You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is NOTICE according to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities? NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Guidelines for Storage Infrastructure say about 3.3.1 Physical Access? (Part 2) According to Security Guidelines for Storage Infrastructure, 3.3.1 Physical Access: twork ports, and management workstations. Communication cables are also a vulnerability. A sophisticated attacker can potentially tap into the storage communication by physically accessing the cables. Another physical access method involves replacing peripheral components, such as the keyboard and mouse, with infected components (e.g., infiltrating an infected keyboard that includes a 'keylogger' component that transmits sensitive data, such as usernames and passwords, or infects the system with malware).

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware. Contains technical security guidance that could inform defensive posture. Source: Security Guidelines for Storage Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Criticality Analysis Process Model_ Prioritizing Systems and Components say about Executive Summary? (Part 2) According to Criticality Analysis Process Model_ Prioritizing Systems and Components, Executive Summary: , criticality analysis is referenced in several NIST special publications including those addressing risk management, system security engineering, and supply chain risk management. The Model references and uses the outputs and artifacts of risk management, information security, project management, system design, safety, privacy, and other activities that an organization may already be performing. To reduce potential redundancy and duplication, the Model identifies integration points with these existing processes. The Criticality Analysis Process Model is structured to logically follow how organizations design and implement projects and systems and can be adapted to fit organizations' unique practices. The Model consists of five main processes: - A. Define Criticality Analysis Procedure(s) where the organization develops or adopts a set of procedures for performing a criticality analysis. - B. Conduct Program-Level Criticality Analysis where the program manager defines, reviews, and analyzes the program to identify key activities that are vital to reaching the objectives of the program and for reaching the overall goals of the organization. - C. Conduct System/Subsystem-Level Criticality Analysis where the system designer reviews and analyzes the system or subsystem from the point of view of its criticality to the overall organizational goals. - D. Conduct Component/Subcomponent-Level Criticality Analysis where the system or component engineer reviews and analyzes component or subcomponent from the point of - view of its criticality to a specific system or subsystem of which these components and subcomponents are a part. - E. Conduct Detailed Review of Criticality for Processes B, C, and D where the program manager or a collaborative group analyzes baseline criticality analysis results to create final criticality levels for Systems/Subsystems and Components/Subcomponents.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Criticality Analysis Process Model_ Prioritizing Systems and Components.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2014 Annual Report? (Part 214) Control HA-3: Questions Federal Acquisition Regulation | ICT | Information and Communications Technol- ogies | | FBI FCCX | Federal Bureau of Investigation Federal Cloud Credential Exchange | IEEE | Institute of Electrical and Electronics Engineers | | FDCC FedRAMP | Federal Desktop Core Configuration Federal Risk and Authorization | INCITS | InterNational Committee for Information Technology Standards | | FHE | Management Program | IP | Internet Protocol Internet Protocol Version 6 | | | fully homomorphic encryption | IPv6 | | | FIPS | Federal Information Processing Standard Forum of Incident Response and Security | IR | Interagency or Internal Report Internet Service Provider | | FIRST | Teams | ISP IT | information technology | | FirstNet | First Responder Network Authority | ITL | Information Technology Laboratory | | | Federal Information Security Management | IUT | Implementation under test | | FISMA FISSEA | Act Federal Information Systems Security | IV&V ISPAB | Independent Verification and Validation Information Security and Privacy Advisory | | FITSI FPE | Federal IT Security Institute format-preserving encryption | ISIMC | Information Security and Identity Management Committee's | | FVAP | Federal Voting Assistance Program | ISO | International Organization for Standardization

Explanation: NIST publication on credential and access management. Topics: authorization, identity management. Contains security framework guidance for authentication systems. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS) provide? (Section 167) ther. - a. It should be made clear that a subject can be trusted (even partially) only^if it is started in a known state, e.g., at a specified entry point, with specified initial values for some data. Except that a trusted subject is itself very analogous to an entire trusted system (or vice versa) and thus might be usefully modelled in terms of secure initial states and security-preserving state transformations this principle doesn't seem to fit too well into, say, the original Bell & La Padula model [Bell75] ; it may call for some additional rules in the model in a B2 or higher class system. In any case, one might have to explicitly define a trusted subject as an entity that has more internal structure (e.g, the code it is to execute) than the uninterpreted subjects of the original Bell & La Padula model - b. A system that enforces the Biba model has what on first glance appears to be an inherent complication: any data, including the executing code that a subject reads must have an integrity label that is a superset (dominates) either of the subject's labels. Thus, for instance, any code or data (other than any in the output GDI's) that a transaction to be run in, say, "cashier role" needs to access must contain "cashier role" in its label. On second glance this actually makes sense: such a transaction is certified to operate properly only if it takes data from a cashier and no-one else; any data that does not contain the "cashier role" marking could have been modified (supplied by) some other kind of person. (Note that "operates properly" here includes the notion that it is inherently improper for a transaction to accept data from anyone other than one of its authorized users.) In any system there are large portions of software and read-only data that a transaction program needs to use and can in general rely on since they are supplied by the manufacturer and "certified" through use.