You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about E.1 Legislative Mandates? (Part 1) According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, E.1 Legislative Mandates: E.1 Legislative Mandates Some legislatively mandated prohibitions against disclosure of information (other than national security information) are identified in Table 6. The table gives the title or subject of the section in the United States Code (U.S.C.) in which the prohibition occurs, the U.S.C. citation for the prohibition, and the Department, agency, or generic information type to which the law applies, and the legal source. Note that the information contained in the table is intended only as an aid and will not always be current. Independent law searches by analysts will generally be necessary. Table 6: Legal Information Disclosure Prohibitions | Subject/Title of Provision | United States Code Citation | Agency/Activity [Reference] | |-------------------------------------------------|-------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Access to Information; Confidentiality | 22 U.S.C., Chapter 46A, Section 3144 | Foreign Direct Investment in United States [Foreign Direct Investment and International Financial Data Improvements Act of 1990, Public Law 101-533, Sec. 8, Nov. 7, 1990, 104 Stat. 2350] | | Access to Records | 42 U.S.C., Chapter 114, Subchapter I, Part A, Section 10806 | Department of Health and Human Services/Public Health Service [Public Law 99-319, Title I, Sec.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Guidelines for Derived Personal Identity Verification (PIV) Credentials? (Part 31) Control PD-12: d PIV Application Command Interface. ## B.1.4.1 Derived PIV Application Key References and Security Conditions of Use Key references are assigned to keys and passwords of the Derived PIV Application. Table 6-1 of [SP80078] and Table 4 of [SP800-73Part1] define the key reference values that shall be used on the Derived PIV Application interfaces with the following mappings: | Derived PIV Key Type | PIV Key Type | |----------------------------------|--------------------------| | Derived PIV Application Password | PIV Card Application PIN | | Password Unblocking Key | PIN Unblocking Key | Table B-2 Mapping of Key Types | Derived PIV Key Type | PIV Key Type | |----------------------------------|----------------------------| | Derived PIV Authentication Key | PIV Authentication Key | | Derived PIV Token Management Key | Card Management Key | | Digital Signature Key | Digital Signature Key | | Key Management Key | Key Management Key | | Retired Key Management Key | Retired Key Management Key | The key reference specifications in Section 5.1 of [SP800-73Part1] are applicable to the corresponding keys included in the Derived PIV Application (mapped per the table above) except for the following: -  References to 'PIV Card Application' are replaced by 'Derived PIV Application' -  References in the 'Security Conditions for Use' column to 'PIN or OCC' are replaced by 'Derived PIV Application Password' ## B.1.4.2 Derived PIV Application Cryptographic Algorithm and Mechanism Identifiers The algorithm identifiers for the cryptographic algorithms that may be recognized on the Derived PIV Application interfaces are the asymmetric and symmetric identifiers specified in Table 6-2 and Table 6-3 of [SP800-78].

Explanation: NIST publication on credential and access management. Topics: authentication, key management, token. Contains security framework guidance for authentication systems. Source: Guidelines for Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Volume 1_ Overview say about SP 800-53A states that:? (Part 2) According to Automation Support for Security Control Assessments_ Volume 1_ Overview, SP 800-53A states that:: e capability (e.g., HWAM, SWAM, or Configuration Setting Management) in which the defect check appears. - Local defect checks - Defect checks that a given organization determines whether to implement. Regarding local defect checks, the organization: - -Might not implement a check because the check assesses a security control item that is in a baseline not found within the organization (e.g., the control item is in the highimpact baseline, but the organization has only low- and moderate-impact systems) or within a specific organizational system; - -Might not implement a check because the check assesses a control item that is not implemented at all within the organization or within a specific system (i.e., has been tailored out with appropriate rationale); - -Might implement a check only for specific system assessment objects on which an associated security control is implemented; - -Might implement an alternative version of the local defect check; or - -Might use manual/procedural assessment methods for certain control items. The organization may customize the defect check tables by adjusting the description of defect checks (adding checks, editing checks, clarifying roles, deselecting checks). Table 15: Sample Rows from a Hypothetical Sub-Capability and Defect Checkprovides an example of part of a defect check table. In order to automate security control assessments to the greatest extent possible and to support ongoing authorization, implementation of the applicable foundational and local defect checks defined in this NISTIR is needed for all implemented security control items.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Automation Support for Security Control Assessments_ Volume 1_ Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Formal Description of the SDNS Security Protocol at Layer 4 (SP4) provide? (Section 64) t := kill_me; end; ``` ``` from WFKR to ACTIVE when K.REPLACEresp provided (direction =down_stack) and (status =assoc_ok) (* Key replacement complete; continue building SE TPDU for output to network. *) var encapsulated_data : data_type; build_status : build_status_type; begin output T.cancel; key_replacement_required := false; flow_control := off; hold_local_key_id := local_key_id; hold_peer_key_id := peer_key_id; hold_security_attributes : = security_attributes; build_SE ( hold_user_data, determine_kind(hold_user_data), fsn, hold_local_key_id, hold_peer_key_id, hold_security_attributes, encapsulated_data, build_status); if (build_status = BUILD_OK) then begin output T.start(inactivity); output N.NUDATAreq( hold_local_address, hold_peer_address, hold_QOS_parameter_set, encapsulated_data); end { otherwise discard problem tpdu } else if (build_status = MAC_ERROR) or (build_status = MDC_ERROR) then report_security_event(my_identifier, MAJOR, INTEGRITY_VIOLATION, INTEGRITY_CHECK_FA1LURE, hold_local_address, hold_peer_address) else if (build_status = ENCIPHER_MECH_ERROR) then report_security_event(my_identifier, MAJOR, SECURITY_DOMAIN_VIOLATION, CRYPTO_FACILITY_FAILURE, hold_local_address, hold__peer_address) else if (build_status = KEY_EXPIRED) then report_security_event(my_identifier, MAJOR, SECURITY_DOMAIN_VIOLATION, KEY_MANAGEMENT_FAILURE, hold_local_address, hold_peer_address) else ``` ``` report_security_event(my_identifier, MINOR, OPERATIONAL_VIOLATION, OTHER_FAILURE, hold_local_address, hold_peer_address); end; from WFKR to ACTIVE when K.REPLACEresp provided (direction =up_stack) and (status =assoc_ok) (* Key replacement complete; continue decoding/decapsulation of SE TPDU for output to user.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Formal Description of the SDNS Security Protocol at Layer 4 (SP4).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.3.3. Human Management-Provided Properties according to NIST Non-Fungible Token Security According to Non-Fungible Token Security, 3.3.3. Human Management-Provided Properties: The human management of the NFT smart contract should provide the properties of unique , authentic , and authorized . These properties are described below.