You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessment of Access Control Systems say about 3.2 Protection Bits and Limitations? (Part 1) According to Assessment of Access Control Systems, 3.2 Protection Bits and Limitations: 3.2 Protection Bits and Limitations A protection bits (or owner/group/other) mechanism [FKC03] is commonly included in UNIX and UNIX-like operating systems. This mechanism is a simple and very common DAC control scheme that uses only a few bits of access control information attached to each file. These bits specify the defined permissions of read, write, and execute for different classes of users: 1. Owner: the file owner 2. Group: users belonging to the owner's group or project specified as the 'owning group' 3. Others: the rest of the world The access control system regulates access to a file by associating read (r), write (w), or execute (x) operations with each of these categories of users (Table 2). Table 2 - Permission Bits | Owner | Owner | Owner | Group | Group | Group | Other | Other | Other | |---------|---------|---------|---------|---------|---------|---------|---------|---------| | R | W | X | R | W | X | R | W | X | By default, the owner of the file is the one who created the file. The owner of the file is typically the only one besides the system administrator ('superuser' or 'root') who can modify the protection bits. Also note that there is only one group that is available for each file. The system administrator controls group memberships, so that as membership within these groups changes, so will the capabilities of users to access files. For example, File \_a has the following protection bits: File\_a: (rwx) (r-x) (--x) The protection bits indicate that the owner has read, write, and execute permission to file File\_a ; the members of the group that is associated with the owner have read and execute permission to the file; and all other system users have execute permission to the file. The '-' marking indicates that the corresponding operation is denied on File\_a .

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Assessment of Access Control Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Use of ISO_IEC 24727 provide? (Section 21) upport multiple languages. ISO/IEC 24727-4 establishes the details for different stack configurations and features that enable clientapplications to interface with card-applications in different ways. Stack configuration choices range from performing all necessary services directly on a smart card to achieving the same functionality in a distributed network environment. The stacks defined are: + Full network stack - a configuration where the various ISO/IEC 24727 interfaces are implemented in a networked environment on different platforms. + Loyal stack - a configuration where ISO/IEC 24727-2 and ISO/IEC 24727-3 are implemented on the same platform. + Remote loyal stack - a configuration where a loyal stack is used on a platform that is remote from the client-application. + Opaque Integrated Circuit Card (ICC) stack - a configuration where the card-application implements and interprets the Generic Card Interface commands. + ICC resident stack - a configuration where the card-application accepts the SALII actions instead of ISO/IEC 7816 commands. + Remote ICC stack - a configuration where physical connection of the ICC is made to a different platform from the rest of the stack. While all of the above configurations are possible, this document will focus on only two: the Loyal stack and ICC resident stack. Figure 4 provides an illustration of how the two configurations are implemented to achieve the same results. Figure 4 - Comparison of Loyal and ICC Resident Stack <!-- image --> ISO/IEC 24727-5 defines test procedures that can be used to validate conformance assertions. The test procedures focus on testing the behaviors of interfaces for each component of the ISO/IEC 24727 architecture to ensure interoperable services, integrity reporting, and connectivity.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Use of ISO_IEC 24727.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Personal Identity Verification Card Management Report? (Part 13) Control PD-12: could encode other values within that field. For example, the SP 800-73 data object tags could be represented in the Path even though 7816-15 does not specifically address naming data by tags or OIDs. An example 7816-15 EF.CD PIV certificate in ASN.1 syntax is show below: ``` 30 66 [ 30 33 Label: 'PIV Authentication Certificate' 0C 1E 50 49 56 20 41 75 74 68 65 6E 74 69 63 61 74 69 6F 6E 20 43 65 72 74 69 66 69 63 61 74 65 ACR: 'Read Always, PIN to Update' 30 11 30 06 03 02 00 80 05 00 30 07 03 02 00 40 04 01 80 Identifier: 36 Byte UID 30 26 04 24 29 23 BE 84 E1 6C D6 AE 52 90 49 F1 F1 BB E9 EB B3 A6 DB 3C 87 0C 3E 99 24 5E 0D 1C 06 B7 47 DE B3 12 4D C8 Referenced Value '5FC105' A1 07 30 05 04 03 5F C1 05 ] ``` ## 3.1.4 Monolithic 7816-15 Structures To reduce the number of data objects required for discovery and still use the features of 7816-15, it is possible to represent the contents of the discovery data structures within the EF.OD itself. There are some drawbacks to this approach because it requires a single data object to hold the discovery data for all objects, which can become burdensome for the parser if it is only interested in certain data types. This method also requires that the access control rules of the EF.OD be identical to those that all of the discovery data structures would have. For example, there could be no granularity in access control for each of the discovery data structures, as they would be contained in a single data object. ## 3.1.5 Transitioning from the CCC to 7816-15 Transitioning from the CCC to 7816-15 should be easy given that the two discovery mechanisms can coexist. The CCC even includes a field that denotes whether a 7816-15 structure exists on a card. The middleware discovery process could take the following steps: -  Attempt to read the CCC and its contents. -  If the first step fails, read the standard EF.DIR location and its contents. -  If the first step succeeds, determine if the PKCS#15 flag is set in the CCC.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Personal Identity Verification Card Management Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report) say about MEANING? According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report), MEANING: MIN Mini Misc N/A NBS NCSC NIST Non-aggreg NSA OMB Oper & Und Oper OPNAVINST PC Pers Persn Phys PL 100-235 PRI Prod Prot Reg Resp Respon Risks S/W SAT Sec SEC Secur/AcquisSpecs Sel Spec Sys S/W & Maint Sys Telecom TIS Und Devel US Userid Va Minimal Minicomputer Miscellaneous Not Applicable National Bureau of Standards (former designation of the National Institute of Standards and Technology) National Computer Security Center National Institute of Standards and Technology (formerly the National Bureau of Standards or NBS) Non-aggregated National Security Agency Office of Management and Budget Operational and Under development Operational Operation Navy Instruction Personal Computer Personnel Selection/Screening Personnel Physical and Environmental Protection Public Law No. 100-235 (same as CSA or ACT) Primary Production (, I/O Controls) Protection Regulation Assignment of Security Responsibility Responsibility Risk/Sensitivity Assessment System Software Controls Security Awareness and Training Security Secondary Security/Acquisition Specifications Selection Special System Software and Maintenance System Telecommunications Trusted Information Systems, Inc. Under Development United States User Identification Variance