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Notional Supply Chain Risk Management Practices for Federal Information Systems say about 3.2.6 Operational Contract Execution? (Part 1) According to Notional Supply Chain Risk Management Practices for Federal Information Systems, 3.2.6 Operational Contract Execution: 3.2.6 Operational Contract Execution Once a system becomes operational, the operating environment may change. Changes include, but are not limited to, suppliers, elements, delivery processes, and business processes. These changes may alter, add, or reduce ICT supply chain risks. During operations, acquirers should continue to perform ICT SCRM, including the assessment of foundational enterprise practices. The acquirer will need to ensure that the integrator or supplier understands supply chain risk and provides information on applicable changes to the element, environment, vulnerabilities, and patches on an ongoing basis. The following activities will help the acquirer maintain supply chain oversight and improve processes for future procurements: - Collect, analyze, record, and disseminate ICT SCRM lessons learned within the project and within the larger organization(s). This information will help enhance immediate project performance and provide input into the enterprise ICT SCRM process; - Collect information on whether the trade-offs that were made during the procurement with regards to mitigating ICT supply chain risks substantially increased that risk; - Identify gaps that were not addressed in past projects and how they can be filled; - Monitor and periodically (or continuously if appropriate) reevaluate changes in the risk environment that impact the supply chain including technology innovation, operational environment, regulatory environment, etc. Respond to change where appropriate through modifying ICT SCRM requirements or if needed, modifying relationships with integrators or suppliers. Note: (1) Use information as available, including information from commercial sources, U.S. government agencies, and intelligence information as appropriate.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Notional Supply Chain Risk Management Practices for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived Personal Identity Verification (PIV) Credentials provide? (Section 83) _\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Standards (PKCS) #10 format over PKIX-CMP. The Entrust Datacard Managed CA returns the signed DPC certificate to the Entrust IdentityGuard service. Issuing the DPC in this test scenario is based upon the subscriber's ownership of a PIV credential and DPC eligibility. In this example solution, the MyID CMS fulfills the role of a PIV Card issuer, a prerequisite to enrollment for a DPC, having been configured with profiles that were compatible with the test PIV Cards used in the example implementation. Next, we uploaded test PIV identities to the MyID CMS through a specialized application that included required PIV data to be stored on the card. An Issue Card workflow completed the PIV issuance within the MyID Desktop administrative console. PIV holders were eligible for a Derived PIV when the identities were mapped to a local MyID group. See Figure 5-9 for a screenshot of the test PIV Card user. Figure 5-9 Test PIV Card User <!-- image --> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ The DPC issuance process begins with a DPC applicant using the PKI-AUTH authentication mechanism from Section 6.2.3.1 of FIPS 201-2 [1] at the MyID Self-Service Kiosk. Once the applicant's PIV Card is inserted into the kiosk, the applicant is prompted for the PIV Card PIN as depicted in Figure 5-10. After successful PIV Card authentication, the kiosk transmits PIV Card information to the MyID CMS through secure transport, where a job is created to handle the second phase of issuance to the end point. Figure 5-10 Kiosk Workflow <!-- image --> The DPC issuance process requires the use of the Identity Agent mobile application or the self-service application to complete the workflow.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Government Smart Card Interoperability Specification, Version 2.1 say about 6.4.1 Grammar Rules? (Part 6) According to Government Smart Card Interoperability Specification, Version 2.1, 6.4.1 Grammar Rules: in the APDU between the GSC-IS Default and the Cryptoflex card are the CLA byte and the P1 parameter. Therefore, only two tuples are necessary since the rest of the APDU is defined by the GSC-IS VCEI. The tuples required to define this SELECT DF command for the Cryptoflex card would be: Table 6-8: Derived Select DF Tuple | # | C-Byte | C-Byte | C-Byte | V-Byte | Description | Description | Description | Tuple | |-----|----------|----------|----------|----------|---------------------|---------------|------------------|---------| | | S | P | FC | | Function, Parameter | V/D | Value/Descriptor | | | 1 | 0 | 1 | 1 | C0 | Select File, CLA | V | 'C0' | 11C0 | | 2 | 0 | 3 | 1 | 00 | Select File, P1 | V | '00' | 3100 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Intrusion Detection and Prevention Systems (IDPS) provide? (Section 169) include network forensic analysis tools, anti-malware technologies (antivirus software and antispyware software), and firewalls and routers. This section provides guidance on selecting IDPS products. It first discusses the identification of general requirements that the IDPS products should meet. Next, it provides sets of criteria that can be used to evaluate four aspects of IDPS technologies: security capabilities, performance, management, and life cycle cost. Finally, the section concludes with a brief discussion of performing hands-on and paper evaluations of products, and when each evaluation technique is most appropriate. This section assumes that an organization has already determined that a particular type of IDPS technology-network-based, wireless, network behavior analysis (NBA), or host-based-is needed. A comparison of the technology types, which can be helpful for selecting the one most appropriate for a particular need, is provided in Section 8. Organizations should use risk management techniques to identify the security controls necessary to mitigate risk to an acceptable level. Although it may be tempting to simply choose a product, using a risk management process to choose the most effective blend of controls enhances an organization's security posture. An explanation of the risk management process is outside the scope of this document; NIST SP 800-30, Risk Management Guide for Information Technology Systems , contains additional information on it. Before evaluating IDPS products, organizations should first define the general requirements that the IDPS solution and products should meet. The features provided by IDPS products and the methodologies that they use vary considerably, so a product that best meets one organization's requirements might not be suitable for meeting another organization's requirements.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain core attributes according to NIST Digital Identity Guidelines_ Federation and Assertions According to Digital Identity Guidelines_ Federation and Assertions, core attributes: The set of identity attributes that the CSP has determined and documented to be required for identity proofing and to provide services.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Digital Identity Guidelines_ Federation and Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Verifying Business Identity : according to NIST A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems According to A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems, Verifying Business Identity :: This use case considers a system to issue and manage public identifiers and credentials for businesses. It could follow either a top-down authority model, such as a system owned by some central authority (e.g., government, chamber of commerce) that identity proofs businesses, or a bottomup authority model (e.g., applications that self-register in an application store). Once originated in the system, businesses have identifiers and can be issued credentials for certificates, accreditations, and other types of verifiable information that will serve for authentication during commercial interactions. Additionally, businesses can become credential issuers with respect to their staff members. In turn, staff members can build verifiable presentations proving that they act on behalf of their company. From an architectural standpoint, identifiers and credentials are both stored in a common onchain registry, allowing for any participant to publicly verify the information of a given business. The solutions proposed by the Global Legal Entity Identifier Foundation, uPort [74], and VON [55] illustrate this use case.

