework, would enable a leap-ahead in securing cyberspace. He believes that this would be a major improvement in both security and ease of use over the existing user name and password systems. The Federated system would not require multiple one-time password tokens. Mr. Ranzini feels that banks are best equipped to provide this single sign-on service, and notes that strong security across the Internet for users is identified in various Federal Government cybersecurity strategy documents as one of the top hard problems that need to be addressed. Question B asked 'What constitutes a key management framework? Mike Markowitz responded to a comment by Santosh Chokhani who stated that the security of keys 'can be ensured using standards, such as FIPS 140-2.' Mr. Markowitz quoted a portion of FIPS 140-2 that states that 'conformance to this standard is not sufficient to ensure that a particular module is secure.' He feels that there is a perception that standards accomplish much more than they actually do. Mr. Markowitz proposed that a Question F be posted that asks 'What can we expect to accomplish with a KM standard?' As a result, Question F was posted.

Explanation: NIST publication on credential and access management. Topics: identity management, key management, token. Contains security framework guidance for authentication systems. Source: Cryptographic Key Management Workshop Summary -- June 8-9, 2009.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT) provide? (Section 115) device manufacturers and security vendors may need to develop device-specific agents and interfaces for monitoring until the standards are tailored for the various IoT use cases and implemented in products; -  Software Assurance: standards for avoiding vulnerabilities in software should be investigated (e.g., malware; integration of best practices for software development into standards for IoT contributing disciplines); -  Supply Chain Risk Management (SCRM): generic standards (e.g., ISO/IEC 27036) are not specific to IoT and should be reviewed to determine if they are sufficient or require revision for IoT systems; and -  System Security Engineering: generic system security engineering standards (e.g., ISO/IEC 15026) should be reviewed for application to IoT systems.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ID-19 in Securing Telehealth Remote Patient Monitoring Ecosystem? (Part 17) Control ID-19: ...............................................................................................41 | | | 4.2.2 | Broadband Pathways..................................................................................................42 | | 4.3 | Data and Process Flows...............................................................................................43 | Data and Process Flows...............................................................................................43 | | 4.4 | Security Capabilities ....................................................................................................46 | Security Capabilities ....................................................................................................46 | | | 4.4.1 | Telehealth Platform Provider......................................................................................47 | | | 4.4.2 | Identity Management, Authentication, and Access Control ......................................48 | | | 4.4.3 Data Security...............................................................................................................50 | 4.4.3 Data Security...............................................................................................................50 | | | 4.4.4 Anomalies and Events and Security Continuous Monitoring .....................................50 | 4.4.4 Anomalies and Events and Security Continuous Monitoring .....................................50 | |---------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 5 | 4.5 | Final Architecture ........................................................................................................50 | | | Security and Privacy Characteristic Analysis ......................................51 | Security and Privacy Characteristic Analysis ......................................51 | | | 5.1 | Assumptions and Limitations ......................................................................................52 | | | 5.2 | Pervasive Controls.......................................................................................................52 | | | 5.3 | Telehealth Platform Providers ....................................................................................53 | | | 5.4 | Risk Assessment (ID.RA and ID.RA-P)..........................................................................54 | | | 5.5 | Identity Management, Authentication, and Access Control (PR.AC and PR.AC-P) Protective Technology (PR.PT-P).................................................................................54 | | | 5.6 | Data Security (PR.DS and PR.DS-P)..............................................................................56 | | | 5.7 | Anomalies and Events, Security Continuous Monitoring (DE.AE, DE.CM), and Data Processing Management (CT.DM-P) ...........................................................................56 | | 6 | Functional Evaluation........................................................................57 | Functional Evaluation........................................................................57

