You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-201 in Trustworthy Email? (Part 112) Control PS-201: ocol. It is further recommended that the connection between the client and MSA be secured using TLS [RFC5246] [RFC8314], associated with the full range of protective measures described in Section 5.2. ## 7.3.2 Receiving via IMAP Email message receiving, and management occurs between a client and a server using the Internet Message Access Protocol (IMAP) protocol [RFC3501] over port 143 and 993. A client may be located anywhere on the Internet, establish a transport connection with the server, authenticate itself, and manipulate the remote mailbox with a variety of commands. Depending on the server implementation, it is feasible to have access to the same mailbox from multiple clients. IMAP has operations for creating, deleting and renaming mailboxes; checking for new messages; permanently removing messages; parsing; searching; and selective fetching of message attributes, texts and parts thereof. It is equivalent to the local control of a mailbox and its folders. Establishing a connection with the server over TCP and authenticating to a mailbox with a username and password sent without encryption is not recommended. IMAP clients should connect to servers using TLS [RFC5246] [RFC8314], which should be associated with the full range of applicable protective measures described in Section 5.2. ## 7.3.3 Receiving via POP3 Before IMAP [RFC3501] was invented, the Post O ffice Protocol (POP , now POP version 3 or POP3) had been created as a mechanism for remote users to connect to mailbox, download mail, an d delete it off the server . It was expected at the time that access be from a single, dedicated user, with no conflicts . Provision for encrypted transport was not made. �e protocol went through an evolutionary cycle of upgrade s, and the current instance, POP3 [RFC5034] is aligned with the Simple Authentication Security Layer (SASL) [RFC4422] and optionally operated over a secure encrypted transport layer, TLS [RFC5246].

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Card Technology Developments and Gap Analysis Interagency Report say about Transcript Excerpts:? (Part 3) According to Card Technology Developments and Gap Analysis Interagency Report, Transcript Excerpts:: one barrier. Security: The multi-application is in my opinion the most important. And that's actually part of the migration strategy, the fact that you can have multiple applications on the same card. Interoperability and Further Growth: So in multi-application, the way I like to describe it, is if you took 16, 32, whatever the capacity chip is, separate cards and glued them all together in one card, in effect it is 16 different cards. Each card has its own security keys. And in a sense, it's almost like a firewall. One application can't get to the other application. So conceptually, it's just 15 cards all glued together in one convenient form factor. And here I'm showing that in each of the different application slots, you can put different applications. Access control and logical access are the two most mainstream. And interestingly enough, this actually solves an interesting problem. This is because the physical security director of an installation never trusts the IT guy because they're sort of like rivals. And the IT guy doesn't trust the other guy. So in the older models, they actually used separate cards. But now because each one has its own keys and can maintain its own application, they can both play in the same sandbox together. Everyone can carry the same card. Yet, the IT guy can control access to the computers. And the physical access guy can control access to the building. Multiple Applications: One particular thing that I think is real important when you get to multiple applications is access control is typically the application. That controls the card. What I mean by that is that's typically where the card gets issued from. And if you have a vendor that doesn't tell you or won't disclose to you the keys, the unused applications, that in effect becomes a proprietary card. And you can't use the card for other applications. So that's a real important thing when selecting access control.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Card Technology Developments and Gap Analysis Interagency Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2013 Annual Report provide? (Section 111) mponents for conformance to specifications in FIPS 201 and its companion documents. The two PIV components that come under the scope of NPIVP are PIV Smart Card Application and PIV Middleware. All of the tests under NPIVP are handled by third-party laboratories that are accredited as Cryptographic and Security Testing (CST) Laboratories by the NIST NVLAP and are called accredited NPIVP test facilities. As of September 2013, there were nine such facilities. In prior years, CSD published SP 800-85A, PIV Card Application and Middleware Interface Test Guidelines , to facilitate development of PIV Smart Card Application and PIV Middleware that conform to interface specifications in SP 800-73, Interfaces for Personal Identity Verification . CSD also developed an integrated toolkit called 'PIV Interface Test Runner' for conducting tests on both PIV Card Application and PIV Middleware products, and provided the toolkit to accredited NPIVP test facilities. NPIVP validation utilized the following versions and documents throughout FY 2013: -  SP 800-73-3, Interfaces for Personal Identity Verification -  SP 800-85A-2, PIV Card Application and Middleware Interface Test Guidelines In FY 2013, two new PIV card application products were validated for conformance to SP 800-73-3 and received certificates, bringing the total number of NPIVP validated PIV Card application products to 36. Three PIV Middleware products were validated for conformance to SP 800-73-3 and received certificates, for a total number of 20 NPIVP-validated PIV Middleware products. In addition, NPIVP is closely involved in ensuring that all changes in PIV companion documents, such as SP 80073-3, SP 800-76-2, and SP 800-78-3, are fully reflected in the conformance test document SP 800-85A-2 as well as subsequently in the PIV Test Runner toolkit consequent on the expected publication of FIPS 201-2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2013 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IA-2 in Security and Privacy Controls for Information Systems and Organizations? (Part 8) Control IA-2: d/or requested action. For example, a user authenticates via a notebook computer to a remote server to which the user desires access and requests some action of the server via that communication path. Subsequently, the server contacts the user via the user’s cell phone to verify that the requested action originated from the user. The user may confirm the intended action to an individual on the telephone or provide an authentication code via the telephone. Out-of-band authentication can be used to mitigate actual or suspected “man-in the-middle” attacks. The conditions or criteria for activation include suspicious activities, new threat indicators, elevated threat levels, or the impact or classification level of information in requested transactions. Related Controls: IA-10, IA-11, SC-37. References: [FIPS 140-3], [FIPS 201-2], [FIPS 202], [SP 800-63-3], [SP 800-73-4], [SP 800-76-2], [SP 800-78-4], [SP 800-79-2], [SP 800-156], [SP 800-166], [IR 7539], [IR 7676], [IR 7817], [IR 7849], [IR 7870], [IR 7874], [IR 7966].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in Guide to Bluetooth Security? (Part 23) Control HA-256: ic strength. 