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Non-Fungible Token Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings provide? (Section 13) ent common interface could serve as a model. He argued that a unified interface makes things much simpler, and from this standpoint gave an optimistic assessment of PDF signing and encryption support. Anders Rundgren discussed webform signing, which is already used by millions in Europe, largely for citizen-to-government transactions. However, the systems used are proprietary and non-interoperable, so Rundgren is launching the WASP (Web Activated Signature Protocol) standards proposal in cooperation with five groups in Europe. The WASP use cases all stem from efforts to increase usage of e-government. Sandhu discussed prospects for transaction signatures, as vs. document signatures - addressing the many potential applications in which there are many transactions requiring only a modest level of assurance, instead of a few transactions requiring high assurance. One key difference is that where document signatures are generally humanverified, transaction signatures are verified by a computer, "with possibly human audit and recourse forensics". Both Rundgren and Sandhu noted the Outlook Express "Security Warning" black screen as a particularly egregious example of how not to design a user interface for email security. In the discussion, Rich Guida stressed the importance of asking "Is it better than the way we do it now?" Guida suggested that even with their imperfections, any of the signing mechanisms presented in the panel would be better than paper-based signature processes like signing every line of a form. Guida noted that SAFE (http://www.safe-biopharma.org) is working on a universal signing interface. One of the project contractors has developed an approach to verifying historical digital signatures, based on retrieving historical CRLs. This sparked controversy about record-retention issues more generally.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EP-67 in Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)? (Part 101) Control EP-67: • To assess the degree of industry and vertical market fragmentation. • To point towards actions that can increase the effectiveness of IoT standardisation, to improve interoperability, and to allow for the building of IoT ecosystems | | | ETSI TR 118 518 V2.0.0 (2016-09) | ETSI | oneM2M; Industrial Domain Enablement (oneM2M TR-0018 version 2.0.0 Release 2) The present document collects the use cases of the industrial domain and the requirements needed to support the use cases collectively. In addition, it identifies the necessary technical work needed to be addressed while enhancing future oneM2M specifications. | Approved Standard | | HITRUST CSF v9 10 September 2017 | HITRUST Alliance | Access Control: Control objective: to control access to information, information assets, and business processes based on business and security requirements. Authorized Access to Information Systems: Control Objective: to ensure authorized user accounts are registered, tracked and periodically validated to prevent unauthorized access to information systems. Network Access Control: Control Objective: to prevent unauthorized access to networking services that they have been specifically authorized to use. Authentication and authorization mechanisms shall be applied for users and equipment.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to SSL VPNs? (Part 49) Control ES-1: esource. This makes adding and removing resources to and from a group transparent to the users and reduces policy complexity. In some specific instances, user-level parameters are also set. Table 3-1. Access Control Examples | Method | Example | |--------------|--------------------------------------------------------------------------------------------------------| | Per-user | The CEO may access all intranet servers, email, and the executive folder of the administrative server. | | Per-group | Sales staff may access email, the organization's intranet, and the sales server. | | Per-resource | All users and groups may access the Community Relations server. | Access control can also be integrated with endpoint security controls. SSL VPNs can use host integrity checking to check the status of the SSL VPN client before access is granted. Some SSL VPNs have the capability to perform this checking either before or after authentication to determine the appropriate access controls. Access control in this sense may be as simple as allowing or denying access completely, or more elaborate such as providing restricted access to selected information based on host integrity checks. Access controls may also be configured per-user, per-group, and per-resource in terms of host integrity checking. It is beneficial to have the ability to bypass the endpoint security restrictions for certain circumstances such as disaster response. Bypassing endpoint security for special circumstances may be accomplished through a special access control policy setting or whitelist. Table 3-2 shows some examples of access control policies in conjunction with endpoint security controls. These examples are an extension of the examples in Table 3-1. The first user is the CEO, who is accessing the SSL VPN from home via an organization-issued laptop.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Guide to SSL VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Workshop on Security Procedures for the Interchange of Electronic Documents_ Selected Papers and Results provide? (Section 30) high level of risk in that category, as well as a significant confidentiality risk. A particular type of electronic document may have different levels of risk for different categories or applications. For example, purchase orders used for low-dollar-value transactions may be determined to have low authentication risk, while otherwise identical purchase orders used for high-value transactions may carry a greater risk. For establishment of particular protective techniques, the likelihood of occurrence of the several types of exposures must be considered and it must be determined, in a general sense, what expense is reasonable for protection against them. This is the essential requirement of the Computer Security Act of 1987, which assigns to NIST responsibility for developing standards and guidelines needed to assure the cost-effective security and privacy of sensitive information in Federal computer systems. The Act states that implementation of protective techniques shall be "commensurate with the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of the information ..." For messages where confidentiality is a major issue, it might be determined that it is worth the expenditure to protect against eavesdropping if that can be done at a reasonable cost and with reasonable administrative simplicity. For messages for which assurance of delivery is an issue, or for which undesired changes in numerical values contained within the message would be seriously detrimental, appropriate protections may be recommended, again using reasonable cost and administrative simplicity as criteria. The kinds of protective techniques associated with documents embodied in paper media must be appropriate to the media, and analogous electronic techniques at the same level of protection must be appropriate to the new medium.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Workshop on Security Procedures for the Interchange of Electronic Documents_ Selected Papers and Results.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain A failure in control item effectiveness results in a defect in one or more of the following defect checks: according to NIST Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management According to Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management, A failure in control item effectiveness results in a defect in one or more of the following defect checks:: | Determination Statement ID | Defect Check ID | Defect Check Name | Rationale If an [organization-defined measure] for this defect check is above [the organization- defined threshold], then defects in conducting reviews and updates of the {actual state} system component inventory {for devices and device components}" with the "organization-defined frequency" related to this control item might be the cause of ... | |------------------------------|-------------------|-----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | CM-8(b)(1) | HWAM- Q04 | Low Timeliness Metric | low timeliness of overall ISCM reporting. |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Enhanced Security Requirements for Controlled Unclassified Information say about GLOSSARY? (Part 14) According to Assessing Enhanced Security Requirements for Controlled Unclassified Information, GLOSSARY: ng as intended. Also used to refer to units of related data fields (i.e., groups of data fields that can be accessed by a program and that contain the complete set of information on particular items). | | risk [OMB A-130] | A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically is a function of: (i) the adverse impact, or magnitude of harm, that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | risk assessment [SP 800-30] | The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of a system. | |-----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | sanitization | Actions taken to render data written on media unrecoverable by both ordinary and, for some forms of sanitization, extraordinary means. Process to remove information from media such that data recovery is not possible. | | security | A condition that results from the establishment and maintenance of protective measures that enable an organization to perform its mission or critical functions despite risks posed by threats to its use of systems.