You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Government Smart Card Interoperability Specification, Version 2.1 provide? (Section 226) d. A transaction must be completed by a call to gscBsiUtilEndTransaction(). For single-threaded BSI implementations, it can be assumed that each application will be associated with a separate process. The same process that starts a transaction must also complete the transaction. For multi-threaded BSI implements, it can be assumed that each application will be associated with a separate thread and/or process. The same thread that starts a transaction must also complete the transaction. If this function is called by a thread that has already called gscBsiUtilBeginTransaction() but has not yet called gscBsiUtilEndTransaction() it will return the error BSI\_NOT\_TRANSACTED . If the SPS (Service Provider Software) does not support transaction locking, it should return the error code BSI\_NO\_SPSSERVICE in response to a call to gscBsiUtilBeginTransaction() . ``` Prototype: ``` ``` public abstract void gscBsiUtilBeginTransaction ( int hCard boolean blType ) throws gov.gsc.classes.BSIException; ``` Parameters: hCard: Card communication handle returned from gscBsiUtilConnect() blType: Boolean specifying the type of transaction call ( blType set to 'true' in blocking mode. blType set to 'false' in non blocking mode). Return Code: BSI\_OK BSI\_BAD\_HANDLE BSI\_UNKNOWN\_ERROR BSI\_SC\_LOCKED BSI\_NOT\_TRANSACTED BSI\_NO\_SPSSERVICE Purpose: Completes a previously started transaction, allowing other applications to resume interactions with the card. If this function is called by a thread that has not yet called gscBsiUtilBeginTransaction() it will return the error BSI\_NOT\_TRANSACTED . If the SPS (Service Provider Software) does not support transaction locking, it should return the error code BSI\_NO\_SPSSERVICE in response to a call to gscBsiUtilEndTransaction() . Prototype: public abstract void gscBsiUtilEndTransaction ( int hCard ) throws gov.gsc.classes.BSIException; Parameters: hCard: Card communication handle returned from gscBsiUtilConnect().

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Head Start on Assurance_ Proceedings of an Invitational Workshop on Information Technology (IT) Assurance and Trustworthiness, March 21-23, 1994 say about TABLE OF CONTENTS? (Part 3) According to A Head Start on Assurance_ Proceedings of an Invitational Workshop on Information Technology (IT) Assurance and Trustworthiness, March 21-23, 1994, TABLE OF CONTENTS: WHY | 11 | | 3.4 IS SECURITY OF THE OPERATING SYSTEM TCB DIFFERENT FROM SECURITY OF AN APPLICATION? | 12 | | 3.5 IS IT POSSIBLE TO QUANTIFY ASSURANCE VERSUS VULNERABILITY TRADEOFFS? | 13 | | 3.6 WHO SHOULD MAKE TRADEOFF DECISIONS? | 15 | | 3.7 CONCLUSIONS | 15 | | PEDIGREE | 17 | |-----------------------------------------------------------------------------------------------|------| | 4.1 INTRODUCTION | 17 | | 4.2 ISSUES ASSOCIATED WITH PEDIGREE | 18 | | 4.2.1 WHAT Is A Pedigree?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Head Start on Assurance_ Proceedings of an Invitational Workshop on Information Technology (IT) Assurance and Trustworthiness, March 21-23, 1994.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain C.3.3 Human Resource Management according to NIST Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, C.3.3 Human Resource Management: Human resource management activities involve all activities associated with the recruitment and management of personnel.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Zero Trust Architecture say about 3.3 Algoritmos de confianza? (Part 2) According to Zero Trust Architecture, 3.3 Algoritmos de confianza: factores y de la postura de seguridad de los activos, se podría restringir o denegar el acceso a estos - Base de datos de los sujetos : corresponde a quién solicita el acceso al recurso ( SP 80063 ). Es decir, es el conjunto de sujetos (humanos y procesos) de la empresa o colaboradores, así como los atributos y privilegios que se les asignan. Estos sujetos y atributos forman la base de las políticas de acceso a los recursos ( SP 800-162 ) ( NISTIR 7987 ) 7 . Las identidades de los usuarios pueden incluir una mezcla de identidades lógicas, por ejemplo, la identificación (ID, por su nombre en inglés identity document ) de la cuenta y los resultados de las comprobaciones de autenticación realizadas por los PEP. Los parámetros de la identidad que se consideran para derivar el nivel de confianza incluyen la hora y la geolocalización. Se podría considerar una serie de privilegios otorgados a varios sujetos con un mismo rol; sin embargo, los permisos deben asignarse al sujeto de forma individual y no simplemente porque detiene un papel determinado en la organización. Esta selección de privilegios debería codificarse y almacenarse en un sistema de gestión de ID y en una base de datos de políticas. También podrá incluir información sobre el comportamiento anterior del sujeto observados en algunas variantes del TA (véase la sección 3.3.1). - Base de datos de los activos (y observación del estatus): se trata de la base de datos que contiene el estado registrado de cada uno de los activos (físicos y virtuales, hasta cierto punto) que son propiedad de la empresa (y posiblemente de los que no lo son, es decir, los BYOD). Este estado se compara con el estatus del activo que realiza la solicitud y puede incluir la versión del SO, el software presente y su integridad, la ubicación (de la red y la geolocalización) y el nivel de parches. En función de la comparación entre el estado del activo y esta base de datos, se restringirá o denegará el acceso.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Zero Trust Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Best Practices for Privileged User PIV Authentication provide? (Section 23) tion architecture, the user authenticates to a Verifier that is not the Relying Party, after which the Verifier provides the Relying Party with an assertion that the user's identity has been verified. As described in Section 9 of NIST SP 800-63 [2], which provides detailed requirements for use of assertions, some assertion mechanisms can provide e-authentication level 4 assurance to the Relying Party (e.g., Kerberos), and such mechanisms are preferred and should be employed whenever possible, if the indirect verification architecture is used. 15 The Kerberos Network Authentication Protocol [16] is commonly used to implement indirect verification, and it can be implemented in such a way that it provides e-authentication level 4 assurance to the Relying Party. The assertions created by the Verifier in Kerberos are called Kerberos tickets, and they include symmetric session keys that allow the Relying Party to perform a strong cryptographic authentication of the Claimant. The overall authentication process must ensure that the Claimant uses a PIV credential to authenticate to the Verifier before access is granted by the Relying Party. This requirement is satisfied if the Verifier is configured to only accept PIV authentication. Security Assertion Markup Language (SAML) bearer assertions [17] are also commonly used to implement indirect verification. Unlike Kerberos, with bearer assertions the Claimant authenticates to the Relying Party by simply providing a copy of the assertion that it got from the Verifier. So, unlike Kerberos, an attacker could defeat the authentication mechanism by 14 See Section 6.2.3.1 of FIPS 201-2 [5] for an example of PKI-based authentication using the PIV Authentication certificate.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Best Practices for Privileged User PIV Authentication.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Note according to Platform Firmware Resiliency Guidelines? Note: This guideline that RoTs and CoTs be implemented as part of platform firmware applies only to elements that implement the platform resiliency functions described in this paper. Platform vendors are encouraged to maintain a chain of trust from boot firmware through the Operating System to provide resiliency against various forms of attacks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Platform Firmware Resiliency Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2011 Annual Report provide? (Section 93) ine whether any changes need to be made to the final specification for the sets of test cards. Sets of test cards based on the final specification will then be created and made available for purchase. <!