20 A published theoretical known-plaintext attack can recover the encryption key in 2 38 computations, compared with a brute force attack, which would require testing 2 128 possible keys. If communications require FIPS-approved cryptographic protection (e.g., to protect sensitive information transmitted by Federal agencies), this protection can be achieved by layering applicationlevel FIPS-approved encryption over the native Bluetooth encryption. ## 3.1.3.2 AES-CCM Encryption Algorithm As shown in Figure 3-8, the encryption key provided to the encryption algorithm is produced using the h3 function. The h3 function produces stream cipher keys based on the 128-bit link key, which is a secret that is held in the Bluetooth devices; the unique 48-bit Bluetooth device address of the master; the unique 48-bit Bluetooth device address of the slave; a fixed key ID 'btak'; and the 96-bit ACO value. The ACO is produced during the authentication procedure, as shown in Figure 3-6. The encryption key is shortened by taking the 128 most significant bits of the original encryption key. The Bluetooth AES-CCM encryption procedure is based on Request for Comment (RFC) 3610, Advanced Encryption Standard - Counter with Cipher Block Chaining-Message Authentication Code . The AES-CCM encryption function takes the following as inputs: the encryption key, the encryption 20 Y. Lu, W. Meier, and S. Vaudenay. 'The Conditional Correlation Attack: A Practical Attack on Bluetooth Encryption.' nonce, and the payload bits. The nonce format is of two types: the payload counter format which is used for Asynchronous Connection-Less (ACL) packets, and the clock format (which also includes an 11-bit day counter) which is used for enhanced Synchronous Connection Oriented (eSCO) packets. When AES-CCM encryption is enabled, ACL packets include a 4-octet Message Integrity Check (MIC). eSCO packets do not include a MIC. Figure 3-8.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Bluetooth Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Zero Trust Architecture provide? (Section 69) ado en la ausencia de confianza implícita basada en la ubicación de la red significa que los agresores necesitan comprometer una cuenta o un dispositivo existente para conseguir entrar en una empresa. Una ZTA bien desarrollada e implementada debería impedir que una cuenta o activo comprometido acceda a otros recursos fuera de su ámbito o patrones de acceso normales. En consecuencia, las cuentas con políticas de acceso a los recursos serían los objetivos principales de los agresores. Los atacantes pueden utilizar el Phishing, la Ingeniería Social o una combinación de ataques para obtener las credenciales de cuentas con valor, y el significado de valor será diferente en función de la motivación. Por ejemplo, las cuentas de administrador de la empresa pueden ser valiosas, pero los interesados en obtener beneficios económicos considerarán que aquellas cuentas que tienen acceso a los recursos financieros o de pago tienen el mismo valor que las mencionadas anteriormente. La implementación de un MFA para las solicitudes de acceso puede reducir el riesgo de pérdida de información de una cuenta afectada. Sin embargo, un atacante con credenciales válidas (o un usuario malintencionado) podría acceder a los recursos de una cuenta para la que se le hubiese concedido el acceso. Por ejemplo, un agresor o un colaborador afectado que tuviese las credenciales y el acceso al activo propiedad de la empresa de un empleado válido de recursos humanos podría acceder a su base de datos. La ZTA reduce el riesgo y evita que cualquier cuenta o activo comprometido se desplace lateralmente por la red. Si las credenciales afectadas no están autorizadas para acceder a un recurso concreto, se les denegará el acceso. Además, es más probable que un algoritmo de confianza contextual (véase la sección 3.3.1) detecte y responda rápidamente a este ataque que cuando se produce en una red heredada basada en el perímetro.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Zero Trust Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Author ORCID iDs according to NIST Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, Author ORCID iDs: Ron Ross: 0000-0002-1099-9757 Victoria Pillitteri: 0000-0002-7446-7506

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2003 Annual Report say about MULTI-CARD TECHNOLOGY? (Part 3) According to Computer Security Division 2003 Annual Report, MULTI-CARD TECHNOLOGY: tions across organizations, and interoperability. These issues have been examined for evidence of gaps in existing standards and other factors that hamper government-wide application integration. The findings from the initial efforts and suggested priorities for follow-on activities are being developed into NIST Interagency Report 7056, Card Technology Developments and Gap Analysis Interagency Report, which should be available in the first part of 2004. Contact: Mr. Curt Barker (301) 975-8443 wbarker@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2003 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Length according to Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? Length: unspecified [text/html]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report_ Authentication Diary Study say about 5.2.3.3 Authentication Element Entry Effort? (Part 1) According to Report_ Authentication Diary Study, 5.2.3.3 Authentication Element Entry Effort: 5.2.3.3 Authentication Element Entry Effort The factor pertaining to the effort required to submit authentication information was informed by adding an assigned 'effort value' for each element reported being used during an authentication event. The effort factor added to the overall calculated distribution measure is always a negative value, reflecting the negative effect on the participant's primary task. As shown in Table 14, the value -0.5 is assigned if the user had the element memorized or had to look it up (e.g., on a handwritten note), and -0.1 if the element was contained in a mechanism such as a Web browser or PIV card. Note the relatively small value assigned to the Minor impact category reflects the relatively lower cognitive impact on the user. Table 14: Effort values for different types of authentication elements | Authentication element status | Impact | Value | |-------------------------------------------------------------------------------------------------------------------|----------|---------| | Memorized or remembered | Major | -0.5 | | Look up by user (e.g., RSA token, file, paper) | Major | -0.5 | | 'Something you have,' 'something you are' or contained in mechanism (e.g., PIV card, fingerprint, browser-stored) | Minor | -0.1 | Most authentications required a combination of different types of elements or information, and some required multiple elements of the same type.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Report_ Authentication Diary Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities provide? (Section 69) lity Impact metrics are each set to 'Complete' to indicate the increased level of access. The Collateral Damage Potential is set to 'Low' because exploitation would cause only slight damage and loss. In the example environment, the need for availability for the targets is low as compared to preserving their confidentiality and integrity, so the Availability Requirement is set to 'Low' and the Confidentiality and Integrity Requirements are set to 'Medium.' The environmental vector would be LVP:L/PTV:L/LRL:L/EC:C/EI:C/EA:C/CDP:L/CR:M/IR:M/AR:L. The environmental exploitability subscore is 1.6 and the impact subscore is 10.0, for an exploitability score of 6.1. CCSS is based on CVSS and CMSS, so there are many similarities among the three specifications. However, there are some important differences as well. This section provides a brief discussion of the major differences between the specifications. Individuals interested in more details on the differences are encouraged to compare the specifications side-by-side. The specifications have similar structures, making such comparisons easy. 15 For the base metrics, all three specifications use the same six metrics and the same equations for calculating scores. The descriptions for each metric have been adjusted to fit the characteristics of the category of vulnerabilities that they cover. The most notable difference is that CCSS also measures the type of exploitation: active or passive. Active exploitation refers to an attacker performing actions to take advantage of a vulnerability, while passive exploitation refers to vulnerabilities that prevent authorized actions from occurring, such as a configuration setting that prevents audit log records from being generated for security events. The Exploitability base metrics in CCSS are defined differently for active and passive exploitation because of the differences in the ease of exploitation.