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Property Management Systems say about 5.2.6 PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties? According to Securing Property Management Systems, 5.2.6 PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties: The access control platform, TDi ConsoleWorks 5.2-0u1, and network protection device, CryptoniteNXT Secure Zone 2.9.1, work in combination to limit access in the least allowable fashion to only those authorized entities, users, systems, transactions, and platforms. Connections that are authorized are given the least level of privilege as feasible.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Securing Property Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Usage Restrictions according to NIST Secure Data Network Systems (SDNS) Key Management Documents According to Secure Data Network Systems (SDNS) Key Management Documents, Usage Restrictions: Only the initiator of the application association may request the K-EXCH-CRED service, except after a K-TRY-ME or K-NO-KEY service. After a K-TRY-ME or K-NO-KEY service, only the responder of the application association service may request the K-EXCH-CRED. The K- EXCH-CRED service must be (*or must have been) invoked prior to the use of the following services: - 0 K-TEK-ATTRIBUTES - 0 K-IREKEY - 0 K-REQUEST-SREKEY - o K-DELIVER-SREKEY - o K-GET-CRL - 0 K-UPDATE-TEK* - 10.1.3. Disrupted Services The K-EXCH-CRED service does not disrupt any services. - 10.1.4. Disrupting Services 10.2. The A-ABORT and the A-P-ABORT services disrupt the K-EXCH-CRED service. - K-TRY-ME Service Sequencing Information - 10.2.1. Type of Service K-TRY-ME is an unconfirmed service. - 10.2.2. Usage Restrictions Only the initiator of the application association may request the K-TRY-ME service. - 10.2.3. Disrupted Services The K-TRY-ME service does not disrupt any services. - 10.2.4. Disrupting Services 10.3. The A-ABORT and the A-P-ABORT services disrupt the K-TRY-ME service.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Engineering Trustworthy Secure Systems say about Authority? According to Engineering Trustworthy Secure Systems, Authority: This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: Information is represented internally within systems using abstractions known as

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Technical Guide to Information Security Testing and Assessment say about 3.2 Log Review? (Part 1) According to Technical Guide to Information Security Testing and Assessment, 3.2 Log Review: 3.2 Log Review Log review determines if security controls are logging the proper information, and if the organization is adhering to its log management policies. 7 As a source of historical information, audit logs can be used to help validate that the system is operating in accordance with established policies. For example, if the logging policy states that all authentication attempts to critical servers must be logged, the log review will determine if this information is being collected and shows the appropriate level of detail. Log review may also reveal problems such as misconfigured services and security controls, unauthorized accesses, and attempted intrusions. For example, if an intrusion detection system (IDS) sensor is placed behind a firewall, its logs can be used to examine communications that the firewall allows into the network. If the sensor registers activities that should be blocked, it indicates that the firewall is not configured securely. 6 This publication discusses reviews strictly from the aspect of assessment. Reviews should also be conducted periodically as part of regular system monitoring and maintenance, such as to identify operational problems, security misconfigurations, malicious activity, and other types of security events. Organizations can choose to use findings from operational reviews for their assessments. 7 NIST SP 800-92, Guide to Security Log Management , provides more information on security log management methods and techniques, including log review. It is available at Examples of log information that may be useful when conducting technical security assessments include: - GLYPH<c=31,font=/DGCOEC+Webdings> Authentication server or system logs may include successful and failed authentication attempts.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Technical Guide to Information Security Testing and Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-16(01) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control AC-16(01): SECURITY AND PRIVACY ATTRIBUTES | DYNAMIC ATTRIBUTE ASSOCIATION ASSESSMENT OBJECTIVE: Determine if:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Requirements and Conformance Test Assertions for ANSI_NIST-ITL 1-2011 Record Type 18 - DNA Record say about 2.2 Record Type 18 Table of Requirement and Assertions? According to Requirements and Conformance Test Assertions for ANSI_NIST-ITL 1-2011 Record Type 18 - DNA Record, 2.2 Record Type 18 Table of Requirement and Assertions: In preparation for extending BioCTS for AN-2011 to support conformance testing of AN-2011 Record Type 18, the BioCTS team identified over two-hundred test assertions that are necessary to meet the conformance requirements for this Record Type. The test assertions have been organized into a table of requirements and assertions following the format documented in NIST Special Publication 500-295 [8]. Table B.1, which identifies all requirements and associated test assertions for Type 18, uses the test assertion syntax documented Tables 2.1, 2.2, and 2.3 found in Section 2.3. The tables define the Operator Definitions, Terms, and Operand Definitions respectively and are also specified in NIST SP 500-295, section 5.5 - Test Assertion Syntax. They have been reproduced in their entirety in this document for consistency, although some entries in the tables may not be used in the test assertions for Record Type 18. Table B.1 headings are also defined in NIST SP 500-295, Section 5.6 (Tables of requirements and assertions - Table headers) with the exception of Requirement number. Not all test notes included in NIST SP 500-295 apply to the Record Type 18 Table. The three test notes referred to in table B.1 are included below the table. Test Notes 2 and 6 are the same test notes found in NIST SP 500-295, Section 6.3. Test note 18 applies only to Record Type 18. Conformance test levels are defined in NIST's Special Publication 500-295 Section 5.3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Requirements and Conformance Test Assertions for ANSI_NIST-ITL 1-2011 Record Type 18 - DNA Record.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is The local exploit level can be captured using two environmental metrics according to The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities? The local exploit level can be captured using two environmental metrics: Local Vulnerability Prevalence and Perceived Target Value.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure say about 5.2.1. Identity Management, Authentication and Access Control Category? (Part 3) According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure, 5.2.1. Identity Management, Authentication and Access Control Category: | Ecosystem: Consider implementing formal procedures and guidelines to issue, manage, and verify identities and credentials. Credential management may be performed by an independent entity. This may include the management of authentication mechanisms (e.g., single-factor, multi-factor) and unique identifiers, such as usernames, passwords, certificates, biometrics, smart cards, and hardware tokens. Implement mechanisms to track, log, approve, and audit access attempts and activities of devices within the ecosystem. Identities/credentials stored within the ecosystem may include manufacturer identities, employee identities, supplier identities, provider identities, device identities, test and validation certificates, software certificates, and system administration credentials. Consider that credentials should be promptly accredited and decommissioned when issued and revoked.