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance say about Map Data Flows? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance, Map Data Flows: Data flow diagrams enable a manufacturer to understand the flow of data between networked components of the manufacturing system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3. On-Card Cryptographic Requirements according to NIST Cryptographic Algorithms and Key Sizes for Personal Identity Verification According to Cryptographic Algorithms and Key Sizes for Personal Identity Verification, 3. On-Card Cryptographic Requirements: FIPS 201-3 identifies a suite of objects that are stored on the PIV Card for use in authentication mechanisms or other security protocols. These objects may be divided into three classes: cryptographic keys, signed authentication information stored on the PIV Card, and message digests of information stored on the PIV Card. Cryptographic requirements for PIV keys are detailed in Sec. 3.1. Cryptographic requirements for other stored objects are detailed in Sec. 3.2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cryptographic Algorithms and Key Sizes for Personal Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Overview and Considerations of Access Control Based on Attribute Encryption say about 4.2. Key-Policy Attribute-Based Encryption? (Part 2) According to Overview and Considerations of Access Control Based on Attribute Encryption, 4.2. Key-Policy Attribute-Based Encryption: ey PK to the data owner. 4. Data owners generate ciphertext for the data (i.e., message) based on the applied attribute set and public key PK and then upload the data to the data resource provider. 5. The requester retrieves and decrypts ciphertext from the data source provider using their secret key SKx and attributes associated with the access structure. Fig. 5. Basic process steps of KP-ABE scheme <!-- image --> In general, the size of the public key of KP-ABE is linear to the total number of applied attribute sets. That is, the public key size is linear to the maximum number of attributes effectively used in encryption. However, it can be a fixed size in a random oracle large universe construction with hash function [GOLIC]. Using the example in Fig. 4 , instead of a policy structure of data, it now represents an attribute structure of a data requester. The following demonstrates an example of KP-ABE's algorithms of setup, encryption, key generation, and decryption functions.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Overview and Considerations of Access Control Based on Attribute Encryption.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Authority Information Access : according to NIST NIST Test Personal Identity Verification (PIV) Cards Version 2 According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Authority Information Access :: CA Issuers - IIssuingCA.p7c CA Issuers - ldap://smime2.nist.gov/cn=Test%20PIV-I%20RSA%202048- bit%20CA%20for%20Test%20PIV%20Cards%20v2,ou=Test%20CA,o=Test%20Certificat es%202020,c=US?cACertificate;binary,crossCertificatePair;binary OCSP -


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.1 About the Package according to NIST A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications According to A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, 5.1 About the Package: This toolbox was specifically designed for individuals interested in conducting statistical testing of cryptographic (P)RNGs. Several implementations of PRNGs utilized during the development phase of the project have also been included. This package will address the problem of evaluating (P)RNGs for randomness. It will be useful in: - identifying (P)RNGs which produce weak (or patterned) binary sequences, - designing new (P)RNGs, - verifying that the implementations of (P)RNGs are correct, - studying (P)RNGs described in standards, and - investigating the degree of randomness by currently used (P)RNGs. The objectives during the development of the NIST statistical test suite included: - Platform Independence: The source code was written in ANSI C. However, some modification may have to be made, depending on the target platform and the compiler. - Flexibility: The user may freely introduce their own math software routines. - Extensibility: New statistical tests can easily be incorporated. - Versatility: The test suite is useful in performing tests for PRNGs, RNGs and cipher algorithms. - Portability: With minor modifications, source code may be ported to different platforms. The NIST source code was ported to a Windows XP system running Visual Studio 2005 compiler and a Ubuntu Linux system running gcc. - Orthogonality: A diverse set of tests is provided. - Efficiency: Linear time or space algorithms were utilized whenever possible.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations according to NIST Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations: Kelley Dempsey Nirali Shah Chawla Arnold Johnson Ronald Johnston Alicia Clay Jones Angela Orebaugh Matthew Scholl Kevin Stine