-- image --> Contacts: Dr. David Cooper (301) 975-3194 david.cooper@nist.gov Mr. William Polk (301) 975-3348 william.polk@nist.gov Modern computers rely on fundamental system firmware, commonly known as the Basic Input/Output System (BIOS), to facilitate the hardware initialization process and transition control to the operating system. The BIOS is a security-critical component because of its unique and privileged position within modern computers. A malicious BIOS modification could be part of a sophisticated, targeted attack on an organization-either a permanent denial of service (if the BIOS is corrupted) or a persistent malware presence (if the BIOS is implanted with malware). As security in operating systems and applications has improved, a race to 'bare metal' has begun between those wishing to attack systems and those responsible for protecting them. Attacks on the BIOS are an evolving threat area that could become a future battlefront. To combat this threat, in FY2011, NIST began a new project to secure the BIOS. As the computer industry is currently transitioning to BIOS based on the Unified Extensible Firmware Interface (UEFI), a recent industry specification for system firmware, NIST had the opportunity to influence the next generation of systems. For the past year, NIST has been working with key members of the computer industry on mechanisms to improve the security of the BIOS. In April 2011, NIST issued SP 800-147, BIOS Protection Guidelines, which provides guidance on protecting the BIOS in laptop and desktop computers. This document provides platform vendors with recommendations and guidelines for a secure BIOS update process.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about Confidentiality? According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Confidentiality: The confidentiality impact level is the effect of unauthorized disclosure of public comment tracking information on the ability of responsible agencies to solicit, maintain, and respond to public comments regarding proposed regulations. The effects of loss of confidentiality of information associated with the public comment process are unlikely to pose the threat of serious harm to agency assets, personnel or operations. In a few cases, the rationale for public comments can include information that is sensitive in terms of proprietary information sensitive Federal government information, or even national security information. However, such cases are exceptional and the information in question would be expected to be representative of information types covered elsewhere in this guideline. Recommended Confidentiality Impact Level : The provisional confidentiality impact level recommended for public comment tracking information is low .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control NT-7 in Dramatically Reducing Software Vulnerabilities_ Report to the White House Office of Science and Technology Policy? (Part 16) Control NT-7: a significant part of the national information infrastructure. Given the clear manageability, cost and performance advantages of using them, it is reasonable to expect their use to continue to expand. Security-enhanced versions of these technologies, if adopted, can therefore have a widespread effect on the exploitation of software vulnerabilities throughout the National Information Infrastructure. Additive Software Analysis. There are many types of software analysis - some are general and some target very specific vulnerabilities. The goal of additive software analysis is to be able to use multiple tools as part of an ecosystem. This will allow for increased growth and use of specialized software analysis tools and ability to gain a synergy between tools and techniques. More Mature Domain-Specific Software Development Frameworks. The goal of this approach is to promote the use (and reuse) of well-tested, well-analyzed code, and thus to reduce the incidence of exploitable vulnerabilities. Moving Target Defenses (MTD) and Automatic Software Diversity. This approach is a collection of techniques to vary the software's detailed structures and properties such that an attacker has much greater difficulty exploiting any vulnerability. The goal of automatic software diversity and MTD is to reduce an attacker's ability to exploit any vulnerabilities in the software, not to reduce the number of weaknesses in software. A critical need for improving security is to have software with fewer and less exploitable vulnerabilities. The measures, techniques and approaches we have described will be able to do this. Higher quality software, however, does not get created in a vacuum. There must be a robust research infrastructure, education and training and customer demand. Higher quality software is a necessary step, but it is insufficient. A robust operation and maintenance agenda that spans a system's lifecycle is still needed.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Dramatically Reducing Software Vulnerabilities_ Report to the White House Office of Science and Technology Policy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Study of OSI Key Management provide? (Section 170) ncryption and notarization are employed. [ANSI X9.17] defines notarization as: A method of applying additional security to a key utilizing the identities of the originator and the ultimate recipient. Thus, when notarization or just offset encryption is done, the KEK is transformed. Before notarization is explained, a double DES encryption must be described . The following figure is taken from Security For Computer Networks [DAVI89]. Two single DES keys are concatenated to form a double DES key. The double DES key consists of two halves, KKl and KKr respectively. Figure Al:l Double DES encryption/decryption <!-- image --> Encryption is performed by encrypting the plaintext X with KKl, thereafter the result of the encryption is decrypted with KKr. The decryption is followed by a new encryption with KKl, Double DES decryption is the inverse operation, see the figure above. The motive to employ a double DES key is that the KEK becomes cryptographically stronger than a single DES key. More about double DES encryption can be found in [MEYE82a]. Now notarization can be explained. The following figure is also taken from [DAVI89] and explains notarization when using a double DES key as a KEK. As explained above the double DES key consists of two parts, KKl and KKr. The identity of the initiating entity is given by FO and the identity of the responding entity is given by TO. The identities are split into two halves. The identity of the initiating entity, FM, is split into FMl and FM2 respectively. The identity of the responding entity, TO, is split into TOl and T02 respectively. CT is a counter which is associated with the *KK. Figure Al:2 Key notarization <!-- image --> A notarization key, *KN, is produced, a data key is encrypted with *KN. The data key then becomes notarized. By including the identities of the originator and recipient the situation is avoided where a legitimate party can perform a masquerade.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: A Study of OSI Key Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does De-Identifying Government Datasets_ Techniques and Governance provide? (Section 129) very, analysts should be able to validate their discoveries against the original data to ensure that the things they discover are in the original data and not artifacts of the data generation process. Both high-fidelity models and synthetic data generated from models may leak personal information that is potentially re-identifiable. The amount of leakage can be controlled using formal privacy models (e.g., differential privacy) that typically involve the introduction of noise. Section 4.4.7 describes the construction of fully synthetic data with differential privacy. There are several advantages for agencies that choose to release de-identified data as a fully synthetic dataset: - It can be very difficult to map records to actual people if the synthetic dataset is sufficiently large. - The privacy guarantees can potentially be mathematically established and proven ( Sec. 4.4.7). - The privacy guarantees can remain in force even if there are future data releases. Fully synthetic data also have these disadvantages and limitations: - It is not possible to create pseudonyms that map back to actual people because the records are fully fabricated. - The data release may be less useful for accountability or transparency. For example, investigators equipped with a synthetic data release would be unable to find the actual 'people' who make up the release because they would not actually exist. - For traditional models (such as Gaussian mixture models), it may be difficult to find meaningful correlations or abnormalities in synthetic data that are not represented in the model. For example, if a model contains only main effects and first-order interactions, then all second-order interactions can only be estimated from the synthetic data to the extent that their design is correlated with the main or first-order interactions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: De-Identifying Government Datasets_ Techniques and Governance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Section 182) Officer; System Privacy Officer; Senior Agency Information Security Officer; Control Assessor. System Development Life Cycle Phase: New - Implementation/Assessment. Existing - Operations/Maintenance. Discussion: Authorization packages 96 include security and privacy plans, security and privacy assessment reports, plans of action and milestones, and an executive summary. Additional information can be included in the authorization package at the request of the authorizing official. Organizations maintain version and change control as the information in the authorization package is updated. Providing timely updates to the plans, assessment reports, and plans of action and milestones on an ongoing basis supports the concept of near real-time risk management and ongoing authorization, and can be used for reauthorization actions, if required. The senior agency official for privacy reviews the authorization package for systems that process PII to ensure compliance with applicable privacy requirements and to manage privacy risks, prior to authorizing officials making risk determination and acceptance decisions. The information in the authorization package is used by authorizing officials to make informed, risk-based decisions. When controls are implemented by an external provider through contracts, interagency agreements, lines of business arrangements, licensing agreements, or supply chain arrangements, the organization ensures that the information needed to make risk-based decisions is made available by the provider. The authorization package may be provided to the authorizing official in hard copy or electronically or may be generated using an automated security/privacy management and reporting tool. Organizations can use automated support tools in preparing and managing the content of the authorization package.