You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived PIV Application and Data Model Test Guidelines provide? (Section 172) 0x5B byte, respectively) Note: In Step 2 it may be necessary to send the VERIFY command with a correct Derived PIV Application Password in order to prevent the retry counter from decrementing to zero. | |--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Expected Result(s) | 1. From Step 1, the command returns the application property template with the status word '90 00'. 2. From Step 2, the command returns either status word: 1) '6A 80' (incorrect parameter in command data field) or 2) '63 CX' and the retry counter is decremented by 1 (where 'X' is the number of tries remaining). | | Postcondition(s) | Current password is unchanged.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Applications Using Approved Hash Algorithms provide? (Section 38) umber generators were either specified or approved by reference in FIPS 186-2 [FIPS 186-2]; however, their use is limited (see SP 800-131A [SP 800-131A]). RBGs may be constructed using hash functions. The hash function used by the RBG shall be selected so that the RBG can provide a security strength that meets or exceeds the minimum security strength required for the random bits that it generates. See SP 80057, Part 1, for the security strength that can be provided for each approved hash function for random number generation. | [SP 800-38B] | NIST Special Publication (SP) 800-38B, Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication, May 2005. | |----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------| | [SP 800-38C] | NIST Special Publication (SP) 800-38C, Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality, July 2007. | | [SP 800-38D] | NIST Special Publication (SP) 800-38D, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC, November 2007. | | [SP 800-56A] | NIST Special Publication (SP) 800-56A, Recommendation for Pair-Wise Key Establishment | 5 Commonly known as deterministic random bit generators or pseudorandom number generators. | | Schemes Using Discrete Logarithm Cryptography, March 2007. | |---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [SP 800-56B] | NIST Special Publication (SP) 800-56B, Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography, August 2009.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Recommendation for Applications Using Approved Hash Algorithms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control BM-650 in Computer Security and the Data Encryption Standard_ Proceedings of the Conference on Computer Security and the Data Encryption Standard? (Part 53) Control BM-650: image --> Howard Crumb Federal Reserve Bank 33 Liberty Street New York, N. Y. 10045 The following paper has been extracted from the verbal presentation of Mr. Crumb at the February 15th Conference. A written paper had not been submitted at the time of publication of these proceedings. ## 1. Introduction This afternoon I plan to discuss the Federal Reserve Communications System, some of our concerns for security, and the type of operations that the communications system supports. The Federal Reserve System was created by an act of Congress in 1913. Its job was to insure an orderly economic growth, supervise and regulate banks, act as a fiscal agent for the United States Treasury, and provide for an improved collection system. The United States is divided into twelve Federal Reserve regions and there is a Federal Reserve bank in each of the regions. Each bank is an independent corporation. The overall guidance for the Federal Reserve system comes from its Board of Governors located in Washington, D. C. However, each of the banks is responsible for its own operation. ## 2. FEDWIRE Communications System With this introduction, I would like to talk about the communications system between these banks frequently referred to as the FEDWIRE. This system is used to transfer balances between Federal Reserve member banks throughout the country. There was a manual system before FEDWIRE was installed consisting of couriers which transferred money among the member banks, and as a result was vulnerable to those hazards and threats affecting physical transportation. The FEDWIRE was developed to eliminate charges for transfer of funds imposed by the courier system and to make the transfer of funds much faster. The FEDWIRE consists of a central communications site at Culpeper, Virginia and communication lines to each of the Federal Reserve Banks. Similarly, each Federal Reserve Bank is linked to its member banks within its own region or district.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security and the Data Encryption Standard_ Proceedings of the Conference on Computer Security and the Data Encryption Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security Requirements for Controlled Unclassified Information provide? (Section 99) and the system. A.03.15.03.d[01]: the rules of behavior are reviewed <A.03.15.03.ODP[01]: frequency> . A.03.15.03.d[02]: the rules of behavior are updated <A.03.15.03.ODP[01]: frequency> . [SELECT FROM: security planning policy and procedures; rules of behavior for system users; signed acknowledgements of rules of behavior; records for rules of behavior reviews and updates; system security plan; other relevant documents or records] [SELECT FROM: personnel with rules of behavior establishment, review, and update responsibilities; personnel with literacy training and awareness responsibilities; personnel with role-based training responsibilities; authorized users of the system who have signed rules of behavior; personnel with information security responsibilities] NIST SP 800-171Ar3 May 2024 [SELECT FROM: processes for establishing, reviewing, disseminating, and updating rules of behavior; mechanisms for supporting or implementing the establishment, dissemination, review, and update of rules of behavior] Source Assessment Procedure: PL-04 Determine if: A.03.16.01.ODP[01]: systems security engineering principles to be applied to the development or modification of the system and system components are defined. A.03.16.01: <A.03.16.01.ODP[01]: systems security engineering principles> are applied to the development or modification of the system and system components.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0 say about Cybersecurity Framework Alignment:? (Part 36) According to NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0, Cybersecurity Framework Alignment:: ate data processing safeguards. | and responsibilities in the data processing ecosystem, and management commitment), processes, and procedures are maintained and used to manage the protection of data. | PR.PO-P6: Effectiveness of protection technologies is shared. | | | appropriate data processing safeguards. | and responsibilities in the data processing ecosystem, and management commitment), processes, and procedures are maintained and used to manage the protection of data. | PR.PO-P7: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed. | | | appropriate data processing safeguards. | and responsibilities in the data processing ecosystem, and management commitment), processes, and procedures are maintained and used to manage the protection of data. | PR.PO-P8: Response and recovery plans are tested. | | | appropriate data processing safeguards. | and responsibilities in the data processing ecosystem, and management commitment), processes, and procedures are maintained and used to manage the protection of data. | PR.PO-P9: Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening). | | | appropriate data processing safeguards. | and responsibilities in the data processing ecosystem, and management commitment), processes, and procedures are maintained and used to manage the protection of data. | PR.PO-P10: A vulnerability management plan is developed and implemented. | | | appropriate data processing safeguards. | Identity Management, Authentication, and Access Control (PR.AC-P): Access to data and devices is limited to authorized individuals, processes, and devices, and is managed consistent with the assessed risk of unauthorized access.