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N say about Executive Summary? (Part 1) According to A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N, Executive Summary: Executive Summary Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC) are very different attribute based access control (ABAC) standards with similar goals and objectives. XACML, available since 2003, is an Extensible Markup Language (XML) based language standard designed to express security policies, as well as the access requests and responses needed for querying the policy system and reaching an authorization decision [1]. NGAC is a relations and architecture-based standard designed to express, manage, and enforce access control policies through configuration of its relations. What are the similarities and differences between these two standards? What are their comparative advantages and disadvantages? These questions are particularly relevant because XACML and NGAC are different approaches to achieving a common access control goal-to allow applications with vastly different access policies to be expressed and enforced using the features of the same underlying mechanism in diverse ways. These are also important questions, given the prevalence of data services in computing. Data services include computational capabilities that allow the consumption, alteration, and management of data resources, and distribution of access rights to data resources. Data services can take on many forms, to include applications such as time and attendance reporting, payroll processing, and health benefits management, but also including system level utilities such as file management. To answer these questions, this document first describes XACML and NGAC, then compares them with respect to five criteria. The first criterion is the relative degree to which the access control functionality of a data service can be separated from a proprietary operational environment.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PM-01 in Assessing Security and Privacy Controls in Information Systems and Organizations? Control PM-01: INFORMATION SECURITY PROGRAM PLAN POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does BioCTS 2012_ Advanced Conformance Test Architectures and Test Suites for Biometric Data Interchange Formats and Biometric Information Records say about Table of Contents? (Part 6) According to BioCTS 2012_ Advanced Conformance Test Architectures and Test Suites for Biometric Data Interchange Formats and Biometric Information Records, Table of Contents: 27 Annex A - Roadmaps of Biometric Data Interchange Formats and Conformance Testing | | Figure 2 5: 'Field' Class ...............................................................................................................................................11 | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Figure 2 6: 'Header' Class ...........................................................................................................................................11 | | Figure 2 7: 'Representation' Class ..............................................................................................................................12 | | Figure 2 8: 'Data Format' Class ..................................................................................................................................12 | | Figure 2 9: CBEFF Structure and Elements...................................................................................................................14 | | Figure 2 10: 'BIR, PatronFormat', 'DataFormat', and 'SecurityFormat' Classes ......................................................15 | | Figure 2-11: BioCTS 2012 for ISO/IEC High-Level Architecture ....................................................................................16 | | Figure 2 12: 'Field' and 'Subfield' Classes..................................................................................................................17 | | Figure 2 13: 'InformastionItem' and 'BinarySubField' Classes ..................................................................................17 | | Figure 2-14: 'Record' Class and Inheritance ...............................................................................................................18 | | Figure 2 15: BioCTS 2012 for AN-2011 High-Level Architecture ..................................................................................21 | | Table 2-1: Comparison of the Field Structure in the Standard and the Code...............................................................24 | | Figure 2.16: Generic AN-2011 Field Structure..............................................................................................................24 | | Figure 2.17: AN-2011 Field Structure Example............................................................................................................25 | | Figure A.1: 1G Biometric Data Formats and Associated CTMs....................................................................................28 | | Figure A.2: 2G Biometric Data Formats and Associated CTMs....................................................................................29 | | Figure B.1: Roadmap of CTSs for AN-2011 Transactions .............................................................................................30 | | Figure B.2: Roadmap of CTSs for ISO/IEC Data Interchange Formats .........................................................................31 | | Figure B.3:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: BioCTS 2012_ Advanced Conformance Test Architectures and Test Suites for Biometric Data Interchange Formats and Biometric Information Records.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 7.5 Protecting Keys and Secrets according to NIST Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases, 7.5 Protecting Keys and Secrets: Cryptographic keys are high-value assets in workloads, especially in environments where the owner of the keys is not in complete control of the infrastructure, such as public clouds, edge computing, and network functions virtualization (NFV) deployments. In these environments, keys are typically provisioned on disk as flat files or entries in configuration files. At runtime, workloads read the keys into random access memory (RAM) and use them to perform cryptographic operations like data signing, encryption/decryption, or Transport Layer Security (TLS) termination. Keys on disk and in RAM are exposed to conventional attacks like privilege escalation, remote code execution, and input buffer mismanagement. Keys can also be stolen by malicious administrators or be disclosed because of operational errors. For example, an improperly protected VM snapshot can be used by a malicious agent to extract keys. An HSM can be attached to a server and used by workloads to store keys and perform cryptographic operations. This results in keys being protected at rest and in use. In this model, keys are never stored on disk or loaded into RAM. If attaching an HSM to a server is not an option, or if keys are needed in many servers at the same time, an alternative option is to use a network HSM. Workloads send the payload that needs cryptographic processing over a network connection to the network HSM, which then performs the cryptographic operations locally, typically in an attached HSM. An HSM option is not feasible in some environments. Workload owners may not have access to a cloud or edge environment in order to attach their HSM to a hardware server. Network HSMs can suffer from network latency, and some workloads require an optimized response time. Additionally, network HSMs are often provided as a service by the cloud, edge, or NFV providers and are billed by the number of transactions. Cost is often a deciding factor for using a provider network HSM.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DS-3 in Cryptographic Key Management Workshop Summary -- June 8-9, 2009? (Part 35) Control DS-3: would like network security at no extra cost. Recall the days when we were told that the cost of safety was not justifiable in automobiles. We were told that the public would never pay for seat belts. Today, not only do we have seat belts, but we have front and rear air bags, side air bags, and someday soon perhaps upper and lower air bags. Yes, we pay more for our cars, but we expect safety to be built in. There may also be smaller leaps in security that could help solve our cryptographic key management problems. What if we had the capability to automatically validate key establishment protocols or even use provably-secure protocols? Quantum cryptography could also improve security by permitting us to easily distribute secret values in a secure manner. But, there is more to key management than key establishment. Many key management problems involve the secure generation, storage, access and recovery of the keys, either before or after they are distributed. - Leaps in ease of implementation, management, and use: We have already made significant progress in this area. Electronic distribution of wrapped keys led to an improvement over manually distributed keys, and public key-based key distribution led to an improvement over key wrapping. Today, PKI, even with all of its problems, provides a major leap ahead over previously used systems. But, we still seem to be repeating some of the mistakes of the past. We build systems, we implement them, and then we find out that the users consider them unacceptable. We must not wait until the last minute to get the user's opinion. We need to build prototypes of a system and test them with real users before we extensively field the final product. - We need to explore the advantages of alternative approaches like identity-based key management. - What if we had cloud key management?