Explanation: NIST publication on credential and access management. Topics: authentication, identity management. Contains security framework guidance for authentication systems. Source: A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is WiMAX Forum according to Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective? WiMAX Forum: The WiMAX Forum is an industry-led, not-for-profit organization formed to certify and promote the compatibility and interoperability of broadband wireless products based upon the harmonized IEEE 802.16/ETSI (European Telecommunications Standards Institute) HiperMAN standard.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance) provide? (Section 223) ----------------------------------------------------------------------------------------------------------------------------------------| | Reference(s) | 1. SP 800-73-4 Part 2, Section 3.2.2 2. AS05.01, AS05.23 through AS05.27 , and AS05.24A-R4 | | Precondition(s) | 1. PIV Application PIN and Global PIN (if supported) reset retry counter values (maximum number of PIN tries allowed) are recorded. 2. PIV Card Application PIN is recorded. 3. Global PIN (if supported) is recorded. 4. The IUT is placed within the reading range of the contactless reader. 5. There exists a valid PC/SC connection between the test system and the contactless reader. 6. No other contactless card is within the proximity of the reader. 7. The PIV Card Application is the currently selected application on the card. 8. There exists a valid VCI connection to the card. 9. No application is currently connected to the PIV Card Application. | | Test Scenario | 1. Repeat test steps from C.2.2.1, with the exception of steps 1 (selecting PIV Card Application) and 3 (PUK tests), using the '0C' CLA byte 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Verification and Test Methods for Access Control Policies_Models say about Privilege leakage? According to Verification and Test Methods for Access Control Policies_Models, Privilege leakage: Privilege (i.e. action and resource pair) leakage refers to situations in which a subject is able to access resources that are prohibited by the safety requirements. Such leakage may cause either the privilege escalation from one resource domain or class to prohibited ones such as leakage from lower to higher ranks of an MLS policy, or privilege leak such as from one role to other prohibited ones of an RBAC policy. Privilege leakage can be caused by mistaken privilege assignment directly or careless privilege inheritance indirectly.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Verification and Test Methods for Access Control Policies_Models.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-1 in Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers? (Part 183) Control CM-1: out the magfido Files and Directories This section provides additional information regarding files referenced and/or modified by StrongKey to implement FIDO U2F MFA for these example implementations. If you are familiar with Magento, then you may skip this section; others may find this section to be helpful in understanding what must be done to integrate FIDO U2F into their Magento instance in a production environment. Magento includes several boilerplate/configuration files: composer.json and registration.php are those that must be included in every Magento module because they identify the module to the Magento system. The etc folder contains configuration files: -  module.xml is a boilerplate file. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ -  di.xml tells Magento to override the default PaymentInformationManagement.php file with StrongKey ʼ s custom version (named PIMOverrideFidoAuthenticate.php ). -  extension\_attributes.xml tells Magento that purchase-transaction data sent to the server may have signature data appended to it, which can be identified by the attribute name signature . -  etc/frontend/di.xml adds an AdditionalConfigProvider that supplies the MFA modal dialogue with the file name loading.gif . -  routes.xml tells Magento that this module defines controllers that will handle uniform resource locator (URL) requests to fidou2fauthenticator. The api folder contains interface files describing valid functions of the models FidoService and RiskAssessor . The interface files are named FidoServiceInterface.php and RiskAssessorInterface.php . The block folder contains server-side logic to generate views displayed by the browser.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa, sso. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality provide? (Section 21) may be considered as the parameter of the formatting function that determines the value of q .) The value of n , in turn, determines the maximum number of distinct nonces, namely, 2 8 n . Thus, the fourth condition amounts to a tradeoff between the maximum number of invocations of CCM under a given key and the maximum payload length for those invocations. The formatting of the input data ( N , A , P ) into a sequence of blocks B 0 , B 1 , …, B r is presented in the following three sections: in Section A.2.1, the formatting of the nonce and control information such as length indicators is specified; in Section A.2.2, the formatting of A is specified; in Section A.2.3, the formatting of P is specified. B B B B The leading octet of the first block of the formatting, B 0, contains four flags for control information: two single bits, called Reserved and Adata , and two strings of three bits, to encode the values t and q . The encoding of t is [( t -2)/2]3, and the encoding of q is [ q -1]3. Thus, for example, if the MAC length is 8 octets, then t is encoded as 011. Note that the encoding 000 in both cases does not correspond to a permitted value of t or q . The Reserved bit is reserved to enable future extensions of the formatting; it shall be set to '0'. The Adata bit is '0' if a =0 and '1' if a >0. The ordering of the flags within the octet is given in Table 1. B Table 1: Formatting of the Flags Octet in B 0 | Bit number | 7 | 6 | 4 | 3 | 2 | 1 | 0 | |--------------|----------|-------|---------------|-----|-----|-----------|-----| | Contents | Reserved | Adata | [( t -2)/2] 3 | | | [ q -1] 3 | | The remaining 15 octets of the first block of the formatting are devoted to the nonce and the binary representation of the message length in q octets, as given in Table 2. B Table 2: Formatting of B 0 | Octet number | 0 | 1 ...

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.1.3 Six Control Categories. according to NIST Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls, 4.1.3 Six Control Categories.: As to controls, NBS has provided detailed discussion of six basic control categories and indicated the general problems that each will address. Included are: * Data Validation - -Consistency and reasonableness checks - -Data entry validation - -Validation during processing - -Data element dictionary/ directory * User Identity Verification * Authorization * Journal ling * Variance Detection * Encrjrption

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector provide? (Section 194) I | Introduction of malicious software | PROTECT (PR) Protective Technology DETECT (DE) Anomalies and Events Detection Security Continuous Monitoring | | I | Unintended use of service | IDENTIFY (ID) ID.AM-2: Software platforms and applications within the organization are inventoried.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, continuous monitoring. General security reference material without sensitive content. Source: Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Conducting Risk Assessments say about COMMON TERMS AND DEFINITIONS? (Part 19) According to Guide for Conducting Risk Assessments, COMMON TERMS AND DEFINITIONS: s provided by security controls planned or in place. | | Risk Assessment Methodology | A risk assessment process, together with a risk model, assessment approach, and analysis approach. | | Risk Assessment Report | The report which contains the results of performing a risk assessment or the formal output from the process of assessing risk. | | Risk Assessor | The individual, group, or organization responsible for conducting a risk assessment. | | Risk Executive (Function) [CNSSI No. 4009] | An individual or group within an organization that helps to ensure that: (i) security risk-related considerations for individual information systems, to include the authorization decisions for those systems, are viewed from an organization-wide perspective with regard to the overall strategic goals and objectives of the organization in carrying out its missions and business functions; and (ii) managing risk from individual information systems is consistent across the organization, reflects organizational risk tolerance, and is considered along with other organizational risks affecting mission/business success. | | Risk Factor | A characteristic used in a risk model as an input to determining the level of risk in a risk assessment. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Risk Management [NIST SP 800-39] [CNSSI No.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Guide for Conducting Risk Assessments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for Managing the Security of Mobile Devices in the Enterprise say about 5.3.2. Integration of EMM into the Enterprise Service Infrastructure? According to Guidelines for Managing the Security of Mobile Devices in the Enterprise, 5.3.2. Integration of EMM into the Enterprise Service Infrastructure: Both large and small enterprises may connect their EMM system to existing enterprise infrastructure services to improve the security management of mobile devices. Such services support authentication, identification, and access control to enterprise networks and resources. The Remote Authentication Dial-In User Service (RADIUS) is a standard network authentication service protocol that provides authentication of access credentials followed by policy-based network resource assignments (e.g., Internet Protocol [IP] address, permitted network connection time). Directory services, such as Microsoft's Active Directory, map network resources (e.g., volumes, printers, users, devices) to network addresses. Enterprise systems use the Lightweight Directory Access Protocol (LDAP) to communicate with directory services. Another set of services enables remote connectivity via a VPN to enterprise systems. By integrating an EMM with enterprise backend infrastructure services such as RADIUS or directory services, an organization can enable finer-grained management of mobile device access to mission-critical enterprise resources. System administrators can set policy-based configurations for mobile devices to constrain access to sensitive resources, depending on mobile device conditions (e.g., connection from a public WiFi network or user-managed device running a corporate application). When enterprises deploy an EMM without integrating it with their backend security infrastructure, mobile device connections to the enterprise network may be managed via global passphrases for connection to the enterprise WiFi network. Mobile devices with WiFi network access can then reach any of the services on the enterprise network, meaning that when a device is connected to the WiFi network, it can access everything on the typical enterprise network.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Guidelines for Managing the Security of Mobile Devices in the Enterprise.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to Computer Security Division 2005 Annual Report? http: //csrc.nist.gov/sec-cert Contacts: Dr. Ron Ross (301) 975-5390 ron.ross@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2005 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control MA-3 in Guide to Operational Technology (OT) Security? Control MA-3: (2) MAINTENANCE TOOLS | INSPECT MEDIA

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance say about 1.3.3 Single or Multi-Use Keys? According to Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance, 1.3.3 Single or Multi-Use Keys: A major thrust from Part 1 of this Recommendation is that, in general, keys shall not be used for multiple cryptographic purposes. For example, the same key shall not be used to generate a digital signature and to establish other keying material (see [SP 800-57 Part 1, Sec. 8.1.5.1.1.2 ] for the rare exceptions to this guidance). It is less clear as to whether a digital signature key, for example, can be used only for a specific application (e.g., signing e-mail) or for multiple applications (e.g., for both signing e-mail and signing documents). In some cases, it may be acceptable for an application to share keys with other applications. In other cases, sharing keys may not be desirable. For example, best practices indicate that a server's TLS keys should not be used to support other applications. Even where keys are used to perform the same cryptographic operation (e.g., digital signatures), sharing keys may be inappropriate because one application could be providing one service (e.g., authentication), while a second application could be providing a different service (e.g., non-repudiation). It is important to remember that it may be a bad idea to use keys for multiple applications. An agency should perform a risk assessment when considering the use of the same key for multiple applications.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Random Number Generation Using Deterministic Random Bit Generators say about 11 Assurance? (Part 2) According to Recommendation for Random Number Generation Using Deterministic Random Bit Generators, 11 Assurance: ation. However, this level of testing is outside the scope of this Recommendation. Note that any entropy input used for testing (either for validation testing or health testing) may be publicly known. Therefore, entropy input used for testing shall not be used for normal operational use.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Number Generation Using Deterministic Random Bit Generators.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography say about 6.4.2.3.2 Recipient Obtains Assurance Directly from the Claimed Owner (i.e., the Other Party)? (Part 2) According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography, 6.4.2.3.2 Recipient Obtains Assurance Directly from the Claimed Owner (i.e., the Other Party): ssurance to party V that party U possesses the private key corresponding to PubKeyU (the public key that was associated with party U when that key pair is used during the keyagreement transaction). 4. The KAS2-bilateral-confirmation scheme in Section 8.3.3.4 can be used to provide assurance to each party that the other party possesses the correct private key that corresponds to the other party's public key; i.e., when bilateral key-confirmation is successful, party U obtains assurance that party V possesses the private key corresponding to PubKeyV (the key pair that was associated with party V and that was used during the key-agreement transaction), and party V obtains assurance that party U possesses the private key corresponding to PubKeyU (the key pair that was associated with party U and that was used during the key-agreement transaction). 5. The KTS-OAEP-Party\_V-confirmation scheme in Section 9.2.4.2 can be used to provide assurance to party U (the key-transport sender) that party V (the key-transport receiver) possesses the private key corresponding to PubKeyV (the key pair that was associated with party V and that was used during the key-agreement transaction). The recipient of a public key (or agents trusted to act on the recipient's behalf) shall determine whether or not using one of the key-establishment schemes in this Recommendation to obtain assurance of possession through key confirmation is sufficient and appropriate to meet the security requirements of the recipient's intended application(s). Other approved methods (e.g., see Section 5.4.4 of SP 800-57-Part 1) of directly obtaining this assurance of possession from the owner are also allowed. If obtaining assurance of possession directly from the owner is not acceptable, then assurance of possession shall be obtained indirectly as discussed in Section 6.4.2.3.1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Technical Guide to Information Security Testing and Assessment provide? (Section 97) ible for damages incurred by the organization being assessed. External entities should also understand and comply with the organization's applicable policies and operational and security requirements. In addition to those listed above, the responsibilities for external assessors include: - GLYPH<c=31,font=/DGCOEC+Webdings> Coordinating and communicating with the organization being assessed - GLYPH<c=31,font=/DGCOEC+Webdings> Ensuring that proper authority is granted, and maintaining a signed copy of the assessment plan to ensure all updates are documented - GLYPH<c=31,font=/DGCOEC+Webdings> Signing and abiding by any required nondisclosure agreements - GLYPH<c=31,font=/DGCOEC+Webdings> Properly protecting data in accordance with the organization's regulations, including handling, transmission, storage, and deletion of all collected data and resulting reports. The environment in which assessors operate differs according to the techniques being used. For many types of tests, assessors can operate either onsite or offsite, with onsite testing defined as testing executed at the organization's location. Placing assessors offsite, however, may make the test more realistic (e.g., when applying the covert testing approach). For examinations, assessors are generally located onsite so they can easily access the organization's security documentation, logs, and other information. For assessments performed by third parties, the organization will need to determine the appropriate level of physical access (e.g., unrestricted, escorted). For technical assessments conducted from within the network-such as security configuration reviews and vulnerability scanning-assessors should be provided network access either onsite, through an encrypted virtual private network (VPN) tunnel, or via a dedicated connection from a trusted environment such as an approved test lab.