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, incident response. Contains technical security guidance that could inform defensive posture. Source: NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in 2016 NIST_ITL Cybersecurity Program Annual Report? (Part 212) Control HA-3: d methods to effectively monitor and detect data corruption in commodity components (server, operating system, applications, and software configurations) as well as custom applications and data. The project also explored issues of auditing and reporting (user activity monitoring, file system monitoring, database monitoring, scanning backups/snapshots for malware and rapid recovery solutions) to support recovery and investigations. To address real-world business challenges around data integrity, the resulting example solution was composed of open-source and commercially available components. Ultimately, this project resulted in a publicly available NIST Cybersecurity Practice Guide-a description of the solution and practical steps needed to implement an example solution that addresses these existing challenges. ## Domain Name System-Based Security for Electronic Mail ## https:/ /nccoe.nist.gov/projects/building\_blocks/secured\_ email The Domain Name System-Based Security for Electronic Mail project produced a proof-of-concept security platform that demonstrated trustworthy email exchanges across organizational boundaries. The product of the project was a security platform that included the authentication of mail servers, the signing and encryption of email, and binding cryptographic key certificates to the servers; it also included a practice guide that explained how to configure and use the demonstrated platform to satisfy both operational and security requirements. Domain Name System Security Extension (DNSSEC) protocols were used to authenticate server addresses and certificates by binding the X.509 certificates used for TLS to DNS names verified by DNSSEC.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Introduction to Cybersecurity for Commercial Satellite Operations provide? (Section 49) The selection of the subcategories results in Table 5 , which is the Target Profile. These include NIST references and those from other sources, such as Standards Development Organizations (SDOs), the Committee on National Security Systems Instruction (CNSSI) 1200, and others that are relevant to the organization. Table 5. Target Profile | Functions | | Informative Reference | Informative Reference | |-------------|---------------------------------------------------------------------------------------------|--------------------------------------------------------------|---------------------------------------------------------------------| | | Subcategories | SP 800-53, Rev. 4 | SP 800-53, Rev. 5 | | Identify | ID.RA-1: Asset vulnerabilities are identified and documented. | CA-2, CA-7, CA- 8, RA3, RA-5, SA-5, SA-11, SI- 2, SI-4, SI-5 | CA-2, CA-7, CA-8, RA-3, RA-5, SA-5, SA-11, SI-2, SI-4, SI- 5, PM-15 | | | ID.RA-2: Cyber threat intelligence is received from information-sharing forums and sources. | SI-5, PM-15, PM-16 | SI-5, PM-15, PM-16, RA-10 | | Functions | Subcategories | Informative SP 800-53, Rev. 4 | Reference SP 800-53, Rev.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Introduction to Cybersecurity for Commercial Satellite Operations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Training & Awareness Course Compendium say about VENDOR:? (Part 1) According to Computer Security Training & Awareness Course Compendium, VENDOR:: VENDOR: USDA Graduate School 600 Maryland Ave., S.W. Washington, D.C. 20024 (202) 382-8620 Internal auditors have a major role in reviewing the security and controls in sensitive automated systems. This course provides practical guidelines ant techniques for auditing and evaluating the adequacy of security and internal controls in sensitive automated systems. Major problem areas are discussed and examples illustrating the results of inadequate security and controls are presented. In addition, the responsibilities of management, internal audit, and data processing personnel are discussed. This course also provides the attendee with a comprehensive methodology for conducting security and internal control audits of sensitive data processing systems. Using a case study approach, the course illustrates how to identify and quantify the vulnerabilities of automated systems to fraud, disclosure, delay and other threats. The internal control techniques which can be applied to address these vulnerabilities are discussed, as well as the requirements of OMB circulars A- 127 and A-130. COURSE TITLE: Fundamentals of Computer Security for Federal Information Systems COURSE LENGTH: 5 DAY VENDOR: USDA Graduate School 600 Maryland Ave., S.W. Washington, D.C. 20024 (202) 447-7124 This five-day course provides those responsible for computer security with an overview of security issues specifically related t the federal government. Designed to introduce and cover the fundamentals areas of concern facing computer security officers, from mainframe to PC's. The objectives are covered by lecture, group discussion, slide and video presentations. The instructor will provide extensive insights into computer security based on operational experiences. In addition, hands-on risk analysis exercises will be performed. The student will be provided with extensive materials, including demonstration diskettes and public domain anti-virus software.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SR-12 in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 80) Control SR-12: t of criteria for the provision of security services. [SP 800-160-1 adapted] security policy filter A set of rules that governs all aspects of security-relevant system and system component behavior. A hardware and/or software component that performs one or more of the following functions: content verification to ensure the data type of the submitted content; content inspection to analyze the submitted content and verify that complies with a defined policy; malicious content checker that evaluates the content for malicious code; suspicious activity checker that evaluates or executes the content in a safe manner, such as in a sandbox or detonation chamber and monitors for suspicious activity; or content sanitization, cleansing, and transformation, which modifies the submitted content to comply with a defined policy. APPENDIX A PAGE 417 NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ security requirement [FIPS 200, Adapted] security service [SP 800-160-1] security-relevant information selection operation T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : senior agency information security officer h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I senior agency official for privacy [OMB A-130] senior information security officer sensitive compartmented information [CNSSI 4009] A requirement levied on an information system or an organization that is derived from applicable laws, executive orders, directives, regulations, policies, standards, procedures, or mission/business needs to ensure the confidentiality, integrity, and availability of information that is being processed, stored, or transmitted.