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain IN SUMMARY according to NIST A Study of Federal Agency Needs for Information Technology Security According to A Study of Federal Agency Needs for Information Technology Security, IN SUMMARY: Those organizations the study team worked with and visited appear to have a deep commitment to securily, despite a number of constraints, limitations, and frustrations. They are looking for a clear statement of what is required and expected of them with regard to security - and they expect these requirements to make sense and to be consistent with their other requirements. While agencies regard NIST as one important source for help, they are by no means standing Idly by. They are actively developing programs that work for them. They are also beginning to coordinate their efforts with other agencies. There is clearly a need for federal agencies to continue to be proactive regarding security and define the role they will assume in their own behalf. In this regard, it is recommended that federal agencies continue to monitor their security needs, communicate these needs to the central agencies, seek sources of help from within the federal community, and be generous in the sharing of their own experiences, efforts, and products. Finally, this study is but one piece of a much larger mosaic. We believe this study is an important element in providing a sound basis for planning future NIST security-related efforts. In addition to NIST and the other central agencies, each agency's staff, including agency security, management, and individual users, are among those who play an integral role in providing comprehensive security for the federal government. In deciding where to apply resources and energies, it is Important to take into account the roles and relationships among all these players. There is an open invitation and welcome for all to join in the search for and development of solutions that serve our community.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of Federal Agency Needs for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Dictionary Maintainer according to Common Platform Enumeration_ Dictionary Specification Version 2.3? Dictionary Maintainer: An organization that manages a CPE dictionary and all processes relating to that CPE dictionary. In the majority of cases, the organization that serves as the dictionary creator for a specific CPE dictionary will also serve as the dictionary maintainer. Otherwise, generally the dictionary maintainer is supporting the dictionary on behalf of the dictionary creator.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Platform Enumeration_ Dictionary Specification Version 2.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to SSL VPNs provide? (Section 151) n properly when proxying is used, so network extension must be used. - -When users login from public hosts that are not organization-managed, they can access a set of Web-based applications via proxy. - -The set of HR applications are accessible by network extension because some require many interlocking programs and cannot be accessed by other means. Table 7-1 summarizes the organization's access control policy. Table 7-1. Organization's Access Control Policy | Resource | Group | Condition | Access Type | |---------------------------------------------|----------|--------------------------------------------------------------------------------------------------------------------------|-------------------| | Internal resources (except HR applications) | Users | Organization-managed host | Network extension | | Web applications | Users | Any host running a recent version of Windows with critical updates installed and updated antivirus and firewall software | Proxy | | HR applications (only) | HR users | Organization-managed host | Network extension | The organization designs an endpoint security policy to enforce access control. The policy is mainly driven by a prelogin sequence executed by the SSL VPN appliance before a user logs in. This sequence runs host integrity checks that require the host to download and run active content controls. These controls or applets ensure that the host complies with the organization's endpoint security policy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to SSL VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Metrics and Methodology for Hardware Security Constructs say about 5. Methodology for Hardware Weakness Threat Analysis? (Part 8) According to Metrics and Methodology for Hardware Security Constructs, 5. Methodology for Hardware Weakness Threat Analysis: Mapping a newly discovered attack technique to an existing generalized class of attacks is a relatively straightforward process. The third step of the methodology involves performing a simple matrix multiplication to identify correlations between the most common hardware weaknesses and standard attack patterns. Table 6T shows the result of multiplying the matrices in Table 4 and Table 5. Table 6.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Metrics and Methodology for Hardware Security Constructs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Building Secure Microservices-based Applications Using Service-Mesh Architecture provide? (Section 16) 5 of the OSI model) concerns. However, fine-grained authorization may still need to be performed at the microservice level since that is the only entity that has full knowledge of the business logic. Alternatively, the Service Mesh can be defined as 'a distributed computing middleware that optimizes communications between application services [3].' The service-to-service communication is most effectively enabled using a proxy (see Section 1.1). A Service Mesh is typically implemented as an array of lightweight network proxies that are deployed alongside application code without the application needing to be aware [4]. In addition, the Service Mesh can be leveraged to monitor and secure communication. Because it is intercepting and routing all cluster traffic and gathering health metrics, the Service Mesh can learn and intelligently route traffic. Examples of this higher-level functionality include A/B testing, canary deployments, beta channels, automatic retries, circuit breakers, and injecting faults. These features are only possible because the Service Mesh is able to view and learn from the entire cluster's traffic. It is considered economical to deploy Service Mesh when the number of microservices in the application is in the order of hundreds or thousands. However, the Service Mesh is not without some drawbacks. Because each microservice requires its own service proxy, the number of runtime instances and the overall attack surface for the application increases. As the functionality built into a service proxy increases, it may become a communication bottleneck. A Service Mesh consists of two main architectural layers or components: - Data plane - Control plane The interconnected set of proxies in a Service Mesh that control the inter-services communication represents its data plane. The data plane is the data path and provides the ability to forward requests from the applications.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Building Secure Microservices-based Applications Using Service-Mesh Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events say about Continuous Monitoring? (Part 1) According to Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events, Continuous Monitoring: Continuous Monitoring Maintaining ongoing awareness to support organizational risk decisions SOURCE: NIST SP 800-137 Cybersecurity Prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation SOURCE: CNSSI 4009-2015 (NSPD-54/HSPD-23) Data A subset of information in an electronic format that allows it to be retrieved or transmitted SOURCE: CNSSI-4009 Data Integrity The property that data has not been changed, destroyed, or lost in an unauthorized or accidental manner SOURCE: CNSSI-4009 Information Security The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability SOURCE: FIPS 199 (44 U.S.C., Sec. 3542) Information Security Risk The risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation due to the potential for unauthorized access, use, disclosure, disruption, modification, or destruction of information and/or information systems SOURCE: CNSSI 4009-2015 (NIST SP 800-30 Rev. 1) Information System A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information SOURCE: FIPS 200 (44 U.S.C., Sec. 3502) Insider An entity inside the security perimeter that is authorized to access system resources but uses them in a way not approved by those who granted the authorization SOURCE: NIST SP 800-82 Rev. 2 (RFC 4949) Kerberos An authentication system developed at the Massachusetts Institute of Technology (MIT).