Explanation: NIST publication on credential and access management. Topics: pki, key management. Contains security framework guidance for authentication systems. Source: Cryptographic Key Management Workshop Summary -- June 8-9, 2009.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Study of OSI Key Management provide? (Section 150) The KMSAs have prior agreements but need to initialize cryptographic variables; - The KMSAs negotiate about the algorithms to use. The protocol uses the Kirq and Kirs PDUs to establish the algorithms. ``` Kirq ::= SEQUENCE { protocolVersion ProtocolVersion, secServGrpProp [0] IMPLICIT SecServGrpProp OPTIONAL, keyEchGrpProp CHOICE { [1] IMPLICIT AsymmKeyExchGrpProp, [2] IMPLICrT SymmKeyExchGrpProp } OPTIONAL } ``` - Kirs ::= SEQUENCE { stateResult StateResult, protocolVersion ProtocolVersion, secServGipAcc [0] IMPLICIT SecServGrpAcc OPTIONAL keyEchGrpAcc CHOICE { [1] IMPLICIT AsyminKeyExchGipAcc, [2] IMPLICrr SymmKeyExchGrpAcc } OPTIONAL) SecServGrpProp ::= SEQUENCE { confAlgs SEQUENCE OF Algorithmidentifier, icvAlgs SEQUENCE OF Algorithmidentifier) SecServGrpAcc ::= SEQUENCE { confAlg Algorithmidentifier, icvAlg Algorithmidentifier) - AsymmKeyExchGrpProp ::= SEQUENCE { keyExchMethods SEQUENCE OF Algorithmidentifier - possibly more declarations have to be put in) AsymmKeyExchGrpAcc ::= SEQUENCE { keyExchMethod Algorithmidentifier - possibly more declarations have to be put in) Both secServGrpProp and keyEchGrpProp are optional because there can be prior agreements between the KMSAs about the algorithms to use. The KMSAs may therefore have no need to send the information contained in secServGrpProp and keyEchGrpFTop. Before the initiating key manager performs a key exchange, it looks up in the SMIB whether there are prior agreements made with the peer system. Problems arise when a KMSA makes a priori agreements with several other KMSAs and the agreements include different types of algorithms. For example, KMSA A has made an agreement to use key exchange method diffieHellmanModel with KMSA B and the key exchange method described in NLSP with KMSA C. Since algorithm identifiers are not exchanged when the application association is opened, how can KMSA A when acting as the responding party know the syntax of the algorithm dependent data conveyed in the Nkrq PDU?

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: A Study of OSI Key Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Framework for Emergency Response Officials (ERO)_ Authentication and Authorization Infrastructure say about Table of Contents? (Part 3) According to Framework for Emergency Response Officials (ERO)_ Authentication and Authorization Infrastructure, Table of Contents: | 5 OF .................................................................................... | | 2.2 | 2.2 | 8 COMPONENTS CREDENTIALING SERVICE CLASS COMPONENTS OF CREDENTIALVERIFICATION SERVICE CLASS ......................................................... | | 2.4 | 2.4 | 9 COMPONENTS OF TRUST FEDERATION SERVICE CLASS............................................................................... | | 3. | 11 LEVERAGING STANDARDS AND EMERGING SPECIFICATIONS................................................... | 11 LEVERAGING STANDARDS AND EMERGING SPECIFICATIONS................................................... | | 4. SUMMARY.......................................................................................................................................................12 | 4. SUMMARY.......................................................................................................................................................12 | 4.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Framework for Emergency Response Officials (ERO)_ Authentication and Authorization Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Required Test Procedures: according to NIST Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements According to Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements, Required Test Procedures:: SCAP.T.4000.1: The tester SHALL import the SCAP source data stream and apply it to a known target, producing an SCAP result data stream. SCAP.T.4000.2: The tester SHALL validate the results produced using SCAPVal; the validation MUST NOT produce any errors.  CVE  OCIL  CVE  OCIL  CVE  OCIL SCAP.T.4000.3: The tester SHALL visually inspect the results to ensure the Asset Identification Fields are as expected. SCAP.R.4100: The product SHALL be able to correctly produce an SCAP result data stream conforming to the ARF specification for each XCCDF, OVAL, and OCIL component. SCAP Capability:  ACS

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IP-3 in Data Integrity_ Recovering from Ransomware and Other Destructive Events? (Part 5) Control IP-3: These types of adverse events ultimately impact data integrity (DI). It is imperative for organizations to recover quickly from a DI attack and trust the accuracy and precision of the recovered data. The National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) built a laboratory environment to explore methods to recover from a data corruption event in various information technology (IT) enterprise environments. The example solution outlined in this guide describes the solution built in the NCCoE lab. It encourages effective monitoring and detection of data corruption in standard enterprise components as well as custom applications and data composed of open-source and commercially available components. The goals of this NIST Cybersecurity Practice Guide are to help organizations confidently: -  restore data to its last known good configuration -  identify the correct backup version (free of malicious code and data for data restoration) -  identify altered data as well as the date and time of alteration -  determine the identity/identities of those who alter data -  identify other events that coincide with data alteration -  determine any impact of the data alteration For ease of use, here is a short description of the different sections of this volume. -  Section 1: Summary presents the challenge addressed by the NCCoE project, with an in-depth look at our approach, the architecture, and the security characteristics we used; the solution demonstrated to address the challenge; benefits of the solution; and the technology partners that participated in building, demonstrating, and documenting the solution. The Summary also explains how to provide feedback on this guide. -  Section 2: How to Use This Guide explains how readers-business decision makers, program managers, and IT professionals (e.g., systems administrators)-might use each volume of the guide.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations say about Table of Contents? (Part 11) According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, Table of Contents: | | | D.3.1.14. Attachments.....................................................................................................................216 | | | D.3.1.15. C-SCRM Plan and Life Cycles ............................................................................................216 | | | D.4.1. C-SCRM Template ....................................................................................................................218 | | | D.4.1.1. Authority and Compliance..................................................................................................218 | | | D.4.1.2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.2. MFA Requirements Assessment according to NIST Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information, 3.2. MFA Requirements Assessment: When deploying an MFA solution, all agencies should conduct a requirements assessment to help determine the MFA solution that will best meet agency needs. This assessment should include, but is not limited to, engaging with the applicable stakeholders discussed in this section.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, mfa. Contains security framework guidance for authentication systems. Source: Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Device Security_ Bring Your Own Device (BYOD) provide? (Section 107) --------------------------------------------------------------------------------------| | Kryptowire Cloud Service | Application Vetting | ID.RA-1: Asset vulnerabilities are identified and documented. | CA-2, CA-7, CA-8: Security Assessment and Authorization RA-3, RA-5: Risk Assessment SA-4: Acquisition Process SI-7: Software, Firmware, and Information Integrity | A.12.6.1: Control of technical vulnerabilities A.18.2.3: Technical Compliance Review | CSC 4: Continuous Vulnerability Assessment and Remediation | SP-RSK-002: Security Control Assessor SP-ARC-002: Security Architect OM-ANA-001: Systems Security Analyst | | Specific product used | Function | Applicable NIST Cybersecurity Framework Subcategories | Applicable NIST SP 800-53 Revision 5 Controls | ISO/IEC 27001:2013 | CIS 6 | Applicable NIST SP 800-181 NICE Framework Work Roles (2017) | |-------------------------|------------|------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------|--------------------------------------------|------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | ID.RA-3: Threats, both internal and external, are identified and documented.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IA-4 in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 1) Control IA-4: IDENTIFIER MANAGEMENT Control: Manage system identifiers by: a. Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, service, or device identifier; b. Selecting an identifier that identifies an individual, group, role, service, or device; c. Assigning the identifier to the intended individual, group, role, service, or device; and d. Preventing reuse of identifiers for [Assignment: organization-defined time period]. Discussion: Common device identifiers include Media Access Control (MAC) addresses, Internet Protocol (IP) addresses, or device-unique token identifiers. The management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the usernames of the system accounts assigned to those individuals. In such instances, the account management activities of AC-2 use account names provided by IA-4. Identifier management also addresses individual identifiers not necessarily associated with system accounts. Preventing the reuse of identifiers implies preventing the assignment of previously used individual, group, role, service, or device identifiers to different individuals, groups, roles, services, or devices. Related Controls: AC-5, IA-2, IA-3, IA-5, IA-8, IA-9, IA-12, MA-4, PE-2, PE-3, PE-4, PL-4, PM-12, PS- 3, PS-4, PS-5, SC-37. Control Enhancements: (1) IDENTIFIER MANAGEMENT | PROHIBIT ACCOUNT IDENTIFIERS AS PUBLIC IDENTIFIERS Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts. Discussion: Prohibiting account identifiers as public identifiers applies to any publicly disclosed account identifier used for communication such as, electronic mail and instant CHAPTER THREE PAGE 136 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I .