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2 provide? (Section 26) strate some uses of XCCDF security checklists and tools. -  Scenario 1 - An industry consortium, in conjunction with a product vendor, wants to produce a security checklist for an application server. The core security settings are the same for all OS platforms on which the server runs, but a few settings are OS-specific. The consortium crafts one checklist for the core settings and writes several OS-specific ones that supplement the core settings. Users download the core checklist and the OS-specific checklists that apply to their installations, and then run an assessment tool to score their compliance with the checklists. -  Scenario 2 - An academic group produces a checklist for secure configuration of a particular server operating system version. A government agency issues a set of rules extending the academic checklist to meet more stringent user authorization criteria imposed by statute. A medical enterprise downloads both the academic checklist and the government extension, tailors them to fit their internal security policy, and uses them for an enterprise-wide audit using a commercial security audit tool. Reports outputted by the tool include remediation measures which the IT staff can use to bring their systems into full internal policy compliance. (Note that remediation processes should be carefully planned and implemented.) These scenarios demonstrate some of XCCDF's range of capabilities. XCCDF can represent complex conditions and relationships about the systems to be assessed, and it can incorporate descriptive material and remediative measures. It is also designed to be modular; for example, XCCDF benchmarks acquire programmatically ascertainable information through lower-level check system languages. The basic unit of structure for a checklist is a rule. A rule simply describes a state or condition which the target of the document should exhibit. A simple checklist might consist of a list of rules, but richer ones require additional structure.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is FR according to A Framework for Designing Cryptographic Key Management Systems? FR: 6.108 A CKMS design shall specify the key revocation mechanism(s) and associated relying entity notification mechanism(s) used or available for use.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: A Framework for Designing Cryptographic Key Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Cyber Threat Information Sharing provide? (Section 48) ------------------------------------| | Phishing Email Samples | Email headers may contain information such as: • Mail agent IP addresses, • Host or domain names, and • Email addresses. An email message body may also contain PII, CUI, or other types of sensitive information. | Organizations should anonymize email samples and remove any sensitive information that is not necessary for describing an incident or event of interest. | | System, Network, and Application Logs | Log files may contain PII, CUI or other types of sensitive information. Log data may reveal IP addresses, ports, protocols, services, and URLs, as well as connection strings, logon credentials, portions of financial transactions, or other activities captured in URL parameters. | Organizations should perform IP address, timestamp, port, and protocol anonymization and remove any sensitive information that is not necessary for describing an incident or event of interest. Before sharing log data, it may also be necessary to sanitize URLs that contain identifying information such as session or user identifiers. Application logs may require redaction and anonymizing operations that are specific to particular application log formats. | | Malware Indicators and Samples | Although organizations are unlikely to encounter sensitive information in malware indicators or samples, sensitive information may be present depending on how targeted the malware is and what collection methods were used to gather a sample. | Organizations should remove PII, CUI, and other types of sensitive information that is not necessary for describing an incident or event of interest. | A variety of methods exist to designate handling requirements for shared threat information. These designations identify unclassified information that may not be suitable for public release and that may require special handling.

Explanation: NIST publication discussing classified information handling. References: classified, cui. Contains guidance on protecting sensitive government information. Source: Guide to Cyber Threat Information Sharing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Guidance for First Responder Mobile and Wearable Devices say about B.1.3 Test 3: Device Ruggedization Ratings? (Part 1) According to Security Guidance for First Responder Mobile and Wearable Devices, B.1.3 Test 3: Device Ruggedization Ratings: B.1.3 Test 3: Device Ruggedization Ratings Security Objective(s) : Device availability and integrity through survivability, healthy mobile ecosystem through continuous operation, and ease of management in day-to-day operations. Test Description : Implementation of ruggedization ensures durability for First Responder applications and survivability of day-to-day use. This test identifies the Ingress Protection (IP) ratings and any ruggedization information available for the device. IP ratings are followed by two numbers that correspond with the device's protection. The first number defines protection against solid objects. The second number defines the device's protection against liquids. A larger number designates more protection against environmental particulate or liquids. The lowest and highest IP rating for a device is IP00 and IP69 respectively [6]. Physical survivability of First Responder mobile devices ensures the integrity of responder data. IP ratings and certification ensure data integrity by reducing the occurrence of device failure in extreme environments as well as reliable communications. Test Procedures: Utilizing the methodologies described in Test 1, obtain metrics to determine any certifications of ruggedization. Through local observation, inspect any protective surfaces or covers that enhance device survival in demanding environments. Check any fortifications that ensure battery operation or temperature threshold parameters. Test Outcome: Device ruggedization metrics and certifications are obtained through a combination of online documentation, product inserts, and queries to the manufacturer's technical support. Physical observations can also determine if a device is built specifically for First Responder applications. Attributes include, but are not limited to, features such as protective glass, fortified case, and high-impact plastics. The most common ruggedization standard utilized is the MIL-STD-810G [17].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Guidance for First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Secure Web Services provide? (Section 44) e open standards communities that created Web services developed a number of security standards for Web services. Figure 2-9 illustrates a notional reference model for Web services security standards. This reference model maps the different standards to the different functional layers of a typical Web service implementation. These layers are modeled after the OSI Reference Model but are not intended to be interpreted as strictly hierarchical. Figure 2-9. Web Services Security Standards: Notional Reference Model <!-- image --> Standards at the network, transport and XML security layers are used to secure messages as they are transmitted over the network. The security standards IPsec, SSL/TLS (Secure Sockets Layer/Transport Layer Security), XML Encryption and XML Signature each operate on SOAP messages at a different level. Above the XML Security layer, there are two types of standards: standards built on top of SOAP and standalone standards. Message security standards WS-Security and WS-SecureConversation define how to use XML Signature, XML Encryption and credentials to secure SOAP at the message layer while reliable messaging standards define the protocols and constructs necessary to ensure that messages will be received. The access control standards are not unique to Web services; XACML can define the access policy for any system and SAML can be used to define assertions in any environment. The policy layer's WS-Policy defines a grammar to communicate the policy requirements of a Web service. These standards are described in more detail in Section 3. Security management specifications define other Web services to manage credentials such as PKI certificates within the SOA. Identity management standards take advantage of access control standards, policy standards and SOAP standards to offer services for distributing and managing user identities and credentials within the SOA.