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technical Guide to Information Security Testing and Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Secure Deployment of IPv6 provide? (Section 201) pe of tunneling is used. Ensuring that address selection policy is correctly specified can affect other assumptions about security. The address selection rules can help enable some attacks on privacy. By probing a host with requests that come from different source addresses and observing what source addresses the target uses for replies, one can extract information about the set of addresses used by the target. If an attacker were to compromise and modify the address selection policy table, this could cause a manin-the-middle or DOS attack. This can be mitigated by applying best practices of desktop and server security (e.g., malware filtering in web and e-mail content, patching processes, removal of administrative rights from end-users, etc.), methods that apply equally to IPv6 and IPv4. Experience using the rules described above for address selection has unveiled several problematic configurations, which require further attention. When a link has more than one router, or a site border router is connected to more than one ISP, multiple prefixes can be used. If the prefix of a source address does not correspond to the connection used, the packet may be dropped because of ingress filtering, or an asymmetrical route may be established, and returned packets may be dropped due to packet filtering. This problem is even worse in the case in which one of the routers is not globally connected but only connected to a closed network segment. Prefix renumbering increases the complexity of this, because choices of appropriate prefixes are not static. The longest prefix match rule can always distinguish currently allocated global addresses from unique local addresses, but this will become an issue when global addresses with a leading one bit begin to be allocated. Applications may need to have better control over address selection in certain cases. One case is choosing between temporary and permanent addresses; another is between home and care-of addresses.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog say about Table of Contents? (Part 4) According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog, Table of Contents: | PROTECTION.................................................................................... 17 | | | (CRY) Cryptography Capabilities and Support..............................................17 | | | (KEY) Cryptographic Key Management ........................................................17 | | | (STO) Secure Storage ..................................................................................18 | | (STX) | Secure Transmission ..........................................................................18 | | LA - LOGICAL ACCESS TO INTERFACES..........................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities say about 2.1.1.4 Access Complexity (AC)? (Part 2) According to The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities, 2.1.1.4 Access Complexity (AC): is a person or entity whose direct actions take advantage of the software security configuration issue. A user may be malicious or non-malicious. In contrast, an attacker is always malicious. Table 3. Access Complexity Scoring Evaluation | Metric Value | Description | |----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | High (H) | Active Exploitation: Specialized access conditions exist for active exploitation. For example: • The vulnerability makes it only slightly easier for an attack to succeed.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2014 Annual Report say about NIST Technical Series Publications FIPS, SPs, NISTIRs, and ITL Bulletins? (Part 4) According to Computer Security Division 2014 Annual Report, NIST Technical Series Publications FIPS, SPs, NISTIRs, and ITL Bulletins: for ISO/IEC 27001 and 15408 | August 2014 | | SP 800-16 Revision 1 (Second Draft) (Third Draft) | A Role-Based Model For Federal Information Technology/ CyberSecurity Training | October 2013 March 2014 | | NIST INTERAGENCY OR INTERNAL REPORTS (NISTIRs) | NIST INTERAGENCY OR INTERNAL REPORTS (NISTIRs) | NIST INTERAGENCY OR INTERNAL REPORTS (NISTIRs) | |--------------------------------------------------|-------------------------------------------------------------------------|--------------------------------------------------| | Publication Number | Publication Title | Draft Released Date | | NISTIR 8023 | Risk Management for Replication Devices (RDs) | September 2014 | | NISTIR 8018 | Public Safety Mobile Application Security Requirements Workshop Summary | July 2014 | | NISTIR 8014 | Considerations for Identity Management in Public Safety Mobile Networks | July 2014 | | NISTIR 8006 | NIST Cloud Forensic Science Challenges | June 2014 | | NISTIR 7981 | Mobile, PIV, and Authentication | March 2014 | | NISTIR 7977 | NIST Cryptographic Standards and Guidelines Development Process | February 2014 | | NISTIR 7966 | Security of Automated Access Management Using Secure Shell (SSH) | August 2014 | | NISTIR 7924 (Second Draft) | Reference Certificate Policy | May 2014 | | NISTIR 7863 | Cardholder Authentication for the PIV Digital Signature Key | December 2013

Explanation: NIST publication on credential and access management. Topics: authentication, identity management. Contains security framework guidance for authentication systems. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Internet Messaging according to Cell Phone Forensic Tools_ an Overview and Analysis? Internet Messaging: N.A. - The Nokia 6200 does not support email. (NA)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain SI-2 FLAW REMEDIATION according to NIST Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, SI-2 FLAW REMEDIATION: Supplemental C-SCRM Guidance: The output of flaw remediation activities provides useful input into the ICT/OT SCRM processes described in Section 2 and Appendix C. Enterprises should require their prime contractors to implement this control and flow down this requirement to relevant sub-tier contractors.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain ALARMS according to NIST Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS) According to Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS), ALARMS: Any event that results in an entry in the security variance log, also generates an alarm count. When the count exceeds a threshold, corrective action is initiated. In the early days of the system, when it owned all of the lines, the corrective action was to disable the terminal and send a message to it about the variance. Since management action was required to enable the terminal again, this was a powerful mechanism for informing management of the alarm condition. Today, the system employs a network shared with other systems and applications. Though it can still disable the port, it cannot really disable the terminal. Therefore the threshold is now set to ten rather than the old two. While no longer as effective in notifying management of the variance, the control is still effective in limiting exhaustive attacks. Today, corrective action relies more heavily upon the information in the variance journal.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)? (Part 183) Control PD-12: | | ## Table G.2: Controls and Assessment Procedures for Derived PIV Credential Issuers (DPCIs) This table specifies the controls and assessment procedures for the Derived PIV Credential and its related token. The controls in this section are mapped to the PCI controls in G.1 to assist issuers that intend to issue both types of credentials. Unlike for a PIV Card Issuer, not all issuer controls are applicable to a Derived PIV Credential Issuer. Certain issuer controls are applicable to only LOA-3 or to only LOA-4 Derived PIV Credentials and therefore must be implemented by the issuer only if they are issuing that level of a Derived PIV Credential. This is represented via the ' applicability ' column within this table. Controls with an applicability column marked with DPCI (e.g., without LOA-4 or 3 postfix) apply to both LOA-3 and LOA-4 Derived PIV Credential.