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach say about 3.4.5 Two Level Work Priority Dimensions/Characteristics? According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach, 3.4.5 Two Level Work Priority Dimensions/Characteristics: The two level work priority scheme permits a high amount of flexibility since it can be applied in any degree of detail required. For example, the results of Level I ranking may be adequate to prioritize all audit work, based on available time and resources. If additional ranking characteristics are necessary, the more detailed Level II can be used to further prioritize audit work. A two level review, additionally, enables the auditor to purge from consideration those systems which will definitely not be reviewed for any number of reasons. Environment and resource issues enter in here. The two level work priority scheme follows in outline form, identifying the five dimensions and their related characteristics. [Note: The same characteristic may be used in more than one dimension. The question asked in each will, however, be different.]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The NIST Cybersecurity Framework (CSF) 2.0 provide? (Section 43) d. Organizational cybersecurity practices are regularly updated based on the application of risk management processes to changes in business/mission requirements, threats, and technological landscape. | There is an organization-wide approach to managing cybersecurity risks. Cybersecurity information is routinely shared throughout the organization. Consistent methods are in place to respond effectively to changes in risk. Personnel possess the knowledge and skills to perform their appointed roles and responsibilities. The organization consistently and accurately monitors the cybersecurity risks of assets. Senior cybersecurity and non-cybersecurity executives communicate regularly regarding cybersecurity risks. Executives ensure that cybersecurity is considered through all lines of operation in the organization.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, csf, fips. General security reference material without sensitive content. Source: The NIST Cybersecurity Framework (CSF) 2.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 7.3.5 Location tracking of public safety wearables according to NIST Security Analysis of First Responder Mobile and Wearable Devices According to Security Analysis of First Responder Mobile and Wearable Devices, 7.3.5 Location tracking of public safety wearables: Threat Description: Wearables may beacon out identifying information about the device, such as WiFi or LTE identifiers. From another perspective, installed applications could programmatically access a device's location information. Vulnerability: A lack of temporary identities means that many wireless protocols and devices regularly transmit unencrypted permanent identities that can be stored and tracked. Threat Source: Adversarial Moderate Likelihood: Justification : COTS WiFi, Bluetooth, and LTE devices regularly expose this information. Severity - Emergency Medical Service: Low Confidentiality Impact Justification: Being able to track an EMT would not lead to loss of life or severely impact dayto-day operations. Low Confidentiality Impact Severity - Fire Service: Justification: Being able to track a firefighter would not lead to loss of life or severely impact day-to-day operations. Severity - Law Enforcement: High Confidentiality Impact Justification: If a malicious user could track an officer's device entering an area, they could evade their presence or place the officer in danger. If an undercover agent's device is targeted, it could reveal their identity and result in loss of life. Source: N/A

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Analysis of First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Workshop on Enhancing Security of Devices and Components Across the Supply Chain provide? (Section 20) ltiple vulnerabilities to fully exploit a system. In the past, it has been difficult to organize data for higher-level contextual information using datasets and standards from NIST, MITRE, and others. However, Jeremy's team has recently utilized generative AI tooling to obtain this higher-level context without the additional resources needed for conventional methods. For him, the emergence of AI tools has moved the industry from the 'age of context' to, as he terms it, the 'age of interface.' With this perspective and tools at hand, Jeremy presented his success with advanced generative AI to augment the development of attack chains with vulnerability information. This approach shows promise, yet it is not devoid of risks. Jeremy presented examples of using generative AI systems with prompts defining strict policies that tools violated, despite being given the needed context. Nonetheless, he is confident that they will improve in this age of interface and enable new capabilities for attackers and defenders alike. Finally, Peter Mell presented his research on the software, hardware, and trends for vulnerability management in the past, present, and future. Historically, claims of unbreakable secure software were met with skepticism, while hardware was perceived to be the immutable root of trust. This perception persisted, even though hardware is designed and programmable with software. As Peter put it, in some sense, 'hardware is software.' To effectively compare and contrast hardware and software, more data are needed for hardware vulnerability research. Peter compared the public infrastructure for software to the current hardware vulnerability landscape. For the categorization of vulnerability types, less than half have been observed with confirmed hardware bugs, with little overlap in categories between hardware and software bugs. Additionally, Peter pointed out that he found little public evidence of hardware bugs, as opposed to thousands a year for software.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Workshop on Enhancing Security of Devices and Components Across the Supply Chain.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Integrating Forensic Techniques into Incident Response say about N? (Part 8) According to Guide to Integrating Forensic Techniques into Incident Response, N: See Incident response | O | O | O | O | O | O | O | O | O | O | O | O | O | O | | Incident Incident response, 2-1, 2-3, 2-4, 3-5, 3-7 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | Office of Inspector General, 2-3, 2-5 | | Containment, 3-5 Exercises, B-1 | Operating system, 5-1, C-2 | Operating system, 5-1, C-2 | Operating system, 5-1, C-2 | Operating system, 5-1, C-2 | Operating system, 5-1, C-2 | Operating system, 5-1, C-2 | Operating system, 5-1, C-2 | Operating system, 5-1, C-2 | Operating system, 5-1, C-2 | Operating system, 5-1, C-2 | Operating system, 5-1, C-2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Integrating Forensic Techniques into Incident Response.