Explanation: NIST publication on credential and access management. Topics: access control, identity management, pki. Contains security framework guidance for authentication systems. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Key Management Documents say about 7. Attribute Negotiation Service? According to Secure Data Network Systems (SDNS) Key Management Documents, 7. Attribute Negotiation Service: The KMASE K-TEK-ATTRIBUTES service provides the attribute negotiation activities. The K-TEK-ATTRIBUTES service verifies the cryptographic compatibility with the TEK, negotiates the communication and security attributes associated with the TEK, and exchanges Compromised Key List (CRL) numbers. Additionally, K-TEK-ATTRIBUTES allows a KMAP to associate the attributes of a previous TEK with a new TEK. The K-TEK-ATTRIBUTES parameters are illustrated in Table 1. Table 1 - K-TEK-ATTRIBUTES parameters | Parameter Name | Req | ind | rsp | cnf | |------------------|-------|----------|-------|--------| | init-kid | | | M | M( = ) | | resp-kid | M | M( = ) | | | | proposed-options | U | U( = ) | | | | selected-options | | | M | M( = ) | | add-info | U | U( = ) | U | U( = ) | | old-resp-kid | U | U{ = ) | | | | cri-ver | M | IVI( = ) | | | | result | | | M | M( = ) | Legend: blank - not applicable M - presence is mandatory U - presence is user option = - p value is semantically equal to value to its left in the table

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain tampering according to NIST Engineering Trustworthy Secure Systems According to Engineering Trustworthy Secure Systems, tampering: An intentional but unauthorized act resulting in the modification of a system, components of systems, its intended behavior, or data. [89]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 916) f processing information with different classifications and categories that simultaneously permits access by users with different security clearances and denies access to users who lack authorization. multiple security levels [CNSSI 4009] Capability of a system that is trusted to contain, and maintain separation between, resources (particularly stored data) of different security domains. APPENDIX A PAGE 408 h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ national security system [OMB A-130] T h s i p u b l i c a t i o n i s network network access nonce [SP 800-63-3] nondiscretionary access control nonlocal maintenance Any system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—(i) the function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions (excluding a system that is to be used for routine administrative and business applications, for example, payroll, finance, logistics, and personnel management applications); or (ii) is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy. A system implemented with a collection of connected components.

Explanation: NIST publication discussing classified information handling. References: classified, security clearance, national security. Contains guidance on protecting sensitive government information. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Organizations should ensure that the mail clients are deployed, configured, and used properly to meet the security requirements of the organization. according to NIST Guidelines on Electronic Mail Security According to Guidelines on Electronic Mail Security, Organizations should ensure that the mail clients are deployed, configured, and used properly to meet the security requirements of the organization.: In many respects, the client side of email represents a greater risk to security than the mail server. Numerous issues need to be carefully considered and addressed to provide an appropriate level of security for mail clients. Securely installing, configuring, and using mail client applications would generally include the following steps: - GLYPH<c=31,font=/HABHKN+Webdings> Patch and upgrade the mail client applications - GLYPH<c=31,font=/HABHKN+Webdings> Configure mail client security features, such as disabling automatic opening of messages and enabling anti-spam and anti-phishing features - GLYPH<c=31,font=/HABHKN+Webdings> Configure mailbox authentication and access - GLYPH<c=31,font=/HABHKN+Webdings> Secure the client host's operating system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation say about 5.2 Combined ROV and RPKI Reference Architecture Example? (Part 1) According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, 5.2 Combined ROV and RPKI Reference Architecture Example: 5.2 Combined ROV and RPKI Reference Architecture Example Figure 5-4 depicts examples of all three reference architectures (ROV, hosted RPKI, and delegated RPKI) in one realistic network diagram. It shows three ASes (AS A, AS B, and AS C), each of which is capable of participating in RPKI -based ROV, both as a network operator and as an address holder. Figure 5-4 also includes icons representing RIR RPKI C As and repositories. Figure 5-4 Example ROV and RPKI Reference Architectures <!-- image --> Viewing the architecture in Figure 5-4, in terms of its depiction of address holders, AS A represents an address holder that is implementing the delegated model of RPKI. T his AS has set up its own CA and repository and is responsible for creating, signing, and storing ROAs for the addresses that it holds and for any addresses that it may sub-allocate to its customers. ROAs for all addresses that have been allocated to AS A must be downloaded from the repository that is associated with AS A. Assuming that AS A received its address allocation from an RIR, that RIR's repository will point to AS A's repository. On the other hand, AS B and AS C represent address holders that are implementing the hosted model of RPKI. They have not set up their own CA or repositories. When they want to have ROAs created for the addresses that they hold, they must request that the entity that allocated the addresses to them creates, signs, and stores the ROAs on their behalf. AS B or AS C may have received its address allocation from its RIR, in which case it would use a tool (i.e., a web interface to an RIR tool) to request that the RIR creates, manages, and stores its ROAs. Alternatively, AS B or AS C may have received its address allocation from its ISP (i.e., from AS A). In this case, it would rely on AS A to create, manage, and store its ROAs.