Explanation: NIST publication on credential and access management. Topics: access control, authorization, token. Contains security framework guidance for authentication systems. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Electronic Health Records on Mobile Devices provide? (Section 102) allow enterprise connection security to enable certificate-based authentication to the AP. The APs assist in facilitating mobile device connectivity to each of the remote health organization networks. Each connected mobile device can then securely connect to the EHR server by using the AP connection. This section will describe how to configure the APs with IPs, media access control (MAC) address filtering, and certificate-based access control. NIST SP 1800-1C: Securing Electronic Health Records on Mobile Devices 32 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 1 . . System requirements ▪ ▪ ▪ Two Cisco RV220W APs At least version 1.0.6.6 and up firmware A PC to connect to and configure the web-based interface You will also need the following parts of this guide: ▪ ▪ ▪ Section 3.1, Hostnames Section 10.2.1, MDM Setup Section 7.1, Cisco Identity Services Engine 8.1.1 Cisco RV220 AP Setup We assume that you have a functional internet connection via Ethernet. 1. Connect the Ethernet cable from the internet to the wide area network (WAN) port of the RV220W. 2. Connect one end of a different Ethernet cable to one of the local area network (LAN)(Ethernet) ports on the back of the unit. 3. Connect the other end to an Ethernet port on the PC that will be used to run the web-based device manager. 4. Connect the power line and turn on the power switch. More detailed procedures for installing the Cisco® RV220W Network Security Firewall are available from the Cisco installation guide at administration/guide/rv220w_ag_78-19743.pdf. 8.1.2 Post-Setup Tasks 1. Use a PC to connect to a LAN port of the Cisco RV220W. If Dynamic Host Configuration Protocol (DHCP) is enabled, the PC should receive an IP address, and the PC becomes a DHCP client of the RV220W.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services say about Appendix D. Applying the PNT Profile to Cybersecurity Risk Management? (Part 1) According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services, Appendix D. Applying the PNT Profile to Cybersecurity Risk Management: Appendix D. Applying the PNT Profile to Cybersecurity Risk Management The PNT Profile can be used to augment an organization's pre-existing risk management program. This section further tailors the PNT Profile in context of a few notional fault scenarios to illustrate how the guidance can be applied to assess and manage PNT related risks in the context of a loss or degradation of PNT data or services. Organizations using the PNT data have the responsibility for mitigating temporary PNT disruptions . An effective PNT risk management strategy provides a dynamic and flexible approach to control risks in evolving environments. A comprehensive risk management strategy requires proper preparation, which is further detailed in Appendix E. Organizations are encouraged to apply the PNT Profile with their risk management approach from concept to acquisitions to acceptance, integration, and deployment, to operations and maintenance. Leveraging the organization's existing risk management program enables a system-level shared context. Furthermore, setting priorities for privacy and security risk management affords additional assurance from component to system implementation. Each organization selects PNT Profile Subcategories, the cybersecurity outcomes relevant to their mission and business objectives and implements associated controls proportional to their risk exposure. The organization verifies and validates the implementation throughout the PNT system lifecycle. A PNT system lifecycle can include the consideration of the acquisition, integration, deployment, operations and maintenance, repair, and replacement of PNT components and services. A comprehensive, well-documented, and disciplined risk management process for PNT systems allows for continuous monitoring of threats, likelihoods, and impacts, in order to provide efficient identification and analysis of risks and effectiveness of the controls applied to manage those risks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Note according to Engineering Trustworthy Secure Systems? Note: Vulnerability can exist in anywhere throughout the life cycle of a system, such as in the CONOPS, procedures, processes, requirements, design, implementation, utilization, and sustainment of the system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to SIMfill Use and Development say about 6. Code Modifications? (Part 1) According to Guide to SIMfill Use and Development, 6. Code Modifications: 6. Code Modifications SIMfill can be modified by users to fit their specific needs. The java classfiles are included in the distribution. They can also be studied to gain further insight into SIMfill's operation. The key components of SIMfill are listed in Figure 15. Note that modifications made to the code may also require changes to the schema definitions and reference test data. Table 2: Key SIMfill Components | Identifier | Component | |---------------------|------------------------------------------------------------------------------------------| | com.simfill.gui | The classes for the model, controller, and view components comprising the user interface | | com.simfill | The classes for the registry and the parser thread | | com.simfill.SimFill | The entry point of the application | | com.simfill.PCSC | The PC/SC abstraction layer | | com.simfill.gsm | The classes for internal data objects | One foreseeable change is to have SIMfill support an EF directly as a named EF, such as those shown in Table 1, in lieu of using the generic EF, RAW, which is identified and populated through its16-bit file identifier. To make such a change, several steps are required. The first step is to define the schema description for the new XML data entry, using the W3C conventions. Updating the XML schema file, data.xsd, with that definition allows an XML file containing the new data to be created and validated, and sets the foundation for the remaining steps. The second step is to add new states to the parsing automaton embodied in the DataXMLHandler class.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to SIMfill Use and Development.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways provide? (Section 12) | | Brian Williams | VMware | The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register. Respondents with relevant capabilities or product components were invited to sign a Cooperative Research and Development Agreement (CRADA) with NIST, allowing them to participate in a consortium to build this example solution. We worked with: | Technology Partner/Collaborator | Build Involvement | |-----------------------------------|---------------------------------------------------------------------------| | Cisco | Cisco Firepower Threat Defense (FTD) Cisco Identity Services Engine (ISE) | | Eclypsium | Eclypsium Administration and Analytics Service | | Forescout | Forescout Platform | | IBM | IBM Code Risk Analyzer IBM MaaS360 with Watson | | Lookout | Lookout Mobile Endpoint Security | | Microsoft | Microsoft Endpoint Configuration Manager | | Tenable | Nessus Tenable.io Tenable.sc | | VMware | VMware vRealize Automation SaltStack Config | The terms 'shall' and 'shall not' indicate requirements to be followed strictly to conform to the publication and from which no deviation is permitted.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 say about MISCELLANEOUS PUBLICATIONS AND WEBSITES? (Part 1) According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171, MISCELLANEOUS PUBLICATIONS AND WEBSITES: MISCELLANEOUS PUBLICATIONS AND WEBSITES - [DOD ACQ] Department of Defense , Defense Acquisition University (2020) , DAU Glossary of Defense Acquisition Acronyms and Terms. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | [GAO 19-128] | U.S. Government Accountability Office (2018) Weapons Systems Cybersecurity: DOD Just Beginning to Grapple with Scale of Vulnerabilities. (GAO, Washington, DC), Report to the Committee on Armed Services, U.S. Senate, GAO 19-128. | |----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [NARA CUI] | National Archives and Records Administration (2019) Controlled Unclassified Information (CUI) Registry . https://www.archives.gov/cui | | [NIST CSF] | National Institute of Standards and Technology (2018) Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1. (National Institute of Standards and Technology, Gaithersburg, MD). https://doi.org/10.6028/NIST.CSWP.04162018 | | [NIST TRUST] | National Institute of Standards and Technology (2019) Roots of Trust Project .