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Report on Lightweight Cryptography according to NIST Report on Lightweight Cryptography According to Report on Lightweight Cryptography, Report on Lightweight Cryptography: Kerry A. McKay Larry Bassham Meltem Sönmez Turan Nicky Mouha Computer Security Division Information Technology Laboratory This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8114 March 2017 <!-- image --> U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report on Lightweight Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on PDA Forensics say about 1.1 Authority? According to Guidelines on PDA Forensics, 1.1 Authority: The National Institute of Standards and Technology (NIST) developed this guide in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all Federal agency operations and assets; but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), 'Securing Agency Information Systems,' as analyzed in A130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III. This guide has been prepared for use by Federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright, though attribution is desired. Nothing in this guide should be taken to contradict standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority, nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Guidelines on PDA Forensics.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to 2016 NIST_ITL Cybersecurity Program Annual Report? https: / /nccoe.nist.gov/projects/use\_cases/securingsensitive-consumer-data

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Survey of Remote Monitoring say about Remotely Controlled Software Monitors? (Part 1) According to A Survey of Remote Monitoring, Remotely Controlled Software Monitors: Remotely Controlled Software Monitors A remotely controlled software monitor can be implemented as simply as a system log monitor. The purpose of the monitor is limited only by the ingenuity of the impl ementers , e'g. it may monitor the CPU utilization, inspect resource utilization, etc. In a pure software monitor, the monitor is instigated, for a particular run, by an operator, a system clock, or it is set for cyclic invocation at system initiation time. A remotely controlled software monitor is triggered by a central monitor controller. There are two prominent examples of actual implementations which employ this technique: the first example is the WWMCCS ADP System Security Officer (WASSO) station, 29j42 gp^ ^1^^ second example is a technique used on Control Data computers. ^ ^' The WASSO station potentially could be implemented as a true remotely controlled software monitor, or as a monitor distributed between a software tool and an intelligent terminal; the former case is discussed in this section. Most sites in the WWMCCS are centered around a Honeywell 6000 series computer under the GCOS III operating system. Each site is potentially processing sensitive data in a multiprogramming environment; thus, there is a need for a secure operating policy in the system. Each such site has at least one ADP System Security Officer whose mission is to monitor the physical protocol of the site, as well as the internal operation of the system. The WASSO station is under development to aid the officer in the latter part of his mission by providing a facility to implement collection, reduction, and analysis of information necessary to assess the site's security posture. The current status of the WASSO study is that a prototype system is being built, and this prototype will partially rely on the standard software tools that exist in the operating system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Survey of Remote Monitoring.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Telehealth Remote Patient Monitoring Ecosystem provide? (Section 366)  Ability to prevent external access to the IoT device management interface.  Ability to control the IoT device's logical interface (e.g., locally or remotely).  Ability to detect remote activation attempts.  Ability to detect remote activation of a collaborative computing device/component (e.g., microphone, camera).  Ability to detect remote activation of sensors.  Ability to establish access to the IoT device to perform organizationally defined user actions without identification or authentication.  Ability to assign roles to IoT device user accounts.  Ability to support a hierarchy of logical access privileges for the IoT device based on roles (e.g., admin, emergency, user, local, temporary) o Ability to establish user accounts to support role- based logical access privileges. o Ability to administer user accounts to support role- based logical access privileges. o Ability to use organizationally defined roles to define each user account's access and permitted device actions. |  Providing descriptions of the types of access to the IoT device that the manufacturer will require on an ongoing or regular basis.  Providing detailed instructions for how to implement management and operational controls based on the role of the IoT device user, and not on an individual basis.  Providing documentation and/or other communications describing how to implement management and operational controls to protect data obtained from IoT devices and associated systems from unauthorized access, modification, and deletion.  Providing a detailed description of the other types of devices and systems that will access the IoT device during customer use of the device, and how they will access it.  Providing communications and detailed instructions for implementing a hierarchy of privilege levels to use with the IoT device and/or necessary associated information systems.  Providing communications and documentation detailing how to perform | .

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Access Control Documents say about 3.3 Layer 7 E-Mail? (Part 3) According to Secure Data Network Systems (SDNS) Access Control Documents, 3.3 Layer 7 E-Mail: eer-to-peer characteristics which are necessary for SDNS components to guarantee enforcement without relying on processing performed within non-SDNS intermediate entities (e.g., mail staging systems). User-level COMPOSITE IDs will contain one of two separate classes of clearance/accreditation information: a first class (USER DATA) specifying the user's clearance information, and a second class (END SYSTEM DATA) reflecting those end system characteristics (e.g., authorized sensitivity levels and other inputs to risk index computations) which are needed in order to constrain dataflows appropriately. If the user moves to an alternate end system, the alternate end system's END SYSTEM DATA, rather than the home end system's END SYSTEM DATA, would become relevant. This implies that the process performed in order to activate a user's ID at an alternate end system must, in effect, associate USER DATA information with the applicable end system's END SYSTEM DATA.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Secure Data Network Systems (SDNS) Access Control Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research provide? (Section 74) zeroize the token containing the DPC, MyID will revoke all certificates. In this scenario, using one of MyID's several mechanisms to revoke credentials, an operator can use the Remove Person workflow. The Remove Person workflow will revoke all active credentials and associated certificates immediately. The MyID Operator removes a Subscriber by using the People  Remove Person workflow as shown in Figure 49. Figure 49: MyID Remove Person <!-- image --> The MyID Operator selects the reason for termination as shown in Figure 50. Figure 50: MyID Remove Person Reason Selection <!-- image --> The MyID CMS will revoke all certificates associated with the Subscriber's record. The serial numbers of the certificates will appear in the next DPC PIV CA and DPC LOA-3 CA CRL publications as shown in Figures 51 and 52. <!-- image --> Figure 51: Subscriber's PIV Authentication Certificate and CRL Entry <!-- image --> Figure 52: Subscriber's Derived PIV Authentication Certificate and CRL Entry <!-- image --> Section 4.3 of this report describes the services that the user will be accessing using their DPCs. Microsoft Office 365 'single sign-on' allows customers to use their organization credentials to access Office 365 services. This capability is provided through ADFS or third-party single signon providers. 36 At the time of this report's publication, the various Office 365 services use different protocols. For the user to be prompted for his or her X.509-based credential at time of authentication, the Web Services Federation (WS-Federation) passive requester profile 37 is used. Office 365 Outlook Web Access, SharePoint, and OneDrive use WS-Federation. The ADFS Identity Provider Security Token Service (IdP STS) authenticates the user to AD and generates a SAML token asserting the user's identity. Within this token is the authenticating user's AD UserPrincipalName (UPN) and ObjectGUID, a unique AD object.