Explanation: NIST publication on credential and access management. Topics: pki, sso. Contains security framework guidance for authentication systems. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation say about 5.5 BGP Flow Specification (Flowspec)? (Part 22) According to Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation, 5.5 BGP Flow Specification (Flowspec): . Montgomery, W.C. Barker, A. Tan, 'Protecting the Integrity of Internet Routing: Border Gateway Protocol (BGP) Route Origin Validation, Volume B,' NIST Special Publication (SP) 1800-14B, August 2018. piir-nist-sp1800-14b-draft.pdf | | [NIST-CSF] | Cybersecurity Framework, National Institute of Standards and Technology [Web site], http://www.nist.gov/cyberframework/ | | [NIST-RIDR] | 'Robust Inter-Domain Routing,' NIST RIDR project. https://www.nist.gov/programs-projects/robust-inter-domain-routing | | [NIST-RPKI] | 'RPKI Deployment Monitor,' NIST's online monitor with Global and Regional views. https://rpki-monitor.antd.nist.gov/ | | [NIST-SRx] | BGP Secure Routing Extension (BGP-SRx): Open source Origin Validation and BGPsec Path Validation implementations in Quagga. | | [NSA-BGP] | 'A guide to Border Gateway Protocol (BGP) Best Practices,' NSA Technical Report, September 2018.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, csf. General security reference material without sensitive content. Source: Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case say about Prerequisites? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case, Prerequisites: Connectivity between your Linux clients and AD server: Ensure the Linux clients can reach the AD Domain Controller. Configure the appropriate DNS settings on the Linux client. Set the search domain to domain name of Active Directory. Verify the DNS-settings in the /etc/resolv.conf file of your Linux server. The following instructions are for a Debian/Ubuntu system: 1. Download the Centrify Express (CentrifyDC) free package from https://launchpad.net or https://www.centrify.com/express/linux/download/ as per CPU architecture of the Linux client. 2. Install the package: dpkg -i <package\_name> 3. Install any dependencies if prompted. Re-run when done. 4. Run the command adlicense --express to activate the free express mode. <!-- image --> 5. Run the command: adjoin --workstation domain-name . This will prompt you to enter a Domain Administrator password. <!-- image --> 6. Run adinfo to verify the domain join status. The CentrifyDC mode should show as connected . 7. Login to the Linux host using AD credentials. - a. For example: ssh username.domain-name@hostname.domain-name - b. OR by entering <Domain-Name\Username> on a Desktop based version 8. Enable sudo for AD-resources using the following steps - a. Add the following line in /etc/sudoers file (using the command visudo) to make an AD Domain Group a sudoer <!-- image --> ``` %adgroup ALL=(ALL) ALL ``` Where, adgroup , is a group from the Active directory. The group names from active directory are transformed into all lower-case letters with underscores replacing spaces. For instance, %domain\_admins for the Domain Admins group.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-200901022 in Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171? (Part 46) Control PD-200901022: in awareness training for [ Assignment: organization- defined roles ] that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors. | | x | | AT-6 | Training Feedback | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ TABLE C-3: AUDIT AND ACCOUNTABILITY REQUIREMENT MAPPINGS | SECURITY REQUIREMENTS | Defense-in-Depth Protection Strategy | Defense-in-Depth Protection Strategy | Defense-in-Depth Protection Strategy | NIST SP 800-53 Relevant Security Controls | |---------------------------------------------------------------------------|---------------------------------------------------------------------------|---------------------------------------------------------------------------|---------------------------------------------------------------------------|---------------------------------------------------------------------------| | | PRA | DLO | CRS | | | There are no enhanced security requirements for audit and accountability.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identity and Access Management for Electric Utilities provide? (Section 72) twork is not connected to the NIST enterprise network. Table 5-1 lists the software and hardware components that we used in the build, as well as the specific function that each component contributes. NIST SP 1800-2B: Identity and Access Management for Electric Utilities 39 Table 5-1 Build Architecture Component List Product Vendor Component Name Function Dell Dell Dell VMware Microsoft Microsoft Windows Windows PowerEdge R620 Physical server hardware PowerConnect 7024 Physical network switch EqualLogic NAS vSphere vCenter Server Version 5.5 Windows Server 2012 r2 AD Server Virtual server and workstation environment Authentication and authority Windows 7 Information management Windows Server 2012 r2 Domain Name System (DNS) Server Structured Query Language (SQL) Server DNS Database AlertEnterprise Enterprise Guardian Interface and translation between the IdAM central store and the PACS management server Identity and access automation management application, IdAM provisioning Identity Manager Release 12.6.05 Build 06109.28 ISE Network Server 3415 Network access controller Catalyst 3650 Digital Certificates Ozone Authority Ozone Console Ozone Envoy Ozone Server TrustSec-enabled physical network switch Cloud certificate authority Central attribute management system Ozone administrative management console Enterprise identity store interface Ozone centralized attribute- based authorization server T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . CA Cisco Cisco GlobalSign MAG MAG MAG MAG NIST SP 1800-2B: Identity and Access Management for Electric Utilities 40 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . .