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, continuous monitoring. General security reference material without sensitive content. Source: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SC-38 in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? (Part 5) Control SC-38: i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 1 6 0 v 2 r 1 . I NIST SP 800-160, VOL. 2, REV. 1 DEVELOPING CYBER-RESILIENT SYSTEMS _________________________________________________________________________________________________ The consequence model for cyber resiliency encompasses consequences to information and information systems (i.e., a loss of confidentiality, integrity, or availability, as defined in [FIPS 199]). These general consequences can be translated into more specific harms to information and systems that include or are enabled by cyber resources: degraded or disrupted functionality or performance; modified, corrupted, or fabricated information; usurped or misused system resources; or exfiltrated or exposed information. However, the consequence model for cyber resiliency also considers the potential consequences to the missions or business functions supported by the system, to the organization, and sometimes to other stakeholders (e.g., individuals whose personal information may be exfiltrated or exposed, members of the public affected by environmental harms resulting from the failure of a critical infrastructure system). In general, a cyber resiliency solution identified and implemented for a given scope is intended to reduce risks at the next level; for example, implementing a solution at the system level can mitigate risks to mission or business functions. Consequences to a mission or business function or to an organization can be defined in terms of impacts on the performance of required functions or on preserving required properties. The risk model for cyber resiliency, therefore, aligns well with mission risk models [Musman18].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain National Institute of Standards and Technology Interagency or Internal Report 8286A 61 pages (November 2021) according to NIST Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management According to Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, National Institute of Standards and Technology Interagency or Internal Report 8286A 61 pages (November 2021): This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8286A Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control II-4 in 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report)? (Part 12) Control II-4: UATION GUIDE - E. OMB BULLETIN 89-17 - F. ABBREVIATIONS AND ACRONYMS - G. APPLICABLE LAWS AND REGULATIONS AS REPORTED BY CSPPs - H. APPLICABLE GUIDANCE AS REPORTED BY CSPPs - I . REFERENCES - J. EXAMPLES OF AGENCY REACTIONS TO CSPP REVIEWS | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ## I.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines on Active Content and Mobile Code provide? (Section 27) ser and able to interpret such content directly. To keep the browser safe from sources that have varying levels of trust, the program components must take precautions against arbitrary input received. Because these programs are contained within the browser, the browser manufacturer is able to impose security constraints on them. Built-in functionality is also a means for the manufacturer to distinguish its product from others in various ways such as offering proprietary extensions to standard script languages, close integration and interworking with other product offerings, and entirely new content handling capabilities. Built-in functionality should follow an explicit security model to ensure security. For example, enforcing the same origin policy, which prevents content loaded from one 'origin' (i.e., the context defined by host domain name, protocol, and port) from getting or setting properties of a document loaded from a different 'origin,' is a fundamental policy employed by present-day browsers. The implementation of secure JavaScript in Mozilla illustrates the range of considerations involved in defining a security model [Anu98]. The implementation controls access to resources and external interfaces, prevents residual information from being retained and accessible among different contexts operating simultaneously or sequentially, and allows policy, which partitions the name space for access control purposes, to be specified independently of mechanism. Differences can and do exist in the security models used by different browsers. - GLYPH<c=31,font=/BAADDB+Webdings> Components installed to extend the browser functionality. A significant innovation in the design of Web browsers is the ability to extend them beyond their built-in functionality through a defined interface.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Active Content and Mobile Code.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 879) e c v r e S i m e t s y S n o i t a m r o f n I d i r G t r a m S ) A M G S . ( e c n a n e t n a M d n a i t n e m p o e v e D l X X X X X X X X X X X X X X X X 149 ) . C A G S ( l o r t n o C s s e c c A X Architecting for bounded recovery and reaction Architecting Real- time security Calibrating assurance and timeliness trade- offs Legacy system integration Resiliency Management and Decision Support Efficient Composition of Mechanisms Risk Assessment and Management r o w t e N Safe use of g n k COTS/Publicly Available i Smart Grid Security Requirements Families ) R I . G S ( e s n o p s e R t n e d c n I i t n e m e g a n a M t n e m u c o D d n a n o i t a m r o f n I ) D I . G S ( ) P M G S . ( n o i t c e t o r P a d e M i ) . S P G S ( y t i r u c e S l e n n o s r e P y t i r u c e S l a t n e m n o r i v n E d n a ) . E P G S ( l i a c s y h P ) L P G S . ( i l g n n n a P c g e t a r t i S n o i t a z i r o h t u A d n a t n e m s s e s s A y t i r u c e S ) . A C G S ( ) M P G S . ( t n e m e g a n a M m a r g o r P y t i r u c e S ) L P G S . ( i g n n n a P l d n a m e t s y S n o i t a m r o f n I d i r G t r a m S ) . C S G S ( n o i t c e t o r P n o i t a c n u m m o C i d n a m e t s y S n o i t a m r o f n I d i r G t r a m S ) I . S G S ( y t i r g e t n I n o i t a m r o f n I d n a m e t s y S n o i t a m r o f n I d i r G t r a m S ) . A S G S i ( n o i t i s u q c A s e c v r e S i m e t s y S n o i t a m r o f n I d i r G t r a m S ) A M G S . ( e c n a n e t n a M d n a i t n e m p o e v e D l ) . P C G S ( s n o i t a r e p O f o y t i u n i t n o C ) A I . G S ( n o i t a c i t n e h t u A d n a n o i t a c i f i t n e d I X X X X X X X X X X X X X X X ) T A G S . i i ( g n n a r T d n a s s e n e r a w A X ) .