Explanation: NIST publication on credential and access management. Topics: authorization, token. Contains security framework guidance for authentication systems. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case say about Prerequisites? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case, Prerequisites: Windows 2012 R2 server (preferably two for redundancy) up to date on patches, static IP address assigned with primary DNS server set to 127.0.0.1 (localhost) 1. Launch the Windows Server Manager and click on Add Roles and Features 2. Click ' Next ' at the first page as shown below <!-- image --> 3. Select Role Based or Feature Based Installation under Installation Type 4. Select Active Directory Domain Services and DNS Server to install. Click Next. <!-- image --> <!-- image --> 5. Click Next on the Features screen, leave the default options selected, 6. Click Next on the AD DS screen and the following DNS Server screen as well. 7. Verify your settings on the Confirmation screen. Click Install to proceed. <!-- image --> <!-- image --> 8. Wait till the installation process completes and shows an Installation succeeded message. Hit Close button. 9. Launch Server Manager again and click on Promote this server to a domain controller . 10. Select Add a new forest on the Deployment Configuration step, as this would be a new domain controller in a new forest. Mention a Root Domain name as applicable to your environment. <!-- image --> <!-- image --> 11. Set a Directory Services Restore Mode password in the next step. Click Next 12. Under ' DNS Options ' leave the default options selected. Click Next <!-- image --> <!-- image --> 13. Confirm the NETBIOS domain name under Additional Options . Click Next . 14. Leave the default folder paths as it is Under Paths . Click Next <!-- image --> <!-- image --> 15. Confirm all the settings On the Review Options page. Click Next . 16. Click Install on the Prerequisites Check to launch the installation process. The server will auto reboot upon completion. 17. Login with domain administrator credentials upon reboot. Open Server Manager and click on Active Directory Users and Computers under Tools to manage your AD. <!-- image --> <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to SSL VPNs provide? (Section 166) Lightweight Directory Access Protocol | | MAC | Message Authentication Code | | MIB | Management Information Base | | MPPE | Microsoft Point to Point Encryption | | MS-CHAP | Microsoft Challenge Handshake Authentication Protocol | | MTU | Maximum Transmission Unit | | NAT | Network Address Translation | | NetBEUI | NetBIOS Extended User Interface | | NetBIOS | Network Basic Input/Output System | | NIST | National Institute of Standards and Technology | | OMB | Office of Management and Budget | | PAP | Password Authentication Protocol | | PC | Personal Computer | | PDA | Personal Digital Assistant | | PGP | Pretty Good Privacy | | PIN | Personal Identification Number | | PKI | Public Key Infrastructure | | POP | Point of Presence | | PPP | Point-to-Point Protocol | | PPTP | Point-to-Point Tunneling Protocol | | QoS | Quality of Service | | RADIUS | Remote Authentication Dial-In User Server | | RC4 | Rivest Cipher 4 | | RCP | Remote Copy Protocol | | RFC | Request for Comment | | RMON | Remote Monitoring | | RSA | Rivest Shamir Adleman | | S/MIME |

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Guide to SSL VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines for Securing Radio Frequency Identification (RFID) Systems? (Part 131) Control ES-1: odify and amplify signals in unintended and potentially harmful ways, and - GLYPH<c=31,font=/MCAMJE+Webdings> Legitimate radios with which the RF subsystem communication will cause interference. Applicability: All environments in which the organization deploying RFID systems determines the location of the RF equipment (which excludes many consumer and supply chain applications). ## Benefits: - GLYPH<c=31,font=/MCAMJE+Webdings> Reduced risk of interference with legitimate radios - GLYPH<c=31,font=/MCAMJE+Webdings> Reduced risk of eavesdropping and unauthorized RF subsystem transactions - GLYPH<c=31,font=/MCAMJE+Webdings> Mitigation of HERF/HERO/HERP ## Weaknesses: - GLYPH<c=31,font=/MCAMJE+Webdings> Tag location cannot always be controlled, such as when tags are used to track mobile items (e.g., hospital cart) or items in transit (e.g., pallet on a truck). - GLYPH<c=31,font=/MCAMJE+Webdings> Radio interference may persist even if the tags or readers are placed in a new location that is still sufficiently close to other radios. 43 ## 5.2.3 Secure Disposal of Tags Control: Secure disposal involves physically or electronically destroying tags, as opposed to just discarding them, when they are no longer needed to perform their intended function. Physical destruction may involve manual tearing or shredding using a paper shredder. Electronic destruction can be accomplished by using a tag's kill feature or using a strong electromagnetic field to render a tag's circuitry permanently inoperable. When a tag supports an electronic disabling mechanism, it usually is the preferred way to disable a tag before it is disposed because it can be accomplished without touching each tag, thereby reducing the cost of the effort. The kill feature is also discussed in Section 5.3.3.3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: rmf, fips, security control. General security reference material without sensitive content. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Security Considerations for Voice Over IP Systems? (Part 84) Control HA-1: voice into digital data and back again, and may also compress and decompress the data for more efficient transmission. Firewall Control Proxy - component that controls a firewall's handling of a call. The firewall control proxy can instruct the firewall to open specific ports that are needed by a call, and direct the firewall to close these ports at call termination. H.323 - The International Telecommunications Union (ITU) standard for packetswitched network voice and video calling and signaling. Jitter - non-uniform delays that can cause packets to arrive and be processed out of sequence Latency - time delay in processing voice packets. Media gateway - the interface between circuit switched networks and IP network. Media gateways handle analog/digital conversion, call origination and reception, and quality improvement functions such as compression or echo cancellation. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Media Gateway Control Protocol - common protocol used with media gateways to provide network management and control functions. PSTN - the public switched telephone network. QoS -Quality of Service - a network property that specifies a guaranteed throughput level. Session Initiation Protocol (SIP) - A standard for voice and video over a packet switched network developed by IETF. Sniffer - a network monitoring tool, usually a software tool running on a PC.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Considerations for Identity Management in Public Safety Mobile Networks say about 3. Identity Management Guidance & Frameworks? According to Considerations for Identity Management in Public Safety Mobile Networks, 3. Identity Management Guidance & Frameworks: This section introduces the relevant identity management guidance from both public and private entities. Federal guidance includes OMB M-04-04, E-Authentication Guidance for Federal Agencies, NIST SP 800-63-2, Electronic Authentication Guideline , and HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors , alongside its associated standards. Industry guidance includes information from the National Public Safety Telecommunications Council (NPSTC) and the Alliance for Telecommunications Industry Solutions (ATIS) guidance and frameworks.

