You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control OC-01 in The NIST Cybersecurity Framework (CSF) 2.0? (Part 8) Control OC-01: firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability - o PR.PS-01: Configuration management practices are established and applied - o PR.PS-02: Software is maintained, replaced, and removed commensurate with risk - o PR.PS-03: Hardware is maintained, replaced, and removed commensurate with risk - o PR.PS-04: Log records are generated and made available for continuous monitoring - o PR.PS-05: Installation and execution of unauthorized software are prevented - o PR.PS-06: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle - Technology Infrastructure Resilience (PR.IR): Security architectures are managed with the organization's risk strategy to protect asset confidentiality, integrity, and availability, and organizational resilience - o PR.IR-01: Networks and environments are protected from unauthorized logical access and usage - o PR.IR-02: The organization's technology assets are protected from environmental threats - o PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations - o PR.IR-04: Adequate resource capacity to ensure availability is maintained ## DETECT (DE): Possible cybersecurity attacks and compromises are found and analyzed - Continuous Monitoring (DE.CM): Assets are monitored to

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, csf, fips. General security reference material without sensitive content. Source: The NIST Cybersecurity Framework (CSF) 2.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector? (Part 111) Control AM-1: | | Associated Test Case | PACS-1 | | Associated Cybersecurity Framework Subcategories | PR.AC-1, PR.AC-7 | | Preconditions |  PACS-1 test case produces successful results that prove the PACS created patient studies and the VNA stored the studies.  A Microsoft Azure storage account exists.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Guidance for First Responder Mobile and Wearable Devices say about B.1.4 Test 4: Obtaining Vulnerability Information from OS version and known databases? (Part 4) According to Security Guidance for First Responder Mobile and Wearable Devices, B.1.4 Test 4: Obtaining Vulnerability Information from OS version and known databases: are administered at the discretion of the first responder and/or mobile ISP service provider. It is recommended to check for device software updates regularly and apply those patches when available. Note that not all CVEs may apply to a specific device, nor may it be possible to address or patch the CVE. OS and patch-level information should be readily available to the device user at any time of inquiry. Figure 6 - CVE reference in National Vulnerability Database <!-- image --> Using one of the CVE's found in Figure 5, Figure 6, cross-references the CVE-2018-9497 ID in the NIST National Vulnerability Database to obtain more information about the unpatched vulnerability [23]. Detailed information can be used to determine if a patch is available or if further action is needed to mitigate the risk. Benefits: Analysis of known vulnerabilities informs the user of potential threats that the device may incur. CVE analysis allows the users to determine the next steps to secure the device, such as if the device can be updated, if further protections are necessary, or supplemental mitigation mechanisms must be employed.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, cve-. Contains technical security guidance that could inform defensive posture. Source: Security Guidance for First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD) say about The uplink port? (Part 1) According to Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD), The uplink port: The uplink port auto eth enp1s0 iface eth0inet dhcp v. Confirm that the bridge entry contains an ovs_bridge_uplink_port line referring to the uplink interface as seen in the config below: auto brmn001 allow-ovs brmn001 iface brmn001 inet manual ovs_type OVSBridge ... # This is the port that's connected to the Internet ovs_bridge_uplink_port enp1s0 ... vi. Reboot the gateway to apply the changes to the /etc/network/interfaces file by executing the following command: sudo reboot Create a gateway configuration file for the Micronets Gateway to register for the subscriber: Copy and save the MAC addresses and corresponding interface names output by execut- ing the following command: ifconfig NIST SP 1800-15C: Securing Small-Business and Home Internet of Things Devices 175 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 Navigate to the /etc/network/interfaces file on the gateway, and copy the subnets con- figurations, which will be used for the gateway configuration file in the following steps: sudo vim /etc/network/interfaces Copy and save the subnet and ranges associated with the interfaces identified in the previous step from this file. (Note: these are at the bottom of the file.) NIST SP 1800-15C: Securing Small-Business and Home Internet of Things Devices 176 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 Create the gateway config file by entering the following command: sudo vim gateway-config-001.json Modify the following configuration to include your gateway’s MAC address and subnets as seen below, and copy them into the gateway-config-001.json file.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-8(5) in Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management? (Part 28) Control CM-8(5): | The defect check to assess whether this sub-capability is operating effectively is defined as follows: | Defect Check ID | Defect Check Name | Assessment Criteria Summary | Assessment Criteria Notes | Selected | |-------------------|------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------| | HWAM-Q04 | Poor timeliness metric | Frequency of update (timeliness) of the actual inventory collection is lower than an [organization- defined-threshold].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT) provide? (Section 58) itionally, if a component fails, it should fail in a manner that does not generate unnecessary traffic on IoT or other networks, or does not cause another problem elsewhere, such as a cascading event. IoT system should also allow for graceful degradation such as moving from 'normal operation' with full automation to 'emergency operation' with operators more involved and less automation to 'manual operation' with no automation. -  Restoring the system after an incident. Incidents are inevitable, and an incident response plan is essential. A major characteristic of a good security program is how quickly an IoT system can be recovered after an incident has occurred. For the purposes of this report, risk is a measure of the extent to which an entity is threatened by a potential circumstance or event and is typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. For example, information security risks are those that arise from the loss of confidentiality, integrity, or availability of information or information systems. Information security risks reflect the potential adverse impacts to organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. Risk assessment is the process of identifying, estimating, and prioritizing risks. Assessing risk requires the careful analysis of threat and vulnerability information to determine the extent to which circumstances or events could adversely impact an organization and the likelihood that such circumstances or events will occur [21]. The proliferation and increased ubiquity of IoT components are likely to heighten the risks they present; particularly as cyber criminals work to develop new generations of malware dedicated to exploiting them. For instance, Dyn, a company that monitors and routes Internet traffic, was a victim of a DDoS attack in October 2016.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, malware. Contains technical security guidance that could inform defensive posture. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain REFERENCES according to NIST Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, REFERENCES: Source Control: MA-04 Supporting Publications: SP 800-63-3 [27], SP 800-88 [50]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control say about Identity Function? (Part 29) According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control, Identity Function: For example, the | [NIST-SP800-53r5] PM-30, SA-9, SR-1, SR-2, SR-3, SR-5 [NIST-SP800-161] | | Subcategory | Applicability to the Ground Segment | References | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------| | organizational stakeholders.