You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control UM-1 in A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification? (Part 36) Control UM-1: Physical Token - Cardholder Binding (Strong or Weak depending upon PIN size) | | | object verified PUM-8: The cardholder presents a live sample of biometric data under the supervision of an attendant (e.g., Security Guard) | | |---------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 6.2.2 - OCC-AUTH - Authentication Using On-Card Biometric Comparison | (It is assumed that a signed biometric object containing the biometric template and the unique identifier exists in the card (though not read) ) A live sample of the biometric is presented directly on the card.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings say about 2.2 Canada's Secure Channel? (Part 3) According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, 2.2 Canada's Secure Channel: erent government programs). It is likely though that individuals will opt for a manageable number of epasses , supporting a more consistent experience in their authentication to government. Note also that no personal information about an individual is maintained centrally to support the epass service; personal information about a user is retained within the context of their relationship within a program.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings say about 7 SUMMARY? According to 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings, 7 SUMMARY: In this paper, we have identified several pitfalls for certification paths. We have identified various solutions that are secure, interoperable, standards compliant, realizable using commercial products, and meet the operational constraints of the various PKIs. Specifically, we have identified the following: - /square4 Self-issued certificates can lead to circularity. Not checking revocation status of self-issued certificates or using an untrusted public key to verify signatures to remove the circularity is non-compliant with the standards. There are several standardscompliant alternatives to remove circularity. - /square4 Standards do not provide any constraints for trust models to support usage of indirect CRLs. This can lead to insecurity. We have proposed indirect CRL trust model constraints and associated extensions. - /square4 Standards do not provide guidance on matching EE certification paths and CRL or OCSP Responder certification paths. This lack of guidance could lead to insecure results. We have provided a solution that can reduce the computational complexity for certification path development while enhancing security. We recommend that TA driven trust models for OCSP Responders not be used since they do not scale to crosscertified and Bridge environments, due to use of different relying party TAs. - /square4 While the solutions presented in this paper are illustrated using simple examples of circularity, the solutions are applicable to mitigate convoluted circularities.

Explanation: NIST publication on credential and access management. Topics: pki, sso. Contains security framework guidance for authentication systems. Source: 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-4 in Guide to Operational Technology (OT) Security? Control SI-4: (5) SYSTEM MONITORING | SYSTEM-GENERATED ALERTS

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report) say about TABLE OF CONTENTS? (Part 8) According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report), TABLE OF CONTENTS: | | | | | | D. | Document | Overview | | | | | | | 1-3 | | | | | | | | | | | | | E. | Additional | Sources | of | | Information | | | | 1-4 | | | | | | | | | | | | II. | DESCRIPTION OF THE CSPP REVIEW PROCESS . | DESCRIPTION OF THE CSPP REVIEW PROCESS . | DESCRIPTION OF THE CSPP REVIEW PROCESS .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements provide? (Section 49) tems Instructions 20 Distributed Denial of Service 1. No previously identified vulnerabilities and predisposing conditions apply, only new vulnerabilities and predisposing conditions (may) apply. 2. Some, but not all previously considered vulnerabilities and predisposing conditions apply, and new vulnerabilities and predisposing conditions apply. 3. Some, but not all previously considered vulnerabilities and predisposing conditions apply, but no new vulnerabilities and predisposing conditions apply. 4. All previously considered vulnerabilities and predisposing conditions still apply, and new vulnerabilities and predisposing conditions apply. How does the IoT device affect likelihood(s) of occurrence determinations as part of a risk assessment? Risk impact is dependent on two components: likelihood of occurrence and magnitude of impact. As per CNSSI No. 4009, likelihood of occurrence 'is a weighted risk factor based on an analysis of the probability that a given threat is capable of exploiting a given vulnerability (or set of vulnerabilities).' [CNSSI] Determination of likelihood as part of a risk assessment is therefore based on identified threat sources and events as well as vulnerabilities and pre-disposing conditions. Threat sources, events, and vulnerabilities identified for the IoT device must be used in the assessment of likelihood. Likelihood of occurrence can often be expressed in a relative way (e.g., low, medium, or high likelihood of occurrence). As part of a risk assessment, the effect of an IoT device on likelihood of occurrence can be expressed as being greater , lower , or equal to the likelihood of occurrence without the IoT device. For example, an IoT device being connected to a system may create new possible connections (e.g., cellular data connections) that may increase the likelihood of a remote actor being able to exploit a vulnerability.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2 provide? (Section 39) -------------------------------------------|---------------------------------------------------------------------------------------------------------| | Element Definition | A data stream. This element contains the links to all of the components that comprise this data stream. | A data stream. This element contains the links to all of the components that comprise this data stream. | A data stream. This element contains the links to all of the components that comprise this data stream. | | Properties | Properties | Properties | Properties | | Name | Type | Count | Property Definition | | id | literal - ID | 1 | The identifier for the data stream. This identifier MUST be globally unique (see Section 3.1.3). | | use-case | literal - token | 1 | The use case represented by the data stream. The value MUST be one of the following: CONFIGURATION, VULNERABILITY, INVENTORY, or OTHER. The value selected MUST indicate which type of content is being represented as defined in Section 5.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Family: Supply Chain Risk Management according to NIST Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer According to Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer, Family: Supply Chain Risk Management: Description: A systematic process for managing cyber supply chain risk exposures, threats, and vulnerabilities throughout the supply chain and developing risk response strategies to the risks presented by the supplier, the supplied products and services, or the supply chain. [SP 800-53].

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SC-30(4) in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Control SC-30(4): Monitor Logs (CM2104) Behavior Validation Detect