Explanation: NIST publication on credential and access management. Topics: authentication, identity management, sso. Contains security framework guidance for authentication systems. Source: Considerations for Identity Management in Public Safety Mobile Networks.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cell Phone Forensic Tools_ an Overview and Analysis Update say about Scenario Results - Cell Phones? (Part 2) According to Cell Phone Forensic Tools_ an Overview and Analysis Update, Scenario Results - Cell Phones: Table 13: Results Matrix | | Device | Device | Device | Device | Device | Device | |----------------------------|---------------|--------------|---------------|-------------|------------|------------| | Scenario | Ericsson T68i | Motorola V66 | Motorola V300 | Nokia 6610i | Nokia 6200 | Nokia 7610 | | Connectivity and Retrieval | Meet | Meet | Meet | Meet | Meet | Meet | | PIM Applications | Below | Below | Below | Below | Below | Below | | | Device | Device | Device | Device | Device | Device | |---------------------------------|---------------|--------------|---------------|-------------|------------|------------| | Scenario | Ericsson T68i | Motorola V66 | Motorola V300 | Nokia 6610i | Nokia 6200 | Nokia 7610 | | Dialed/Received Phone Calls | Below | Below | Below | Below | Below | Miss | | SMS/MMS Messaging | Below | Below | Below | Below | Below | Miss | | Internet Messaging | Miss | NA | Below | NA | NA | Miss | | Web Applications | Miss | NA | Miss | Below | Miss | Miss | | Text File Formats | NA | NA | Miss | Below | Below | Below | | Graphics File Formats | Miss | NA |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.1 W and W -1 according to NIST Recommendation for Block Cipher Modes of Operation_ Methods for Key Wrapping According to Recommendation for Block Cipher Modes of Operation_ Methods for Key Wrapping, 6.1 W and W -1: Algorithm 1 below specifies the wrapping function, W, for KW-AE (see Sec. 6.2) and KWP-AE (see Sec. 6.3), using the same KEK and designated cipher function.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Block Cipher Modes of Operation_ Methods for Key Wrapping.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography? (Part 2) Control HA-3: uted using ephemeral keys in a Diffie-Hellman primitive. | | Z s | Acomponent of the shared secret (represented as a byte string) that is computed using static keys in a Diffie-Hellman primitive. | The following notations are used for FFC and ECC in this Recommendation. Note that the notation sometimes differs between the two scheme types due to the differing notations used in the two standards on which this Recommendation is based (i.e., ANS X9.42 and ANS X9.63). FFC: | GF(p) | The finite field with p elements, where p is an (odd) prime number. The elements of GF ( p ) can be represented by the set of integers {0 , 1 , …, p - 1}. The addition and multiplication operations for GF ( p ) can be realized by performing the corresponding integer operations and reducing the results modulo p . | |------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | GF ( p ) * | The multiplicative group of non-zero field elements in GF ( p ). | | g | An FFC domain parameter; the selected generator of the multiplicative subgroup of prime order q in GF ( p ) * . | | k mod p | The modular reduction of the (arbitrary) integer k by the (positive) integer p (the modulus ) . For the purposes of this Recommendation, j = k mod p is the unique integer satisfying the following two conditions: 0  j < p , and k -  j is a multiple of p . In short, j = k -  k / p  p . | | p | An FFC domain parameter; an odd prime number that determines the size of the finite field GF ( p ).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings provide? (Section 62) organization management service (VOMS) [5] was developed by the European Data Grid project to allow for attribute-based authorization to the Globus Toolkit job management services. It uses X.509 attribute certificates [7] in a push mode to assert attributes in a modified version of the Globus Toolkit. We believe that Shibboleth, with its use of SAML, will be more easily interoperable with Web services-based technologies emerging in the Grid community. VOMS also does not support a pseudonymous mode, nor does it have any other provisions for privacy support. The Community Authorization Service (CAS) [17] is similar to Shibboleth in its use of SAML assertions. However CAS operates at the level of capabilities rather than attributes; that is, instead of expressing abstractly what someone is, CAS expresses explicitly what actions they are allowed to take. CAS also does not support a pseudonymous mode or have any other provision for privacy. Akenti [22] and PERMIS [2] are authorization systems that have been integrated with the Globus Toolkit through the use of authorization callouts [13,28]. Both Akenti and PERMIS allow for the use of X.509 attribute certificates to make attribute-based authorization decisions. We envision our work as being complementary to these systems. Our focus falls on the technology to transport SAML assertions from the Shibboleth attribute authority to the Globus Toolkit-based services, whereas these systems are designed primarily as authorization decision makers. We envision a mode of operation in which these systems can be used to provide rich authorization capabilities using Shibboleth-issued SAML assertions in addition to the X.509 attribute certificates they use today. The Signet privilege management system [21] is being developed by a working group of the Internet2 Middleware Initiative.

Explanation: NIST publication on credential and access management. Topics: authorization, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Labels for Open Systems_ an Invitational Workshop provide? (Section 36) six classes: - (1) FIXED LABEL association: the requirement that an application association should be able to be created all of whose A-PDUs are visibly associated with a single security label (i.e. labelled field = the whole association); - (2) FIXED label-set association: the requirement that an application association should be able to be created all of whose A-PDUs are visibly associated with a single set of security labels (i.e. labelled field = the whole association); - (3) variable label association: the requirement that an application association should be able to be created each A-PDUs of which are visibly associated with a single security label, but not necessarily the same one (i.e. labelled field = one A-PDU); - (4) variable label-set association: the requirement that an application association should be able to be created each A-PDUs of which are visibly associated with a single set of security labels, but not necessarily the same one (i.e. labelled field - one A-PDU); - (5) multiple label association: the requirement that an application association should be able to be created each a-pdu of which is divided into a number of fields each visibly associated with one of many security labels (i.e. labelled field = a fraction of an A-PDU); and, - (6) multiple label-set association: the requirement that an application association should be able to be created each a-pdu of which is divided into a number of fields each visibly associated with one of many sets of security labels (i.e. labelled field = a fraction of an A-PDU). The position in the communications architecture at which the access control service is provided may be at a layer below the application layer. 1 Thus there is a gap between the position at which access control is required (the application layer) and the position at which it is provided. This latter layer (or sublayer), at which data labelling is manifest in the layer protocol and service, will be referred to as the (L)-layer.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Security Labels for Open Systems_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Policy Machine_ Features, Architecture, and Specification provide? (Section 30) s origins with military and civilian government security policy, where individuals are assigned clearances and messages, reports, and other forms of data are assigned classifications [San94]. The security level of user clearances and of data classifications govern whether an individual can gain access to data. For example, an individual can read a report, only if the security level of the report is classified at or below his or her level of clearance. Defining MAC for a computer system requires assignment of a security level to each subject and each object. Security levels form a strict hierarchy such that security level x dominates security level y, if and only if, x is greater than or equal to y within the hierarchy. The U.S. military security levels of Top Secret, Secret, Confidential, and Unclassified are a good example of a strict hierarchy. Access is determined based on assigned security levels to subjects and objects and the dominance relation between the subject's and object's assigned security. The security objective of MAC is to restrict the flow of information from an entity at one security level to an entity at a lesser security level. Two properties accomplish this. The simple security property specifies that a subject is permitted read access to an object only if the subject's security level dominates the object's security level. The  -property specifies that a subject is permitted write access to an object only if the object's security level dominates the subject's security level. Indirectly, the  -property, also referred to as the confinement property, prevents the transfer of data from an object of a higher level to an object of a lower classification and is required to maintain system security in an automated environment. These two properties are supplemented by the tranquility property, which can take either of two forms: strong and weak.