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines for Securing Radio Frequency Identification (RFID) Systems? (Part 277) Control ES-1: UHF, which can offer operating ranges of several meters. The UHF specification defines a tag that operates at 860 MHz - 960 MHz and has an EPC identifier, an error detection code, and a kill command. The EPC shall be a valid EPC that contains four subfields: a header, an EPC manager ID, an object class, and a serial number. The error detection is performed using a 16-bit CRC. The kill password is 8 bits. 95 The EPCglobal Class-1 Generation-2 standard is the only specification that became a standard ratified by EPCglobal. 96 The previous Class-0 and Class-1 Generation-1 tags are expected to be phased out and replaced by Class-1 Generation-2 tags. It describes tags with five major features: an EPC, a tag identifier (TID), a kill command, an optional password-protected access control, and an optional user memory. The tag identifier is used to identify the design and features of the individual tag. This is necessary since tags may have optional or custom commands and features. CRCs are used in some communications and for the EPC. There is a 32-bit kill password and a 32-bit access password. The standard also implements a lock command which can temporarily or permanently make an area of memory write-protected or readand-write protected. 97 EPCglobal Class-1 Generation-2 tags also use a cover-coding method to obscure information that is sent from a reader to a tag. Cover-coding is explained in Section 5.3.2.1. ## A.3 Security Mechanisms in RFID Standards Table A-2 provides an overview of the security mechanisms offered by several RFID standards. 94 Auto-ID Center, "Technical Report, 13.56 MHz ISM Band Class 1 Radio Frequency Identification Tag Interface Specification: Candidate Recommendation, Version 1.0.0," February 1, 2003,

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Domain Name System-Based Electronic Mail Security provide? (Section 250) d terminate voluntarily after processing a limited number of requests. To conserve system resources, most server programs terminate when they become idle. Client programs run outside the Postfix core. They interact with Postfix server programs through mail delivery instructions in the user's ~/.forward file, and through small 'gate' programs to submit mail or to request queue status information. As an SMTP server, Postfix implements a first layer of defense against spambots and malware. Administrators can combine Postfix with other software that provides spam/virus filtering (e.g., Amavisd-new), message-store access (e.g., Dovecot), or complex SMTP-level access-policies (e.g., postfwd, policyd-weight or greylisting). Features include: -  standards-compliant support for SMTPUTF8, SMTP, LMTP, STARTTLS encryption including DANE protocol support and 'perfect' forward secrecy, SASL authentication, MIME encapsulation and transformation, DSN delivery status notifications, IPv4, and IPv6 -  configurable SMTP-level access policy that automatically adapts to overload -  virtual domains with distinct address-namespaces -  UNIX-system interfaces for command-line submission, for delivery to command, and for direct delivery to message stores in mbox and maildir format -  light-weight content inspection based on regular expressions -  database lookup mechanisms including Berkeley DB, CDB, OpenLDAP LMDB, Memcached, LDAP and multiple SQL database implementations -  a scheduler that implements parallel deliveries, with configurable concurrency and back-off strategies -  a scalable zombie blocker that reduces SMTP server load due to botnet spam Postfix extensions use the SMTP or Milter (Sendmail mail filter) protocols which both give full control over the message envelope and content, or a simple text-based protocol that enables complex SMTPlevel access control policies.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition say about Security? According to Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition, Security: FRN-Nov07 lists the major security-evaluation factors as: - (i) applications of the hash functions 1 ; - (ii) specific requirements when hash functions are used to support HMAC, Pseudo Random Functions (PRFs), or Randomized Hashing; - (iii) additional security requirements of hash functions; - (iv) evaluations relating to attack resistance; and - (v) other consideration factors. For its security evaluations, NIST studied the large amount of feedback received from the cryptographic community via e-mail discussions in the official mailing list ( hash-forum@nist.gov ), and the SHA-3 Zoo web page [22], as well as the security arguments presented by the designers. NIST researchers also conducted their own internal cryptanalysis of the candidates.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TG-005 in Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS)? (Part 24) Control TG-005: t in time be enforced by the system. They suggested that the distinction might be based in part upon Clark and Wilson's view of what was practical and that it might discourage attempts at enforcement. The group felt that while certification is both indicated and necessary, that its use should not be mandated where enforcement might also be an equally appropriate choice. Certification was seen as one tool among others, and not to be automatically preferred. (A subsequent discussion suggested that perhaps the distinction was between those rules that were application specific (C) and those that were specific only to the system (E)). ## GRANULARITY The working group concluded that granularity of TPs and CDIs was ultimately an application issue. While it is difficult to conclude exactly what granularity is required except in the context of a particular application, the group identified useful guidance. ## single Function The group concluded that TPs should be limited to a single well-defined function or be composed only of like or related functions. While too many small particles may be messy and administratively burdensome, in computer systems, it is far easier to group things than it is to divide them. Another test that was agreed to was that a manager should never be forced to grant privilege A simply for the purpose of conferring B. A and B should be separate units. In that case, sets A-B could be formed as could A-A and B-B. On the other hand if AB was the smallest named unit, that would fail the test. ## Separation of Duties The group took note of the generally accepted standards of good business practice for separation of duties (see position paper by W. H. Murray, attached) . These practices require that at a minimum managers must be able to separate the following: * origination from approval - * - creation from maintenance * procedure from data * assets from records ## Obvious Intent The TP should be small enough that it is obvious in its intent.