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study say about Table of Contents? (Part 6) According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study, Table of Contents: .................................................................................. | 3.3 SECURITY AWARENESS PROGRAMS ................................................................................... | 12 | | 3.3.1 | Program Size............................................................................................................. | 12 | | 3.3.2 | Team Size .................................................................................................................. | 14 | | 4 CONCLUSION................................................................................................................... 17 | 4 CONCLUSION................................................................................................................... 17 | 4 CONCLUSION................................................................................................................... 17 | | REFERENCES............................................................................................................................ 18 | REFERENCES............................................................................................................................ 18 | REFERENCES............................................................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Secure Web Services say about 6.3.2 XML? (Part 2) According to Guide to Secure Web Services, 6.3.2 XML: ser with illegitimate entity references - Enforce validation. An attacker may be able to subvert the validate command called by the XML application when it has loaded the schema cache with namespaces. Attackers do this by using a root element from a different namespace to redirect xsi:schemaLocation to point to their own schema, in which they include the declaration <xs:any namespace=##any,, processContents='skip'/> .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Attribute Based Access Control (ABAC) Definition and Considerations say about 1.4 Notes on Terminology? (Part 2) According to Guide to Attribute Based Access Control (ABAC) Definition and Considerations, 1.4 Notes on Terminology: erent roles, and may inherit different privileges tied to those roles. The person may establish different personas for each organization or role and amass different attributes related to each persona. For example, an individual may work for Company A as a gate guard during the week and may work for Company B as a shift manager on the weekend. The subject attributes are different for each persona. Although trained and qualified as a Gate Guard for Company A, while operating in her Company B persona as a shift manager on the weekend she does not have the authority to perform as a Gate Guard for Company B. Authentication is not the same as access control or authorization. Authentication is the act of verifying that the subject has been authorized to use the presented identifier by a trusted identity provider organization. Access control or authorization , on the other hand, is the decision to permit or deny a subject access to system objects (network, data, application, service, etc.) Note that ABAC can be used without identification information, and authentication method is not addressed in this document. The terms access control and authorization are used synonymously throughout this document. Privileges represent the authorized behavior of a subject; they are defined by an authority and embodied in policy or rules. For the purposes of this document, the terms privileges and authorizations are used interchangeably in that they are meant to convey one's authority and implicit approval to access one or more objects. Environment conditions are dynamic factors, independent of subject and object, that may be used as attributes at decision time to influence an access decision. Examples of environment conditions include time, location, threat level, and temperature. Policy, rules, and relationships govern allowable behavior within an organization, based on the privileges of subjects and how resources or objects are to be protected under which environment conditions.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Guide to Attribute Based Access Control (ABAC) Definition and Considerations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Guide to IPsec VPNs? (Part 161) Control HA-1: r confidentiality and integrity protection and for key exchange involves choosing encryption and integrity protection algorithms, 56 key lengths, DH groups for key exchange, and IKE and ESP lifetimes. For up-to-date policies and advice on these settings, see NIST SP 800-131A [18] and FIPS 140 [13][14] as well as the recommendations of the IETF for IKE [25] and ESP [63]. Note that these documents will be updated over time or be obsoleted for newer publications. The IKE protocol sends just a few packets per hour, so it makes sense to be extra cautious and pick strong algorithms with large enough keys and, specifically, a strong DH group. Approved DH groups are identified in NIST SP 800-56A [64]. The bulk of the CPU power of an IPsec host will be spent on IPsec, not IKE. In IKE, the most CPU-intensive operation is the DH calculation. When an IPsec host has hundreds or thousands of IKE (re)connections, choosing the right DH group becomes very important. The use of strong key sizes is recommended for IKE. The performance impact of larger key sizes is minimal because IKE traffic is negligible compared to IPsec traffic. For IPsec (ESP), the key 56 Only FIPS-validated implementations of NIST-approved algorithms shall be used. size can have a significant impact on performance. In general, use larger key sizes for IPsec if performance is not an issue. For ESP, the choice of algorithms for confidentiality and integrity protection should also take performance into account. Using an AEAD algorithm that can provide both confidentiality and integrity protection in a single operation, such as AES-GCM, will give better performance than using non-AEAD algorithms that require separate operations (e.g., AES-CBC for encryption and HMAC for integrity protection). It is important to estimate the processing resources that the cryptographic computations will require during peak usage. It is uncommon to use 192-bit AES keys, and this key length is optional in [25].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Guide to IPsec VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems say about RECOVERY? According to Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems, RECOVERY: j '• t 5 '7 ?.:--:;fji: 3^0 ku ;Ci --7 ijf.-t' 0 7 f>i. :»'.-f,-:' e Q-.-ir-V'ti .'Anol??T^'J ;& ;7x^:'.>t» :•' ."Xiv »• i •' ', "iJ''.- :}r=!5>47 n^'.''' ':':^j,ts«"^ ln.7S? 3id ft Wfrlfj4--. i.> o.i iv<vt t*fb ;(« .'x-yrjssit -ISiltXti %nk,<:TpO ir^u -J:jsbxt»mjv XXf»W '' '^sjvoasrj: fit?!? ' u&Xq ^ *ji;^ 5<7 i^sits •?»tixr xill?^ .rk himM$mi:K , -:i9Sfsa«i:Jrj ' 'vv '' ^0 v-v*v\*>!>a-s 'k tii jeM? 5,0 <»« ?-ir3'y<3 ' ''- ' rik' XSOTDSl^ •30.^:420^ 5'd ^ «i>o «»-:}; jiciqatif .. ^5«3ljf' 4 . ^ 1^1 ' ''<9ifjr •