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Operational Technology (OT) Security provide? (Section 78) d information security program. However, information security programs typically focus on the confidentiality, integrity, and availability – in that order – of information for the entire organization. Information security programs do not necessarily address all of the specific security and operational needs of an OT environment, which instead prioritizes safety, followed by availability, integrity, and confidentiality. This difference in focus and priorities between IT and OT security programs should be kept in mind. NIST SP 800-100, Information Security Handbook: A Guide for Managers [SP800-100], provides a broad overview of information security program elements to assist in establishing and implementing an information security program in an organization. The lifespan of an OT system can exceed 20 years. As a result, many legacy systems may contain hardware and software that are no longer supported by vendors and cannot be patched or updated to protect against new vulnerabilities. In that case, the security program should be tailored to the unique characteristics of the legacy system to determine whether the controls are applicable. When security controls are not supported by the legacy OT system, compensating controls should be considered. For example, anti-malware software may not be available for systems such as PLCs and DCS, which means that malware protection requirements cannot be applied to these endpoints. In this case, a compensating control should be considered, such as using a firewall with a deep packet inspection capability that can monitor and block advanced threats like malware. The primary purpose of investing in a cybersecurity program is risk management. Risk to operations exists because of the potential of threat actors exploiting the vulnerabilities in the applications and infrastructures.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, threat actor, malware. Contains technical security guidance that could inform defensive posture. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-7 in Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments? (Part 191) Control CM-7: the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.autoInstall.disable If isolation.tools.autoInstall.disable does not exist or is not set to true, this is a finding. | TRUE | | CCE ID | Configur ation(s) | Built-In/ Enhanced | Prod- uct | Audit Procedure | Recommended Parameter Value | |---------------|---------------------------------|----------------------|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------| | CCE- 8433 6-7 | NIST800 53-VI- ESXI- CFG- 00099 | Enhanced | vCent er | From a PowerCLI command prompt, while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.setinfo.sizeLimit If tools.setinfo.sizeLimit does not exist or is not set to 1048576, this is a finding. | 1048576 | | CCE- 8433 7-5 | NIST800 53-VI- ESXI- CFG- 00100 | Enhanced | vCent er | From a PowerCLI command prompt, while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.device.edit.disable If isolation.device.edit.disable does not exist or is not set to true, this is a finding.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is References according to NIST_SP_800-53r5_Security_Privacy_Controls? References: [OMB A-130], [FIPS 140-3], [SP 800-61], [SP 800-83], [SP 800-92], [SP 800-94], [SP

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Exchanging Event Tickets and Coupons : according to NIST A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems According to A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems, Exchanging Event Tickets and Coupons :: This use case considers a system to issue and manage transferable event tickets and coupons (e.g., for concerts, conferences). The system is owned by a ticketing company that controls initial identity proofing and user registration. Once registered, event organizers can issue transferable tickets to registered users (in the form of non-fungible tokens). Although the initial registration is controlled by the system owner, users can transfer tickets on their own without any further approval from the system owner. For instance, a ticket owner may be able to exchange the ticket for one on another date, give it to a friend, or sell it. After attending a concert, an individual may keep the digital ticket as a souvenir and add an attestation of it on social media to connect with other attendees and artists. The system also implements a loyalty program to earn rewards and attend other events. It periodically distributes redeemable coupons (in the form of a Merkle airdrop of non-fungible tokens) to the customer base that can then be used to claim discounts to attend new events. While these coupons have an expiration date and were issued to a certain group of individuals, they too can be made transferable. For example, an individual that receives a coupon but prefers to give it to a friend can do so, thus allowing the event organizers to reach a wider target audience.

Explanation: NIST publication on credential and access management. Topics: identity management, token. Contains security framework guidance for authentication systems. Source: A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RA-1 in Securing Wireless Infusion Pumps in Healthcare Delivery Organizations? (Part 77) Control RA-1: data reporting and analysis to add safety, efficiency, and value Provides an interface capability to help the hospital biomedical engineering department effectively manage their infusion pump fleet. The drug library publishing module helps the hospital pharmacy effectively distribute and enforce medication safety rules. A virtual server platform that provides two-way wireless communication with Alaris PC units Manages drug libraries, firmware updates, and configurations of intravenous pumps NIST SP 1800-8C: Securing Wireless Infusion Pumps 31 Vendor Name Product Name Operating Platform Description Smiths Medical PharmGuard Server Microsoft Windows Manages drug libraries, firmware updates, and configurations of Hospira intravenous pumps for Smiths Medical Pumps NCCoE installed the pump servers in the network in the VLAN 1400. To do so, we prepared a virtual machine in the VMware with the operating system and network, as specified in the vendor installation manual. Because one or more database is associated with the infusion pump server for storing the data, the installation and configuration of the database are parts of the pump server installation procedure. After the installation, we implemented a basic configuration: the user account setup, reporting template configuration, security hardening, license installation, pump metadata installation. T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P 1 8 0 0 - 8 . . We have not included the pump server setup because the vendor performs this activity.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Study of OSI Key Management provide? (Section 213) describing the Internet suite of protocols and related experiments. Responder: A service user that responds to a connection or association. RFC: See Request for Comments. QOS: See Quality of Service. Quality of Service: The desired or actual characteristics of a service; typically, but not always, those of the network service. SAP: See service access point. SDU: See service data unit. Service access point: An artifact modeling how a service is made available to a user. Service data unit: User-data passed through a service access point. Service primitive: An artifact modeling how a service is requested or accepted by a user. Session layer: That portion of an OSI system responsible for adding control mechanisms to the data exchange. Transfer syntax: A description of an instance of a data structure that is expressed as string of bits. Transport layer: That portion of an OSI system responsible for reliability and multiplexing of data across network (over and above that provided by the network layer) to the level required by the application. TSAP: Transport service access point. In this section security terms and abbreviations used in this paper are defined. The terms and abbreviations are compiled mainly from [ISO 7498-2], [ISO/SC21 6693] and [BARK91]. Access Control: The prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorized manner. Asymmetric cryptographic algorithm: A cryptographic algorithm that uses two related keys. At least one of the two keys is the cryptographic inverse of the other. CA: (Certification Authority. Confidentiality: The property that information is not made available or disclosed to unauthorized individuals, entities, or processes. Connection confidentiality: This service provides for the protection of (N)-user-data on an (N)-connection. Connectionless confidentiality: This service provides for the confidentiality of all (N)-user-data in a single connectionless (N)-SDU.