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process provide? (Section 58) cryptanalysis. This is particularly true for digital signature schemes where the best schemes that are not based on structured lattices have a substantial performance penalty for general-purpose use. For the eight alternate candidate algorithms advancing to the third round, NIST notes that these algorithms still may potentially be standardized; although that most likely will not occur at the end of the third round. NIST expects to have a fourth round of evaluation for some of the candidates on this track. If new results emerge during the third round which undermine NIST's confidence in some of the finalists, NIST may extend the timeline, or make changes to the process. If NIST has less serious concerns specific to a particular finalist and sees the need to continue evaluating it, NIST may instead defer the decision about standardization for the affected finalist until the fourth round. The third round is expected to last 12-18 months. Submission modifications should be submitted to NIST by October 1, 2020, in a complete submission package as defined in [33]. It would be helpful if submission teams provided NIST with a summary of their expected changes by August 10, 2020. As a general guideline, NIST expects that any modifications to the seven finalists should be relatively minor while allowing more latitude to the eight additional candidate algorithms. Note, however, that larger changes may signal that an algorithm is not mature enough for standardization at this time. More detailed instructions will be provided. The efforts of the cryptographic community have been invaluable in analyzing and implementing schemes throughout this process. NIST hopes that with only seven finalists and eight alternate candidates, the public review period will include more work on side-channel resistant implementations, performance data in internet protocols, and performance data for hardware implementations in addition to more rigorous cryptanalytical study.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT) say about Data Processing? According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT), Data Processing: A data processing capability provides the ability to transform data based on an algorithm. The transformation may be very simple, with a single input variable and a single output, or it may be complex with multiple inputs and outputs. Control algorithms are an important type of processing that take the output of sensor(s) and actuator(s) or pre-processor(s) and provide an output that can be fed into an actuator or post-processor. These control algorithms often are used within negative feedback loops, but not always. A proportional-integral-derivative (PID) 3 controller (widely used in industrial control systems) is an example of such a control algorithm. Another example is an algorithm which models the human insulin response in a real-time system that manages the function of an artificial pancreas. Additional examples of data processing include: data aggregation capability, predictive analysis, and binary (Yes/No) analysis.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 350) s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication). Actions can be taken to safeguard individual authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed. Related Controls: AC-3, AC-6, CM-6, IA-2, IA-4, IA-7, IA-8, IA-9, MA-4, PE-2, PL-4, SC-12, SC-13.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Secure Web Services? (Part 34) Control ES-1: taken from NIST IR 7298, Glossary of Key Information Security Terms and NIST SP 800-100, Information Security Handbook: A Guide for Managers, available at http://csrc.nist.gov/publications/nistpubs/. More information on these concepts can be found in Computer Security: Art and Science by Matt Bishop. - Confidentiality. Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information - Privacy. Restricting access to subscriber or relying party information in accordance with Federal law and organization policy ## 2.3 Web Services Security Dimensions The Web services security dimensions have been defined as: secure messaging, resource protection, negotiation of contracts, trust management, and security properties 12 . These dimensions encompass the elements of security (discussed in Section 2.2) in a Web services environment. Each dimension is essential to the development of secure applications using Web services, but each dimension affects a different layer of the Web service. This section describes each security dimension and provides an overview of what technologies are available, what is on the horizon, and what remains to be done. ## 2.3.1 Secure Messaging Web services rely on the Internet for communication. Because SOAP was not designed with security in mind, 13 SOAP messages can be viewed or modified by attackers as the messages traverse the Internet. There are several options available for securing Web service messages: - HTTP over SSL/TLS (HTTPS). Because SOAP messages are transmitted using HTTP, it is trivial to modify a Web service to support HTTPS. - XML Encryption and XML Signature. These XML security standards developed by W3C allow XML content to be signed and encrypted.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Engineering Trustworthy Secure Systems say about SIGNIFICANCE OF LOSS - AN EXAMPLE? (Part 3) According to Engineering Trustworthy Secure Systems, SIGNIFICANCE OF LOSS - AN EXAMPLE: kely or probable to happen?' 39 Addressing loss occurs through the protective measures that enforce constraints to ensure that only authorized and intended behaviors and outcomes of the system occur. These include: - Protective measures that are provided by the machine portion of the system (i.e., the system architecture and design, the use of engineered features and devices within the architecture and design) - Protective measures that are provided by the human in the system (i.e., personnel, practices, procedures, the use of tools to support the human as a system element, and the human role in designing and building the machine part of the system) - Protective measures that are provided by the physical environment (i.e., controlled access areas, facility access points, physical monitoring, environmental controls, fire suppression) The terminology used to describe means and methods includes mechanisms, configurations, controls, safeguards, countermeasures, features, techniques, overrides, practices, procedures, processes, and inhibits. These may be applied in accordance with governing policies, regulations, laws, practices, standards, and techniques.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices provide? (Section 481) Promotion Board [Potato Research and Promotion Act, Public Law 91-670, Title III, Sec. 310, Jan. 11, 1971, 84 Stat. 2044; amended by Public Law 101- 624, Title XIX, Sec. 1942, Nov. 28, 1990, 104 Stat. 3867] | Table 6: Legal Information Disclosure Prohibitions | Subject/Title of Provision | United States Code Citation | Agency/Activity [Reference] | |----------------------------------------------------------------------------------------------|---------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Authorization for Disclosure and Use of Intercepted Wire, Oral, or Electronic Communications | 18 U.S.C., Part I, Chapter 119, Section 2517(6) | Law Enforcement [Omnibus Crime Control and Safe Streets Act of 1968, Public Law 90- 351, Title III, Sec.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 80) Control HA-1: Principle of Least Authority (POLA). The design picture of XPOLA is shown in Figure 3. The capability manager (Capman) is the platform for resource providers to collaborate with their users. Through this platform, the resource users send requests to the providers for access rights; the provider processes the requests and creates the corresponding capability tokens. The capability manager stores the capability tokens and supports the providers with the functionalities for manipulating the capabilities: capability generation, destruction, update, renewal, request processing, and optionally pushing the capabilities to the users. ## 4th Annual PKI R&D Workshop -- Proceedings The registry service provides registration and discovery of the available Web service instances. It keeps the information of all the registered service instances. Every time a new service is instantiated, it is supposed to register itself by sending a Web Services Definition Language (WSDL) document to the registry. A WSDL document contains the detailed information needed to interact with the service instance. If the capability of a specific resource for a specific user exists in the capability manager's storage, the user can fetch the capability from the manager directly and stores it in her local token agent. The token agent is an ssh-agent-like client for interacting with the capability manager and caching the retrieved capability tokens. Figure 3 The Big Picture <!