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Section 342) gency official for privacy, senior accountable official for risk management or risk executive [function]; control assessors; system security or privacy officer; and the continuous monitoring program). The authorization package 128 includes the following: - Executive summary; - Security and privacy plans; 129 130 127 Authorization packages for common controls that are not system-based may not include a security or privacy plan, but do include a record of common control implementation details. 128 The authorizing official determines what additional supporting information, artifacts, or references may be required in the authorization package. The additional documentation may include, for example, risk assessments, contingency plans, or SCRM plans. 129 [SP 800-18] provides guidance on system security plans. Guidance on privacy plans will be addressed in a planned publication specific to privacy plans. 130 In accordance with [OMB A-130], the information system security plan and the privacy plan may be integrated into one consolidated document. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ - Security and privacy assessment reports; 131 and - Plans of action and milestones. The executive summary provides a consolidated view of the security and privacy information in the authorization package. The executive summary identifies and highlights risk management issues associated with protecting information systems and the environments in which the systems operate. The summary provides the essential information needed by the authorizing official to understand the security and privacy risks to the organization's operations and assets, individuals, other organizations, and the Nation.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Appendix B: Generation of Other Quantities according to NIST Digital Signature Standard (DSS) According to Digital Signature Standard (DSS), Appendix B: Generation of Other Quantities: This appendix contains routines for the supplementary processes required for the implementation of this standard. Appendix B.1 is needed to produce the inverse of the per-message secret k (see Section 6.3 and Appendices A.2.1 and A.2.2) and the inverse of the signature portion s that is used during signature verification (see Section 6.4). The routines in Appendix B.2 are required to convert between bit strings and integers when implementing this standard. Appendix B.3 contains probabilistic primality tests to be used during the generation of RSA key pairs. Appendices B.4 and B.5 contain algorithms required during the Lucas probabilistic primality test of Appendix B.3.3 to check for a perfect square and to compute the Jacobi symbol. Appendix B.6 contains the Shawe-Taylor algorithm for the construction of primes. Appendix B.7 provides a process to perform trial division as required by the random prime generation routine in Appendix B.6. The sieve procedure in Appendix C.8 is needed by the trial division routine in Appendix B.7. The trial division process in Appendix B.7 and the sieve procedure in Appendix B.8 have been extracted from ANS X9.80 [23], Prime Number Generation, Primality Testing, and Primality Certificates . Appendix B.9 is required during the generation of RSA key pairs. Appendix B.10 provides a method for constructing provable primes for RSA (see Appendix A.1.2.2 and A.1.4).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Digital Signature Standard (DSS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Section 59) link to the CAD/RMS system. 6. The CAD/RMS system redirects the officer's browser to the IdP to authenticate. 7. Since the officer has an active session with the IdP, they do not need to authenticate. The IdP redirects the officer's browser to the CAD/RMS system with a SAML assertion. 8. The CAD/RMS system validates the assertion and logs in the officer. 9. The officer submits a query to the CAD/RMS system. 10. The CAD/RMS system sends a WS-Trust Security Token Request to the IdP, including the SAML assertion it received earlier in the onBehalfOf element to indicate that the request is for a token to present to the message switch on behalf of the previously authenticated user. 11. The IdP creates a new SAML assertion with the officer as the subject and with a suitable audience parameter for the message switch. The IdP returns this SAML assertion to the CAD/RMS system in a WS-Trust Request Security Token Response message. 12. The CAD/RMS system sends this new SAML assertion and the query to the message switch. 13. The message switch validates the assertion and extracts the user's identity and attributes. The message switch can use these attributes to authorize the query. This section considers the case where the CAD/RMS system is a client/server application hosted at the county level and accessed through a 'thick client' software application installed on the MDC. For this section, we also assume that county users authenticate to a state-hosted IdP. The thick client introduces a challenge for SAML integration. The common SAML SSO interactions rely on web functionality such as HTTP redirect and POST messages and the use of a browser for interactive authentication to the IdP. However, the MDC operating systems typically provide mechanisms for thick client applications to interact with the web browser that can be used to implement SAML and other authentication and authorization protocols like OIDC and OAuth.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, multi-factor. Contains security framework guidance for authentication systems. Source: Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Voice Over IP Systems say about 5.2.5 IPsec usage within SIP? According to Security Considerations for Voice Over IP Systems, 5.2.5 IPsec usage within SIP: IPsec may also be used to provide security for SIP signaling at the network layer. This type of security is most suited to securing SIP hosts in a SIP VPN scenario (SIP user agents/proxies) or between administrative SIP domains. IPsec works for all UDP, TCP and SCTP based SIP signaling. IPsec may be used to provide authentication, integrity and confidentiality for the transmitted data and supports end-to-end as well as hop-by-hop scenarios. At this time there is no default cipher suite for IPsec defined in SIP. Note that RFC 3261 does not describe a framework for the use of IPsec and no requirement is given as to how the key management is to be realized, or which IPsec header and mode is to be used. One accepted protocol for key management is Internet Key Exchange (IKE), a hybrid protocol based on the Internet Security Association and Key Management Protocol (ISAKMP), the Oakley Key Determination Protocol (RFC 2412) and the Secure Key Exchange Mechanism for the Internet (SKEME). The IKE protocol provides automated cryptographic key exchange and management mechanisms for IPsec. IKE is used to negotiate security associations (SAs) for use with its own key management exchanges (called Phase 1) and for other services such as IPsec (called Phase 2). IKE is particularly used in the establishment of VPNs.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-200901022 in Assessing Enhanced Security Requirements for Controlled Unclassified Information? (Part 9) Control PD-200901022: g related to an audited event. | | authentication [FIPS 200, Adapted] | Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in a system. | | availability [44 USC 3552] | Ensuring timely and reliable access to and use of information. | | baseline configuration | A documented set of specifications for a system or a configuration item within a system that has been formally reviewed and agreed on at a given point in time and which can only be changed through change control procedures. | | bidirectional authentication | Two parties authenticating each other at the same time. Also known as mutual authentication or two-way authentication. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | boundary | Physical or logical perimeter of a system. | |------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | component | See system component. | | confidentiality [44 USC 3552] | Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT) say about Table 13 - Network Security Standards? (Part 29) According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT), Table 13 - Network Security Standards: | Recommendation ITU-T X.1362 : Simple encryption procedure for Internet of things (IoT) environments Specifies encryption with associated mask data (EAMD) for the Internet of things devices. It describes EAMD and how it provides a set of security services for traffic using EADM. | Approved Standard | | LoRaWAN | LoRa Alliance | Link layer/Physical Layer LoRaWAN is a wireless protocol for IoT applications that is available in integrated circuits. The protocol specification is built on top of the LoRa technology developed by the LoRa Alliance. It uses unlicensed radio spectrum in the Industrial, Scientific and Medical (ISM) bands to enable low power, wide area, bi-directionally secure communication between remote sensors and gateways connected to the network. | Approved Standard Market Acceptance | | MQTT Link Dec 2015 | MQTT | MQTT is a machine-to-machine (M2M)/' Internet of Things' connectivity protocol. Note: References to other protocols. Authentication of Clients by the Server: Implementations can choose how to make use of the content of these fields. They may provide their own authentication mechanism, use an external authentication such as LDAP or OAuth tokens, or leverage operating system authentication mechanisms. | Guidance Available Approved Standard | | Network Security: Standards that provide security requirements and guidelines on processes and methods for the secure management, operation and use of information, information networks, and their inter-connections. | Network Security: Standards that provide security requirements and guidelines on processes and methods for the secure management, operation and use of information, information networks, and their inter-connections. | Network Security: Standards that provide security requirements and guidelines on processes and methods for the secure management, operation and use of information, information networks, and their inter-connections.