Explanation: NIST publication on credential and access management. Topics: access control, key management, sso. Contains security framework guidance for authentication systems. Source: A Study of OSI Key Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-6 in NIST_SP_800-37r2_Risk_Management_Framework? (Part 231) Control AM-6: MANAGEMENT PROCESS he following sections describe the roles and responsibilities of key participants involved in an organization's risk management process.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does IT Asset Management say about 5.3.4.11 AssetCentral? According to IT Asset Management, 5.3.4.11 AssetCentral: AssetCentral is a Web-based IT asset management and data center management solution. Information on all physical IT assets used in the ITAM project was entered into AssetCentral. This information includes make, model, serial number, barcode, room, rack, and owner. This information is then used to provide a complete picture of the state of an asset. Splunk Enterprise utilizes a direct SQL database query to gather information from AssetCentral.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IT Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Notional Supply Chain Risk Management Practices for Federal Information Systems provide? (Section 55) ssue or adverse supply chain event. - c) Establish policies and procedures that require identification methods to support provenance in the event of a supply chain issue or adverse supply chain event. - d) Define, design, and implement roles that limit privilege and create redundancy throughout the element life cycle to mitigate the risk of a single role being able to, intentionally or unintentionally, create adverse consequences. - e) Require protection and safeguarding of authentication mechanisms. - a) Implement unique identification requirements for elements and systems by applying policies, procedures, and means of identification to the supply chain. - b) Apply unique identifiers to design, test, and evaluation activities, including design tools (hardware and software), drawings and diagrams, bills of material, and tools used to protect the design, test, and evaluation processes. - c) Integrate mechanism(s) to uniquely identify system-critical hardware elements, such as a physical identifier or authenticator to the hardware. This makes unauthorized substitutions more detectable. This can include etched bar codes, holograms, or other unique identification technologies. None - a) Assess the effectiveness of acquirer and integrator identity management and access control policies, procedures, and practices in limiting exposure of, or access to, elements or element processes. - b) Assess implementation of the acquirers' and integrators' assignment of tasks and activities to roles. - c) Employ tools and techniques to determine if authenticators are sufficiently strong to resist attacks intended to discover or compromise authenticators. - d) Perform audits on unique identification deficiencies within acquirer system/environment and report up the supply chain for corrective action. - e) Check for robustness of the acquirer and integrator infrastructure that manages both identities and labels.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Notional Supply Chain Risk Management Practices for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research say about 4.8.5 Microsoft VSC Technology? (Part 1) According to Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research, 4.8.5 Microsoft VSC Technology: 4.8.5 Microsoft VSC Technology The Microsoft Windows 8.1 VSC is a multi-factor X.509-based cryptographic device. 29 The system's TPM protects the DPC's cryptographic key that is activated through a second authentication factor (e.g., PIN). Authentication is accomplished by proving possession of the device and control of the key. All private key cryptographic functions occur within the TPM. Cryptographic message digests occur within the OS's Cryptographic Service Provider (CSP). VSCs utilizing a TPM support three main security principles: - Non-exportability: Since all private information on the VSC is encrypted by using the host machine's TPM, it cannot be used on a different machine with a different TPM. Additionally, TPMs are designed to be tamper-resistant and non-exportable themselves, so an adversary cannot reverse engineer an identical TPM or install the same one on a different machine. - Isolated cryptography: TPMs provide the same properties of isolated cryptography offered by conventional smart cards, and this is utilized by VSCs. When used, unencrypted copies of private keys are loaded only within the TPM and never into memory accessible by the OS. All cryptographic operations with these private keys occur inside the TPM. - Anti-hammering: If a user enters a PIN incorrectly, the VSC responds by using the antihammering logic of the TPM, which rejects further attempts for a period of time instead of blocking the card. This is also known as lockout. ADCS supports TPM attestation, 30 which provides the ability for the issuing CA to confirm that the key in the certificate request is protected by a known TPM.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Threshold Schemes for Cryptographic Primitives_ Challenges and Opportunities in Standardization and Validation of Threshold Cryptography provide? (Section 8) ficult to reach a state where the number of contemporaneous compromised shares surpasses the compromise threshold. Separating the analysis of different security aspects can sometimes lead to pitfalls. To avoid such problems it is important to use appropriate formal models of security. At the same time, it is relevant to assess potential tradeoffs that a threshold cryptographic scheme induces across different security properties. A system model is also important to characterize different types of attack that a system may be subject to. Specific attacks in the real world exploit differences between conventional implementations and their idealized versions. Threshold schemes can be used to improve resistance against some of these specific attacks that breach specific security properties (e.g., confidentiality of a key) or sets thereof. An abstract security model is not enough to assess the effects of placing a threshold scheme in an adversarial environment. One also needs to characterize implementation aspects whose variation may affect security. Such characterization helps distinguish, possibly across different application contexts, the resistance provided against certain classes of attacks. To this end, this document proposes that a basis for discussion and comparison of threshold schemes should include the description of several characterizing features. These include the types of threshold, the communication interfaces, the target computing platforms, and the setup and maintenance requirements. The examples in the document illustrate how security properties can vary depending on high-level features, on assumed attack vectors and on the type of adversarial goals and capabilities. On one hand, this helps prevent a possible misconception that a higher threshold directly means higher security. On the other hand, it also intends to convey that threshold schemes can be used to implement cryptographic primitives in a more secure way.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, attack vector. Contains technical security guidance that could inform defensive posture. Source: Threshold Schemes for Cryptographic Primitives_ Challenges and Opportunities in Standardization and Validation of Threshold Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Technology Assessment_ Methods for Measuring the Level of Computer Security say about Siiat\_skiiis\_aEe\_Eeeded\_tQ\_siiQQessfull3z\_u£e\_it?? According to Technology Assessment_ Methods for Measuring the Level of Computer Security, Siiat\_skiiis\_aEe\_Eeeded\_tQ\_siiQQessfull3z\_u£e\_it?: An auditor with ADP skills is needed to carry out the methodology. As the hook notes, "Evaluation of control strengths and weaknesses is a highly subjective process. No pat formula or procedures exist to give the answers or even to make it easy. This is the process which most requires professional skills of the auditor" [p. 181].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technology Assessment_ Methods for Measuring the Level of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain <question> according to NIST Specification for the Extensible Configuration Checklist Description Format (XCCDF) According to Specification for the Extensible Configuration Checklist Description Format (XCCDF), <question>: This element specifies an interrogatory string with which to prompt the user during tailoring. It may also be included into a generated document. Note that this element may not contain any XCCDF child elements nor may it contain XHTML formatting elements. Multiple instances may appear with different xml:lang attributes. Content: string Cardinality: 0-n Parent Elements: Group, Rule, Value Attributes: xml:lang Child Elements: none For Rule and Group objects, the question text should be simple binary (yes/no) question, because tailoring for Rules and Groups is for selection only. For Value objects, the question should reflect the designed data value needed for tailoring.