Explanation: NIST publication on credential and access management. Topics: authentication, token, single sign-on. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Key Notarization System for Computer Networks say about 11.3 THE REG EIVER? According to A Key Notarization System for Computer Networks, 11.3 THE REG EIVER: Once user j is active, and has received the encrypted DKij, IV, and data, he may use LDK and LIV to load the receive active storage. He can then decrypt and check the signature to insure that it is correct. Note that the same data key may be used for both encryption and digital signatures. If j wishes he can generate a DKji to communicate securely to i, but communications from j to i will not be encrypted with the same data key as communications from i to j ·

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Key Notarization System for Computer Networks.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Segmentation in a Small Manufacturing Environment say about Why should I implement Security Segmentation?? (Part 1) According to Security Segmentation in a Small Manufacturing Environment, Why should I implement Security Segmentation?: Why should I implement Security Segmentation? Table 1 shows how security segmentation helps address some common cybersecurity weaknesses that most small manufacturing environments face. Table 1. How Security Segmentation Addresses Common Weaknesses | Common Weakness | Security Segmentation | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Incomplete or nonexistent asset inventory: without an asset inventory, it is difficult to identify vulnerabilities or to mitigate them in devices and on the network.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Segmentation in a Small Manufacturing Environment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 590) rts, protocols, or services that pose unnecessarily high risks and understand the trade-offs involved in blocking specific ports, protocols, or services or requiring system service providers to do so. Early identification of functions, ports, protocols, and services avoids costly retrofitting of controls after the system, component, or system service has been implemented. SA-9 describes the requirements for external system services. Organizations identify which functions, ports, protocols, and services are provided from external sources. Related Controls: CM-7, SA-9. (10) ACQUISITION PROCESS | USE OF APPROVED PIV PRODUCTS Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems. Discussion: Products on the FIPS 201-approved products list meet NIST requirements for Personal Identity Verification (PIV) of Federal Employees and Contractors. PIV cards are used for multi-factor authentication in systems and organizations. Related Controls: IA-2, IA-8, PM-9. (11) ACQUISITION PROCESS | SYSTEM OF RECORDS Include [Assignment: organization-defined Privacy Act requirements] in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function. Discussion: When, by contract, an organization provides for the operation of a system of records to accomplish an organizational mission or function, the organization, consistent with its authority, causes the requirements of the [PRIVACT] to be applied to the system of records. Related Controls: PT-6. (12) ACQUISITION PROCESS | DATA OWNERSHIP (a) Include organizational data ownership requirements in the acquisition contract; and (b) Require all data to be removed from the contractor’s system and returned to the organization within [Assignment: organization-defined time frame].

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor. Contains security framework guidance for authentication systems. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Random Bit Generator (RBG) Constructions say about 3.2.2.1. External Conditioning When Full Entropy is Not Required? According to Recommendation for Random Bit Generator (RBG) Constructions, 3.2.2.1. External Conditioning When Full Entropy is Not Required: The Get\_conditioned\_input procedure specified below iteratively requests entropy from the Get\_entropy\_bitstring process (represented as a Get\_entropy\_bitstring procedure; see Sec. 2.8.2 and 3.1) and distributes the entropy in the newly acquired entropy\_bitstring across the conditioning function's output block. The output of the Get\_conditioned\_input procedure is the concatenation of the conditioning function output blocks. The entire output of the 12 Any padding required could be done before submitting the entropy\_bitstring to the CBC-MAC function. Get\_conditioned\_input procedure shall be provided as input to the DRBG mechanism (i.e., the output of the Get\_conditioned\_input function shall not be truncated). Let output\_len be the length of the conditioning function's output block.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Bit Generator (RBG) Constructions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Automation Support for Security Control Assessments_ Software Asset Management provide? (Section 248) | Determine if the organization: employs integrity verification tools to detect unauthorized changes to [Assignment: an organization-defined subset of software, firmware, and information]. | | Determination Statement ID | Implemented By | Assessment Boundary | Assessment Responsibility | Assessment Methods | Selected | Rationale for Risk Acceptance | Frequency of Assessment | Impact of Not Implementing | |------------------------------|------------------|-----------------------|-----------------------------|----------------------|------------|---------------------------------|---------------------------|------------------------------| | SI-7{1} | ISCM-Ops | ISCM-TN | ISCM-Sys | Test | | | | | A failure in effectiveness of this control item results in a defect in one or more of the following defect checks: | Determination Statement ID | Defect Check ID | Defect Check Name | Rationale If an [organization-defined measure] for this defect check is above [the organization-defined threshold], then defects in employing integrity verification tools to detect unauthorized changes to specified software related to this control item might be the cause of the defect, i.e.,… | |------------------------------|-------------------|---------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | SI-7{1} | SWAM- F01 | Unauthorized software executes | the execution of unauthorized software.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CP-09 in Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations? (Part 61) Control CP-09: . Update risk assessments [ Assignment: organization-defined frequency ]. ## DISCUSSION Establishing the system boundary is a prerequisite to assessing the risk of the unauthorized disclosure of CUI. Risk assessments consider threats, vulnerabilities, likelihood, and adverse impacts to organizational operations and assets based on the operation and use of the system and the unauthorized disclosure of CUI. Risk assessments also consider risks from external parties (e.g., contractors operating systems on behalf of the organization, service providers, individuals accessing systems, and outsourcing entities). Risk assessments can be conducted at the organization level, the mission or business process level, or the system level and at any phase in the system development life cycle. Risk assessments include supply chain-related risks associated with suppliers or contractors and the system, system component, or system service that they provide. ## REFERENCES Source Controls: RA-03, RA-03(01), SR-06 Supporting Publications: SP 800-30 [55], SP 800-161 [33] ## 03.11.02 Vulnerability Monitoring and Scanning - a. Monitor and scan the system for vulnerabilities [ Assignment: organizationdefined frequency ] and when new vulnerabilities affecting the system are identified. - b. Remediate system vulnerabilities within [ Assignment: organization-defined response times ]. - c. Update system vulnerabilities to be scanned [ Assignment: organization-defined frequency ] and when new vulnerabilities are identified and reported. ## DISCUSSION Organizations determine the required vulnerability scanning for system components and ensure that potential sources of vulnerabilities (e.g., networked printers, scanners, and copiers) are not overlooked. Vulnerability analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, or binary analysis.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about III. Sensitive But Unclassified Information? According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, III. Sensitive But Unclassified Information: In addition to information that could reasonably be expected to assist in the development or use of weapons of mass destruction, which should be classified or reclassified as described in Parts I and II above, departments and agencies maintain and control sensitive information related to America's homeland security that might not meet one or more of the standards for classification set forth in Part 1 of Executive Order 12958. The need to protect such sensitive information from inappropriate disclosure should be carefully considered, on a case-by-case basis, together with the benefits that result from the open and efficient exchange of scientific, technical, and like information. All departments and agencies should ensure that in taking necessary and appropriate actions to safeguard sensitive but unclassified information related to America's homeland security, they process any Freedom of Information Act request for records containing such information in accordance with the Attorney General's FOIA Memorandum of October 12, 2001, by giving full and careful consideration to all applicable FOIA exemptions. See FOIA Post, "New Attorney General FOIA Memorandum Issued" (posted 10/15/01) (found at http://www.usdoj.gov/oip/foiapost/2001foiapost19.htm), which discusses and provides electronic links to further guidance on the authority available under Exemption 2 of the FOIA, 5 U.S.C. § 552(b)(2), for the protection of sensitive critical infrastructure information. In the case of information that is voluntarily submitted to the Government from the private sector, such information may readily fall within the protection of Exemption 4 of the FOIA, 5 U.S.C. § 552(b)(4).