Explanation: NIST publication on credential and access management. Topics: authentication, token, sso. Contains security framework guidance for authentication systems. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 14) effectiveness of security and privacy controls associated with systems and their environments of operation and to provide credible and meaningful inputs to the organization’s risk management process. A well- executed assessment helps determine the validity of the controls contained in the organization’s security and privacy plans and subsequently employed in organizational systems and environments of operation. Control assessments facilitate a cost-effective approach to managing risk by identifying weaknesses or deficiencies in systems, thus enabling the organization to determine appropriate risk responses in a disciplined manner that is consistent with organizational mission and business needs. SP 800-53A is a companion guideline to [SP 800-53] Security and Privacy Controls for Systems and Organizations. Each publication provides guidance for implementing specific steps in the Risk Management Framework (RMF).1 SP 800-53 and [SP 800-53B] address the Select step of the RMF and provide guidance on security and privacy control selection (i.e., determining the controls needed to manage risks to organizational operations and assets, individuals, other organizations, and the Nation). SP 800-53A addresses the Assess and Monitor steps of the RMF and provides guidance on the security and privacy control assessment processes. SP 800-53A also includes guidance on how to build effective assessment plans and how to analyze and manage assessment results. SP 800-53A provides a process that allows organizations to tailor the assessment procedures outlined in the guidance. Tailoring involves customizing the assessment procedures to match the characteristics of the system and its environment of operation more closely.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, rmf, fips. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain NISTIR 7511 Revision 3, Security Content Automation Protocol (SCAP) Version 1.2 according to NIST Computer Security Division 2013 Annual Report According to Computer Security Division 2013 Annual Report, NISTIR 7511 Revision 3, Security Content Automation Protocol (SCAP) Version 1.2: Validation Program Test Requirements This report defines the requirements and associated test procedures necessary for products to achieve one or more Security Content Automation Protocol (SCAP) validations. Validation is awarded based on a defined set of SCAP capabilities by independent laboratories that have been accredited for SCAP testing by the NIST National Voluntary Laboratory Accreditation Program (NVLAP).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2013 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SA-12(12) in Security and Privacy Controls for Information Systems and Organizations? (Part 1) Control SA-12(12): INTER-ORGANIZATIONAL AGREEMENTS CRITICAL INFORMATION SYSTEM COMPONENTS IDENTITY AND TRACEABILITY PROCESSES TO ADDRESS WEAKNESSES OR DEFICIENCIES Trustworthiness Criticality Analysis O O O √ √ √ W: Moved to SR Family. W: Moved to SR-5. W: Moved to SR-6. W: Incorporated into SR-3. W: Moved to SR-3(1). W: Moved to SR-3(2). W: Incorporated into SR-5(1). W: Moved to SR-5(2). W: Incorporated into RA-3(2). W: Moved to SR-7. W: Moved to SR-4(3). W: Moved to SR-6(1). W: Moved to SR-8. W: Incorporated into MA-6 and RA-9. W: Moved to SR-4(1) and SR-4(2). W: Incorporated into SR-3. W: Incorporated into SA-8. W: Incorporated into RA-9. CRITICAL COMPONENTS WITH NO VIABLE ALTERNATIVE SOURCING W: Incorporated into SA-20. Development Process, Standards, and Tools QUALITY METRICS SECURITY AND PRIVACY TRACKING TOOLS CRITICALITY ANALYSIS O O O O THREAT MODELING AND VULNERABILITY ANALYSIS W: Incorporated into SA-11(2). ATTACK SURFACE REDUCTION CONTINUOUS IMPROVEMENT AUTOMATED VULNERABILITY ANALYSIS REUSE OF THREAT AND VULNERABILITY INFORMATION USE OF LIVE DATA INCIDENT RESPONSE PLAN ARCHIVE SYSTEM OR COMPONENT MINIMIZE PERSONALLY IDENTIFIABLE INFORMATION Developer-Provided Training Developer Security and Privacy Architecture and Design FORMAL POLICY MODEL SECURITY-RELEVANT COMPONENTS FORMAL CORRESPONDENCE INFORMAL CORRESPONDENCE CONCEPTUALLY SIMPLE DESIGN O O O O W: Incorporated into SA-3(2). O O O O O O O O O O √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ APPENDIX C PAGE 456 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, incident response. Contains technical security guidance that could inform defensive posture. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols say about 8.2.1.3 KEY-ID? According to Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols, 8.2.1.3 KEY-ID: The key identifier field (KEY-ID) identifies the cryptographic key used to protect the TPDU.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Section 77) establishment transaction. That is, when a key-establishment scheme uses both a static key pair and an ephemeral key pair, they shall be generated using the same set of domain parameters. If p is a prime number, then GF ( p ) denotes the finite field with p elements, which can be represented by the set of integers {0 , 1 , …, p -1}. The addition and multiplication operations for GF ( p ) can be realized by performing the corresponding integer operations and reducing the results modulo p . The multiplicative group of non-zero field elements is denoted by GF ( p ) * . In this Recommendation, an FFC key-establishment scheme requires the use of public keys that are restricted to a (unique) cyclic subgroup of GF ( p ) * with prime order q (where q divides p - 1). If g is a generator of this cyclic subgroup, then its elements can be represented as {1, g mod p , g 2 mod p , …, g q -1 mod p }, and 1 = g q mod p . Domain parameters for an FFC scheme are of the form ( p, q, g {, SEED, counter }), where p is the (odd) prime field size, q is an (odd) prime divisor of p - 1, and g is a generator of the cyclic subgroup of GF ( p ) * of order q . The optional parameters, SEED and counter , are described below. Two classes of domain parameters are approved for FFC key agreement: a class of 'safe' domain parameters that are associated with approved safe-prime groups, and a class of 'FIPS 186 14 -type' domain parameters that conform to one of the FIPS 186-type parametersize sets that are listed in Table 1. The safe-prime groups approved for use by U.S. Government applications are listed in Appendix D. The associated domain parameters have the form ( p , q = ( p - 1)/2, g = 2) for specific choices of p .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for API Protection for Cloud-Native Systems provide? (Section 21) (e.g., the exact versions of common software being run, internal names of systems for future pivot attacks). Trusting unverified inputs is one of a major class of recurring security bugs in software. There are at least two levels of verification that APIs need to consider: - Validating that the input is syntactically correct - Ensuring that valid input is not malicious A service must validate that each request (i.e., input) matches the API's definition, all expected fields are present and of the correct type, and no unexpected fields are present. For example, an API definition may say, 'The 'name' field is required and must be a non-empty string less than 100 characters long,' which must be verified at runtime on every request. The lack of input validation results in a variety of risks, including: - Impacting the availability of APIs - o The 'query of death' (QoD) [24] is a DoS attack via specially crafted requests that trigger pathological worst-case behavior in the server (i.e., the server itself may crash due to bad input handling). - Invalid or malicious data being stored in the system, which can cause latent issues (e.g., failure to restart during recovery, crashes when accessing invalid records) - Unanticipated error handling during request processing, which leaks internal information While the input may satisfy 'syntactic' validation, it also needs to be verified as non-malicious before it is used. Malicious input is any input that is syntactically valid but attempts to get the system to misbehave, potentially in a way that can be exploited to trigger an attack. Extending the 'name' example above, a caller may send a request that contains a name field with a string less than 100 characters (i.e., valid), but that string may be a Structured Query Language (SQL) injection attack.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for API Protection for Cloud-Native Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-3 in Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders? (Part 28) Control AC-3: ator is registered with an RP, a new key pair is created and associated with the RP's application ID, which is derived from the domain name in the URL where the registration transaction was initiated. During authentication, the application ID is again derived from the URL of the page that is requesting authentication, and the authenticator will sign the authentication challenge only if a key pair has been registered with the matching application ID. The FIDO Facet specification enables sites to define a list of domain names that should be treated as a single application ID to accommodate service providers that span multiple domain names, such as google.com and gmail.com. The application ID verification effectively prevents the most common type of phishing attack, in which the attacker creates a new domain and tricks users into visiting that domain instead of an intended RP where the user has an account. For example, an attacker might register a domain called 'googleaccts.com' and send emails with a pretext to get users to visit the site, such as a warning that the user's account will be disabled unless some action is taken. The attacker's site would present a login screen identical to Google's login screen to obtain the user's password (and OTP, if enabled) credentials and to use them to impersonate the user to the real Google services. With FIDO, the authenticator would not have an existing key pair registered under the attacker's domain, so the user would be unable to return a signed FIDO challenge to the attacker's site. If the attacker could convince the user to register the FIDO authenticator with the malicious site and then sign an authentication challenge, the signed FIDO assertion could not be used to authenticate to Google because the RP can also verify the application ID associated with the signed challenge, and it would not be the expected ID.