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report_ Authentication Diary Study say about A.1.2.3 Frequency? According to Report_ Authentication Diary Study, A.1.2.3 Frequency: Let's look at a couple of episodes where you marked that you were very frustrated. [ Walk through the data from the form, if you have it, up to the point of describing the problem. After you read their description, ask: ] What happened here? - What was frustrating about it? [or, continue, if needed:] Why did you become frustrated? - What did that event cost you?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report_ Authentication Diary Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Q. In what time frame must systems and data be recovered and restored when a disruption occurs? according to NIST Information Security Handbook_ A Guide for Managers According to Information Security Handbook_ A Guide for Managers, Q. In what time frame must systems and data be recovered and restored when a disruption occurs?: - A. When a disruption occurs, a recovery strategy must be implemented within the recovery time objective (RTO) period.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Interoperability according to Card Technology Developments and Gap Analysis Interagency Report? Interoperability: Card Operating System level - Interoperability of card ICs from different manufacturers that have a microprocessor can also be achieved through the use of a common operating system. Even to the point where it's certainly technically feasible to port the operating systems from the contact card world to a contactless card IC. The protocol obviously, the transmission protocol, has to be different. Currently, these microprocessor based ICs are available that conform to all four parts of ISO14443 or they're becoming available.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Card Technology Developments and Gap Analysis Interagency Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges say about TRAININGGLYPH<c=2,font=/HAAAAA+HKGrotesk-Bold> COMPLIANCEGLYPH<c=2,font=/HAAAAA+HKGrotesk-Bold>? According to Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges, TRAININGGLYPH<c=2,font=/HAAAAA+HKGrotesk-Bold> COMPLIANCEGLYPH<c=2,font=/HAAAAA+HKGrotesk-Bold>: While organizations most often use learning management systems to track RBT completion, over a third use a manual system for tracking. Participants selected all methods that their organization utilizes to track RBT completion (Figure 6). Over half (54%) of survey participants use a Department-wide learning management system (LMS). Over a third (37%) utilize a spreadsheet or other type of manual method to track RBT completion. Only 7% indicated that their organization does not track RBT completion. 29% of survey participants use more than one method to track. Figure 6. Tracking RBT completion (n = 82) <!-- image --> Most organizations do not experience challenges tracking RBT completion, but training tracking for contractors is more challenging than for federal employees. Survey participants rated the level of challenge their organizations face when tracking federal and contractor employee completion of RBT (Figure 7). 19% of participants indicated that it was very or moderately challenging to track federal employee completion of RBT. Over a quarter (29%) said it was very or moderately challenging to track contractor completion of RBT. <!-- image --> 'We've explored self-paced training options, but ensuring compliance and tracking completion is challenging there.' (Q72) Figure 7. Tracking federal and contractor employee RBT completion (n = 76) <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Test Personal Identity Verification (PIV) Cards Version 2 say about Subject Key Identifier :? According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Subject Key Identifier :: A7:16:70:77:ED:C6:C9:30:6F:BC:A3:C3:D1:BA:D5:C5:40:25:47:43

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does PIV Data Model Test Guidelines provide? (Section 221) | 1. Set cardHandle := <<valid card handle>> cate from 2. Set OID := <<Digital Signature Certifi (2.16.840.1.101.3.7.2.1.0)>> 3. Call pivGetData w/ • (IN) cardHandle • (IN) OID • (OUT) data 4. Extract the value of the keyUsage extension field the certificate | |--------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Expected Result(s) | The digitalSignature and nonRepudiation bits have been set. | | Purpose | Con exists in the certificate corresponds to the p firms that the public key that rivate key on the card. | |--------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Reference(s) | 1. FIPS201, Section 5 2. AS07.02.07 | | Precondition | 1. A valid PIV card is inserted into the contact reader. 2. n exists between the test application and er. 3. ion is currently connected to the card application nt on A valid PC/SC connectio the contact read The test applicat which is accessible through card handle. 4. A digital signature key and corresponding certificate are prese the PIV card. | | Test Steps | 1. Take an arbitrary stream of data 2. Hash the data using a hash algorithm 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders say about 3.5.1 PSFR Risks? According to Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders, 3.5.1 PSFR Risks: As PSFR communities adopt mobile platforms and applications, organizations should consider potential risks that these new devices and ecosystems introduce that may negatively affect PSFR organizations and the ability of PSFR personnel to operate. These are some of the risks: -  The reliance on passwords alone by many PSFR entities effectively expands the scope of a single application/database compromise when users fall back to reusing a small set of easily remembered passwords across multiple applications. -  Complex passwords are harder to remember and input to IT systems. Mobile devices exacerbate this issue with small touchscreens that may not work with gloves or other PSFR equipment, and with three separate keyboards among which the user must switch. In an emergency response, any delay in accessing information may prove critical to containing a situation. -  Social engineering, machine-in-the-middle attacks, replay attacks, and phishing all present real threats to password-based authentication systems. -  Deterministic, cryptographic authentication mechanisms have security benefits, yet come with the challenge of cryptographic key management. Loss or misuse of cryptographic keys could undermine an authentication system, leading to unauthorized access or data leakage. -  Biometric authentication mechanisms may be optimal for some PSFR personnel, yet organizations need to ensure that PII, such as fingerprint templates, is protected. -  Credentials exposed to mobile applications could be stolen by malicious applications or misused by nonmalicious applications. Previously, it was common for native applications to use embedded user-agents (commonly implemented with web views) for OAuth requests. That approach has many drawbacks, including the host application being able to copy user credentials and cookies, as well as the user needing to authenticate again in each application.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1.3 Organization according to NIST A Framework for Designing Cryptographic Key Management Systems According to A Framework for Designing Cryptographic Key Management Systems, 1.3 Organization: Section 1 Introduction provides an introduction to the Key Management Framework and the motivation behind it. Section 2 Framework Basics covers basic concepts of this Framework and provides an overview of the Framework. Section 3 Goals defines the goals of a robust CKMS. Section 4 Security Policies discusses the structure, typical contents, and need for information management, information security, CKMS security, and other related security policies. Section 5 Roles and Responsibilities presents the roles and responsibilities that support a CKMS. SP 800-130 August 2013 Section 6 Cryptographic Keys and Metadata covers the most critical elements of a CKMS: keys and metadata, by enumerating and defining possible key types; key metadata; and key and metadata management functions, along with access control considerations, security issues and recovery mechanisms. Section 7 Interoperability and Transitioning considers the need for interoperability and the ability to easily make transitions in CKMS capabilities in order to accommodate future needs. Section 8 Security Controls describes security controls applicable to a typical CKMS. Section 9 Testing and System Assurances describes security testing and assurances. Section 10 Disaster Recovery deals with disaster recovery in general and of a CKMS specifically. Section 11 Security Assessment discusses the security assessment of a CKMS. Section 12 Technology Challenges briefly discusses the technical challenges provided by new attacks on cryptographic algorithms, key establishment protocols, CKMS devices, and quantum computing. Appendix A enumerates and describes useful references. Appendix B consists of a glossary of terms used in this Framework. Appendix C provides a list of acronyms used in this Framework.