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide for Conducting Risk Assessments provide? (Section 72) _\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ The first step in the risk assessment process is to prepare for the assessment. The objective of this step is to establish a context for the risk assessment. This context is established and informed by the results from the risk framing step of the risk management process. Risk framing identifies, for example, organizational information regarding policies and requirements for conducting risk assessments, specific assessment methodologies to be employed, procedures for selecting risk factors to be considered, scope of the assessments, rigor of analyses, degree of formality, and requirements that facilitate consistent and repeatable risk determinations across the organization. Organizations use the risk management strategy to the extent practicable to obtain information to prepare for the risk assessment. Preparing for a risk assessment includes the following tasks: - Identify the purpose of the assessment; - Identify the scope of the assessment; - Identify the assumptions and constraints associated with the assessment; - Identify the sources of information to be used as inputs to the assessment; and - Identify the risk model and analytic approaches (i.e., assessment and analysis approaches) to be employed during the assessment. TASK 1-1: Identify the purpose of the risk assessment in terms of the information that the assessment is intended to produce and the decisions the assessment is intended to support. Supplemental Guidance: The purpose of the risk assessment is explicitly stated in sufficient detail to ensure that the assessment produces the appropriate information and supports the intended decisions. Organizations can provide guidance on how to capture and present information produced during the risk assessment (e.g., using a defined organizational template). Appendix K provides an exemplary template for a risk assessment report or the preferred vehicle for risk communication.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide for Conducting Risk Assessments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Printed Information : according to NIST NIST Test Personal Identity Verification (PIV) Cards Version 2 According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Printed Information :: Name: Test Cardholder IV Employee Affiliation: Employee Expiration Date: 2040DEC31 Agency Card Serial Number: 0000212348 Issuer Identification: TSTISR320161719 Organization Affiliation (Line 1): Not present Organization Affiliation (Line 2): Not present

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio provide? (Section 70) (the product of likelihood and impact). Public officials and board members also provide guidance to their corporate officers at the enterprise level and highlevel executives at the organization level. This includes guidance on ceilings for capital expenditures (CapEx) and operating expenses (OpEx) and objectives for free cash flow. For the Federal Government, similar requirements are expressed through OMB guidance and strategic direction from senior agency officials, chief executives, and other designees (e.g., an ERM Council). For both private- and public-sector entities, leaders issue guidance to continue, accelerate, reduce, delay, or cancel significant enterprise initiatives while considering their risk appetite and tolerance levels. They also do this while making decisions about what constitutes prudent risk disclosures, balancing the competing objectives of a) properly informing stakeholders and overseers (including regulators) through required filings and statements at hearings and b) protecting sensitive information from competitors and adversaries. The second step in the risk management life cycle involves identifying a comprehensive set of risks and recording them in the risk register. This involves identifying events that could enhance or impede objectives, including the risks involved in failing to pursue opportunities. ICT risk identification is composed of four inputs: 1. Identification of the organization's mission-supporting assets and their valuation, 2. Determination of potential threats that might jeopardize the security or performance of those assets and potential ICT opportunities that might benefit the organization, 3. Consideration of the vulnerabilities of those assets, and 4. Evaluation of the potential consequences of risk scenarios. Sections 3.2.1 through 3.2.4 discuss each of these four inputs in more detail. Risk practitioners often perform risk identification as both top-down and bottom-up exercises.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog say about 1.4 Publication Organization? (Part 2) According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog, 1.4 Publication Organization: further define support needed related to the higher-level capability. The need for a sub-capability or its elements is guided by the cybersecurity needs of the organization as described in SP 800-213. Figure 1 shows the structure of a sub-capability, which like capabilities are named and defined with a short description and further discussion about the sub-capability and why it may be needed. A mapping to related SP 800-53 Rev. 5 controls is also provided for each sub-capability that can help organizations identify the controls and/or enhancements 6 that may be supported by each 5 Capability names follow from NISTIRs 8259A [IR8259A] and 8259B [IR8259B], which were used as inputs along with SP 800-53 Rev. 5 [800-53] to generate this catalog. 6 Organizations should note that applicable control enhancements are sometimes included in the mapping for a sub-capability without the corresponding control that would be assumed in place if the enhancement is in place. Mappings in this catalog reflect the controls and/or enhancements from SP 800-53 Rev. 5 [800-53] that may be supported by the functionality or actions described in the sub-capability. In some cases, control enhancements are supported by the sub-capability while the base control sub-capability. This support for controls may come from a fulfilment of all or part of a control by the presence of the functionality or actions described in the sub-capability. For example, the control may state that the element should function in a specific way and the sub-capability describes how the IoT device should function based on the control. In other cases, support for controls is in the form of enabling the system and/or organization to perform some system/organization-wide function or action including the IoT device.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Guidelines for Storage Infrastructure provide? (Section 114) astructure and should be used: EN-SS-R1 - TLS, hashing, and encryption: To support encrypted communication between storage clients and servers, Transport Layer Security (TLS) protocol should be used. To prevent the use of insecure or outdated configuration, the selection and configuration of TLS protocol implementations, including the selection of TLS version, and the choice of hashing and encryption algorithms, should be based on the following guidelines (or more current versions when published): - Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations (NIST SP800-52 Rev2) [37] - SNIA TLS Specification for Storage Systems Version 1.1 [38] EN-SS-R2 - Cleartext protocols (e.g., HyperText Transfer Protocol (HTTP), Telnet, File Transfer Protocol (FTP), or Remote Shell (RSH)) should not be used: Cleartext protocols are vulnerable to sniffing, interception, and other attacks as they do not encrypt traffic or logon details, making it easy for an eavesdropper to intercept this information. In some implementations, HTTP is supported only for the purpose of redirection to HTTPS to deal with the case of mistyped URL. This should not be allowed in sensitive storage environments. EN-SS-R3 - Encryption for storage management API sessions: Storage management APIs and CLIs are used for administrative access to storage systems. All API and CLI client sessions should be encrypted leveraging features such as vendor configuration options within the management software or the API/CLI software component. EN-SS-R4 - Encryption for administrative access sessions: Administrative sessions over HTTP should use TLS (HTTPS). CLI access should be encrypted using SSH rather than Telnet. The authentication during API access should not use cleartext, and the session itself should be encrypted.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security Guidelines for Storage Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Cryptographic Standards and Guidelines Development Process say about 6. Consider Contributing Standards and Guidelines for Adoption by SDOs? (Part 2) According to NIST Cryptographic Standards and Guidelines Development Process, 6. Consider Contributing Standards and Guidelines for Adoption by SDOs: nvolve seeking public comment on the applicability and currency of the standard or guideline. Comments on proposed updates to or the withdrawal of a FIPS will be solicited using the Federal Register . -  Make the review results public, including any public comments received. -  Renew, update or withdraw the standard or guideline. Renewal involves keeping the document unchanged. Update involves making revisions to the document (technical and otherwise). Withdrawal may be immediate, or it may be a phased withdrawal ('sunsetting'). Some technical content of a withdrawn standard or guideline can potentially be moved to another new or existing standard or guideline. An analysis of the comments received on existing FIPS will be published in the Federal Register and the comments posted on the CSRC website; comments received on existing SPs will be posted on the CSRC website. NIST also will announce its decision on any maintenance effort (e.g., document update or withdrawal) that will take place. NIST will use the processes and procedures described in this publication to develop future cryptographic standards and guidelines. They are designed to provide broad opportunity to offer input on its cryptographic standards and guidelines, and to maximize openness and transparency. NIST will review this publication and its processes and procedures every five years -and more frequently if a need arises. Please address any comments regarding these principles, processes and procedures -and NIST's use of them in developing cryptographic standards and guidelines -to Chief, NIST Computer Security Division at crypto@nist.gov. All comments and NIST's responses will be posted on the CSRC website.