-- image --> The Community Informative Authority (CIA) is an optional trusted authentication service for identity verification in the community. It establishes trust relationships, either mutual or unilateral as required, between the users and providers. Note that CIA service does not make any authorization decisions for the providers.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Accuracy, Integrity, and Security in Computerized Vote-Tallying provide? (Section 129) Elkins' complaints, it was reported that Attorney General Jim Mattox and Secretary of State Myra McDaniel began investigations into voting discrepancies. According to the Dallas Morning News of Sept. 23, 1986, "the probe centers on allegations that computerized voting equipment and computer programs used to tabulate state and local elections may have been tampered with to bring about "preprogrammed' results." [53] In that same newspaper article, Ms. Elkins was quoted as saying that "the allegation is that the computer used to count the votes was given new instructions after it calculated that Max Goldblatt was leading Starke Taylor by 400 votes." Ms. Elkins has noted that the Dallas County computer had encountered difficulties shortly after 8 p.m. on election night, and that the candidate who was leading at 8 p.m., prior to the computer difficulties, was not leading when the computer reported again. Ms. Conny McCormack, Dallas County Elections Administrator, admitted that the documentation for the April 6, 1985 election could appear contradictory. Her explanation was that the difficulty concerned the treatment of "split precincts," that is, those precincts bisected by the Dallas city boundary. There were 11 such split precincts. The value of 78,398 for ballots cast was produced by assuming zero ballots cast from these split precincts. The value of 80,208 for ballots cast was produced by adding the total ballots from the split precincts, including ballots cast outside of the city. The final value of 79,783 for ballots cast included only those ballots cast within the city of Dallas. Ms. McCormack contended that the recount generally confirmed the correctness of the originally reported outcome. [54] Ms. McCormack's explanation of the problem of reporting split precincts was supported by the vendor of the vote-tallying system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Accuracy, Integrity, and Security in Computerized Vote-Tallying.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2 provide? (Section 20) e, and development. -  Section 4 defines SCAP content processing requirements and recommendations. -  Section 5 provides additional content requirements and recommendations for particular use cases. -  Appendix A gives an overview of major security considerations for SCAP implementation. -  Appendix B contains an acronym and abbreviation list. -  Appendix C contains a glossary of selected terms used in the document. -  Appendix D lists references and other resources related to SCAP 1.2. -  Appendix E provides a change log that documents significant changes to major drafts of this specification. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in Request for Comment (RFC) 2119 [RFC2119]. When these words appear in regular case, such as 'should' or 'may', they are not intended to be interpreted as RFC 2119 key words. When a single term within a sentence is italicized, this indicates that the term is being defined. These terms and their definitions also appear in Appendix C. Some of the requirements and conventions used in this document reference Extensible Markup Language (XML) content [XMLS]. These references come in two forms, inline and indented. An example of an inline reference is: a <cpe2\_dict:cpe-item> may contain <cpe2\_dict:check > elements that reference OVAL Definitions. In this example the notation <cpe2\_dict:cpe-item> can be replaced by the more verbose equivalent 'the XML element whose qualified name is cpe2\_dict:cpe-item '. An example of an indented reference is: References to OVAL Definitions are expressed using the following format: ``` <cpe2_dict:check system= "http://oval.mitre.org/XMLSchema/oval-definitions-5" href= " Oval_URL " >[ Oval_inventory_definition_id ] ``` 7 http://csrc.nist.gov/publications/PubsSPs.html#800-117 </cpe2\_dict:check> .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identity and Access Management for Electric Utilities provide? (Section 18) ics Evaluation Assumptions and Limitations ............................. 59 5.9.3 Example Solution Analysis .......................................................................................... 60 5.9.4 Security Characteristics Addressed ............................................................................ 62 5.9.5 Assessment of Reference Architecture ...................................................................... 64 5.9.6 Security Recommendations ........................................................................................ 69 5.9.7 Security Characteristics Evaluation Summary ............................................................ 71 NIST SP 1800-2B: Identity and Access Management for Electric Utilities vii T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . NIST SP 1800-2B: Identity and Access Management for Electric Utilities viii T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . List of Figures Figure 5-1 IdAM Capabilities ............................................................................................................. 21 Figure 5-2 IdAM Example Solution .................................................................................................... 23 Figure 5-3 Notional PACS Architecture .............................................................................................. 26 Figure 5-4 Notional OT Silo Architecture ........................................................................................... 27 Figure 5-5 Notional IT Silo Architecture .............................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1.2 Report Structure according to NIST Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research According to Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research, 1.2 Report Structure: The remainder of this report is organized into the following sections and appendices: - Section 2 provides a summary of the business opportunities for using DPCs with modern mobile client devices. - Section 3 describes usage scenarios for issuing PIV credentials and associated DPCs. - Section 4 explains the application of Microsoft and Intercede technologies in accordance with NIST SP 800-157 to support the organization-provisioned PIV credentials usage scenario. - The following sections discuss DPC-related activities: - o Section 5: Initial issuance - o Section 6: Maintenance - o Section 7: Termination - o Section 8: Usage - Section 9 briefly looks at next steps for research in the area of DPCs. - Appendix A provides mappings between the DPC requirements from this report and requirements from other federal government standards and guidelines. - Appendix B- defines acronyms and abbreviations used in the report. - Appendix C- provides a bibliography for the report. 