Explanation: NIST publication on credential and access management. Topics: access control, key management. Contains security framework guidance for authentication systems. Source: A Framework for Designing Cryptographic Key Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines on Electronic Mail Security? (Part 276) Control ES-1: the internal network from the mail server and vice versa | ## Appendix G-Acronym List | 3DES | Triple Data Encryption Standard | |--------|---------------------------------------------------| | ACL | Access Control List | | AES | Advanced Encryption Standard | | API | Application Programming Interface | | ARP | Address Resolution Protocol | | ARPA | Advanced Research Project Agency | | ASCII | American Standard Code of Information Interchange | | BCP | Best Current Practice | | CA | Certificate Authority | | CIO | Chief Information Officer | | CMVP | Cryptographic Module Validation Program | | CPU | Central Processing Unit | | CRAM | Challenge-Response Authentication Mechanism | | CSE | Communications Security Establishment | | DDoS | Distributed Denial of Service | | DMZ | Demilitarized Zone | | DNS | Domain Name System | | DNSBL | Domain Name System Blacklist | | DoD | Department of Defense | | DoS | Denial of Service | | DSA | Digital Signature Algorithm | | DSN | Delivery Status Notification | | DSS | Digital Signature Standard | | ESMTP | Extended Simple Mail Transfer Protocol | | FIPS | Federal Information Processing Standards |

Explanation: NIST publication on credential and access management. Topics: access control, authentication, certificate authority. Contains security framework guidance for authentication systems. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SA-11(01) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control SA-11(01): DEVELOPER TESTING AND EVALUATION | STATIC CODE ANALYSIS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IA-02(10) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control IA-02(10): a single sign-on capability is provided for <IA-02(10)_ODP system accounts and services>. POTENTIAL ASSESSMENT METHODS AND OBJECTS:


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendations for Federal Vulnerability Disclosure Guidelines say about Abstract? According to Recommendations for Federal Vulnerability Disclosure Guidelines, Abstract: Receiving reports on suspected security vulnerabilities in information systems is one of the best ways for developers and services to become aware of issues. Formalizing actions to accept, assess, and manage vulnerability disclosure reports can help reduce known security vulnerabilities. This document recommends guidance for establishing a federal vulnerability disclosure framework, properly handling vulnerability reports, and communicating the mitigation and/or remediation of vulnerabilities. The framework allows for local resolution support while providing federal oversight and should be applied to all software, hardware, and digital services under federal control.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendations for Federal Vulnerability Disclosure Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identity and Access Management for Electric Utilities say about Java Application? (Part 75) According to Identity and Access Management for Electric Utilities, Java Application: agement for Electric Utilities 247 Figure 13-6 Ozone Import Group from Directory T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 Select the Schedule, Publication Points, and Distribution Points, as shown in Figure 13-7. . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . NIST SP 1800-2C: Identity and Access Management for Electric Utilities 248 Figure 13-7 Ozone New Proof Information T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 Click the Administrators tab, as shown in Figure 13-8. Click the Add Administrators button. Select the users who will administer the proof. Select Add Entities. . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . NIST SP 1800-2C: Identity and Access Management for Electric Utilities 249 Figure 13-8 Ozone New Proof Administrators T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . Click Save. Create the Ozone Server Configuration: Select Configuration > Ozone Server > New…. Click Add proof from tree…. Select a proof that the Ozone Server should use for authorizations, as shown in Figure 13-9. . NIST SP 1800-2C: Identity and Access Management for Electric Utilities 250 Figure 13-9 Ozone Peer Proofs T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . Set the number of proof references (depth) that the proof may follow to authorize a credential, as shown in Figure 13-10. Ensure that the locations where the Ozone Server will retrieve the proof are correct. .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)? (Part 164) Control PD-12: | [FIPS 201-2], Section 4.3.1 - Activation by Cardholder | | IAT = Processes | IAT = Processes | IAT = Processes | IAT = Processes | |--------------------------|-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | Authorization Focus Area | Identifier | Issuer Control | Source | | | AI-6 | The PIV Card is valid for no more than six years.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is This publication is available free of charge from according to Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security? This publication is available free of charge from:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DS-3 in Cryptographic Key Management Workshop Summary -- June 8-9, 2009? (Part 7) Control DS-3: , is needed; a collection of generic building blocks of security that can be integrated into a system and methods to analyze the resulting system are needed in creating a good key management platform. ## 2.1.8 Future Key Management Methods: David McGrew, Cisco - The focus of the talk was from a manufacturer's perspective and included the challenges of the equipment distribution problem and creating a manufacturer's device certificates. A manufacturer often ships devices to customers with a hardwired private key, device certificate, and device identifier. This would give the capability for devices to authenticate each other from a distance, but would not solve the authorization problem. - Threshold cryptography was discussed (i.e., M out of N keys must be available to perform an operation), as well as manufacturing certificates, automating manual key distribution, and a symmetric key generation system. - Threshold cryptography is useful for encrypted data storage access (e.g., a minimum number of people must cooperate in order to retrieve sensitive, stored information. - There is a problem with replacing the keys and updating revocation lists. We need to be able to streamline the distribution process and replace manual key distribution with a minimal impact process. - We need an automated CKM system that can be implemented in existing systems. - Requirements include: the authenticated/authorized distribution of keys, keys must persist over a long term, a system that replaces/updates keys when needed, key creation should not be centralized, minimal operational impact, and the CKM should be interoperable with Multipoint Key Distribution (MKD). Candidates for this type of KM system would be Kerberos (for session keys), OASIS (for storage keys) or GDOI (for group key management).