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Cryptographic Standards and Guidelines Development Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PE-6 in Identity and Access Management for Electric Utilities? (Part 154) Control PE-6: igure 9-3 Guardian ActiveMQ T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . 9.2.3.4 You must install hardware and OS versions specific to Apache Tomcat: Installing Apache Tomcat Double-click the setup launcher to start the setup. It will start the installation process. Click Next to start the installation process. NIST SP 1800-2C: Identity and Access Management for Electric Utilities 155 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . Click I Agree to accept the license terms. It displays the Choose Components screen. Select Custom as the install type, and uncheck the Examples option. Click Next to specify the destination folder for installation. We strongly recommend using the D:\AlertEnterprise\Tomcat location. Click Next to specify the configuration parameters. Enter the desired port in the Connector Port text area. The default port is 8080. Specify the User Name and Password in the respective fields. Click Next to select the path of the JRE installed on the system. Select the path of the JDK/JRE that you just installed (e.g., C:\Program Files\Java\jre1.6). Click Install to start the file copying process. Uncheck the Run Apache Tomcat and Show Readme options in the final dialog box. Click Finish to finish the installation. 9.2.3.5 Apache Tomcat Configuration You need to specify the Tomcat configuration, as described in the following steps: Click Start > Programs > Apache Tomcat > Configure Tomcat. Click the Java tab in the Apache Tomcat Properties dialog box. Enter the following settings: a. Initial memory pool: 1024 b. Maximum memory pool: 1024 c. Thread stack size: 300 Note: These settings may vary with the volume of random access memory (RAM) in the server. Click Apply > OK to close the dialog box.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD) say about DO NOT EDIT THESE LINES. OSMUD WILL REPLACE WITH ITS CON-? (Part 4) According to Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD), DO NOT EDIT THESE LINES. OSMUD WILL REPLACE WITH ITS CON-: ip 192.168.20.197 NIST SP 1800-15D: Securing Small-Business and Home Internet of Things Devices 181 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 Test Case Field Description config rule option enabled '1' option name 'mud_192.168.20.197_same-manufac- ture-pi_REJECT-ALL-LOCAL-TO' option target REJECT option src lan option dest lan option proto all option family ipv4 option src_ip any option dest_ip 192.168.20.197 config rule option enabled '1' option name 'mud_192.168.20.197_same-manufac- ture-pi_REJECT-ALL' option target REJECT option src lan option dest wan option proto all option family ipv4 option src_ip 192.168.20.197

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2010 Annual Report? (Part 78) Control HA-3: er's license. We continue to work with the U.S. national standards committees to ensure compatibility with federal credentials and to address the needs of non-federal com munities. Contact: Mr. Sal Francomacaro (301) 975-6414 salfra@nist.gov ## Biometric Standards and Conformity Assessment Activities Biometric technologies are currently required in many public and private sector applications worldwide to authenticate an individ ual's identity, secure national borders and restrict access to secure sites including buildings and computer networks. Biometrics pro vide for secure transactions, positive identification, and augmenta tion to human judgment. Use of biometrics is being considered by financial institutions, the healthcare industry, and in educational ap plications. Consumer uses are also expected to significantly increase for personal security and convenience in home automation and se curity systems, and in the retail, gaming and hospitality industries. These many varied uses require the development of open standards to maintain interoperability and encourage continued adoption. The NIST Biometrics program supports the development of volun tary standards for biometrics, and responds to government, indus try and market demands for open systems standards by: - Accelerating development oGLYPH(cmap:df00) GLYPH(cmap:df00)ormal national and international biometric standards and associated conformity assessment; - Educating users on the capability oGLYPH(cmap:df00) standards-based open systems solutions; - Promoting standards adoption; - Developing conGLYPH(cmap:df00)ormance test architectures and test tools to test implementations of these standards; - Supporting harmonization oGLYPH(cmap:df00) biometric, tokens and security standards; and - Addressing the use oGLYPH(cmap:df00) biometric-based solutions GLYPH(cmap:df00)or ID Management applications.

Explanation: NIST publication on credential and access management. Topics: token, sso. Contains security framework guidance for authentication systems. Source: Computer Security Division 2010 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Codes for Identification of Federal and Federally-Assisted Organizations say about Code Organization? (Part 2) According to Codes for Identification of Federal and Federally-Assisted Organizations, Code Organization: | 1900 | STATE , Department of - continued | |--------|-----------------------------------------------------------------------------------| | 1914 | Office of the Under Secretary for Economic and Agricultural Affairs | | 1933 | Bureau of Economic and Business Affair | | 1934 | Bureau of Overseas Buildings Operations | | 1915 | Office of the Under Secretary for Arms Control and International Security Affairs | | 1950 | Bureau of Political-Military Affairs | | 1951 | Assistant Secretary for Arms Control | | 1955 | Assistant Secretary for Non-Proliferation | | 1956 | Assistant Secretary for Verification and Compliance | | 19TB | Office of the Under Secretary for Public Diplomacy and Public Affairs | | 1952 | Bureau of Public Affairs | | 1953 | Bureau of Educational and Cultural Affairs | | 1957 | International Public Information Core Group Secretariat | | 1959 | Office of International Information Programs | | 1941 | Office of the Under Secretary for Global Affairs | | 1936 | Bureau of Democracy, Human Rights and Labor | | 1942 | Bureau of International Narcotics and Law Enforcement Affairs | | 1948 | Bureau of Oceans and International Environmental and Scientific Affairs | | 1954 | Bureau of

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Codes for Identification of Federal and Federally-Assisted Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Key Management Documents say about 7.3.4 Per KPDU Security Label and Format? According to Secure Data Network Systems (SDNS) Key Management Documents, 7.3.4 Per KPDU Security Label and Format: This option is used to negotiate the existence and format of an explicit security label on every PDU exchanged while using the TEK identified. The choices for this option and the mnemonics are: ppl abs Per PDU security label absent ppl DoD DoD security label per PDU ppl XXX XXX security label per PDU NOTE: XXX is yet to be defined. 7.3.5

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 7.2.2 Delegated RPKI-Model Functional Requirements according to NIST Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, 7.2.2 Delegated RPKI-Model Functional Requirements: The SIDR example implementation included the capability for a resource holder to set up its own delegated CA, create its own repository, and offer a hosted service to its customers, including the ability to publish customer ROAs to its repository, delete customer ROAs from its repository, and have customer ROAs expire from its repository. The ROAs in this delegated CA repository were included in the RPKI data that RPs downloaded to their VCs, and VRPs derived from these ROAs were provided to RP routers via the RPKI -to-router protocol.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Framework for Designing Cryptographic Key Management Systems provide? (Section 23) | Destroy Key and Metadata............................................................................. Associate a Key with its Metadata............................................................... | 44 45 | | Modify | | Metadata.......................................................................................... 45 | | 6.4.11 | Delete Metadata............................................................................................ | 45 | | 6.4.12 | List Key Metadata........................................................................................