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2014 Annual Report say about F E D E R A L I N F O R M AT I O N S E C U R I T Y M A N A G E M E N T A C T ( F I S M A ) I M P L E M E N T A T I O N P R O J E C T? (Part 5) According to Computer Security Division 2014 Annual Report, F E D E R A L I N F O R M AT I O N S E C U R I T Y M A N A G E M E N T A C T ( F I S M A ) I M P L E M E N T A T I O N P R O J E C T: on NIST standards and guidelines; and - Continued the development of a preliminary draft of SP 800-18 Revision 2, Guide for Developing Security Plans for Federal Information Systems and Organizations. In FY 2015, CSD intends to: - Finalize SP 800-53A Revision 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations; - P ublish an errata update to SP 800-53 Revision 4; - Begin the automation of the SP 800-53 revision and public comment process in support of more timely updates to counter threats and keep up with technological advancements; - Finalize SP 800-16, A Role-Based Model for Federal Information Technology / CyberSecurity Training; - Finalize SP 800-160, Systems Security Engineering: An Integrated Approach to Building Trustworthy Resilient Systems; - Publish the IPD of SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations; - Begin the development of SP 800-60 Revision 2, Guide for Mapping Types of Information and Information Systems to Security Categories; - Finalize SP 800-18 Revision 2, Guide for Developing Security Plans for Federal Information Systems and Organizations; - Expand cybersecurity outreach to include additional state, local, and tribal governments, as well as private sector organizations and academic institutions; and - Continue to support federal agencies in the effective implementation of the NIST RMF. http:/ /csrc.nist.gov/groups/SMA/fisma

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2011 Annual Report say about National Initiative for Cybersecurity Education (NICE)? (Part 2) According to Computer Security Division 2011 Annual Report, National Initiative for Cybersecurity Education (NICE): a Digital Nation.' This plan was developed from separate drafts that expressed the views of the four component areas into a comprehensive document that will be submitted for Cyber IPC approval. NIST organized and hosted the second annual NICE Workshop, ' Shaping the Future of Cybersecurity Education, ' held on September 20-22, 2011. The workshop served as a forum for the community to openly discuss progress, solutions, challenges, and proposals relating to the goals of the NICE program. Over 500 attendees from academia, government, and industry joined in the workshop, either in person or virtually through webinars/ webcasts. The participation of universities, community colleges, high schools, and other training associations, including international groups from Canada, Japan, Brazil and Italy, exceeded expectations. As part of its outreach role, the NIST NICE Leadership Team (NNLT) members also attended more than 100 events, symposia, forums, competitions, educational outreach meetings, and workshops to promote the initiative. In FY2012, NIST plans to finalize the NICE Strategic Plan, communications plan, and component-specific implementation plans and baseline studies. NIST will also continue to improve the NICE website and host the third annual NICE workshop. http://www.nist.gov/nice/ Contacts: Dr. Ernest McDuffie, NICE Project Lead (301) 975-8897 ernest.mcduffie@nist.gov Ms. Magdalena Benitez (301) 975-6182 mbenitez@nist.gov Mr. Bill Newhouse (301) 975-2869 william.newhouse@nist.gov Ms. Pat Toth (301) 975-5140 ptoth@nist.gov Ms. Richard Kissel (301) 975-5017 richard.kissel@nist.gov Ms. Celia Paulsen (301) 975-5981 celia.paulsen@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events say about D.3 Test Case: Data Integrity IP-1? (Part 2) According to Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events, D.3 Test Case: Data Integrity IP-1: | | Description | Show that the DI solution can identify and resolve vulnerabilities and protect against ransomware. | | Associated Cybersecurity Framework Subcategories | ID.AM-1, ID.AM-2, ID.RA-1, ID.RA-2, ID.RA-6, DE.CM-8, PR.IP-12, RS.MI-3, PR.IP-4, PR.DS-1, PR.DS-6, PR.PT-1, PR.MA-2 | | Preconditions | User navigates to a malicious website and clicks on an ad for a virus cleaner. The virus cleaner is actually ransomware, which propagates across the domain and encrypts user files. | | Procedure | The denylisting capability is used to prevent access to and downloads from known malicious sites. The inventory capability is used to identify organizational assets and devices. The network protection capability is used to prevent the propagation of ransomware across the enterprise. The vulnerability management capability is used to identify vulnerabilities that allow malware to propagate. The integrity monitoring and logging collect integrity information and baseline the file system. | | Expected Results (pass) | The vulnerability that allows the ransomware to propagate is identified (CR 1.a). The user cannot access the site when it is blocked (CR 1.b). | | | The user cannot download the ransomware from the site when it is blocked (CR 1.c).

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-6 in NIST_SP_800-37r2_Risk_Management_Framework? (Part 127) Control AM-6: d and transferred to the plan of actions and milestones. Findings from a system-level control assessment may necessitate an update to the system risk assessment and the organizational risk assessment. 93 The updated risk assessments and any inputs from the senior accountable official for risk management or risk executive (function) determines the initial remediation actions and the prioritization of those actions. System owners and common control providers may decide, based on a system or organizational risk assessment, that certain findings are inconsequential and present no significant security or privacy risk. Such findings are retained in the security and privacy assessment reports and monitored during the monitoring step. The authorizing official is responsible for reviewing and understanding the assessor findings and for accepting the security and privacy risks (including any supply chain risks) that result from the operation the system or the use of common controls. In all cases, organizations review assessor findings to determine the significance of the findings and whether the findings warrant any further investigation or remediation. Senior leadership involvement in the mitigation process is necessary to ensure that the organization's resources are effectively allocated in accordance with organizational priorities-providing resources to the systems that are supporting the most critical missions and business functions or correcting the deficiencies that pose the greatest risk. References: [SP 800-53A]; [SP 800-160 v1] (Verification and Validation Processes). ## PLAN OF ACTION AND MILESTONES TASK A-6 Prepare the plan of action and milestones based on the findings and recommendations of the assessment reports. Potential Inputs: Updated security and privacy assessment reports; updated security and privacy plans; organization- and system-level risk assessment results; organizational risk management strategy and risk tolerance.