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-6 in Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy? (Part 171) Control AM-6: al Institute of Standards and Technology Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems , February 2004. https://doi.org/10.6028/NIST.FIPS.199 | | [FIPS 200] | National Institute of Standards and Technology Federal Information Processing Standards Publication 200, Minimum Security Requirements for Federal Information and Information Systems , March 2006. https://doi.org/10.6028/NIST.FIPS.200 | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | [SP 800-18] | National Institute of Standards and Technology Special Publication 800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems , February 2006. https://doi.org/10.6028/NIST.SP.800-18r1 | |----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [SP 800-30] | National Institute of Standards and Technology Special Publication 800-30, Revision 1, Guide for Conducting Risk Assessments , September 2012. | | [SP 800-39] | National Institute of Standards and Technology Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View , March 2011.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, fips, security control. General security reference material without sensitive content. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is URI according to NIST Test Personal Identity Verification (PIV) Cards Version 2? URI: urn:uuid:26092f20-f792-4f7f-94b2-d0923cce6c7a

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to Securing Wireless Infusion Pumps in Healthcare Delivery Organizations? http: //nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-124r1.pdf [accessed 2/8/18].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4 Federal Research in the Area according to NIST Symposium on Federally Funded Research on Cybersecurity of Electric Vehicle Supply Equipment (EVSE) According to Symposium on Federally Funded Research on Cybersecurity of Electric Vehicle Supply Equipment (EVSE), 4 Federal Research in the Area: Six projects, supported by federal dollars, presented their research: - Threat Model of Vehicle Charging Infrastructure (Sandia National Labs) - Enabling Secure and Resilient XFC: A Software/Hardware-Security Co-Design Approach ( Virginia Tech) - Consequence-Driven Cybersecurity for High-Power Charging Infrastructure ( Idaho National Labs) - Cybersecurity for Grid Connected eXtreme Fast Charging (XFC) Station (CyberX) (ABB) 5 National ZEV Investment Plan: Cycle 2 Public Version - February 4, 2019, Electrify America - EVSE Cybersecurity Projects (National Motor Freight Traffic Association/DOT Volpe Center) - Developing a Reference Architecture XFC-Integrated Charging Security Infrastructure Ecosystem ( The Electric Power Research Institute EPRI) The full agenda is included in Appendix A, and presentation slides may be found in Appendix B.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Symposium on Federally Funded Research on Cybersecurity of Electric Vehicle Supply Equipment (EVSE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of say about UNITED STATES? (Part 4) According to Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of , UNITED STATES: , federalist system of government which encourages local experimentation and favors state-sponsored solutions. This has resulted in a dispersion of authority to make, interpret, and apply privacy law. See generally Appendix 4. For example, the two-hundred year-old U.S. Constitution (most of its safeguards which apply to the states) demarcates a zone of privacy around the individual by restricting the means by which Government can collect information about individuals and the uses which it can make of such information (see Fourth Amendment restrictions and First Amendment and Equal Protection clause protections) . It also ensures procedural fairness by requiring that individuals be given a fair opportunity to challenge adverse governmental actions against them and scrutinize the factual records upon which they have been based (see Due Process clause safeguards). Privacy safeguards are also found in the "common law," a body of legal rules which originated in historical usages and customs in the British laws given recognition by early U.S. courts, and which is continuously evolving through judicial interpretation. Common-law rules, for example, limit intrusive collection of personal information, penalize unwarranted disclosure of such data, and protect against disclosure of erroneous data about individuals. Responsibility for interpreting and applying these rules lies primarily with state courts Statutory law has played an increasingly important role during the past twenty years in the development of U.S. privacy law. These statutes often build upon existing common-law rules --clarifying, redefining, and sometimes creating new rights - rather than supplanting them, and often also are influenced by constitutional principles. Statutory law and related regulations are primarily responsible for developing the interests of individuals to learn the contents of records about them and to participate in setting conditions for their use.