Explanation: NIST publication discussing classified information handling. References: classified, sensitive but unclassified. Contains guidance on protecting sensitive government information. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: Hardware integrity verification allows organizations to detect unauthorized

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems provide? (Section 68) or Program [M0942] Limit Software Installation [M1033] | CM1.1 COMP 1.1 | | Guideline 7: Protect Communications Connections | Guideline 7: Protect Communications Connections | Guideline 7: Protect Communications Connections | Guideline 7: Protect Communications Connections | Guideline 7: Protect Communications Connections | Guideline 7: Protect Communications Connections | | PR.IR-01 | 12.2 | Boundary Protection [SC-7] | DS: COM(1) DO: SMP(5h) | Network Segmentation [M0930] | NET 1.1 | The NVD was reviewed in early 2022 to better understand known cybersecurity vulnerabilities that have been identified in smart inverters.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2012 Annual Report provide? (Section 37) :df00) outreach activities with academic institutions, providing information on NIST's security standards and guidelines and exploring new areas of cybersecurity research and development. In FY2012, CSD completeGLYPH(cmap:df00) the following activities: -  DevelopeGLYPH(cmap:df00) NIST SP 800-30, Revision 1, Guide for Conducting Risk Assessments ; -  DevelopeGLYPH(cmap:df00) GLYPH(cmap:df00)raft SP 800-53, Revision 4, Recommended Security Controls for Federal Information Systems and Organizations ; -  Released example security assessment cases for assessment proceGLYPH(cmap:df00)ures in SP 800-53A, Revision 1, Guide for Security Assessment of Federal Information Systems and Organizations: Building Effective Security Assessment Plans ; and -  CollaborateGLYPH(cmap:df00) with the ITL Software anGLYPH(cmap:df00) Systems Division and the NIST Standards CoorGLYPH(cmap:df00)ination Office using the International StanGLYPH(cmap:df00)arGLYPH(cmap:df00) ISO/IEC 17020:2008 General criteria for the operation of various types of bodies performing inspections , in support of GSA in establishing a process for qualifying Third Party Assessment Organizations (3PAOs) to conGLYPH(cmap:df00)uct security assessments of Cloud Service Providers (CSPs) information systems consistent with GSA requirements based on NIST standards and guidelines.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-2 in Computer Security Division 2004 Annual Report? (Part 58) Control HA-2: uirements to evaluate vendors' operational procedures, review third-party audits and assess operational compliance demonstrations when establishing the initial list of three approved PKI providers. It has been asked why the SSP system is necessary when services are currently available under the Access Certificates for Electronic Services (ACES) program or the GSA smart card contract. The SSP Program does not establish a contract but creates a qualified bidders list. The SSP Subcommittee does not want to limit agencies to one solution. The SSP Subcommittee does want to set a standard for PKI that implements a common policy in the Federal government that ensures a minimum level of security and quality when agencies contract for PKI services. CSD, as part of the SSP Subcommittee, has developed the Shared Service Provider Roadmap. The Shared Service Provider Roadmap is intended to identify the background information, phases and activities related to the selection process for prospective PKI managed service providers. This document identifies the process by which a vendor qualifies for inclusion on the Qualified Bidders List. The document also describes requirements that must be met to maintain qualification, as well as contracting considerations. We are also assisting GSA in the development of an online e-authentication credential validation infrastructure. The GSA e-Authentication Gateway will mediate between government applications and non-government CSPs, permitting applications to accept a variety of identification credentials. For example, individuals may be able to leverage authentication mechanisms, such as passwords, established with their banks to access government applications. The GSA E-Authentication Gateway architecture relies on SAML, TLS and PKI to exchange authentication information with CSPs and government applications.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Computer Security Division 2004 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2016 NIST_ITL Cybersecurity Program Annual Report say about https:/ /doi.org/10.1109/TIFS.2016.2516916? According to 2016 NIST_ITL Cybersecurity Program Annual Report, https:/ /doi.org/10.1109/TIFS.2016.2516916: Network diversity has long been regarded as a security mechanism for improving the resilience of software and networks against various attacks. More recently, this diversity has found new applications in cloud computing security, moving-target defense, and improving the robustness of network routing. However, most existing efforts rely on intuitive and imprecise notions of diversity, and the few existing diversity models are mostly designed for a single system running diverse software replicas or variants. At a higher abstraction level, as a global property of the entire network, network diversity and its effect on security have received limited attention. In this paper, we take the first step toward formally modeling network diversity as a security metric by designing and evaluating a series of diversity metrics. In particular, we first devise a biodiversity-inspired metric based on the effective number of distinct resources. We then propose two complementary diversity metrics, based on the least and the average attacking efforts, respectively. We provide guidelines for instantiating the proposed metrics and present a case study on estimating software diversity. Finally, we evaluate the proposed metrics through simulation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Secure Web Services provide? (Section 148) user authentication. Set up an end-to-end user authentication mechanism that reaches from requesters to the mainframe or other backend legacy server. - Establish an end-to-end encrypted data channel. Use encryption from the individual requesters to the Web service interface and from the Web service interface to the legacy backend system. This is done to ensure that sensitive data are not exposed in transit over external and internal networks. If the 55 For further guidance on public key implementation, see NIST SP 800-32, Introduction to Public Key Technology and the Federal PKI Infrastructure and NIST SP 800-44, Guidelines on Securing Public Web Servers, available at http://csrc.nist.gov/publications/nistpubs/. backend system does not natively support encrypted data channels, IPsec or SSL tunneling software can provide an encrypted data channel. - Implement public key security end-to-end. Deploy public key components all the way from the requester to the backend system and integrate them with existing security systems. In addition to certificate-based identification and authentication (I&A), the Web service will also need to perform application-level monitoring and auditing of Web connections, access events, and security violations. In certain high-risk environments, a second factor of authentication, in addition to PKI certificate-based I&A, may be desired. This second factor may include a static password, a dynamic password, or a biometric. In some applications, the user's initial authentication may be via a second-factor mechanism during the authenticated session. Security for the mainframe was not designed with the SOA processing model in mind. Rather, mainframe security was designed for a closed, well-defined, and tightly controlled environment. Key characteristics of such environments include a known and relatively trusted user population, a well-defined set of applications, and firm connectivity boundaries.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Both finger's template records shall be wrapped in a single CBEFF structure AS05.02.01: prior to storage on the PIV card. according to NIST PIV Data Model Test Guidelines According to PIV Data Model Test Guidelines, Both finger's template records shall be wrapped in a single CBEFF structure AS05.02.01: prior to storage on the PIV card.: e is constructed in accordance with this assertion. VE05.02.01.01: The vendor shall specify in its documentation the CBEFF structur TE05.02.01.01: The tester shall parse the biometric data container to verify this assertion. elf is tested in later assertions. Note: The CBEFF structure its