Explanation: NIST publication discussing classified information handling. References: classified, secret, top secret. Contains guidance on protecting sensitive government information. Source: Policy Machine_ Features, Architecture, and Specification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Intrusion Detection and Prevention Systems (IDPS)? (Part 200) Control ES-1: is being monitored because the real-world activity is likely to contain different types of malicious activity, and it is sometimes unclear whether or not the detected activity was actually malicious. Prevention capabilities are generally not tested in real-world environments because they can easily cause disruptions to benign activity. It is very difficult to duplicate real-world environments in lab environments, so organizations performing IDPS testing generally need to do their testing separately in each environment. - GLYPH<c=31,font=/HHCKCL+Webdings> Test Availability. There are no standard IDPS test suites available. Organizations performing IDPS testing need to find ways to generate both malicious activity (to see how well the products identify them) and benign activity (to put the product under normal or heavy loads). The malicious activity should accurately reflect the composition of recent threats against the organization's systems and networks; accordingly, it can take considerable time to identify those threats and acquire tests for them. The tests also need to take into account all detection methodologies used by the IDPSs, because usually different types of tests are needed to properly evaluate the effectiveness of each 55 For more information on the challenges of IDPS testing, see NIST Interagency Report (IR) 7007, An Overview of Issues in Testing Intrusion Detection Systems. It is available at Although it is focused primarily on testing network-based IDPSs, most of the testing problems it discusses are applicable to testing any type of IDPS technology. methodology. 56 Typically it takes a combination of carefully selected tools and custom-written attack scripts to build a reasonable test suite. Each tool and script should be reviewed and tested to ensure that it performs the tests properly. - GLYPH<c=31,font=/HHCKCL+Webdings> Lab Environment Resources.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Enhanced Security Requirements for Controlled Unclassified Information say about Table of Contents? (Part 4) According to Assessing Enhanced Security Requirements for Controlled Unclassified Information, Table of Contents: | PHYSICAL PROTECTION................................................................................................................... | 17 | | 3.11 | RISK ASSESSMENT........................................................................................................................... | 17 | | 3.12 | SECURITY ASSESSMENT .................................................................................................................. | 22 | | 3.13 | SYSTEMANDCOMMUNICATIONSPROTECTION............................................................................. | 23 | | 3.14 | SYSTEMANDINFORMATIONINTEGRITY......................................................................................... | 26 | | REFERENCES .................................................................................................................................. | REFERENCES .................................................................................................................................. | 32 | | APPENDIXA GLOSSARY................................................................................................................ | APPENDIXA GLOSSARY................................................................................................................

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Building a Cybersecurity and Privacy Learning Program say about 2.4.1.2. Qualitative Measurements? According to Building a Cybersecurity and Privacy Learning Program, 2.4.1.2. Qualitative Measurements: Qualitative measurements are based on descriptive data, for example, data collected through observations, interviews, focus groups, or open-ended text fields in surveys and can provide insight into the learning experience . Some common examples of qualitative learning program data include: - Instructor/presenter observations and feedback - Attitude surveys related to workforce support for the cybersecurity and privacy culture - Open-ended feedback or survey fields - Detailed reports from participants, such as written feedback sent to the program - Focus group discussions with participants, instructors, or other stakeholders - Observations of learning program instruction and interactions - Observations and analyses of instructional case studies - Interviews with participants, instructors, or other stakeholders - Suggestion box submissions

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Building a Cybersecurity and Privacy Learning Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control II-4 in 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report)? (Part 132) Control II-4: erally, sensitivity means the ## characteristic of an asset that implies it is valuable to the organization using it. It also implies that the asset is vulnerable to accidental or deliberate threats. The determination of unclassified information sensitivity is a management judgment. Agencies are expected to use this part of the CSPP to provide a general description of the value of the information, the reasons for the sensitivity, and the areas within which the information may be vulnerable. Agencies should not provide information which is specific or detailed enough that its disclosure would pose a major threat if the CSPP were to be disclosed. Reviewers look for: - an overview of the generic types of information handled by the system (s) - a general statement of the potential damage which might occur through error, unauthorized disclosure or modification, or unavailability; and - a statement of generic threats to which the system or information may be particularly vulnerable. Sufficient information should be provided to determine the general relevance and potential effectiveness of the security controls specified, when viewed in the context of the system functions and operational environment. Particular care should be taken by the reviewer to understand the nature of the system sensitivities in light of the foregoing discussions of the functions carried out by the system and the environment in which it operates. It is only the combination of functions, environment, and sensitivity which leads management to recognize requirements to establish security controls. ## General Description of Information Sensitivity Agencies are to provide a general description of the types of information handled by the system and the perceived needs for protective measures.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ID-19 in Securing Telehealth Remote Patient Monitoring Ecosystem? (Part 276) Control ID-19: | Cybersecurity Framework v1.1 Subcategory | Device Cybersecurity Capabilities | Manufacturer Nontechnical Supporting Capabilities | HIPAA Security Rule Mapping to Cybersecurity Framework Subcategory | |--------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------|----------------------------------------------------------------------| | |  Ability to create an organizationally defined system use notification message or banner to be displayed on the IoT device.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols say about 8.2.3 Protected Data? According to Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols, 8.2.3 Protected Data: The data field contains a TPDU or concatenated set of TPDUs as per ISO 8073 or ISO 8602.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Domain Name System-Based Electronic Mail Security provide? (Section 269) access-control: ::0/0 refuse # access-control: ::1 allow # access-control: ::ffff:127.0.0.1 allow + access-control: 192.168.3.0/23 allow # if given, a chroot(2) is done to the given directory. # i.e. you can chroot to the working directory, for example, @@ -376,7 +380,7 @@ # you start unbound (i.e. in the system boot scripts). And enable: # Please note usage of unbound-anchor root anchor is at your own risk # and under the terms of our LICENSE (see that file in the source). -# auto-trust-anchor-file: "/usr/local/etc/unbound/root.key" + auto-trust-anchor-file: "/usr/local/etc/unbound/root.key" # File with DLV trusted keys. Same format as trust-anchor-file. # There can be only one DLV configured, it is trusted from root down. @@ -614,7 +618,7 @@ remote-control: # Enable remote control with unbound-control(8) here. # set up the keys and certificates with unbound-control-setup. -# control-enable: no + control-enable: yes # Set to no and use an absolute path as control-interface to use # a unix local named pipe for unbound-control. ``` ``` ``` ``` 9831 IN A 185.49.140.60 ns.nlnetlabs.nl. 9831 IN AAAA 2a04:b900::8:0:0:60 ;; Query time: 581 msec ;; SERVER: ::1 ;; WHEN: Thu May 12 05:58:20 2016 ;; MSG SIZE rcvd: 209 # CD unset: [rdolmans@unbound ~]$ drill txt bogus.nlnetlabs.nl @::1 ;; ->>HEADER<<- opcode: QUERY, rcode: SERVFAIL, id: 14388 ;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;; bogus.nlnetlabs.nl.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.