1 http://dx.doi.org/10.6028/NIST.SP.800-157 2 http://dx.doi.org/10.6028/NIST.FIPS.201-2 3 http://dx.doi.org/10.6028/NIST.SP.800-63-2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events say about Appendix D Functional Evaluation? According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events, Appendix D Functional Evaluation: A functional evaluation of the data integrity (DI) example implementation, as constructed in our laboratory, was conducted to verify that it meets its objective of detecting and responding to DI events. Furthermore, this project aims to analyze the events to aid recovery and protection of the enterprise against future attacks. The evaluation verified that the example implementation could perform the following functions: - Detect malicious network activity, malicious mobile code, malicious code execution, and unauthorized user behavior. - Contain and analyze these types of incidents. - Mitigate the impact of these incidents as they occur. - Report relevant details for use in mitigation and protection against future events. Section D.1 describes the format and components of the functional test cases. Each functional test case is designed to assess the capability of the example implementation to perform the functions listed above and detailed in Section D.1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in 2016 NIST_ITL Cybersecurity Program Annual Report? (Part 146) Control HA-3: ic Safety Mobile Authentication . (July 2016) (see http:/ /nvlpubs.nist.gov/nistpubs/ir/2016/NIST. IR.8080.pdf) - NISTIR 8150, Government Data De-Identification Stakeholder's Meeting, Meeting Report . (September 2016) (see http:/ /nvlpubs.nist.gov/nistpubs/ir/2016/ NIST.IR.8150.pdf) - Choong, Y. Y., & Greene, K. K. (2016, September). What's a Special Character Anyway? Effects of Ambiguous Terminology in Password Rules . Published in the Proceedings of the Human Factors and Ergonomics Society Annual Meeting (Vol. 60, No. 1, pp. 760-764). Sage CA: Los Angeles, CA: SAGE Publications. - Theofanos, M., Garfinkel, S. and Choong, Y.Y., (2016). Secure and Usable Enterprise Authentication: Lessons from the Field . IEEE Security & Privacy , 14 (5), pp.14-21. - Greene, K.K., and Choong, Y.Y. ' Must I, Can I? I Don't Understand Your Ambiguous Password Rules. ' This article was accepted on 09/12/2016 and will appear in Issue 1 of the 2017 Volume of Journal of Information and Computer Security. - Stanton, B., Theofanos, M., Spickard Prettyman, S., Furman, S., ' Security Fatigue ', IT Professional , Vol. 18, Issue 5, pp. 26-32, Sept.-Oct. 2016, doi:10.1109/ MITP.2016.84 - Stanton, B., Theofanos, M., Spickard Prettyman, S., Furman, S. (2016). The Power of Qualitative Methods: Aha Moments in Exploring Cybersecurity and Trust . User Experience Magazine, 16(5). Retrieved from http:/ /uxpamagazine.org/thepower-of-qualitative-methods/ - Steves, M., Theofanos, M., (2016) ' What's in your policy? Do your users know?' National Institute of Standards and Technology Interagency Report (NISTIR) that was submitted to IEEE Security and Privacy. - Garfinkle, S., Theofanos, M. and Choong,Y.Y., ' Secure and Usable Enterprise Authentication: Lessons from the Field ,' to appear in IEEE Security & Privacy, September/October 2016, a special issue on usable security.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide: according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance, Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide:: Volume 1 - General Implementation Guidance Keith Stouffer Timothy Zimmerman CheeYee Tang Jeffrey Cichonski Michael Pease Neeraj Shah Wesley Downard This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8183A-1 <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases say about F.2.1 IBM ROP and COP/JOP Attack Defenses? According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases, F.2.1 IBM ROP and COP/JOP Attack Defenses: The POWER platform added four instructions (hashst, hashchk, hashstp, hashchkp) to handle ROP in the Power ISA 3.1B starting in the Power10 processor.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography say about 6. Key Agreement Schemes? (Part 3) According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, 6. Key Agreement Schemes: schemes may be further classified by whether they use finite field cryptography (FFC) or elliptic curve cryptography (ECC). A scheme may use either Diffie-Hellman or MQV primitives (see Section 5.7). Thus, for example, notation C(2e, 2s, FFC DH) completely classifies the dhHybrid1 scheme of Section 6.1.1.1 as a scheme with two ephemeral keys and two static keys that uses finite field cryptography and a Diffie-Hellman primitive (see Table 8). The names of these schemes are taken from ANS X9.42 and ANS X9.63. Table 8: Key-agreement schemes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide for Security-Focused Configuration Management of Information Systems? (Part 108) Control ES-1: ation for Key Management, Part 3: Application-Specific Key Management Guidance. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-57 Part 3, Rev. 1. https://doi.org/10.6028/NIST.SP.800-57pt3r1 | | [SP 800-58] | Kuhn R, Walsh TJ, Fries S (2005) Security Considerations for Voice Over IP Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-58. https://doi.org/10.6028/NIST.SP.800-58 | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | [SP 800-63B] | Grassi PA, Newton EM, Perlner RA, Regenscheid AR, Fenton JL, Burr WE, Richer JP, Lefkovitz NB, Danker JM, Choong Y-Y, Greene KK, Theofanos MF (2017) Digital Identity Guidelines: Authentication and Lifecycle Management. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800- 63B, Includes updates as of December 1, 2017. https://doi.org/10.6028/NIST.SP.800-63B | |----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [SP 800-70] | Quinn SD, Souppaya MP, Cook MR, Scarfone KA (2018) National Checklist Program for IT Products: Guidelines for Checklist Users and Developers.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Managing Information Security Risk_ Organization, Mission, and Information System View say about 2.7 ORGANIZATIONAL CULTURE? (Part 3) According to Managing Information Security Risk_ Organization, Mission, and Information System View, 2.7 ORGANIZATIONAL CULTURE: tions and services solely for their use. These organizations may be reluctant to use externally-provided software applications and services and this reluctance may result in lower risk being incurred. Other organizations may, on the other hand, seek to maximize advantages achieved by modern net-centric architectures (e.g., service-oriented architectures, cloud computing), where hardware, software, and services are typically provided by external organizations. Since organizations typically do not have direct control over assessment, auditing, and oversight activities of external providers, a greater risk might be incurred. In addition to the cultural impacts on organizational risk management perspectives, there can also be cultural issues between organizations. Where two or more organizations are operating together toward a common purpose, there is a possibility that cultural differences in each of the respective organizations may result in different risk management strategies, propensity to incur risk, and \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ willingness to accept risk. 58 For example, assume two organizations are working together to create a common security service intended to address the advanced persistent threat. The culture of one of the organizations may result in a focus on preventing unauthorized disclosure of information, while the nature of the other organization may result in an emphasis on mission continuity. The differences in focus and emphasis resulting from organizational culture can generate different priorities and expectations regarding what security services to procure, because the organizations perceive the nature of the threat differently.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Managing Information Security Risk_ Organization, Mission, and Information System View.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SC-7 in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 15) Control SC-7: on: A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between unclassified national security systems and external networks. Related Controls: None. (26) BOUNDARY PROTECTION | CLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS Prohibit the direct connection of a classified national security system to an external network without the use of [Assignment: organization-defined boundary protection device]. Discussion: A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, CHAPTER THREE PAGE 303 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between classified national security systems and external networks. In addition, approved boundary protection devices (typically managed interface or cross-domain systems) provide information flow enforcement from systems to external networks. Related Controls: None.