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways? (Part 21) Control AM-1: ts. Our implementation of Lookout MES was integrated with IBM MaaS360. Lookout MES shared custom device attributes, such as device threat, with MaaS360, which could in turn provide policy enforcement. The Lookout for Work mobile client was able to provide firmware and application vulnerability assessment for mobile endpoints. Administrators could use Lookout to see which vulnerabilities were affecting deployed endpoints and find risk grades (i.e., A, B, C, D, or F) for installed applications. ## 4.2.8 Microsoft Endpoint Configuration Manager Microsoft Endpoint Configuration Manager was used in this build to perform configuration management, including software and firmware patching, for Windows-based hosts. Our implementation of Endpoint Configuration Manager included Windows Server Update Services (WSUS), an update service primarily used for downloading, distributing, and managing updates for Microsoft Windowsbased systems. The example build used Microsoft Endpoint Configuration Manager to demonstrate the identification of endpoints utilizing Heartbeat discovery and Windows Domain discovery methods, the patching of Windows endpoints via Microsoft updates and third-party update sources, and the deployment of custom scripts to endpoints. ## 4.2.9 Tenable.io In the example build, Tenable.io was used to provide vulnerability scanning and reporting for Docker container images. Containers are built from images and vulnerabilities are patched in images, not deployed containers, so images are the focus of scanning. Tenable.io scanned the repository of a Red Hat OpenShift cluster in the lab environment. Tenable.io was scheduled to routinely pull the latest images from the OpenShift cluster and perform vulnerability scans on them. Scan information was reported in the container security section of the Tenable.io Web Console. Administrators could see vulnerability information for containers deployed in their respective networks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio say about 3.1.2. Risk Appetite and Risk Tolerance? (Part 2) According to Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio, 3.1.2. Risk Appetite and Risk Tolerance: defined at the enterprise level and risk tolerance at the enterprise or organization level, risk appetite is interpreted at the organizational and system levels to develop specific ICT risk tolerance. Risk tolerance represents the specific level of risk deemed acceptable within the risk appetite set by senior leadership (while recognizing that such tolerance can be influenced by legal or regulatory requirements). 11 Risk tolerance is interpreted and applied by the receiving custodians of the risk management discipline (e.g., cybersecurity, financial, legal, privacy) at the organization or system level. Risk appetite and risk tolerance are related but distinct in a similar manner to the relationship between governance and management activities. Risk appetite statements define the overarching risk guidance, and risk tolerance statements define the specific application of that direction. This means that risk tolerance statements are always more specific than the corresponding risk appetite statements. Together, risk appetite and risk tolerance statements represent risk limits, help communicate risk expectations, and improve the focus of risk management efforts. They also help to address other factors, such as findings from internal audits or external reports. The definition of these risk parameters places the enterprise in a better position to identify, prioritize, treat, and monitor risks that may lead to unacceptable loss. Risk tolerance should always stay within the boundaries established by senior leadership and within the parameters of and informed by legal and regulatory requirements.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is FR according to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)? FR: 6.60 The CKMS design shall specify how, and the circumstances under which, keys and metadata can be output from a cryptographic module and the form in which they are output.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Information Security Handbook_ A Guide for Managers provide? (Section 230) -----|------------| | 5. Budget and Resources Are information security resources (internal FTEs and funding) allocated to protect information and information systems in accordance with assessed risks? | | | | | | | | 6. Systems and Projects Inventory Are IT projects and systems identified in an inventory and is the information about the IT projects and systems relevant to the investment management process? Is there an inventory of systems as required by FISMA? | | | | | | | | 7. IT Security Metrics Are IT security metrics collected agency-wide and reported? | | | | | | | | 8. Enterprise Architecture and the Federal Enterprise Architecture Security and Privacy Profile Are system- and enterprise-level information security and privacy requirements and capabilities documented within the agency's Enterprise Architecture? Is that information used to understand the current risks to the agency's mission? Is that information used to help program and agency executives select the best security and privacy solutions to enable the mission? 74 | | | | | | | | 9. Critical Infrastructure Protection Plan If required in your agency, is there a documented critical infrastructure and key resources protection plan that meets the requirements of HSPD-7 | | | | | | | | 10. Life Cycle Management Is there a system life cycle management process that requires each system to be C&A?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does De-Identifying Government Datasets_ Techniques and Governance say about Table of Contents? (Part 10) According to De-Identifying Government Datasets_ Techniques and Governance, Table of Contents: | | 5.2.3. Data | 73 | 5.2.3. Data | 5.2.3. Data | | 5.3. Evaluating De-Identifcation | 74 | 5.3. Evaluating De-Identifcation | 5.3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: De-Identifying Government Datasets_ Techniques and Governance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Data Integrity_ Recovering from Ransomware and Other Destructive Events provide? (Section 20) assumes that IT professionals have experience implementing security products within the enterprise. While we used a suite of commercial products, this guide does not endorse these particular products. Your organization can adopt this solution or one that adheres to these guidelines in whole, or you can use this guide as a starting point for tailoring parts of it to recover from attacks on DI. Your organization's security experts should identify the products that will best integrate with your existing tools and IT system infrastructure. We hope you will seek products that are congruent with applicable standards and best practices. Section 3.5, Technologies, lists the products we used and maps them to the cybersecurity controls provided by this reference solution. A NIST Cybersecurity Practice Guide does not describe 'the' solution, but a possible solution. This is a draft guide. We seek feedback on its contents and welcome your input. Comments, suggestions, and success stories will improve subsequent versions of this guide. Please contribute your thoughts to ds-nccoe@nist.gov. The following table presents typographic conventions used in this volume. | Typeface/ Symbol | Meaning | Example | |--------------------|------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------| | Italics | filenames and pathnames references to documents that are not hyperlinks, new terms, and placeholders | For detailed definitions of terms, see the NCCoE Glossary. | | Bold | names of menus, options, command buttons and fields | Choose File > Edit .