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Domain Name System (DNS) Deployment Guide provide? (Section 110) e servers is as follows: ``` acl 'valid_secondary_NS' { 224.10.229.5; 224.10.235.6; 239.10.245.25; }; ``` The allow-transfer substatement can be used in a zone statement and in an options statement. When it is used in a zone statement, it can restrict zone transfer for that zone; when it is used in an options statement, it can restrict zone transfer for all zones in the name server. The allow-transfer substatement at the server level is as follows: ``` options { allow-transfer { 'valid_secondary_NS'; }; }; ``` The allow-transfer substatement at the zone level is as follows: ``` zone 'example.com' { type master; file 'zonedb.example.com'; allow-transfer { 'valid_secondary_NS'; }; }; ``` The foregoing statements apply to primary name servers. In the secondary and stealth secondary name servers, zone transfer should be disabled as shown below: ``` zone 'example.com' { type slave; masters { 224.239.5.1; } ; file 'zonedb_bak.example.com'; allow-transfer { none; }; }; ``` NSD has a similar set of tools to restrict zone transfers to only a chosen set of slave servers. Like BIND, the administrator should learn and use the options available in the NSD configuration file. There is no way to create access control lists (ACLs), but an administrator can list the individual IP address of slave servers in the zone statements in the NSD configuration file. In the configuration file, the provide-xfr statement is used in the zone statement block of the nsd.conf file much like a combined masters statement and allow-transfer statement in BIND configuration files: ``` zone: #allow transfer from subnet provide-xfr: 169.192.85.0/24 #prevent transfer from specific IP address in block provide-xfr: 169.192.85.66 BLOCKED ``` Only one IP address should appear in a provide-xfr statement, but the address can be an entire subnet. The provide-xfr statement allows transfers; all other transfer requests are rejected by default.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Domain Name System (DNS) Deployment Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT) provide? (Section 333) t affect supply chain security. These other aspects should be considered directly, where and when they have an impact on security management, including transporting these goods along the supply chain. | Approved Standard | | 20243- 1:2018 | ISO/IEC | Information Technology -- Open Trusted Technology Provider Standard (O-TTPS) Identifies secure engineering best practices, including secure management of the IT products, components, and their supply chains | Approved Standard Conformity Assessment | | 27036- 1:2014 | ISO/IEC | Information technology - Security techniques - Information security for supplier relationships - Part 1: Overview and concepts | Approved Standard | Supply Chain Risk Management (SCRM): Standards that provide the confidence that organizations will produce and deliver information technology products or services that perform as required and mitigate supply chain-related risks, such as the insertion of counterfeits and malicious software, unauthorized production, tampering, theft, and poor quality products and services.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation say about E.3.4.5 Test Case: SIDR-ROV-4.5.1? (Part 2) According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, E.3.4.5 Test Case: SIDR-ROV-4.5.1: 01i-R1-2. The RPKI VC 1 contains all used IP prefixes, but for origin 65509. The RPKI VC 2 contains all used IP prefixes of Traffic A with origin 65511, and IP prefixes of Traffic B with origin 65501. VC 1 should result in invalid for all routes in R1-1, and VC 2 will result in valid for all routes in R1- 2 if validated using the RPKI validation algorithm. All routers are configured to NOT drop invalid . Traffic A is a route originated by AS 65511. Traffic B has three routes: one learned via IBGP network, one via static network, and one via local network. R1-1: Configure the connection to RPKI VC 1 and enable Extended Community String. R1-2: Configure the connection to RPKI VC 2 and enable Extended Community String. The following configuration for Routers AS65501 and AS65501i has been added: | | IPv4 or IPv6? | Both Test Harness or Hardware with Live | |-----------------|--------------------------------------------------------------------------------------------------------------------------| | Procedure | 1. Configure the AS 65511 router to redistribute Traffic A to AS 65501. 2. Configure AS 65501 to redistribute Traffic B. |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Personal Identity Verification (PIV) of Federal Employees and Contractors say about Zone 5B? According to Personal Identity Verification (PIV) of Federal Employees and Contractors, Zone 5B: Physical Characteristics of Cardholder When a cardholder attempts to pass through an access control point for a federally controlled facility, a human guard SHALL perform visual identity verification of the cardholder and SHALL determine whether the identified individual should be allowed through the control point. The following steps SHALL be applied in the visual authentication process: - The guard at the access control entry point determines whether the PIV Card appears to be genuine and has not been altered in any way. - The guard compares the cardholder's facial features with the photograph on the card to ensure that they match. - The guard checks the expiration date on the card to ensure that the card has not expired. - The guard compares the cardholder's physical characteristic descriptions to those of the cardholder. (Optional) - The guard collects the cardholder's signature and compares it with the signature on the card. (Optional) - One or more of the other data elements on the card (e.g., name, employee affiliation, agency card serial number, issuer identification, agency name) are used to determine whether the cardholder should be granted access. Some characteristics of the visual authentication mechanism include the following: - human inspection of the card, - does not provide rapid or high-volume access control, - susceptible to human error, - some resistance to the use of an unaltered card by a non-owner, - low resistance to tampering and forgery, and - does not provide protection against the use of a revoked card.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Personal Identity Verification (PIV) of Federal Employees and Contractors.