Explanation: NIST publication on credential and access management. Topics: authorization, key management. Contains security framework guidance for authentication systems. Source: Cryptographic Key Management Workshop Summary -- June 8-9, 2009.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 81) Control HA-1: stablishes trust relationships, either mutual or unilateral as required, between the users and providers. Note that CIA service does not make any authorization decisions for the providers. It is left to the providers themselves to make their authorization decisions based on the provided authentication information. CIA is not necessary if two parties can mutual authenticate each other by other means, for example, through the portal login authentication of a trusted portal. No matter whether it works implicitly or explicitly, the CIA service is designed to address the trust bootstrap problem in an XPOLA-enabled Grid community. To make it better understood, let's walk through one of the use scenarios as a provider, X , of service A , and a service A 's user, Y . Suppose X first creates the service A on a remote host. Upon being created, the service A registers itself to a persistent registry. The provider then wants to distribute the service to other people including the user Y . Through a Capman service, he generates a set of capability tokens which contain detailed authorization policy and protected by X 's signature. We will dissect the capability token later, but here we just need to know that the identity of Y is included in the policy as one of the users. Now X advertises his service to Y , who will to use A . When Y tries to access A , his token agent contacts the Capman service for the required capability token. If available, the token is fetched and sent along with the service request to A , where the capability is to be verified. Thus the user Y is served by A , if the request matches what the capability allows. ## 3.2 Attack Analysis Figure 3 can be simplified as Figure 4 to reflect the trust relationships between the main entities, namely the capability authority, the clients, the service instances, and an optional CIA service.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Version according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case, Version: | Version | Date | Description | Author | |-----------|------------|------------------------------------|------------| | 1 | 02-22-2018 | Initial Draft | Supervisor | | 2 | 04-21-2018 | Major changes to the initial draft | Supervisor |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Cloud Computing Forensic Science Challenges say about Table 1: Cloud forensic challenges? (Part 45) According to NIST Cloud Computing Forensic Science Challenges, Table 1: Cloud forensic challenges: ction | Jurisdiction | Many cloud systems operate in multiple countries and regions, and each jurisdiction has specific legal frameworks governing the release, protection, and acceptable use of data. While various international bodies have attempted to adopt treaties for law enforcement to collect and exchange forensic data, there is no universal agreement between countries that addresses jurisdictional issues when cloud data is stored in multiple countries. | If this challenge were overcome, there would be mechanisms in place that provide agreements between jurisdictions, thereby empowering investigators and law enforcement officers to obtain necessary data pertaining to their investigations.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Cloud Computing Forensic Science Challenges.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Cryptographic Standards and Guidelines Development Process say about Federal Stakeholders? (Part 3) According to NIST Cryptographic Standards and Guidelines Development Process, Federal Stakeholders: ort, and to assure that NIST's standards and guidelines are complementary and compatible with those employed for the protection of national security systems and information contained in those systems. Beyond this statutory requirement calling for NIST to consult with other agencies, the NSA, in particular, has significant expertise in cryptography. Their cooperation with NIST is governed by an MOU between the two agencies and technical staff meet monthly to discuss ongoing collaborative work and future priorities. As part of NSA and other agencies' collaboration with NIST, their staff may assist in the development of new standards and guidelines. This may take the form of coauthoring publications with NIST staff, providing comments on draft documents, or submitting cryptographic algorithms for consideration by NIST. All contributions that significantly affect the content of any standard or guideline - particularly normative statements - will be clearly and publicly acknowledged. In accordance with NIST's authorship policy, NIST will identify the names of any authors of standards or guidelines. If a NIST standard or guideline contains an algorithm that was designed by another agency's employees, NIST will acknowledge that agency as the designer, even though NIST may not be able to list specific individuals. 2 As is the case with private sector organizations, NIST will consider and acknowledge other agencies' comments, whether they are provided during the formal public comment period or other stages of development. That includes information that may be provided during monthly NIST meetings 2 The names of some NSA staff cannot, by law, be publicly revealed. 50 U.S.C. §402 note. Freedom of Information Act (FOIA) requests for documents involving any NIST-NSA collaboration are normally reviewed by both organizations and exempted or excluded information, which may include the names of specific NSA participants as noted, may be redacted. NISTIR 7977 with NSA.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Cryptographic Standards and Guidelines Development Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance say about IoT Device Use Risk Descriptors:? According to Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance, IoT Device Use Risk Descriptors:: - Non-Critical: Devices the customer may regularly use but does not rely upon. Loss of functionality for short periods has minimal impact on the customer organization's operations. The device does not collect any sensitive data. These devices do not introduce significant risk to systems and/or data beyond being a connected product. - Environment: Devices that can have an impact on the physical environment in which the equipment is used but do not pose physical safety risks. These devices are not relied upon for accomplishing core mission functions. The impact on the physical environment introduces additional risk for customer organizations. - Mission/Operation: Devices that the customer relies on for their operations and interference with function or unauthorized data disclosure can introduce significant risk for the customer organization. - Safety: Devices that can impact safety, which can introduce significant risk for the customer organization.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IA-4 in IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog? (Part 14) Control IA-4: (e.g., service-oriented architectures) that rely on: - a. run-time access control decisions facilitated by dynamic privilege management. - b. organizationally-defined actions to access/use device. 