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information provide? (Section 11) ll likely need to integrate with one or both of these technologies. As agencies around the country begin to implement MFA solutions, the approaches they use require careful consideration and planning. This document provides a general overview of MFA, outlines design principles and architecture considerations for implementing MFA to protect CJI, and offers specific examples of use cases that agencies face today. It also outlines how CAD/RMS and message switch technologies can support standards and best practices that provide agencies with maximum optionality to implement MFA in a way that promotes security, interoperability, usability, and cost savings. Credential compromises represent a critical and pervasive cybersecurity threat, serving as a gateway for malicious actors to infiltrate networks and systems, thus gaining access to sensitive data. Whether through phishing, brute-force attacks, or exploiting vulnerabilities in authentication mechanisms, credential compromise poses a significant risk to organizations and individuals alike. To mitigate this threat, version 5.9.2 and subsequent versions of the Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Security Policy [1] require multi-factor authentication (MFA) for all users when accessing criminal justice information (CJI). Both criminal and non-criminal justice agencies that receive CJI are subject to this requirement. In this document, we refer to these organizations generically as agencies . As agencies around the country begin to implement this requirement, they face several challenges that require careful consideration and planning. The purpose of this document is to help agencies identify and address their MFA implementation needs by providing insight into MFA architectures and how they can be used to meet law enforcement-specific use cases.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways provide? (Section 51) er to prompt Tenable to scan devices newly connected to the network. Cisco ISE could then ingest this scan data to find the Common Vulnerability Scoring System (CVSS) scores of device vulnerabilities. An ISE policy was written to apply a quarantine action, via SGTs, to any device with a CVSS score equal to or greater than 7 (corresponding to high and critical vulnerabilities). -  Cisco pxGrid was configured to share contextual information about authenticated devices to the firewall. Cisco ISE was utilized to apply SGTs to devices as they were assessed for vulnerabilities. These SGTs were then passed to the lab firewall via pxGrid, where they could be used in custom firewall rules. pxGrid was also used to share communications between Forescout and Cisco ISE. Forescout could apply a quarantine tag to observed devices, which would then be shared with ISE. In this build, we utilized Eclypsium Administration and Analytics Service to provide agent-based identification of hardware and firmware for our laptop, desktop, and server endpoints while also monitoring the firmware for vulnerable or end-of-life versions. Eclypsium monitored laptop and virtual machine (VM) firmware integrity, and alerted if a component or its associated firmware changed. It also monitored endpoints for known security vulnerabilities from out-of-date firmware. Finally, we utilized Eclypsium's beta firmware update script, which automatically finds the latest known Basic Input/Output System (BIOS) firmware version for the system, downloads the update, and executes it to update the BIOS. In this build the Forescout platform was configured to perform endpoint discovery by detecting endpoints and determining software information about those endpoints based on a set of attributes. Forescout also provided the capability to isolate or restrict assets that cannot be patched and to respond to emergency scenarios, such as providing an emergency mitigation or deploying an emergency patch.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-140 in Computer Security Division 2003 Annual Report? (Part 37) Control PS-140: June 2003 | | NIST IR 6981 | Policy Expression and Enforcement for Handheld Devices | May 2003 | | NIST IR 6985 | COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) | April 2003 | ## INFORMATION TECHNOLOGY LABORATORY BULLETINS WRITTEN BY THE CSD | October 2002 | Security Patches And The CVE Vulnerability Naming Scheme: Tools To Address Computer System Vulnerabilities | |----------------|--------------------------------------------------------------------------------------------------------------| | November 2002 | Security For Telecommuting And Broadband Communications | | December 2002 | Security of Public Web Servers | | January 2003 | Security Of Electronic Mail | | February 2003 | Secure Interconnections for Information Technology Systems | | March 2003 | Security For Wireless Networks And Devices | | June 2003 | ASSET: Security Assessment Tool For Federal Agencies | | July 2003 | Testing Intrusion Detection Systems | | August 2003 | IT Security Metrics | <!-- image --> ## GUEST RESEARCH INTERNSHIPS AT NIST O pportunities are available at NIST for 6 to 24 month internships within the CSD.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Computer Security Division 2003 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Status Report on the First Round of the NIST Post-Quantum Cryptography Standardization Process provide? (Section 48) stablishment Schemes Using Integer Factorization Cryptography, National Institute of Standards and Technology, Gaithersburg, Maryland, September 2014, 121pp. https://doi.org/10.6028/NIST.SP.800-56Br1 | | [4] | NIST Workshop on Cybersecurity in a Post-Quantum World, National Institute of Standards and Technology, Gaithersburg, Maryland, April 2-3, 2015, Post-Quantum-World. | | [5] | L. Chen, S. Jordan, Y.K. Liu, D. Moody, R. Peralta, R. Perlner, D. Smith- tone, Report on Post-Quantum Cryptography , NISTIR 8105, National Institute of Standards and Technology, Gaithersburg, Maryland, April 2016, 10pp. | | [6] | D. Moody, Post-Quantum Cryptography Standardization: Announcement and outline of NIST's Call for Submissions , PQCrypto 2016, Fukuoka, Japan, February 24-26, 2016, NIST-s-Call-for-Submis. | | [7] | 'Post-Quantum Cryptography: Proposed Requirements and Evaluation Criteria,' 81 Federal Register 50686 (August 2, 2016), pp. 50686-50687. https://federalregister.gov/a/2016-18150. | | [8] | 'Announcing Request for Nominations for Public-Key Post-Quantum Cryptographic Algorithms,' 81 Federal Register 92787 (December 20, 2016), pp. 92787-92788. https://federalregister.gov/a/2016-30615. | | [9] | 'Establishment of NIST Smart Grid Advisory Committee and Solicitation of Nominations for Members,' 75 Federal Register 7 (January 12, 2010), pp. | | | 1595-1596. https://federalregister.gov/a/2010-344 [accessed 2/25/14]. | |------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [10] | U.S. Department of Commerce.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the First Round of the NIST Post-Quantum Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Information Technology Security Services say about 4. IT Security Services Life Cycle? (Part 1) According to Guide to Information Technology Security Services, 4. IT Security Services Life Cycle: 4. IT Security Services Life Cycle The IT security services life cycle provides IT security decision makers and managers with a six-phase process by which they can select, implement, and manage IT security services. This chapter details the various life-cycle phases and the issues and decisions within each phase. As Figure 4-1 illustrates, the security services life cycle has both a linear and iterative component. It proceeds linearly from initiation to implementation to closeout, but the assessment, solution, and operations phases must continually occur for an IT security service to succeed. Figure 4-1. IT Security Services Life Cycle <!-- image --> The six phases are described as follows: -  Phase 1: Initiationthe need to initiate the services life cycle is recognized. Section 4.1 discusses potential triggers for this phase. -  Phase 2: Assessmentbefore decision makers can implement a service and select a service provider, an accurate portrait of the current environment must be developed. Section 4.2 discusses Phase 2 and the importance of creating and gathering appropriate metrics. -  Phase 3: Solutiondecision makers choose the appropriate solution from the viable options identified during the assessment phase. Section 4.3 discusses the business cases and implementation plans. -  Phase 4: Implementationthe service and service provider are implemented during the implementation phase. Section 4.4 guides decision makers through service agreement development and service implementation. -  Phase 5: Operationsthe service is operational, the service provider is fully installed, and constant assessment of the service level and performance is made. Section 4.5 discusses the importance of metrics in monitoring service level and performance. -  Phase 6: Closeoutthe environment changes, the need for the service diminishes, or performance deficiencies are noted necessitating a replacement or termination of the IT security service.