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Noun according to Recommendation for Random Bit Generator (RBG) Constructions? Noun: The combination of seed material and (optional) personalization string or additional input.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Bit Generator (RBG) Constructions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Access Control on NoSQL Databases say about 3.2.3. Graph Model? (Part 1) According to Access Control on NoSQL Databases, 3.2.3. Graph Model: 3.2.3. Graph Model Attributes in the graph model can be constructed differently since Graph edges do not necessarily have hierarchical relationships between nodes. Instead, edges connected by nodes may form cyclic relationships rather than a tree structure. As shown in Fig. 9, attributes in a graph database can be described through a sequence of edges and/or nodes without hierarchical relationships. Fig. 9. Example of defining subject and object attributes for a graph model <!-- image --> For example, a subject attribute can be described as user x (node) in (edge) group y (node) works for (edge) company z (node), and an object attribute can be described as file f (node) managed by (edge) department d (node) belongs to (edge) organization o (node). An access control policy based on attributes can then be specified, such as 'the user x in group y who works for company z can read file f managed by department d that belongs to organization o ,' or 'any users in company z can read objects that belong to organization o ' if only applied to attributes without specific subjects or objects. Edges in the graph model are flexible and can be used to implement either an attribute or a permitted action in an access control rule. If implemented as a permitted action, the access control rule can be directly embedded in the database, treating a sequence of links as a rule. In other words, there is no need to store the access control rule outside of the database. An example graph in Fig. 10 contains the following nodes and edges: user x (node) in (edge directed to group y node) can read (edge directed to file y node). Fig. 10.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Access Control on NoSQL Databases.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Common Platform Enumeration_ Name Matching Specification Version 2.3 say about 6.1 Attribute Comparison Relations? (Part 1) According to Common Platform Enumeration_ Name Matching Specification Version 2.3, 6.1 Attribute Comparison Relations: 6.1 Attribute Comparison Relations The first of two CPE name matching phases, the attribute comparison process compares each A-V pair in a source name to its corresponding A-V pair in a target name, matching it to one of the four possible set relations. For example, comparing the source A-V vendor=ANY to the target A-V vendor="microsoft" matches to set relation number 1 in Table 6-1 ( ⊃ ), where the source A-V represents a superset of the target A-V. Table 6-2 enumerates all combinations of CPE WFN A-Vs and defines the set relation for each comparison. The following key describes the attribute value notation for Table 6-2. 1. ANY and NA are logical values as defined in [CPE23-N:5.3.1] 2. i is a wildcard-free attribute-value string, e.g., "foo" 3. k is a wildcard-free attribute-value string that is not identical to i, e.g., "bar" 4. m + wild cards is an attribute-value string containing a legal combination of unquoted question mark or asterisk wild cards at the beginning and/or the end of the string, e.g., "*b??" Table 6-2: Enumeration of Attribute Comparison Set Relations | No.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Platform Enumeration_ Name Matching Specification Version 2.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3 say about Appendix H: Bibliography? (Part 13) According to NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3, Appendix H: Bibliography: | | 3389 3390 | [50] | Z. Khayyat et al. , 'BigDansing: A System for Big Data Cleansing,' in Proceedings of the 2015 ACM SIGMOD International Conference on Management of Data SE - SIGMOD '15 , 2015, pp. | | 3391 | | 1215-1230 [Online]. Available: citeulike-article-id:14396286 | |--------|------|--------------------------------------------------------------------------------------------------| | 3392 | [51] | L. A. Pachano, T. M. Khoshgoftaar, and R. Wald, 'Survey of Data Cleansing and Monitoring for | | 3393 | | Large-Scale Battery Backup Installations,' in 2013 12th International Conference on Machine | | 3394 | | Learning and Applications , 2013, vol. 2, pp. 478-484 [Online]. Available: citeulike-article- | | 3395 | | id:14396282 | | 3396 | [52] | M. Fazio and A. Puliafito, 'Virtual Resource Management Based on Software Transactional | | 3397 | | Memory,' in 2011 First International Symposium on Network Cloud Computing and Applications | | 3398 | | 2011, pp. 1-8 [Online]. Available: | | 3399 | | 84856349781&partnerID=tZOtx3y1 | | 3400 | [53] | A. Celesti, M. Fazio, and M. Villari, 'SE CLEVER: A secure message oriented Middleware for | | 3401 | | Cloud federation,' in Proceedings - International Symposium on Computers and Communications | | 3402 | | 2013, pp. 35-40. | | 3403 | [54] | W. Jun, Z. Di, L. Meng, X. Fang, S. Hu-Lin, and Y.