8. Ability to allow information sharing capabilities based upon the type and/or role of user attempting to share the information. 9. Ability to restrict access to IoT device software, hardware, and data based on user account roles, used with proper authentication of the identity of the user to determine type of authorization. ## (LDU) Limitations on Device Usage Description: Ability to establish restrictions for how the device can be used. Discussion: Aspects of how the IoT device can be used by internal and external users may have to be limited by the organization to comply with security and organizational requirements. In some instances, limitations may have to apply to all who interact with the device, but in others the limitation may change based on various factors. ## Related SP 800-53 Rev. 5 Controls: AC-10, AC-21(2) Requirements that may be necessary: 1. Ability to establish pre-defined restrictions for information searches within the device. 2. Ability to establish limits on authorized concurrent device sessions for: - a. User accounts - b. Roles - c. Groups - d. Dates - e. Times - f. Locations - g. Manufacturer established parameters ## (XCN) External Connections Description: Ability to support external connections. Discussion: Complexities of how system resources are distributed and managed by organizations may require them to securely make external connections to comply with and support security controls. Related SP 800-53 Rev. 5 Controls: AC-10, AC-20(1), AC-21, SC-8 Requirements that may be necessary: 1. Ability to securely interact with authorized external, third-party systems. 2.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Codes for Identification of Federal and Federally-Assisted Organizations say about 5600 Central Intelligence Agency? (Part 5) According to Codes for Identification of Federal and Federally-Assisted Organizations, 5600 Central Intelligence Agency: 3L | Center for Air Force History | | 573M | Air Force Elements, U.S. Southern Command | | 573N | Air Force Elements, U.S. Atlantic Command | | 573O | Air Force Elements, U.S. Pacific Command | | 573Q | Air Force Elements, U.S. Strategic Command | | 573R | Air Force Elements, U.S. Readiness Command | | 573S | Headquarters, U.S. Space Command and NORAD | | 573T | Air Force Elements U.S. Transportation Command | | 573V | Air Force Elements, Other than Europe | | 573W | Air Force Center for Environmental Excellence | | 573Y | Air Force Frequency Management Center | | 573Z | Joint Services Survival, Evasion, Resistance and Escape Agency | | 574Z | Air National Guard | | 57NG | Air National Guard Units (Title 32) | | 57ZG | U.S. Special Operations Command (ANG Title 32) | | 57ZS | U.S.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Codes for Identification of Federal and Federally-Assisted Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.2.3 Identify the Objectives according to NIST Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities According to Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 5.2.3 Identify the Objectives: The objectives of any functional exercise should be validating the content of the IT plan, validating participants' roles and responsibilities as documented in the plan, validating the interdependencies documented in the plan, and providing an opportunity for participants to get hands-on practice in executing their functions. An additional objective for some exercises is meeting regulatory and other such requirements associated with exercising plans, such as the requirement in NIST SP 800-53 for Federal agencies to conduct exercises or tests for their systems' contingency plans at least annually. Specific objectives should be documented and clearly articulated to exercise participants.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is one of the following PARAMETER VALUES is selected according to Assessing Security and Privacy Controls in Information Systems and Organizations? one of the following PARAMETER VALUES is selected: {real-me; near real-me};

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PM-8200 in Cell Phone Forensic Tools_ an Overview and Analysis Update? (Part 73) Control PM-8200: More information can be found in Appendix B: Device Seizure Results.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about Determine if:? According to Assessing Security Requirements for Controlled Unclassified Information, Determine if:: A.03.17.03.ODP[01]: security requirements to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences from supply chain-related events are defined . A.03.17.03.a[01]: a process for identifying weaknesses or deficiencies in the supply chain elements and processes is established. A.03.17.03.a[02]: a process for addressing weaknesses or deficiencies in the supply chain elements and processes is established. A.03.17.03.b: the following security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events: <A.03.17.03.ODP[01]: security requirements> .

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of say about A . Government: Rights of Data Subjects? (Part 1) According to Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of , A . Government: Rights of Data Subjects: A . Government: Rights of Data Subjects - 1 . The Fifth and Fourteenth Amendments to the Constitution prohibit Federal and State and local governments from depriving a person of "life, liberty, or property" without "due process of law." The procedures required by the courts in applying this principle are designed to assure that the individual has a reasonable opportunity to challenge the proposed deprivation. At a minimum, there must be notice and a hearing at which the factual basis of the decision is subject to scrutiny. See Mullane v. Central Hanover Bank & Trust Co., 337 U.S. 306, 314 (1950); Greene v. McElroy, 360 U.S. 474, 496-497 (1959); Goldberg v. Kelly, 397 U.S. 254, 269-271 (1970). 2. The Administrative Procedure Act sets out detailed procedures for Federal agencies' conduct of administrative hearings required by the Constitution or by statute. The Act's provisions prescribe, for example, how notice is to be given and how evidence may be collected, presented, and evaluated. 5 U.S.C. §§ 551, 554-558. 3. The Privacy Act requires agencies, on request, to provide individuals with access to records pertaining to them and an opportunity to correct or challenge the contents of the records. 5 U.S.C. § 552a. 4. The Freedom of Information Act provides individuals with access to many types of records that are exempt from access under the Privacy Act, including many categories of personal information. 5 U.S.C. 552. - § 5. Most of the State fair information practice statutes allow individuals to inspect and challenge information about them held by the State; many also require some type of registry or inventory of State-maintained data bases. See . e . q . Va. Code § 2.1-377; Mass. Gen. Laws ch. 66A; Ark. Stat. § 16-804; Cal. Civ. Code § 1798; Colo. Rev. Stat. §§ 24-72-204 (3 )( a) , 24-90-119; Conn. Gen. Stat. § 4-190; 111. Stat. ch. 116 § 43.5; Ind. Code §§ 5-14-3-1, 4-1-6-3; Ky. Rev. Stat. § 61.884; Mo. Stat. § 182.817; Nev. Rev. Stat. § 229.013; N.Y. Pub.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Privacy Protection in the United States_ A 1991 Survey of Laws and Regulations Affecting Privacy in the Public and Private Sector Including a List of .