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide to Information Technology Security Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events say about 4.1.1 High-Level Architecture? (Part 1) According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events, 4.1.1 High-Level Architecture: 4.1.1 High-Level Architecture The DI solution is designed to address the security Functions and Subcategories described in Table 3-1 and is composed of the capabilities illustrated in Figure 4-1. Figure 4-1 DI Detect & Respond High-Level Architecture <!-- image --> - Integrity monitoring provides capabilities for comparing current system states against established baselines. . - Event detection provides capabilities for detecting ongoing events and can be composed of intrusion detection, malware detection, user anomaly detection, and others, depending on the established threat model of the organization. - L ogging records and stores all the log files produced by components within the enterprise. - Forensics/analytics provides the capability to probe/analyze logs and machines within the enterprise to learn from DI events. - Mitigation and containment allows responding to DI events by containing and limiting the threat's ability to affect the system. - Reporting provides the capability to report on all activities within the enterprise and within the reference architecture for analysis by a security team. These capabilities work together to provide the Detect and Respond Functions for DI. The integrity monitoring capability collects integrity information prior to attacks so that when an attack happens, records of all file/system changes are preserved. In combination with event detection, these records not only function as a tool to inform recovery but also as early indicators of compromise. Event detection uses these records and its own mechanisms to actively detect events as they happen and to take appropriate action through other components of the reference architecture. Logging collects information from event detection and integrity monitoring for use in response functions. Mitigation and containment provides capabilities to stop ongoing attacks and limit their effect on the system.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development” say about The use of robust frameworks and the adoption of open standards are crucial for effectively managing risks across heterogeneous environments.? According to Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”, The use of robust frameworks and the adoption of open standards are crucial for effectively managing risks across heterogeneous environments.: Throughout the workshop, the importance of established frameworks and open standards was discussed as beneficial to enhancing IoT security and reducing threats. Real-world examples showcased how these tools can effectively mitigate cybersecurity threats while considering interactions between mitigations and device properties. It was noted that there are emerging examples of standards organizations using threat frameworks to discuss risk management. Open standards were discussed as crucial in fostering interoperability and resilience, particularly within OT and ICS environments. Participants underscored the value of standards in making vulnerability advisories more actionable through enhanced communication across various systems. The need for clear, informative references and robust use case examples was also highlighted, emphasizing their role in clarifying specific points and supporting industry best practices. As topics of discussion, privacy compliance and risk management emerged as important yet distinct areas of focus. The discussions noted the challenges in defining authority for privacy and managing privacy risks and the value of frameworks such as the NIST Privacy Framework to address these challenges. Additionally, there was a recognized need for a product baseline and specific security controls at varying levels to enhance overall cybersecurity efforts. Participants noted that clear and direct communication, along with formalized sections within documents, would further support the effective implementation of best practices and ensure a comprehensive approach to cybersecurity.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Summary Report for “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development”.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2004 Annual Report say about INFORMATION TECHNOLOGY LABORATORY BULLETINS WRITTEN BY THE CSD? According to Computer Security Division 2004 Annual Report, INFORMATION TECHNOLOGY LABORATORY BULLETINS WRITTEN BY THE CSD: | October 2003 | Information Technology Security Awareness, Training, Education, and Certification | |----------------|------------------------------------------------------------------------------------------------------------------------------------------| | November 2003 | Network Security Testing | | December 2003 | Security Considerations in the Information System Development Life Cycle | | January 2004 | Computer Security Incidents: Assessing, Managing, And Controlling The Risks | | March 2004 | Federal Information Processing Standard (FIPS) 199, Standards For Security Categorization Of Federal Information And Information Systems | | April 2004 | Selecting Information Technology Security Products | | May 2004 | Guide For The Security Certification And Accreditation Of Federal Information Systems | | June 2004 | Information Technology Security Services: How To Select, Implement, And Manage | | July 2004 | Guide For Mapping Types Of Information And Information Systems To Security Categories | | August 2004 | Electronic Authentication: Guidance For Selecting Secure Techniques | | September 2004 | Information Security Within the System Development Life Cycle | February 2004 April 04 August 04 December 03

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2004 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) provide? (Section 20) This Directive established a federal policy to create and use government-wide secure and reliable forms of identification for federal employees and contractors. It further defined secure and reliable forms of identification as ones that - -  Are issued based on sound criteria for verifying an individual's identity; -  Are strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation; -  Can be rapidly authenticated electronically; and -  Are issued only by providers whose reliability has been established by an official accreditation process. NIST developed and published Federal Information Processing Standard (FIPS) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, and several Special Publications providing additional specifications in response to [HSPD-12]. These documents provide the foundation for Government personal identification, verification, and access control systems. Appendix A.1 of FIPS 201-2 states the following: '…[HSPD-12] requires that all cards be issued by providers whose reliability has been established by an official accreditation process.' To determine consistency in operations of issuers of PIV Cards, NIST developed a set of attributes as the basis of reliability assessment and published the first version of this document in July 2005. Subsequent lessons learned in various agencies' implementation, experience in credential management and PIV Card issuance together with the evolution of PIV Card issuing organizations motivated NIST to develop an updated methodology that is objective, efficient, and resulted in a consistent and repeatable authorization decisions. These developments led NIST to publish the first revision to SP 800-79 (i.e., SP 800-79-1) in June 2008. In 2013, FIPS 201 was superseded by FIPS 201 revision 2 (FIPS 201-2). FIPS 201-2 incorporates additional lessons learned from PIV Card issuers and allows for mobile device-integrated PIV credentials.