Explanation: NIST publication discussing classified information handling. References: classified, national security. Contains guidance on protecting sensitive government information. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Keywords according to NIST Guide to Bluetooth Security According to Guide to Bluetooth Security, Keywords: Bluetooth; information security; network security; wireless networking; wireless personal area networks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Bluetooth Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-8(3) in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Control CM-8(3): Data Encoding (T1132) Inspect and Analyze Network Traffic (CM2002) Monitoring and Damage Assessment Detect

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.2.1 Determine the Topics according to NIST Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities According to Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 4.2.1 Determine the Topics: The design team should determine the exercise topic based on the focus of the plan being exercised. General topics can include contingency planning and incident response; specific topics range from sustaining essential functions to managing and reporting IT security incidents. For example, disaster recovery plan exercise discussion topics would likely include the roles and responsibilities of personnel with regard to the processes and procedures associated with restoring an organization's information systems. Incident response plan exercise discussion topics would likely include processes and procedures for managing and reporting IT security incidents.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Platform Firmware Resiliency Guidelines provide? (Section 24) ................................................................................ C-References .......................................................................................................... | | | Appendix | Appendix | Appendix | 37 | | List of Figures | List of Figures | List of Figures | List of Figures | | Figure 1: High-Level System Architecture....................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Platform Firmware Resiliency Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2017 NIST_ITL Cybersecurity Program Annual Report say about 30th Annual FISSEA Conference? According to 2017 NIST_ITL Cybersecurity Program Annual Report, 30th Annual FISSEA Conference: March 14-15 CANCELLED due to inclement weather https:/ /www.nist.gov/news-events/ events/2017/03/30th-annual-fissea-conference

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Cybersecurity according to NIST Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective According to Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective, Cybersecurity: - Federal Information Security Modernization Act of 2014 (Public Law 113-283) - Cybersecurity Enhancement Act of 2014 (Public Law No: 113-274) - Improving Critical Infrastructure Cybersecurity (Executive Order, February 12, 2013) - National Cybersecurity Center of Excellence (Public Law 112-55, Consolidated and Further Continuing Appropriations Act of 2012) - National Initiative For Cybersecurity Education (NICE) - Section 5131 of the Information Technology Management Reform Act of 1996 (Public Law 104-106) [supersedes Computer Security Act of 1987 (Public Law 100-235)] - Federal Information Security Management Act (FISMA) of 2002 (Title III of the EGovernment Act Federal Information Security Management Act of 2002 (Public Law 107-347)) - Cybersecurity Research and Development Act of 2002 (Public Law 107-305) - National Strategy to Secure Cyberspace (February 2003) - Homeland Security Presidential Directive #12: Policy for a Common Identification Standard for Federal Employees and Contractors (August 27, 2004) - Conference Report on House Resolution 5441, Department of Homeland Security Appropriations Act, 2007: Title V - General Provisions (WHTI [Western Hemisphere Travel Initiative] Certification effort) - OMB Circular A-130 Management of Federal Information Resources (February 8, 1996) - OMB M-04-04 E-Authentication Guidance for Federal Agencies (December 16, 2003) - OMB Directive 05-24 Implementation of Homeland Security Presidential Directive (HSPD) 12 - Policy for a Common Identification Standard for Federal Employees and Contractors (August 5, 2005) - OMB Memorandum M-08-05, Implementation of Trusted Internet Connections (November 20, 2007) - OMB M-08-23 Securing the Federal Government's Domain Name System Infrastructure (August 22, 2008) - National Security Presidential Directive 54 / Homeland Security Presidential Directive 23 (NSPD-54/HSPD-23): Comprehensive National Cybersecurity Initiative (January 2008)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series say about 10. Implementation Considerations? (Part 3) According to Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series, 10. Implementation Considerations: e decryption-verification process is returned in constant time. Another unrelated note appears in NIST SP 800-38D, which mentions side-channel information from internal error logs. 10 Andreeva et al. [4] point out that achieving the highest level of security in the RUP setting requires the encode-then-encipher approach mentioned in Section 9 as 'pad-then-encipher.' Likewise, it is assumed for the CCM and GCM modes that the nonce is not reused and that the length of the tag is sufficiently long. Otherwise: - Reuse of the nonce in the CCM or GCM mode results in a reuse of the counter blocks for the underlying CTR mode. This leads to the devastating confidentiality attack described in Section 4.1: with knowledge of certain plaintext blocks, the adversary can use the ciphertext to derive all other plaintext blocks at locations where the counter is reused using a simple XOR operation. - If the tag is not sufficiently long, a guessing attack can be mounted, as explained in Section 5. The adversary can choose tags randomly and independent of the ciphertext and, when successful, use the fact that the underlying CTR allows an adversary to make arbitrary changes to the plaintext by flipping the corresponding bits in the ciphertext (as explained in Section 4). In the case of GCM, even more devastating attacks exist in the aforementioned settings. The adversary can recover the authentication key when short tags are used (as shown by Ferguson [35]) or when the nonce is reused (as shown by Joux [45]). In NIST IR 8319 [55], the single-key setting assumed that the key is drawn uniformly at random and is therefore unknown to the adversary. An adversary may nevertheless know the key if it is generated with an insecure or improperly implemented random bit generator (RBG) or when the protocol uses HMAC with an insecure hash function, such as MD5 or SHA-1, due to the Sloth attack [17] (CVE-2015-7575 [65]).

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: cve-, adversary. Contains technical security guidance that could inform defensive posture. Source: Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 857) tent T h i s p u b l i c a  o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h  p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P. 8 0 0 - 5 3 A r 5 NIST SP 800-53A, REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS SA-08(12) SECURITY AND PRIVACY ENGINEERING PRINCIPLES | HIERARCHICAL PROTECTION ASSESSMENT OBJECTIVE: Determine if: SA-08(12)_ODP systems or system components that implement the security design principle of hierarchical protecon are deﬁned; SA-08(12) <SA-08(12)_ODP systems or system components> implement the security design principle of hierarchical protecon. POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-08(12)-Examine [SELECT FROM: System and services acquision policy; procedures addressing the security design principle of hierarchical protecon used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records]. SA-08(12)-Interview [SELECT FROM: Organizaonal personnel with the responsibility for determining SA-08(12)-Test system security and privacy requirements; organizaonal personnel with system speciﬁcaon, design, development, implementaon, and modiﬁcaon responsibilies; system developers; organizaonal personnel with informaon security responsibilies]. [SELECT FROM: Organizaonal processes for applying the security design principle of hierarchical protecon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of hierarchical protecon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security in ISDN provide? (Section 12) nted. Similar issues attend many financial, medical and criminal justice records. The confidentiality and use of records are now the subject of legislation and will receive more legislative attention. Today individuals are increasingly mobile, often moving to pursue their careers. The use of cash for large transactions, or simply to rent a car or buy an airline ticket, is considered unusual at best and possibly a sign of criminal activity. On the basis of the possession of plastic credit cards merchants broadly extend credit to complete strangers with no authentication of personal identity. A large catalog industry now takes orders primarily over the telephone, shipping merchandise, often within 24 hours, on the basis of a credit card number given over the telephone. A good credit rating and possession of credit cards are necessities of modem everyday life. The public network is the main carrier by which these sensitive records are gathered and accessed. It must support users with a great variety of security policies. The problem is compounded by the successive chain of domains which is involved. By itself, ISDN cannot solve the crossdomain interworking, a problem which is general to all communications systems, but it must support some of the basic mechanisms required to provide secure interworicing between domains. The problem is central to the fabric of modem society, and is as much a social policy issue as a security issue. In the United States, the National Security Agency (NSA) is charged by law with protecting classified data. The security resources and expertise of NSA are unrivaled. The National Institute of Standards and Technology (NIST) has responsibilities for the security of unclassified information.