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on, sso. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Head Start on Assurance_ Proceedings of an Invitational Workshop on Information Technology (IT) Assurance and Trustworthiness, March 21-23, 1994 say about ATTENDEES? (Part 3) According to A Head Start on Assurance_ Proceedings of an Invitational Workshop on Information Technology (IT) Assurance and Trustworthiness, March 21-23, 1994, ATTENDEES: la -Dave t, KY 14850 (^7)277.20*20 Jwi^di4oof*> com €i7\Kkl MTTE6Ciiif5Pr*i«' ^5 Coh^-itt ^UlxatK V;\;i|l m^oOs^ :. ruc MvrEJb.edf|i^i^ B S ' I i'rev'&:^afeVi->ffc <Of«s orR. ' [ViliSDO, UK '«4«M ' = : : . ''' gfe|tt»^'W|t || '''BE S' A. t<Ni Stlo^fntS t1to':»»v{ 63^? I i22 >!4J^.Jif|j|(t^^^^ absRIaol BUugl&MgBto# i f wttf^O snO OCEOr », ^g^uvi 00i!0iitv (01>> WKf3.t»«.»«W'?ri5« ,Wmriw|5Cl oco^AVjijihm^ tK i»b0 ijnx^iirfbciw dd.u^ ^ -awmiE md OdOt CIM ',^>OOwo5^ moo.8i}'»TO»? isi^ $bui&Z}0 »2u4ttrsl tendifeH " » vioJoftflDoT cckiik»x.mm (m .^w4t»(iji^ vlsS'C ,*' ' SS3* W44fl VT}gi£in,ti:^^ ^ > K™ ^ ' Y^ biin^a I22DE P ; i*: 'g

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Head Start on Assurance_ Proceedings of an Invitational Workshop on Information Technology (IT) Assurance and Trustworthiness, March 21-23, 1994.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Operational Technology (OT) Security provide? (Section 181) t can be handed out by a receptionist • Denying needed access to the OT system because of a temporary inability of the sensing device to acknowledge a legitimate user • Being socially acceptable. Users consider some biometric authentication devices more acceptable than others. For example, retinal scans may be considered very low on the scale of acceptability, while thumbprint scanners may be considered high on the scale of acceptability. Users of biometric authentication devices will need to take social acceptability for their target group into consideration when selecting among biometric authentication technologies. When token-based access control employs biometric verification, the access control system should conform to the requirements of NIST SP 800-76-2 [SP800-76-2]. OT-Specific Recommendations and Guidance While biometrics can provide a valuable authentication mechanism, organizations may need to carefully assess the technology for use with 104 NIST SP 800-82r3 September 2023 Guide to Operational Technology (OT) Security industrial applications. Physical and environmental issues within OT environments may decrease the reliability of biometric authorized authentication. Organizations may need to coordinate with system vendors or manufacturers regarding their specific physical and environmental properties and biometric authentication requirements. 6.2.1.4.3. Smart Card Authentication Smart cards come in a variety of form factors, from USB devices to embedded chips on cards the size of credit cards that can be printed and embossed. Smart cards can be customized, individualized, and issued in-house or outsourced to service providers who manufacture hundreds or thousands per day.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, token. Contains security framework guidance for authentication systems. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.3 Implementation according to NIST 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings According to 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings, 2.3 Implementation: While there is no requirement to do so, the 'obvious' way to implement a site SLCS is via MyProxy [14]. We discuss the MyProxy solution further in this section, but it is also worth mentioning Microsoft's Windows Server 2003 which also contains features to run a CA, but will not, as far as the authors are aware, be able to contact an external VO attribute server to add attributes to the certificates. By using MyProxy we can bridge many of the site authentication infrastructures in use to the GSI/PKI world. MyProxy can be configured to provide certificates generated by an internal or external CA. We can also support advanced users who have long-term certificates by enabling them to upload proxies generated from their certificates (they are not permitted to upload the certificates and private keys themselves, by the CA's policy). This was the approach taken in the ShibGrid project [18]; see also Shibboleth discussion in section 2.7. For users who do not have long-term certificates, the service generates short term certificates and keys. MyProxy can also support SASL [12] (allowing Kerberos [19] authentication), PAM (allowing LDAP [29], RADIUS[16] and many other authentication systems) and PubCookie. Although it is simple to use the MyProxy command-line tools to leverage this functionality, this could potentially present users with quite a barrier to overcome. Many of the target audience traditionally balk at security in general, certificates in particular, and anything that cannot be clicked with a mouse. Therefore, we aim to simplify the process as much as possible, and hide the certificate/proxy process. For our own site's authentication infrastructure, Microsoft Active Directory (which happily, for the purposes of this work, is