Explanation: NIST publication on credential and access management. Topics: access control, authorization, credential management. Contains security framework guidance for authentication systems. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Operational Technology (OT) Security provide? (Section 288) s can manipulate OT processes to cause physical damage. Table 21 provides an overview of potential OT threat events and leverages MITRE’s ATT&CK® for Industrial Control Systems [ATTACK-ICS]. Table 21. Examples of potential threat events Threat Event Denial of control Manipulation of control Spoofed reporting message Theft of operational information Description Temporarily prevents operators and engineers from interfacing with process controls. An affected process may still be operating during the period of control loss but not necessarily in a desired state. Unauthorized changes made to programmed instructions in PLCs, RTUs, DCS, or SCADA controllers, alarm thresholds changed, or unauthorized commands issued to control equipment. These changes could potentially result in damage to equipment (if tolerances are exceeded), premature shutdown of processes (e.g., prematurely shutting down transmission lines), an environmental incident, or even disabled control equipment. False information sent to an OT system operator, either for evasion or to impair process control. The adversary could make the defenders and operators think that other errors are occurring in order to distract them from the actual source of the problem (i.e., alarm floods). Adversaries may steal operational information for personal gain or to inform future operations. 179 NIST SP 800-82r3 September 2023 Threat Event Loss of safety Loss of availability Guide to Operational Technology (OT) Security Description Adversaries may target and disable safety system functions as a prerequisite to subsequent attack execution or to allow future unsafe conditionals to go unchecked. Adversaries may leverage malware to delete or encrypt critical data on HMIs, workstations, or databases. Numerous OT incidents have been reported and documented. Descriptions of these events help demonstrate the severity of the threat sources, vulnerabilities, and impacts within the OT domain.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, adversary. Contains technical security guidance that could inform defensive posture. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Software Asset Management say about 2.6.1 Process for Identifying Needed Controls? (Part 1) According to Automation Support for Security Control Assessments_ Software Asset Management, 2.6.1 Process for Identifying Needed Controls: 2.6.1 Process for Identifying Needed Controls In Volume 1 of NISTIR 8011, Section 3.5.2, Tracing Security Control Items to Capabilities, describes the process used to determine the controls needed to support a capability. In short, the two steps are: 1. Use an automated keyword search of the control text to identify control items that might support the capability. See keyword rules used for SWAM in Appendix B. 2. Manually identify those that do support the capability (true positives) and ignore those that do not (false positives). Completion of the above two steps produces three sets of controls: 1. Control items in the low, moderate, and high baselines that support the SWAM capability (listed individually in Section 3.3 on SWAM Control (Item) Security Assessment Plan Narrative Tables and Templates, and listed by security baseline in Section 3.4 on Control Allocation Tables). 2. Control items in the low, moderate, and high baselines selected by the keyword search, but manually determined to be false positives (listed in Appendix C). 20 A risk scoring methodology is necessary to score and prioritize defects but risk scoring is out of scope for this publication. 3. Control items not in a baseline, and not analyzed further after the keyword search, including: - a. Program management (PM) controls, because PM controls do not apply to individual systems; - b. Not selected controls-controls that are in SP 800-53 but are not assigned to (selected in) a baseline; and - c. Privacy controls. The unanalyzed controls are listed in Appendix D, in case the organization wants to develop automated tests. To implement whitelisting/blacklisting in general, and software whitelisting/blacklisting in particular, SWAM may rely on some other capabilities. The controls that support whitelisting and blacklisting are not included in SWAM if the supporting controls are more central to the other capability.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Public Laws according to NIST Security Architecture Design Process for Health Information Exchanges (HIEs) According to Security Architecture Design Process for Health Information Exchanges (HIEs), Public Laws: Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996, August 21, 1996. Public Law 107-347, E-Government Act of 2002 (Title III: Federal Information Security Management Act [FISMA] of 2002), December 17, 2002. Public Law 111-5, American Recovery and Reinvestment Act of 2009 (ARRA) (Title XIII, Health Information Technology for Economic and Clinical Health [HITECH] Act of 2009), February 17, 2009.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Architecture Design Process for Health Information Exchanges (HIEs).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Control Baselines for Information Systems and Organizations say about 3.13 PROGRAM MANAGEMENT FAMILY? (Part 2) According to Control Baselines for Information Systems and Organizations, 3.13 PROGRAM MANAGEMENT FAMILY: | | | | PM-2 | Information Security Program Leadership Role | | | | | | PM-3 | Information Security and Privacy Resources | x | | | | | PM-4 | Plan of Action and Milestones Process | x | | | | | PM-5 | System Inventory | | | | | | PM-5(1) | INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION | x | | | | | PM-6 | Measures of Performance | x | | | | | PM-7 | Enterprise Architecture | x | | | | | PM-7(1) | OFFLOADING | | | | | | PM-8 | Critical Infrastructure Plan | x | | | | | PM-9 | Risk Management Strategy | x | | | | | PM-10 | Authorization Process | x | | | | | PM-11 | Mission and Business Process Definition | x | | | | | PM-12 | Insider Threat Program | | | | | | PM-13 | Security and Privacy Workforce | x | | security | | | PM-14 | Testing, Training, and Monitoring | x | | | | | PM-15 | Security and Privacy Groups and Associations | | |

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Control Baselines for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to IPsec VPNs say about C.4 Section 9.1 Case Study Alternative Using iked on OpenBSD? According to Guide to IPsec VPNs, C.4 Section 9.1 Case Study Alternative Using iked on OpenBSD: The following lists the contents of the same configuration that was provided for Appendix C.1 but using OpenIKED on OpenBSD. Note that this IKE daemon does not support AES-GCM for IKE, only for ESP. The order of the keywords matter. ```

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to IPsec VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does De-Identifying Government Datasets_ Techniques and Governance provide? (Section 91) edge of statistics and computation techniques. Agencies can rely on de-identification standards to provide standardized terminology, procedures, and performance criteria for de-identification efforts. Agencies can adopt existing de-identification standards or create their own. De-identification standards can be prescriptive or risk-based. De-identification standards assist agencies with the process of de-identifying data prior to public release. Without standards, data owners may be unwilling to share data, as they may be unable to assess whether a procedure for de-identifying is sufficient to minimize privacy risk. Standards can increase the availability of individuals with appropriate training by identifying a specific body of knowledge and practice that training should address. Absent standards, agencies may forego opportunities to share data. De-identification standards can help practitioners develop a community, as well as certification and accreditation processes. Standards decrease uncertainty and provide data owners and custodians with best practices to follow. Courts can consider standards as acceptable practices that should generally be followed. In the event of litigation, an agency can point to the standard and say that it followed good data practice. A prescriptive de-identification standard specifies an algorithmic procedure that - if followed - results in data that are de-identified to a previously established benchmark. This approach focuses on the process of de-identification rather than on the specific properties of the de-identified data. The Safe Harbor method of the HIPAA Privacy Rule [3] is an example of a prescriptive deidentification standard. The intent of the Safe Harbor method is to 'provide covered entities with a simple method to determine if the information is adequately de-identified' [118].


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cell Phone Forensic Tools_ an Overview and Analysis say about Report Generation? According to Cell Phone Forensic Tools_ an Overview and Analysis, Report Generation: After a successful acquisition has taken place the examiner then has the opportunity to create a customized report of findings that pertain to the case. To finalize the report, the export option is selected, which allows specific data fields to be incorporated into the report. Figure 78 gives a snapshot of the Report Wizard that allows examiners to select the data fields for the finalized report. Figure 78: Report Wizard <!-- image --> The examiner has the choice of exporting the final report in the formats illustrated below in Figure 79. Figure 79: Report Output Type <!-- image --> Figure 80 and Figure 81 are snapshots of the final generated report. Figure 80: Report Excerpt <!-- image --> Figure 81: Report Excerpt <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.