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Government Smart Card Interoperability Specification, Version 2.1? (Part 32) Control HA-1: integers. See Example 3 in the Section E.3 for more information. ## E.2.1 Variable Length String Data Ten BSI function calls accept and/or return variable-length string data identified in Table E-1. Table E-1: BSI functions using the discovery method | BSI function | Discovery buffer | Discovery length | |---------------------------------------------------|--------------------|--------------------| | gscBsiUtilGetVersion () | *uszVersion | *unVersionLen | | gscBsiUtilGetCardProperties () | *uszCCCUniqueID | *unCCCUniqueIDLen | | gscBsiUtilGetReaderList () | *uszReaderList | *unReaderListLen | | gscBsiUtilPassthru () (See Note in Section E.3.9) | *uszCardResponse | *unCardResponseLen | | gscBsiGcReadTagList () | *TagArray | *unNbTags | | gscBsiGcReadValue () | *uszValue | *unValueLen | | gscBsiGetChallenge () | *uszChallenge | *unChallengeLen | | gscBsiSkiInternalAuthenticate () | *uszCryptogram | *unCryptogramLen | | gscBsiPkiCompute () | *uszResult | *unResultLen | | gscBsiPkiGetCertificate () | *uszCertificate | *unCertificateLen | Each of these functions is invoked in the discovery mode by passing in a NULL value for the discovery buffer parameter. With the exception of gscBsiGcReadTagList () , each of these returns (Discovery call) the size in bytes (including the NULL Terminator) of the buffer needed to store the return variablelength string data. The lone exception, gscBsiGcReadTagList () , returns the number of tags in the tag array, so that the size of the array buffer needed is given by '*unNbTags * size of (GCtag)'.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 244) zational system exchanges information and other systems. For mission-essential systems, services, and applications, including high value assets, it is necessary to identify such information exchanges. The transparency of the controls or protection measures in place in such downstream systems connected directly or indirectly to organizational systems is essential to understanding the security and privacy risks resulting from those information exchanges. Organizational systems can inherit risk from downstream systems through transitive connections and information exchanges, which can make the organizational systems more susceptible to threats, hazards, and adverse impacts. Related Controls: SC-7. References: [OMB A-130], [FIPS 199], [SP 800-47]. CA-4 SECURITY CERTIFICATION [Withdrawn: Incorporated into CA-2.] CA-5 PLAN OF ACTION AND MILESTONES Control: a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and b. Update existing plan of action and milestones [Assignment: organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. Discussion: Plans of action and milestones are useful for any type of organization to track planned remedial actions. Plans of action and milestones are required in authorization packages and subject to federal reporting requirements established by OMB. Related Controls: CA-2, CA-7, PM-4, PM-9, RA-7, SI-2, SI-12. CHAPTER THREE PAGE 88 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.3.4.1 The Information System and Assets Are Monitored to Identify Cybersecurity Events and Verify the Effectiveness of Protective Measures according to NIST Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity According to Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity, 5.3.4.1 The Information System and Assets Are Monitored to Identify Cybersecurity Events and Verify the Effectiveness of Protective Measures: This Cybersecurity Framework Subcategory is supported by the utility cyber monitoring and microgrid cyber monitoring components of the cyber demarcation point, and by the log analysis capability. Each of these monitors aspects of the system and identifies cybersecurity events.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Workstation Login according to NIST 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings According to 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings, Workstation Login: Workstation login that results in users having a personal certificate can be conducted in three ways: - With a user name and password using autoenroll certificates, - With a user name and password using KX.509 certificates (manual), or - With a smart card. The highlight of all logins is that, at the end of login, the user has both a Kerberos credential Fig.7: Authentication Communication From Logon to Application <!-- image -->

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 241) Control HA-1: of a system are also its weaknesses. This is also true with off-line generation. Off-line generation makes key generation easy not only for legitimate users of of the system but for illegitimate ones. An issue that PKIs must consider in their design is that of a Directory Harvest Attack , in which senders of unwanted advertisements or outright fraudulent confidence games use the directory as a way to discover information paths into the system. Off-line generation of keys allows spammers and other attackers to to pre-generate email attacks in their own system or create a distributed system for encrypted attacks. These attacks are not an issue in off-line systems. Off-line generation has the disadvantage that there is complete transparency in the directory, since the directory is an algorithm. Anyone with that algorithm has all possible entries in the directory and their public keys, and this can be exploited in side-channel attacks that are not attacks on the cryptographic system per se , but the way the system is used. Off-line generation has as an additional disadvantage increased revocation problems. A conventional PKI must be able to re-issue certificates and handle for revisions in the PKI. An off-line IBE system must not only handle revocation of the certificates themselves but a revocation of the algorithmic parameters that comprise its own PKI. No IBE system before this one has even considered this real-world problem. In fact, the key advantages of this on-line system are that it considers and solves these real-world problems. ## 6.3 On-Line IBE for the On-Line World Sadly, trends in the real world make the advantages of off-line IBE moot, and turns its disadvantages into outright security problems. There is little need for off-line generation in an on-line world, and the advantages of off-line generation benefit attackers more than defenders. Nonetheless, IBE has desirable characteristics.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Test Personal Identity Verification (PIV) Cards Version 2 say about Authority Key Identifier :? According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Authority Key Identifier :: A5:E9:44:0B:AA:5C:29:EC:B2:DF:5F:90:74:DC:A5:6F:58:65:54:35

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: Authentication feedback from systems does not provide information that would