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Small Business Information Security_ The Fundamentals provide? (Section 5) | 6 | | | 2.1 | ELEMENTS OF RISK .......................................................................................................................6 | | | | 2.2 | MANAGING YOUR RISKS ................................................................................................................8 | | | | | • Identify what information your business stores and uses ...............................................8 | | | | | • Determine the value of your information........................................................................8 | | | | | • Develop an inventory.....................................................................................................10 | | | | | • Understand your threats and vulnerabilities.................................................................11 | | | | 2.3 | WHENYOUNEED HELP ................................................................................................................14 | | | 3 | SAFEGUARDING YOUR INFORMATION...................................................................................................15 | SAFEGUARDING YOUR INFORMATION...................................................................................................15 | | | | 3.1 IDENTIFY ...................................................................................................................................16 | 3.1 IDENTIFY ...................................................................................................................................16 | | | | | • Identify and control who has access to your business information...............................16 | | | | | • Conduct Background Checks..........................................................................................16 | | | | | • Require individual user accounts for each employee.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Small Business Information Security_ The Fundamentals.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PA-220 in Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE)? (Part 181) Control PA-220: ented the reference design, or have questions about applying it in your environment, please email us at mobile-nccoe@nist.gov. All comments are subject to release under the Freedom of Information Act. National Cybersecurity Center of Excellence National Institute of Standards and Technology 100 Bureau Drive Mailstop 2002 Gaithersburg, MD 20899 Email: nccoe@nist.gov ## NATIONAL CYBERSECURITY CENTER OF EXCELLENCE The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute of Standards and Technology (NIST), is a collaborative hub where industry organizations, government agencies, and academic institutions work together to address businesses' most pressing cybersecurity issues. This public-private partnership enables the creation of practical cybersecurity solutions for specific industries, as well as for broad, cross-sector technology challenges. Through consortia under Cooperative Research and Development Agreements (CRADAs), including technology partners-from Fortune 50 market leaders to smaller companies specializing in information technology security-the NCCoE applies standards and best practices to develop modular, adaptable example cybersecurity solutions using commercially available technology. The NCCoE documents these example solutions in the NIST Special Publication 1800 series, which maps capabilities to the NIST Cybersecurity Framework and details the steps needed for another entity to re-create the example solution. The NCCoE was established in 2012 by NIST in partnership with the State of Maryland and Montgomery County, Maryland. To learn more about the NCCoE, visit To learn more about NIST, visit https://www.nist.gov. ## NIST CYBERSECURITY PRACTICE GUIDES NIST Cybersecurity Practice Guides (Special Publication 1800 series) target specific cybersecurity challenges in the public and private sectors.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Email according to Blockchain Networks_ Token Design and Management Overview? Email: blockchain-token-paper@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Zero Trust Architecture provide? (Section 110) tener acceso a los tokens y dispositivos de la empresa, lo que afectaría a la velocidad y eficacia de los procesos empresariales. - [1] Cam-Winget N. (ed.), Appala S., Pope S., Saint-Andre P. (2019). Using Extensible Messaging and Presence Protocol (XMPP) for Security Information Exchange. (Internet Engineering Task Force (IETF)), IETF Solicitud de observacioines ( Request for Comments RFC) 8600. https://doi.org/10.17487/RFC8600 - [2] Software Defined Perimeter Working Group «SDP Specification 1.0». (2014). Cloud Security Alliance. - [3] Stanton B., Theofanos M. F., Spickard Prettyman S., Furman S. (2016). Security Fatigue. IT Professional 18(5): 26-32. https://doi.org/10.1109/MITP.2016.84 - [4] Strouble D., Shechtman G. M., Alsop A. S. (2009). Productivity and Usability Effects of Using a Two-Factor Security System. SAIS 2009 Proceedings (AIS, Charleston, SC), p. 37. Disponible en http://aisel.aisnet.org/sais2009/37 - [5] Weidman J., Grossklags J. (2017). I Like It but I Hate It: Employee Perceptions Towards an Institutional Transition to BYOD Second-Factor Authentication. Proceedings of the 33rd Annual Computer Security Applications Conference (ACSAC 2017) (ACM, Orlando, FL), pp. 212-224.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Zero Trust Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain CONTACT: according to NIST Computer Security Division 2014 Annual Report According to Computer Security Division 2014 Annual Report, CONTACT:: Mr. Andrew Regenscheid (301) 975-5155 andrew.regenscheid@nist.gov <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security say about 2.4 Summary of Key Recommendations? (Part 1) According to Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security, 2.4 Summary of Key Recommendations: 2.4 Summary of Key Recommendations The following list presents some of the key recommendations from this section of the document. -  To support confidentiality, integrity, and availability, all of the components of telework and remote access solutions, including client devices, remote access servers, and internal servers accessed through remote access, should be secured against a variety of threats. (Section 2.1) -  Before designing and deploying telework and remote access solutions, organizations should develop system threat models for the remote access servers and the resources that are accessed through remote access. (Section 2.1) -  When planning telework security policies and controls, organizations should assume that client devices will be acquired by malicious parties who will either attempt to recover sensitive data from the devices or leverage the devices to gain access to the enterprise network. (Section 2.1) 15 A similar network can be set up for third-party-controlled devices if desired, or the same network used for both BYOD and third-party-controlled devices. However, often this is not necessary because there are already contractual agreements and technical checks in place to ensure that these devices are secured in accordance with the organization's policies. -  Organizations should plan their remote access security on the assumption that the networks between the telework client device and the organization cannot be trusted. (Section 2.1) -  Organizations should assume that client devices will become infected with malware and plan their security controls accordingly. (Section 2.1) -  Organizations should carefully consider the balance between the benefits of providing remote access to additional resources and the potential impact of a compromise of those resources.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Web Transactions_ TLS Server Certificate Management say about Appendix C Mapping to the Cybersecurity Framework? (Part 8) According to Securing Web Transactions_ TLS Server Certificate Management, Appendix C Mapping to the Cybersecurity Framework: | NIST SP 800-53 Rev. 4 | NIST SP 800- 181 Work Roles | |------------------------------------|----------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Protect (PR) | Identity Management, Authentication and Access Control (PR.AC) | PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to NIST Test Personal Identity Verification (PIV) Cards Version 2? http: //smime2.nist.gov/PIVTest/RSA2048CA.crl ldap://smime2.nist.gov/cn=Test%20RSA%202048-