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does IT Asset Management say about 4.6.2.1 INSTALL ACTIVE DIRECTORY CERTIFICATE SERVICES (AD CS)? According to IT Asset Management, 4.6.2.1 INSTALL ACTIVE DIRECTORY CERTIFICATE SERVICES (AD CS): 1. Go to Server Manager and click Add Roles and Features Wizard . 2. Click Next . Select Role-based or feature-based installation . Click Next . 3. Select your server on the next screen and click Next . 4. Select the Active Directory Certificate Services and Add Features when prompted. 5. Click Next when you see .NET 4.5 framework and other default selections. 6. Click Next on informational screens. 7. On the Role Services for AD CS , select all checkboxes and click Next . 8. When you are prompted to install the IIS web service, click Install . 9. Click Close when the installation completes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IT Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does User's Guide to Telework and Bring Your Own Device (BYOD) Security say about User's Guide to Telework and Bring Your Own Device (BYOD) Security? According to User's Guide to Telework and Bring Your Own Device (BYOD) Security, User's Guide to Telework and Bring Your Own Device (BYOD) Security: Murugiah Souppaya Computer Security Division Information Technology Laboratory Karen Scarfone Scarfone Cybersecurity Clifton, VA This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-114r1 July 2016 <!-- image --> U.S. Department of Commerce Penny Pritzker, Secretary National Institute of Standards and Technology

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: User's Guide to Telework and Bring Your Own Device (BYOD) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Secure Deployment of IPv6 provide? (Section 321) ions and accreditations; with a dual stack environment only a single certification and accreditation may be required. The goal should be to achieve security as good as or better than the IPv4 network. The operations phase often begins concurrently with the implementation phase. During operations, the focus is the secure operation of a dual stack or mixed IPv6/IPv4 environment. One of the most difficult challenges facing the operations staff in a mixed IPv6/IPv4 environment is keeping the two environments synchronized. When operations makes changes to security controls such as firewall rule sets, access control lists, and IDS signatures, they must ensure the change occurs on both the IPv4 and IPv6 networks. Rules and signatures must be translated between IPv4 and IPv6 syntax and deployed as a single coordinated process. If strict change control is not followed, the two environments will have non-overlapping protections. In a dual stack environment, the physical topologies of the equipment are the same, but the logical topologies can be very different. Configuration changes can have unpredictable or unforeseen consequences. Configuration management controls should be structured to prevent configuration changes on IPv4 or IPv6 networks that affect the other network. Organizations should manage and monitor their IPv4, IPv6, and dual stack environment as a single environment. A migration from IPv4 to IPv6 results in displacement or retirement of equipment. Some equipment does not support IPv6 and is retired, while other equipment is transferred to IPv4 islands or to other organizations. Organizations must plan for the secure disposition of this obsolete equipment, ensuring that no confidential data is released. Organizations place themselves at great risk for exposing confidential information when disposing of obsolete equipment. A key decision concerning sanitization is whether the equipment is planned for reuse or retirement.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Electronic Health Records on Mobile Devices say about puppet will install here? (Part 98) According to Securing Electronic Health Records on Mobile Devices, puppet will install here: onic Health Records on Mobile Devices 17 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P . 1 8 0 0 - 1 . NIST Cybersecurity Framework v1.1 Sector-Specific Standards & Best Practices Security Characteristics Function Category Subcategory Person or entity authentication Protect (PR) Identity Management, Authentication and Access Control (PR.AC) PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes PR.AC-3: Remote access is managed NIST SP80 0-53 Rev 4 AC-1, AC-2, IA-1, IA-2, IA-3, IA-4, IA-5, IA-6, IA-7, IA-8, IA-9, IA-10, IA-11 AC-1, AC-17, AC-19, AC-20, SC-15 IEC/ISO27002 20 Critical Security Controls 8.3.3, 11.2.1, 11.2.2, 11.2.4, 15.2.1, 11.4.3 CSC-5, CSC-9, CSC-11 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.2, 9.2.3, 10.6.1, 11.2.1, 11.2.2, 11.2.4, 11.3.2, 11.4.4 HIPAA Security Rule [2] 45 C.F.R. §§ 164.308(a)(3)(ii)(B), 164.308(a)(3)(ii)(C), 164.308(a)(4)(i), 164.308(a)(4)(ii)(B), 164.308(a)(4)(ii)(C), 164.312(a)(2)(i), 164.312(a)(2)(ii), 164.312(a)(2)(iii), 164.312(d) 45 C.F.R. §§ 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii) NIST SP 1800-1D: Securing Electronic Health Records on Mobile Devices 18 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P . 1 8 0 0 - 1 .

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: Remote access is access to organizational systems (or processes acting on behalf of

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Threshold Schemes for Cryptographic Primitives_ Challenges and Opportunities in Standardization and Validation of Threshold Cryptography say about 4.2 Types of attack? (Part 3) According to Threshold Schemes for Cryptographic Primitives_ Challenges and Opportunities in Standardization and Validation of Threshold Cryptography, 4.2 Types of attack: nto particular zones of a circuit (which requires close proximity), to change an internal state (e.g., a lock bit [AK96]) and thereby inducing a change of behavior. Conventional vs. threshold-related. While threshold schemes may be designed to mitigate the effectiveness of some attacks on conventional applications, the actual implementation of a threshold design may be the cause of new inherent vulnerabilities. For example, an attack may be able to exploit some vulnerability in the communication network that intermediates several nodes, where such a network would not even exist in a conventional implementation. We characterize an attack as threshold-related if the attack vector is inherently allowed by the threshold design. Complementary, there are conventional attacks that can be considered similarly with respect to each component of a threshold scheme. In the latter case, it is still relevant to consider, for example, if an attacker is able to choose whether to attack the nodes/platform in parallel or sequentially. Tolerance to compromise can be useful even in scenarios of non-intentional adversaries. For example, some systems may be constrained to satisfy auditability requirements that warrant taking down components for audit. If a service is supported on a multi-party threshold scheme with tolerance to compromise, then the audit of components can be done without affecting the overall availability.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, attack vector. Contains technical security guidance that could inform defensive posture. Source: Threshold Schemes for Cryptographic Primitives_ Challenges and Opportunities in Standardization and Validation of Threshold Cryptography.