Explanation: NIST publication discussing classified information handling. References: classified, national security. Contains guidance on protecting sensitive government information. Source: Security in ISDN.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Study of Federal Agency Needs for Information Technology Security say about network security? According to A Study of Federal Agency Needs for Information Technology Security, network security: Governmentwide mandatory minimum requirements policy, carrying the force of law, and requiring centralized management and oversight within each agency Guide to network safeguards and when to use them NIST publications need to be updated to place more emphasis on "interconnected network systems"

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of Federal Agency Needs for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Key Management Documents say about 7.5.5. add-info? According to Secure Data Network Systems (SDNS) Key Management Documents, 7.5.5. add-info: In addition to the negotiation of options, the Ssrq and Ssrs exchange may provide the communicating entities with some additional information. This information is optional and its use by the recipient is a local matter. Some of the information may be signed by the KMS or an authorized directory service. The following sections describe some of the possible information which may appear in the Ssrq and Ssrs exchanges. Note - see SDN.906, SDNS Traffic Key Attribute Negotiation, for further information.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does BIOS Protection Guidelines provide? (Section 39) /resources/pc\_client\_work\_group\_specific\_imple mentation\_specification\_for\_conventional\_bios\_specification\_version\_12 - [UEFI] UEFI Specification Version 2.3 . Unified EFI Forum. May 2009. - F. Wecherowski. 'A Real SMM Rootkit: Reversing and Hooking BIOS SMI Handlers.' - [Wech09] Phrack . Issue 66. 6 November 2009. - [WoTe09] R. Wojtczuk and A. Tereshkin. 'Attacking Intel BIOS.' Black Hat USA . Las Vegas, NV. 30 July 2009.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: BIOS Protection Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings say about 4.3 Simulation? (Part 1) According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, 4.3 Simulation: 4.3 Simulation Weuse discrete-event simulation to understand the performance of BGP origin and path authentication schemes in a large-scale environment. As with our earlier work, our experiments uses SSFNet [5, 28], a discrete-event simulator that provides a comprehensive model of basic BGP operations [31]. Our earlier work added hooks for variants of processing models of BGP security schemes [27]. Throughout this study, we evaluate security schemes in the same network topology and same BGP activity settings. We use a 110-AS topology, with one operating BGP speaker per AS. For modeling simplicity, each BGP speaker announces two prefixes. In our model, each AS also possesses virtual BGP speakers that don't actually run a simulated BGP protocol. We use the number of such BGP speakers to represent the size of an AS; its size affects the time it takes for one Update message to be propagated through an AS. We use the public data provided by RouteViews project [33] to generate a graph of AS connectivity of the Internet, then reduce the size to 110 ASes using a collapsing procedure. This reduced graph still preserves certain macroscopic properties [6] seen on the entire Internet. Moreover, we incorporate our estimation of route filtering policies into the topology using a method, similar to the one proposed in [7]. During normal BGP activities, we let one BGP speaker crash and reboot. We evaluate the performance of the entire system during router rebooting process. The work- load on BGP speakers could be much higher than normal BGP activities, since the rebooting BGP speaker receives routing table dumps in a short period of time from each its peers, via a large amount of route announcements. To maximize the e GLYPH<11> ects, we let the rebooting BGP speaker to be the one with the most peers. Besides the common settings, we also have specific parameters for each of the security schemes.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is lunash according to Securing Web Transactions_ TLS Server Certificate Management? lunash: > net dns add searchdomain int-nccoe.org

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Framework for Designing Cryptographic Key Management Systems say about 2.1 Rationale for Cryptographic Key Management? (Part 1) According to A Framework for Designing Cryptographic Key Management Systems, 2.1 Rationale for Cryptographic Key Management: 2.1 Rationale for Cryptographic Key Management Today's information systems and the information that they contain are considered to be critical assets that require protection. The information used by government and business is often contained in computer systems consisting of groups of interconnected computers that make use of shared networks, e.g., the Internet. Since the Internet is shared by diverse and often competing organizations and individuals, information systems should protect themselves and the information that they contain from unauthorized disclosure, modification, and use. In addition, denial of service to legitimate users could be considered a significant threat in many service and time-critical application systems and the CKMS used to protect them. Additional security requirements can be derived from the organizational goals for protecting personal privacy, including anonymity, unlinkability, and unobservability of CKMS-supported communications. The information SP 800-130 August 2013 used by these systems requires protection when it is at rest, when it is being processed within a protected facility, and also when it is transported from one location to another. Cryptography is often used to protect information from unauthorized disclosure, to detect unauthorized modification, and to authenticate the identities of system entities (e.g., individuals, organizations, devices or processes). Cryptography is particularly useful when data transmission or entity authentication occurs over communications networks for which physical means of protection (i.e., physical security techniques) are often costprohibitive or even impossible to implement. Thus, cryptography is widely used when business is conducted or when sensitive information is transmitted over the Internet.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: A Framework for Designing Cryptographic Key Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-1 in Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers? (Part 21) Control CM-1: d authentication capabilities, assesses information about the purchase and the returning purchaser ʼ s profile, and determines if MFA is required from the purchaser to complete shopping-cart checkout. These policies and processes are accomplished by Magento and StrongKey CryptoEngine (SKCE) Version 2.0 Open Source FIDO U2F server interaction [26]. | ID.RA-4, ID.RA- 5 | | Risk Engine | RSA Adaptive Authentication (Cloud) Version 13.1 [27] | Uses data science to provide transaction analysis and response, prompting the returning purchaser to use U2F when the organization's risk threshold is exceeded during a transaction, providing a low-friction experience for the consumer to reduce fraud while minimizing the interruptions and denials that a consumer may encounter. | ID.RA-4, ID.RA- 5 | | MFA Mechanism | SKCE Version 2.0 Open Source FIDO U2F server [26] and TokenOne cloud- based Authentication Version 2.8.5 [28] | Provides a server-based enhanced- authentication capability as required by the risk assessment module (magfido) or for the e-commerce platform administrator (TokenOne).

Explanation: NIST publication on credential and access management. Topics: authentication, mfa, token. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.