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Supporting Roles according to NIST_SP_800-37r2_Risk_Management_Framework? Supporting Roles: Chief Information Officer; Authorizing Official or Authorizing Official Designated Representative; Information Owner or Steward; Senior Agency Information Security Officer; Senior Agency Official for Privacy; Chief Acquisition Officer.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Organizations should use centralized management for all deployments of storage encryption except for standalone deployments and very small-scale deployments. according to NIST Guide to Storage Encryption Technologies for End User Devices According to Guide to Storage Encryption Technologies for End User Devices, Organizations should use centralized management for all deployments of storage encryption except for standalone deployments and very small-scale deployments.: Centralized management is recommended for most storage encryption deployments because of its effectiveness and efficiency for policy verification and enforcement, key management, authenticator management, data recovery, and other management tasks. Centralized management can also automate deployment and configuration of storage encryption software to end user devices, distribution and installation of updates, collection and review of logs, and recovery of information from local failures.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Storage Encryption Technologies for End User Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.18.2 Potential System Impacts according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance, 6.18.2 Potential System Impacts: Authentication and authorization tools can potentially impact the manufacturing system. These tools typically require a software agent to be installed on the device or require network processes that might induce latency or interrupt manufacturing processes. Backup authentication and authorization servers should be considered to prevent operator 'loss of view' and 'loss of control' incidents. Manufacturers should determine where authentication and authorization are not advisable for performance, safety, or reliability reasons.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management_ Part 1 – General provide? (Section 269) | | | Framework (Internet Engineering Task Force (IETF) Network Working Group), IETF Request for Comments (RFC) 3647. https://doi.org/10.17487/RFC3647 | |-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | RFC 8032 | Josefsson S, Liusvaara I (2017) Edwards-Curve Digital Signature Algorithm (EdDSA). (Internet Research Task Force (IRTF)), IRTF Request for Comments (RFC) 8032. https://doi.org/10.17487/RFC8032 | | SP800-32 | Kuhn DR, Hu VC, Polk WT, Chang S-jH (2001) Introduction to Public Key Technology and the Federal PKI Infrastructure. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-32. https://doi.org/10.6028/NIST.SP.800-32 | | SP800-37 | Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-37, Rev. 2. | | SP800-38 | Recommendation for Block Cipher Modes of Operation (all parts).

Explanation: NIST publication on credential and access management. Topics: pki, key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Common Platform Enumeration_ Dictionary Specification Version 2.3 provide? (Section 33) le title of the name. To support uses intended for multiple languages, the <cpe_dict:title> element supports the @xml:lang attribute. At most one <cpe_dict:title> element MAY appear for each language. | | Property | Type | Count | Description | |----------------------|-------------------------|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | notes (element) | cpe_dict:NotesType | 0-n | Optional descriptive material. To support uses intended for multiple languages, the <cpe_dict:notes> element supports the @xml:lang attribute. At most one <cpe_dict:notes> element MAY appear for each language. | | references (element) | cpe_dict:ReferencesType | 0-1 | External references to additional descriptive material. Each reference consists of a piece of text (intended to be human-readable) and a URI (intended to be a URL pointing to a real resource). | | check (element) | cpe_dict:CheckType | 0-n | Calls out a check, such as an OVAL definition, that can confirm or reject an IT system as an instance of the named platform. Includes a REQUIRED check system specification URI (e.g., the URI for a particular version of OVAL), a REQUIRED check identifier, and an OPTIONAL external file reference (for example, a pointer to the file where the check is defined).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Platform Enumeration_ Dictionary Specification Version 2.