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance say about Media Protection? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance, Media Protection: Media protection solutions enable a manufacturer to restrict the use of portable media within the manufacturing system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DR-1 in Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events? (Part 102) Control DR-1: , read and click I accept the license terms. <!-- image --> <!-- image --> 8. Click Next. 9. In the Install Rules section, note and resolve any further conflicts. <!-- image --> 10. Click Next. 11. In the Setup Role section, select SQL Server Feature Installation. 12. Click Next. 13. In the Feature Selection section, select the following: - a. Database Engine Services - b. Client Tools Connectivity - c. Client Tools Backwards Compatibility - d. Client Tools SDK - e. Management Tools - Basic - f. Management Tools - Complete - g. SQL Client Connectivity SDK - h. Any other desired features <!-- image --> <!-- image --> 14. Click Next. 15. In the Instance Configuration section, select Default instance. <!-- image --> 16. Click Next. 17. In the Server Configuration section, click Next. 18. In the Database Engine Configuration section, make sure Mixed Mode is selected. 19. Add all desired users as Administrators under Specify SQL Server Administrators by pressing Add Current User. - a. For Domain accounts, type in $DOMAINNAME\$USERNAME into Enter the object names to select textbox. - b. Click OK. - c. For local computer accounts, click on locations and select the computer's name. - d. Click OK. - e. Type the username into the Enter the object names to select textbox. - f. Once you are finished adding users, click Next. <!-- image --> <!-- image --> 20. In the Ready to install section, verify the installation and click Install. <!-- image --> 21. Wait for the install to finish. 22. Click Close. <!-- image --> ## 2.4.2 Open Port on Firewall 1. Open Windows Firewall with Advanced Security. <!-- image --> 2. Click Inbound Rules. 3. Click New Rule. <!-- image --> 4. Select Port. 5. Click Next. 6. Select TCP and Specific local ports. 7. Type 1433 into the text field. 8. Click Next. 9. Select Allow the connection. <!-- image --> <!-- image --> 10. Click Next. 11. Select all applicable locations. <!-- image --> 12. Click Next. 13. Name the rule Allow SQL Access.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cell Phone Forensic Tools_ an Overview and Analysis Update provide? (Section 143) ults from applying the scenarios listed at the left of the table to the devices across the top. Additional information can be found in NISTIR 7250 Cell Phone Forensic Tools: An Overview and Analysis . Table 30: SIM Card Results Matrix - External Reader | | SIM | SIM | SIM | |-----------------------|-------|-------|-------| | Scenario | 5343 | 8778 | 1144 | | Basic Data | Meet | Below | Below | | Location Data | Meet | Meet | Meet | | EMS Data | Meet | Meet | Meet | | Foreign Language Data | Meet | Meet | Meet | Quantaq's USIMdetective version 1.3.1 19 can acquire information from SIM cards via a PC/SCcompatible reader. The USIMdetective software provides examiners with the ability to acquire, examine and generate customized reports including data such as the Card Identity (ICCID), Stored Dialing Numbers (ADN), Fixed Dialing numbers (FDN), Subscriber Number (MSISDN), Last Numbers Dialed (LND), SMS and EMS Messages, Subscriber Identity (IMSI), Ciphering Key (Kc) and Location Information (LOCI). Once proper connectivity is established with the SIM, the examiner is prompted for the correct PIN, if the SIM is protected, before acquisition begins. If the SIM does not contain a PIN acquisition begins by clicking OK as illustrated below in Figure 51. Figure 51: Acquisition Wizard <!-- image --> After a successful acquisition, the entire SIM contents can be saved and stored in USIMdetective's proprietary format for later processing. USIMdetective uses an internal hashing facility to ensure the integrity of case data and detect whether tampering occurred during storage. USIMdetective uses SHA1 and MD5 integrity checks to ensure that the original file is consistent with the reopened case file. Figure 52 provides a snapshot of the User Interface, which provides the examiner with a self-explanatory interface to supported functions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to SSL VPNs say about 3.6 Summary? (Part 2) According to Guide to SSL VPNs, 3.6 Summary: best product it is recommended to identify the remote access needs and the applications that require remote access. -  Each SSL VPN supports different protocols via proxy and application translation. In addition, some SSL VPN products have concentrated their efforts and expertise in supporting certain protocols and applications. It is crucial to make sure that the SSL VPN provides the necessary proxies and application translators for the applications that require remote access. -  SSL VPN manageability features such as status reporting, logging, and auditing should provide adequate capabilities for the organization to effectively operate and manage the SSL VPN and to extract detailed usage information. -  The SSL VPN high availability and scalability features should support the organization's requirements for failover, load balancing, and throughput. State and information sharing is recommended to keep the failover process transparent to the user. -  SSL VPN portal customization should allow the organization to control the look and feel of the portal and to customize the portal to support various devices such as PDAs and smart phones. -  SSL VPN authentication should provide the necessary support for the organization's current and future authentication methods and to leverage existing authentication databases. SSL VPN authentication should also be tested to ensure interoperability with existing authentication methods. -  Some organizations, such as Federal agencies, have strict requirements for encryption and integrity protection. SSL VPNs should support the required algorithms for symmetric encryption, key exchange, and hash functions. All cryptographic algorithms and modules must be FIPS-approved. -  SSL VPNs should be evaluated to ensure they provide the level of granularity needed for access controls. Access controls should be capable of applying permissions to users, groups, and resources, as well as integrating with endpoint security controls.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Guide to SSL VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain CIPSO LABEL FORMAT according to NIST Standard Security Label for GOSIP_ an Invitational Workshop According to Standard Security Label for GOSIP_ an Invitational Workshop, CIPSO LABEL FORMAT: | 8 bits | 8 bits | 32 bits | 8 bits | 8 bits | ? bits | 8 bits | 8 bits | ? bits | |---------------|---------------|----------------------|----------|------------|-----------|----------|------------|------------| | 134 | 6-40 | 1 • OxffTfffff 1-255 | 1-34 | ? | • • • | 1-255 | 1-34 | • | | option number | option length | DOI | Ug id | tag length | info (kid | tag id | tag length | info field |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Standard Security Label for GOSIP_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain CRL Distribution Points : according to NIST NIST Test Personal Identity Verification (PIV) Cards Version 2 According to NIST Test Personal Identity Verification (PIV) Cards Version 2, CRL Distribution Points :: ldap://smime2.nist.gov/cn=Test%20ECC%20P- 256%20CA%20for%20Test%20PIV%20Cards,ou=Test%20CA,o=Test%20Certificates%2 02010,c=US?certificateRevocationList;binary


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Category according to Guidelines for Smart Grid Cybersecurity? Category: Common Technical Requirements

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-201 in Trustworthy Email? (Part 73) Control PS-201: xt mail messages are submitted by a sender, transmitted hop-by-hop over a series of relays and delivered to a receiver. Any successful man-in-themiddle can intercept such traffic and read it directly. Any bad actor, or organizationally privileged actor, can read such mail on the submission or delivery systems. Email transmission security can be assured by encrypting the traffic along the path . �e Transport Layer Security protocol (TLS) [RFC5246] protects confidentiality by encrypting bidirectional traffic and prevents passive monitoring. TLS relies on public key cryptography and uses X.509 certificates [RFC5280] to encapsulate the public key, and the Certificate Authority (CA) system to issue certificates and authenticate the origin of the key . In recent years the CA system has become the subject of attack and has been successfully compromised on several occasions. 1718 �e DANE protocol [RFC6698] is designed to overcome problems in the CA system by providing an alternative channel for authenticating public keys using DNSSEC. � e result is that the same trust relationships used to certify IP addresses can be used to certify servers operating on those addresses the mechanisms that combine to improve the assurance of email transmission security are described in section 5.2. Encryption at the transport layer gives assurance of the integrity of data in transit, but senders and receivers who want end-to-end assurance, (i.e., mailbox to mailbox) of confidentiality have two alternative mechanisms for achieving this: S/MIME [RFC5750] and OpenPGP [RFC4880]. Both protocols are capable of signing (for authentication) and encryption (for confidentiality) . �e S/MIME protocol is deployed to sign and/or encrypt message contents, using keys stored as X.509 certificates and a PKI (See Section 2.4.2) while OpenPGP uses a different certificate and a Web-of-Trust model for authentication of identities (See Section 2.4.3).