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: A Framework for Designing Cryptographic Key Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security of Interactive and Automated Access Management Using Secure Shell (SSH) say about Source Restriction? (Part 1) According to Security of Interactive and Automated Access Management Using Secure Shell (SSH), Source Restriction: Source Restriction A person who uses an SSH client to access one or more SSH servers, typically to perform administrative operations, transfer data, or access applications. A cryptographic key. In this document, keys generally refer to public key cryptography key pairs used for authentication of users and/or machines (using digital signatures). Examples include identity key and authorized keys. The SSH protocol also uses host keys that are used for authenticating SSH servers to SSH clients connecting them. Changing the key, i.e., replacing it by a new key. The places that use the key or keys derived from it (e.g., authorized keys derived from an identity key, legitimate copies of the identity key, or certificates granted for a key) typically need to be correspondingly updated. With SSH user keys, it means replacing an identity key by a newly generated key and updating authorized keys correspondingly. A file associated with a specific account that contains one or more host keys. Each host key is associated with an SSH server address (IP or hostname) so that the server can be authenticated when a connection is initiated. The user or administrator who makes the first connection to an SSH server is responsible for verifying that the host key presented by that server is the actual key (not a rogue key) before it gets placed in the known hosts file. A password used to protect an identity key. After entered by a user or administrator, a passphrase is mathematically converted into large number which serves as a key that is used to encrypt the identity key. In order to decrypt the identity, the passphrase must be entered again so that the same key can be regenerated for decryption. The act of an attacker moving from one compromised system to one or more other systems within the same or other organizations. Pivoting is fundamental to the success of advanced persistent threat (APT) attacks. SSH trust relationships may more readily allow an attacker to pivot.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Security of Interactive and Automated Access Management Using Secure Shell (SSH).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Telehealth Remote Patient Monitoring Ecosystem say about 10. Click OK.? According to Securing Telehealth Remote Patient Monitoring Ecosystem, 10. Click OK.: <!-- image --> 11. Add additional servers by following the same pattern described above, populating the respective Interface and Address Pool, and check the Enable DHCP Server that corresponds to the appropriate server. Values for each server are described below: 2. e. - a. Interface: Enterprise-Services - i. - Address Pool: 192.168.40.100-192.168.40.254 - ii. Enable DHCP Server: - checked - b. - Interface: HIS-Services - i. - Address Pool: 192.168.41.100-192.168.41.254 - ii. Enable DHCP Server: checked - c. - Interface: Remote-Services - i. - Address Pool: 192.168.42.100-192.168.42.254 - ii. Enable DHCP Server: - checked - d. Interface: Databases - i. - Address Pool: 192.168.43.100-192.168.43.254 - ii. Enable DHCP Server: checked Clinical-Workstations - Interface: - i. - Address Pool: 192.168.44.100-192.168.44.254 - ii. Enable DHCP Server: - checked

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Derivation Using Pseudorandom Functions say about key hierarchy? According to Recommendation for Key Derivation Using Pseudorandom Functions, key hierarchy: A multiple-level tree structure such that each node represents a key and each branch - pointing from one node to another - indicates a key derivation from one key to another key.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key Derivation Using Pseudorandom Functions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations? (Part 68) Control HA-1: | CertiPath Key Recovery Policy , CertiPath, December 2013. 0v.1.5.pdf | | CP X509 CP | CertiPath X.509 Certificate Policy , CertiPath, Version 3.26, November 2014. | | DoD Policy | X.509 Certificate Policy for the United States Department of Defense , Department of Defense, Version 10.5, January 2013.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does An Analysis of Computer Security Safeguards for Detecting and Preventing Intentional Computer Misuse provide? (Section 16) iagram that reflects the model we suggest. Insurance, personnel, and contracts are defined as staff activities, but could be placed at the same level as operations, data processing, security or audit. Following is a brief description of each element of the model: < z g Io Ico < 111 Z -J D > QC UJ O w Li. ^ Vi > ^ O X < ILU IQ. o o LU <!-- image --> CO St < z \_1 u. < CO O < N QC LU hD Q. o o (J z N OQ §2 < ec O < QC O UJ O Q QC O O O < CM LU QC D <!-- image --> - General Management -This element includes those persons or functions whose primary responsibility is the management and administration of the agency. This element is responsible for establishing policy and ensuring that adequate financial and line management support is provided to carry out the agency charter. - Personnel-This subelement is responsible for maintaining personal information on employees required by the agency as well as providing the official guidelines describing the policy of the agency regarding hiring and firing criteria. - Contracts -This subelement is responsible for ensuring that all contracts, including those involving software and hardware, are well specified to minimize the potential for loss resulting from improper performance. - Insurance-This subelement is responsible for ensuring that the facilities, including software and hardware, are adequately insured. - Operations Division-Most Government agencies will have more than one operations division, but conceptually they are all similar from a data processing point of view. Consequently the model provides for only one operations division. An operations division is an organizational unit responsible for one general agency function such as logistics. Each operations division has many departments, but only two, application program development and data handling, are germane to the model.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: An Analysis of Computer Security Safeguards for Detecting and Preventing Intentional Computer Misuse.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Evaluator action elements: according to NIST COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0 According to COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0, Evaluator action elements:: ADO\_IGS.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. ADO\_IGS.1.2E The evaluator shall confirm that the installation procedures result in a secure configuration.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Framework for Designing Cryptographic Key Management Systems say about Contents? (Part 35) According to A Framework for Designing Cryptographic Key Management Systems, Contents: ................................................................................ | 9.3 Interoperability Testing ........................................................................................ | 9.3 Interoperability Testing ........................................................................................ | 77 | | 9.4 Self-Testing .......................................................................................................... | 9.4 Self-Testing .......................................................................................................... | 9.4 Self-Testing .......................................................................................................... | 78 | | 9.5 Scalability Testing ................................................................................................ | 9.5 Scalability Testing ................................................................................................ | 9.5 Scalability Testing ................................................................................................ | 78 | | 9.6 Functional Testing and Security Testing.............................................................. | 9.6 Functional Testing and Security Testing.............................................................. | 9.6 Functional Testing and Security Testing.............................................................. | 78 | | 9.7 Environmental Testing .........................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Framework for Designing Cryptographic Key Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2016 NIST_ITL Cybersecurity Program Annual Report say about F E B R U A R Y 2 0 1 6 :? According to 2016 NIST_ITL Cybersecurity Program Annual Report, F E B R U A R Y 2 0 1 6 :: Trustworthy Suppliers Framework Forum ( Postponed due to inclement weather - rescheduled in May 2016 ) February 16