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook provide? (Section 93) n, or maintenance of computer systems or automated applications, centers could estimate the percentage of that funding that is (or will be) directed toward computer security activities. - a. Purpose . The purpose of the DPI-CSP is to provide a document that serves as the management summary of more detailed information that may be associated with the basic elements of the DPI's computer security program. It should serve as a basis for informing management of security needs, performing security assessments, performing management and compliance reviews, and facilitating the extraction of summary information in response to center, HQ, or other Federal agency requests for planning information. The extent to which this planning activity is integrated into the center planning activities is left to the discretion of each CCSM; however, a DPI must comply with the center's CSP. - b. Content . The DPI-CSP must be kept current and should include elements that are relative to the coverage of the plan and to the computing environment of the DPI, as follows (see Exhibit 5-3): - (1) Summary of the management process describing the general administrative, technical, physical, and personnel protective measures employed at the DPI. If special provisions apply to selective computer systems or applications, this information should be included. 4. (2) 5. Reference to list(s) that uniquely identify computer applications that process sensitive or mission-critical information, the sponsors and/or owners of such applications, and the computer systems that provide processing support - Current Controls - Application Sensitivities - Contingency Plans - Actions Schedule - Review Results - Awareness & Training - Security Tools - Incident identification - Security Contacts - (3) Reference to contingency and disaster recovery plans. - (4) Reference to schedules indicating planned and completed risk assessments, certifications/recertifications, compliance reviews, and CSAT sessions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to a Secure Enterprise Network Landscape say about 5.1.2 Microsegmentation - Implementation Approaches? (Part 2) According to Guide to a Secure Enterprise Network Landscape, 5.1.2 Microsegmentation - Implementation Approaches: ed by a VLAN ID. The group of applications that will run in that particular VLAN segment can be defined using different criteria, one of which is 'all applications with similar security requirements'. Another criterion is that 'all tiers (web front-end, application logic servers, and database servers) associated with a particular application' should run in a single microsegment, as shown in Figure 1. Fig. 1. Segment-based Microsegmentation <!-- image --> <!-- image --> The following are some approaches that are employed to implement microsegmentation [22]: - a. Virtualized server-based approach: This approach is only applicable to networks that contain virtualized servers since it is implemented in the hypervisor. There are two possible mechanisms: 1. Using virtual firewalls inside a hypervisor to isolate traffic destined for different VMs inside the hypervisor 2. Using encapsulation techniques to create overlays (e.g., Virtual Extensible LAN ( VXLAN)) that run on top of an underlying network that consists of IP addresses designations; access control policies are enforced on the hypervisor itself outside of the workload (application or microservice) - b. Host-based microsegmentation: Alternatively (or additionally), host-based microsegmentation can be implemented using software agents on the endpoint artifacts (e.g., servers). It leverages native firewall functionality built into the host. Software agents can overlay a software-defined segmented network across data centers, cloud, bare metal, and hybrid environments. The agent provides context awareness and visibility for each workload and enables the definition and enforcement of fine-grained policies. - c. Identity-based microsegmentation: Identity-based microsegmentation policies use contextual, application-driven identifiers (e.g., order processing front-end service can communicate with inventory back-end service) instead of network parameters (permit calls from 192.168.10.x subnet to 10.0.0.31) [24].

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Guide to a Secure Enterprise Network Landscape.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain NC-SS-R20 - SNMP security: according to NIST Security Guidelines for Storage Infrastructure According to Security Guidelines for Storage Infrastructure, NC-SS-R20 - SNMP security:: - (a) If SNMP if not in use, it should be disabled. - (b) Change the default, known community strings, even if SNMP is not enabled. The configured strings should meet the organizational password policy. - (c) Use different community strings for devices that differ in levels of confidentiality. - (d) Use at least SNMP version 3. - (e) SNMP authentication and encryption (privacy) features should be enforced. - (f) Do not configure SNMP with read-write access unless it is absolutely needed. In this case, limit and control the use of read-write SNMP. - (g) Use access control lists to control access to devices through SNMP. - (h) Validation that SNMP traps are sent to authorized, intended managers should be periodically performed. - (i) Refer to Department of Homeland Security Cybersecurity & Infrastructure Security (DHS CISA) TA17-156A [39] for additional guidance. NC-SS-R21 The authenticity of directory, domain, and similar services (e.g., AD, Domain Name System (DNS), LDAP): The service configurations in all storage elements (e.g., devices, switches, management workstations, management software) should be actively and periodically reviewed to make sure that the approved ones are used, and for remediating any discrepancies.