Explanation: NIST publication on credential and access management. Topics: authentication, pki, certificate authority. Contains security framework guidance for authentication systems. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Blockchain for Access Control Systems provide? (Section 27) ty, and processing speed, and it is often impossible to store extensive interaction history or employ heavy-weight security functions (e.g., microservice of mesh service for SecDevOps implementation). General AC management requirements, such as allowing runtime policy rule changes and policy administration delegation, may further complicate the design of the blockchain AC system, especially the consensus mechanisms and smart contract functions [IR7874]. Any vulnerability of a blockchain AC system on the level of the entire system or an underlying function of a smart contract can be hacked (e.g., reentrancy vulnerability) or misused. For instance, the publicly available smart contract's byte code might generate erroneous system state data that will be securely logged on the blockchain. The only way to fix errors is to delete, correct, and redeploy the entire smart contract. Thus, it is necessary for smart contracts to be correctly deployed (i.e., they work as intended by the developer and cannot be exploited by attackers). Optimizing smart contract codes can effectively reduce potential vulnerabilities and ensure the efficient execution of contracts. For instance, running smart contracts in parallel can speed up contract execution but requires the consideration of how to execute contracts that depend on each other at the same time (especially for dynamic AC policy models). Further, smart contracts might require communicating with out-of-chain services, such as receiving AC data from a PIP host, and rely on the oracle of off-chain resources from trusted third parties to retrieve the data and then push them to the blockchain at predetermined times. Although existing oracles are well-tested, their use may introduce a potential point of failure (e.g., an oracle might be unable to push out or provide erroneous data) [KLG].

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Blockchain for Access Control Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Federal S_MIME V3 Client Profile say about 2.2.1 Sending Signed Messages? According to Federal S_MIME V3 Client Profile, 2.2.1 Sending Signed Messages: - S/MIME implementations MUST be able to generate SignerInfo including signed attributes. - S/MIME implementations MUST be able to generate SMIMECapabilities and signingTime attributes. - S/MIME implementations SHOULD be able to generate signingCertificate attributes. - S/MIME implementations MUST be able to include user certificates and appropriate CRLs. - S/MIME implementations MUST be able to generate multipart/signed (i.e., "clear") messages. - S/MIME implementations MUST be able to request return signed receipt messages (as specified in [RFC 2634]) where the receipt goes to the message originator. (Requesting a return signed receipt where the receipt is directed to a third party is out of scope for this profile, and thus claims to conformance will not be tested. However, correctly responding to the reception of such a signed receipt request is required, as stated in Clause 2.3.2)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Federal S_MIME V3 Client Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 9.4 Security Testing Mail Servers according to NIST Guidelines on Electronic Mail Security According to Guidelines on Electronic Mail Security, 9.4 Security Testing Mail Servers: Periodic security testing of public mail servers is critical. 64 Without periodic testing, there is no assurance that current protective measures are working or that the security patch just applied by the m server administrator is functioning as advertised. Although a variety of security testing techniques e vulnerability scanning is the most common. Vulnerability scanning assists a mail server administrator in identifying vulnerabilities and verifying whether the existing security measures are effective. Penetration testing is also used, but less frequently and usually only as part of an overall penetration test of the organization's network. ail xists, 65

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, penetration test. Contains technical security guidance that could inform defensive posture. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about Confidentiality? According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Confidentiality: The confidentiality impact level is the effect of unauthorized disclosure of subsidies information on the ability of responsible agencies to pay government funds to affect the production or prices of various goods to benefit the public benefit. In many cases, unauthorized disclosure of subsidies information will have only a limited adverse effect on agency operations, assets, or individuals. Special Factors Affecting Confidentiality Impact Determination : Some information associated with applications for subsidies includes information covered by the provisions of the Privacy Act of 1974. (The Privacy Act Information provisional impact levels are documented in the Personal Identity and Authentication information type.) Unauthorized disclosure of large volumes of information protected under the Privacy Act can be expected to have a serious effect on public confidence in the agency. Also, premature unauthorized disclosure of planned subsidies policies can affect financial/commodities markets, with associated potential adverse effects on the U.S. economy and serious adverse effects on public confidence in the agency. This can result in assignment of a moderate impact level to such information. Recommended Confidentiality Impact Level : The provisional confidentiality impact level recommended for most subsidies information is low .

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 42) Control HA-1: cate. In this case the attribute certificate holds the serial number and issuer name of the user's public key certificate e.g. {x509serialNumber=123456 + x509issuer = {OU=Some CA, O=Some Org, C=US}. The limitations of this method are that the user must be PKI enabled, which of course, many are not; and that, depending upon the contents of the user's public key certificate, the user might be identified via this. Finally, the holder can be identified indirectly by reference to the hash of a public key that they hold. This is now effectively a random number, giving good privacy protection. The user can prove ownership of the attribute certificate by digitally signing a challenge provided by the origin authentication server, which can then provide this AC to the target site. The restrictions are that the user needs to be using some form of asymmetric cryptography, has generated their own private/public key pair, has created a self signed certificate with a random DN and does not have a corresponding X.509 public key certificate identifying him/her. The main limitation from a privacy perspective is that the target site can profile the user, without knowing the actual identity of the user, since the same public key hash is used each time. In all these cases there is a trade-off between the 'degree of anonymity' and the 'quality of issuance'. At one extreme we have dynamically generated Shibboleth short lived signed SAML attribute assertions that ## 4th Annual PKI R&D Workshop -- Proceedings provide anonymity but require a trusted directory to store the user's attributes. At the other extreme we have long lived ACs where each attribute authority can issue its own attributes in a controlled manner, but without any privacy protection.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.9.3.2 OCC Reset according to NIST Personal Identity Verification (PIV) of Federal Employees and Contractors According to Personal Identity Verification (PIV) of Federal Employees and Contractors, 2.9.3.2 OCC Reset: Both fingerprints used for OCC SHALL be replaced during an OCC reset. OCC reset MAY be performed in person at an issuing facility or a supervised remote identity proofing station:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Personal Identity Verification (PIV) of Federal Employees and Contractors.