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Minimum Security Requirements for Multi-User Operating Systems provide? (Section 48) , date, location of terminal, or method of access (e.g., dial-up port or local area network port). These requirements provide finer-grained and organizationspecific system access control capabilities. Requirements are specified to display an advisory warning message to all users prior to system logon to discourage a would-be system penetrator from attempting an unauthorized system access. Such a message can also provide a legal basis for subsequent prosecution of system penetrators. Although not a direct countermeasure, auditing requirements are specified to provide the capability to perform an after-the-fact analysis of unauthorized system access attempts. The MSR specify auditing requirements to monitor failed login attempts. In addition, the MSR specify requirements to display to an authorized user, upon successful system access, the date and time, method of access or port of entry, and the number of failed logon attempts since the last successful system access by his or her userlD. These requirements provide an organization with the capability to detect attempted or successful system penetrations. This provides the opportunity for the organization to take corrective action, such as strengthening existing user authentication methods or changing a password. Authorized users can gain access to resources for which they are not allowed by assuming the userlD of another user and gaining the associate access rights. This can be accomplished by exploiting vulnerabilities associated with passwords, or by spoofing legitimate userlD authorization prompts and stealing passwords associated with other users. To address the vulnerability associated with passwords, the MSR specify password requirements that promote a strong organizational password management program.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Minimum Security Requirements for Multi-User Operating Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Securing Web Transactions_ TLS Server Certificate Management? (Part 322) Control HA-1: he following checkbox: - Include in all CRLs. Specifies where to publish in the Active Directory when publishing manually. - In Specify locations, users can obtain a certificate revocation list (CRL). Select the entry C:\\Windows\system32\CertSrv\CertEnroll\<CaName><CRLNameSuffix><DeltaCRLAll owed>.crl. 10. On the Extensions tab, select the following checkboxes: - Publish CRLs to this location. - Publish Delta CRLs to this location. 11. Change Select extension to Authority Information Access (AIA). 12. In the Specify locations, users can obtain a certificate revocation list (CRL) do the following: - a. Select the entry >.crt and then click Remove. In Confirm removal, click Yes. This publication is available free of charge from: http://doi.org/10.6028/NIST.SP.1800-16. - b. Select the entry file://<ServerDNSName>/CertEnroll/<ServerDNSName>\_<CaName><CertificateName> .crt and then click Remove. In Confirm removal, click Yes. 13. In Specify locations, users can obtain a CRL, click Add. 14. In Add Location, in Location , type click OK. This returns to the CA properties dialogue box. 15. On the Extensions tab, select the following checkbox: - Include in the AIA of issued certificates. 16. In Specify locations from which users can obtain a certificate revocation list (CRL), select the entry that starts with ldap://CN=CATruncatedName>,CN=AIA,CN=PublicKeyServices. 17. On the Extensions tab, select the following checkbox: - Include in the AIA extension of issued certificates. 18. In Specify locations, users can obtain a certificate revocation list CRL. Select the entry C:\\Windows\system32\CertSrv\CertEnroll\<ServerDNSName>\_<CaName><CertificateName> .crt. 19.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: Communications paths can be logically separated using encryption.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations say about 1.5.1 Glossary? (Part 9) According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations, 1.5.1 Glossary: module. | | Cryptographic product | Software, hardware or firmware that includes one or more cryptographic functions. Acryptographic product is or contains a cryptographic module. | | Cryptographic service | A service that provides confidentiality, integrity, source authentication, entity authentication, non-repudiation support, access control and availability (e.g., encryption and decryption, and digital signature generation and verification). | | Cryptoperiod | The time span during which a specific key is authorized for use or in which the keys for a given system or application may remain in effect. | | Data integrity | A property whereby data has not been altered in an unauthorized manner since it was created, transmitted, or stored. | | Decryption | The process of changing ciphertext into plaintext using a cryptographic algorithm and key. | | De-registration (of a key) | The inactivation of the records of a key that was registered by a registration authority. | | Destruction | The process of overwriting, erasing, or physically destroying information (e.g., a cryptographic key) so that it cannot be recovered. See SP 800-88. 4 | 4 SP 800-88 Revision 1, Guidelines for Media Sanitization.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings? (Part 17) Control PD-12: it can be supported in a more complex way by adding a second permitted subtree containing the name of the North American Bridge CA and an excluded subtree of all names subordinate to this). This tight trust model is further shown by the Certificate Path Processing Procedure in Section 12.4.3 of the 97 standard, which states: The following checks are applied to a certificate: ….. e) Check that the subject name is within the name-space given by the value of permitted-subtrees and is not within the name-space given by the value of excluded-subtrees. If any of the above checks fails, the procedure terminates, returning a failure indication and an appropriate reason code. Unfortunately, when the GeneralName syntax replaced the X.500 DN syntax in the name constraints extension, it was not as straightforward as simply replacing one syntax with another. The text describing the name constraints extension should have been significantly enhanced, because new possibilities now existed that did not before. Enhancements were needed in a number of ways. Firstly, how was the name constraints extension to ## 5th Annual PKI R&D Workshop - Proceedings handle general names that were not hierarchically structured, such as IP addresses. How could one specify permitted and excluded subtrees for nonhierarchical names? The answer was to exclude these name forms from being applicable to this extension, as is indicated by the text ' only those name forms that have a well-defined hierarchical structure may be used in these fields '. Secondly, what was a relying party to do if there was a mismatch between the various subject alternative name forms in a certificate, and those in the name constraints extension in the issuing CA's certificate? Furthermore what is the default constraint on a name form that is not included in the name constraints extension?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 844) Interface between control systems and equipment with high availability, without compute nor bandwidth constraints Table H-2 Analysis Matrix of Security-Related Logical Interface Categories, Defined by Attributes s t n e m e r i u q e r y t i l i b a l i a v A : 3 - R T A s t n e m e r i u q e r y t i r g e t n I : 2 - R T A f o i h t d w d n a b w o L : 4 - R T A l s e n n a h c i s n o i t a c n u m m o c i s t n a r t s n o c r o s s e c o r p o r c M i : 5 - R T A e t u p m o c d n a y r o m e m n o s e i t i l i b a p a c y t i l a i t n e d i f n o