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, password policy. Contains security framework guidance for authentication systems. Source: Security Guidelines for Storage Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 2016 NIST_ITL Cybersecurity Program Annual Report provide? (Section 268) rity performance, which was posted for public comment on the Baldridge Cybersecurity Initiative website (see https:/ /www.nist.gov/baldrige/products-services/ baldrige-cybersecurity-initiative). The BCEB is a voluntary self-assessment tool that enables organizations to better understand the effectiveness of their cybersecurity risk management efforts. Publications are available for download from CSRC (see http:/ /csrc.nist.gov/publications/), the NCCoE website (see https:/ /nccoe.nist.gov/library) and the main NIST Publications site (see https:/ /www.nist.gov/publications/). The following lists summarize the most-downloaded ITL publications for FY 2016, using weblog data (and excluding traffic from spiders and web crawlers): 1. SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations (303,162); 2. SP 800-145, The NIST Definition of Cloud Computing (235,191); 3. Framework for Improving Critical Infrastructure Cybersecurity, version 1.0 (180,163); 4. SP 800-61 Revision 2, Computer Security Incident Handling Guide (153,723); 5. SP 800-30 Revision 1, Guide for Conducting Risk Assessments (116,991); 6. SP 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (112,104); 7. FIPS 197, Advanced Encryption Standard (AES) (108,162); 8. SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) (81,887); 9. SP 800-12, An Introduction to Computer Security: the NIST Handbook (81,768); and 10. SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations (80,960). 1. FIPS 197, Advanced Encryption Standard (AES) (108,162); 2. FIPS 140-2, Security Requirements for Cryptographic Modules (79,565); and 3.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 say about ADVERSARY EFFECTS? (Part 4) According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171, ADVERSARY EFFECTS: | Reduce likelihood of occurrence and (to a lesser extent) reduce likelihood of impact. | • The adversary's efforts cease. • The adversary actions are mistargeted or misinformed. | | Deter Discourage the adversary from undertaking further activities by instilling fear (e.g., of attribution or retribution) or doubt that those activities would achieve intended effects (e.g., that targets exist). | Reduce likelihood of occurrence. | • The adversary ceases or suspends activities. Example : The defender uses disinformation to make it appear that the organization is better able to detect attacks than it is and is willing to launch major counterstrikes. Therefore, the adversary chooses to not launch an attack due to fear of detection and reprisal. | | Divert Direct the threat event toward defender-chosen resources. | Reduce likelihood of occurrence. | • The adversary refocuses activities on defender-chosen resources. • The adversary directs activities toward targets beyond the defender's purview (e.g., other organizations). • The adversary does not affect resources that the defender has not selected to be targets. Example : The defender maintains an Internet-visible enclave with which untrusted external entities can interact and a private enclave accessible only via a VPN for trusted suppliers, partners, or customers (predefined segmentation). Example : The defender uses non-persistent information and obfuscation to hide critical resources combined with functional relocation of cyber resources and disinformation to lure the adversary toward a sandboxed enclave where adversary actions cannot harm critical resources. | | Deceive Lead the adversary to believe false information about defended systems, missions, or organizations or about defender capabilities or TTPs. | Reduce likelihood of occurrence and/or reduce likelihood of impact. | • The adversary's efforts are wasted as the assumptions on which the adversary bases attacks are false.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SC-8 in Security and Privacy Controls for Information Systems and Organizations? (Part 4) Control SC-8: _____________________ Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [Assignment: organization-defined alternative physical controls]. Discussion: Concealing or randomizing communication patterns addresses protection from unauthorized disclosure of information. Communication patterns include frequency, periods, predictability, and amount. Changes to communications patterns can reveal information with intelligence value, especially when combined with other available information related to the mission and business functions of the organization. Concealing or randomizing communications prevents the derivation of intelligence based on communications patterns and applies to both internal and external networks or links that may be visible to individuals who are not authorized users. Encrypting the links and transmitting in continuous, fixed, or random patterns prevents the derivation of intelligence from the system communications patterns. Alternative physical controls include protected distribution systems. Related Controls: SC-12, SC-13. (5) TRANSMISSION CONFIDENTIALITY AND INTEGRITY | PROTECTED DISTRIBUTION SYSTEM Implement [Assignment: organization-defined protected distribution system] to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission. Discussion: The purpose of a protected distribution system is to deter, detect, and/or make difficult physical access to the communication lines that carry national security information. Related Controls: None. References: [FIPS 140-3], [FIPS 197], [SP 800-52], [SP 800-77], [SP 800-81-2], [SP 800-113], [SP 800-177], [IR 8023].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.