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Section 192) documentation costs, provide increased speed and efficiency in generating important information for decision makers, and provide more effective means for updating critical risk management information. It is recognized that certain controls are not conducive to the use of automated tools and therefore, manual methods are acceptable in those situations. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ be provided. The terms and conditions for the common control authorization provide a description of any specific limitations or restrictions placed on the operation of the system or the controls that must be followed by the system owner or common control provider. The authorization termination date is established by the authorizing official and indicates when the authorization expires. Organizations may eliminate the authorization termination date if the system is operating under an ongoing authorization-that is, the continuous monitoring program is sufficiently robust and mature to provide the authorizing official with the needed information to conduct ongoing risk determination and risk acceptance activities regarding the security and privacy posture of the system and the ongoing effectiveness of the controls employed within and inherited by the system. The authorization decision is included with the authorization package and is transmitted to the system owner or common control provider. Upon receipt of the authorization decision and the authorization package, the system owner or common control provider acknowledges and implements the terms and conditions of the authorization.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, fips, security control. General security reference material without sensitive content. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Random Number Generation Using Deterministic Random Bit Generators say about Table of Contents? (Part 30) According to Recommendation for Random Number Generation Using Deterministic Random Bit Generators, Table of Contents: | Instantiation of CTR_DRBG Without a Derivation Function.......................... 86 | | | B.4.3 | Reseeding a CTR_DRBG Instantiation Without a Derivation Function........ 86 | | | B.4.4 | Generating Pseudorandom Bits Using CTR_DRBG.......................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Number Generation Using Deterministic Random Bit Generators.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management say about 2.2.2.4 Use of Gap Analysis to Identify Threats? (Part 3) According to Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, 2.2.2.4 Use of Gap Analysis to Identify Threats: , but inventory is not always accurate. • Network flows are not mapped. • Asset classification is performed and effective. • Internal security roles are defined but not those of supply chain partners. | • Internal user (adds a non-compliant device; because a device is not in inventory, scans may miss it as a host so vulnerabilities may go undetected) • External adversary (could gain network access, and activities might not be distinguished from unmapped, typical traffic patterns) • External partner (may not fulfill responsibilities for protecting, detecting, or responding to incidents) | | ID.BE | Business Environment | • Priorities and responsibilities based on the Commercial Facilities Sector. • Dependencies and resilience requirements are anecdotally understood but not more formally recorded. | • Power failure (causes customers [e.g., emergency services, hospitals] with critical dependencies to experience an extended loss of internet service due to a lack of service level agreements and documented resilience requirements) | | PR.AT | Awareness and Training | • All staff have been trained in physical and information security practices during onboarding. | • Internal user (may fall victim to an email phishing attack due to a lack of sufficient training) | | PR.DS | Data Security | • Inbound and outbound remote connections are encrypted. • Laptops with proprietary facility information do not have full-disk encryption. • Email systems are configured to provide limited data loss prevention.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Digital Identity Guidelines_ Federation and Assertions say about 4.6.1. IdP-Controlled Decisions? According to Digital Identity Guidelines_ Federation and Assertions, 4.6.1. IdP-Controlled Decisions: - 4.6.1.1. IdP Allowlists of RPs In a pre-established trust agreement, IdPs MAY establish allowlists of RPs that are authorized to receive authentication and attributes from the IdP without a runtime decision from the subscriber. When placing an RP on its allowlist, the IdP SHALL confirm that the RP abides by the terms of the trust agreement. The IdP SHALL determine which identity attributes are passed to the allowlisted RP upon authentication. IdPs SHALL make allowlists available to subscribers, as described in Sec. 7.2. IdP allowlists SHALL uniquely identify RPs through fully qualified domain names, cryptographic keys, or other identifiers that are applicable to the federation protocol in use. Any entities that share an identifier SHALL be considered equivalent for the purposes of the allowlist. Allowlists SHOULD be as specific as possible to avoid unintentional impersonation of an RP. An allowlist entry for an RP SHALL NOT use a wildcard domain identifier. IdP allowlist entries for an RP SHALL indicate which attributes are included as part of an allowlisted decision. If additional attributes are requested by the RP, the request SHALL be: - Subject to a runtime decision of the authorized party to approve the additional attributes requested, - Redacted to only the attributes in the allowlist entry, or - Denied outright by the IdP. IdP allowlist entries MAY be applied based on aspects of the federation transaction, such as the xALs required for the transaction. For example, an IdP could use an allowlist entry to bypass a consent screen for an FAL1 transaction but require confirmation of consent from the subscriber during an FAL3 transaction.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Digital Identity Guidelines_ Federation and Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Architecture Design Process for Health Information Exchanges (HIEs) provide? (Section 45) ital Two are part of an HIE. When exchanging information, the communication channel is protected through various security and privacy controls to ensure that security and privacy requirements are met. For example, Transport Layer Security (TLS) is used to encrypt the channel, and patient consent information will be verified and exchanged before sending health information. HITSP: T17, Secured Communication Channel; TN907, Common Data Transport Technical Note. NHIN Core Service : Messaging Platform. HIPAA Security Rule: 45 CFR 164.312(e)(1), Standard: Transmission Security; Implementation Specification: Encryption. - SP 800-45, Version 2, Guidelines on Electronic Mail Security. - SP 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations. - SP 800-53 Rev. 3, Recommended Security Controls for Federal Information Systems and Organizations, security control family: System and Communications Protection (SC). - SP 800-58, Security Considerations for Voice Over IP Systems. - SP 800-77, Guide to IPsec VPNs. - SP 800-113, Guide to SSL VPNs. Definition: To ensure that sensitive health information is not sent intentionally or unintentionally to a party that is not authorized to view it. Illustration: Hospital One sends health records to Hospital Two. Hospital One sends the document using previously agreed-upon encryption methods to ensure the confidentiality of the exchanged health records. HITSP: TP13, Manage Sharing of Documents. HIPAA Security Rule: 45 CFR 164.312(e)(1), Standard: Transmission Security; Implementation Specification: Encryption. - Draft FIPS 140-3, Security Requirements for Cryptographic Modules . - SP 800-45, Version 2, Guidelines on Electronic Mail Security. - SP 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations. - SP 800-53 Rev.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, control family, security control. General security reference material without sensitive content. Source: Security Architecture Design Process for Health Information Exchanges (HIEs).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Voice Over IP Systems say about 1. Develop appropriate network architecture.? (Part 2) According to Security Considerations for Voice Over IP Systems, 1. Develop appropriate network architecture.: at all and do IP PBX access from a physically secure system. - If performance is a problem, use encryption at the router or other gateway, not the individual endpoints, to provide for IPsec tunneling. Since some VOIP endpoints are not computationally powerful enough to perform encryption, placing this burden at a central point ensures all VOIP traffic emanating from the enterprise network has been encrypted. Newer IP phones are able to provide Advanced Encryption System (AES) encryption at reasonable cost. Note that Federal Information Processing Standard (FIPS) 140-2, Security Requirements for Cryptographic Modules, is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. 2. Ensure that the organization has examined and can acceptably manage and mitigate the risks to their information, system operations, and continuity of essential operations when deploying VOIP systems. An especially challenging security environment is created when new technologies are deployed. Risks often are not fully understood, administrators are not yet experienced with the new technology, and security controls and policies must be updated. Therefore, agencies should carefully consider such issues as their level of knowledge and training in the technology, the maturity and quality of their security practices, controls, policies, and architectures, and their understanding of the associated security risks. These issues should be considered for all systems but are especially important with VOIP deployment for essential operations, such as systems designated "high" under FIPS 199, Standards for Security Categorization of Federal Information and Information Systems [2].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Voice Over IP Systems.