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Personal Identity Verification Card Management Report say about 2. Overview of Card Management Elements? According to Personal Identity Verification Card Management Report, 2. Overview of Card Management Elements: Card management is the term applied to the preparation of a smart card token before its issuance to the cardholder and the provision of administrative functions for the card during its lifetime of use in the possession of the cardholder. Card management is particularly important because it so basically affects the security characteristics of the card, and security is the raison d'etre of smart cards. In this section, the basic elements of card management will be considered.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Personal Identity Verification Card Management Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Malware Incident Prevention and Handling for Desktops and Laptops provide? (Section 43) able to alter critical settings. Antivirus administrators should perform continuous monitoring to confirm that hosts are using current antivirus software and that the software is configured properly. Implementing all of these recommendations should strongly support an organization in having a strong and consistent antivirus deployment across the organization. A possible measure for improving malware prevention is to use multiple antivirus products for key hosts, such as email servers. For example, one antivirus vendor might have a new signature available several hours before another vendor, or an organization might have an operational issue with a particular signature update. Another possibility is that an antivirus product itself might contain an exploitable vulnerability; having an alternative product available in such cases could provide protection until the issue with the primary product has been resolved. Because running multiple antivirus products on a single host simultaneously is likely to cause conflicts between the products, if multiple products are used concurrently, they should be installed on separate hosts. For example, one antivirus product could be used on perimeter email servers and another on internal email servers. This could provide more effective detection of new threats, but also would necessitate increased administration and training, as well as additional hardware and software costs. Although antivirus software has become a necessity for malware incident prevention, it is not possible for antivirus software to stop all malware incidents. As discussed previously in this section, antivirus software does not excel at stopping previously unknown threats. Antivirus software products detect malware primarily by looking for certain characteristics of known instances of malware. This is highly effective for identifying known malware, but is not so effective at detecting the highly customized, tailored malware increasingly being used.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, malware. Contains technical security guidance that could inform defensive posture. Source: Guide to Malware Incident Prevention and Handling for Desktops and Laptops.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does PIV Data Model Test Guidelines say about A.4 Biometric Fingerprint Mapping? (Part 3) According to PIV Data Model Test Guidelines, A.4 Biometric Fingerprint Mapping: ithm in the SignerInfo is based on the expiration date of the PIV card and is in accordance wi 800-78. | | TE06.02.12.01 | digest signed attribute in 10.2.1.9: Verify message SignerInfo | tes. The tester shall validate the presence of a MessageDigest attribute in the signed attribu | | TE06.02.12.02 | ssage digest signed attribute in 10.2.1.9: Verify me SignerInfo | gest attribute against the hash of the The tester shall validate the value of the MessageDi concatenated CBEFF_HEADER and the STD_BIOMETRIC_RECORD. | | TE06.02.13.01 | 10.2.1.10: Verify PIV sig distinguishe ner d name | The tester shall validate the presence of a pivSigner- DN attribute in the signed attributes. | | DTR from Section 6 | Test Assertion from Section 10 | DTR Description | |----------------------|------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | TE06.02.13.02 | 10.2.1.10: Verify PIV sig distinguishe ner d name | r- tric The tester shall validate the value of the pivSigne DN attribute is the same as the subject name that appears in the certificate that signed the biome data. | | TE06.02.14.01 | 10.2.1.11: Verify FASC-N | N .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-512 in Computer Security Division 2009 Annual Report? (Part 73) Control HA-512: d terms. The search results show the detailed checklist metadata and a link to any SCAP content for the checklist, as well as links to any supporting resources associated with the checklist. Although checklists are encouraged for use in both the private and public sectors, federal agencies are required to use security configuration checklists from the NCP. In February 2008, revised Part 39 of the Federal Acquisition Regulation (FAR) was published. Paragraph (d) of section 39.101 states, 'In acquiring information technology, agencies shall include the appropriate IT security policies and requirements, including use of common security configurations available from the NIST website at . Agency contracting officers should consult with the requiring official to ensure the appropriate standards are incorporated.' In Memorandum M08-22, Office of Management and Budget (OMB) mandated the use of SCAP Validated products for continuous monitoring of Federal Desktop Core Configuration (FDCC) compliance. The NCP is defined in NIST SP 800-70 Revision 1, which can be found at http://csrc.nist.gov/publications/ , Contact: Mr. Stephen Quinn (301) 975-6967 stephen.quinn@nist.gov ## Security Content Automation Protocol (SCAP) Validation Program The Security Content Automation Protocol (SCAP) Validation Program performs conformance testing to ensure that products correctly implement SCAP . Conformance testing is necessary because SCAP is a complex specification consisting of six individual specifications that work together to meet various use cases. A single error in product implementation could result in undetected vulnerabilities or policy non-compliance within agency and industry networks. The SCAP Validation Program was created on request by the OMB to support the Federal Desktop Core Configuration (FDCC).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report on Secure Hardware Assurance Reference Dataset (SHARD) Program say about //www.researchgate.net/publication/240767493\_Verification\_and\_Fault\_Localization\_i n\_VHDL\_Programs? According to Report on Secure Hardware Assurance Reference Dataset (SHARD) Program, //www.researchgate.net/publication/240767493\_Verification\_and\_Fault\_Localization\_i n\_VHDL\_Programs: Stefan Staber, Barbara Jobstmann, and Roderick Bloem. 2005. 'Finding and fixing faults.' In Advanced Research Working Conference on Correct Hardware Design and Verification Methods. Springer, pp. 35-49. https://www.semanticscholar.org/paper/Finding-and-fixi ng-faults-Jobstmann-Staber/e34670945b5be85db9866491510f6f441cfed7f1 - They have three examples in Figs. 6, 7, and 8. They are written in a Verilog-like language. - They 'assume that a (partial) specification is given in linear-time temporal logic (LTL) …'. J. C. Madre, O. Coudert, and J. P. Billon. 1989. 'Automating the diagnosis and the rectification of design errors with PRIAM', In 1989 IEEE International Conference on ComputerAided Design. Digest of Technical Papers. 30-33. DOI: 10.1109/ICCAD.1989.76898 Claire Le Goues, Michael Dewey-Vogt, Stephanie Forrest, and Westley Weimer, 'A Systematic Study of Automated Program Repair: Fixing 55 out of 105 Bugs for $8 Each' in 2012 34th International Conference on Software Engineering (ICSE). Available at https: //clairelegoues.com/assets/papers/legoues12icse.pdf This deals with software, not hardware.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report on Secure Hardware Assurance Reference Dataset (SHARD) Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Federal Computer Security Program Managers' Forum according to NIST Computer Security Division 2008 Annual Report According to Computer Security Division 2008 Annual Report, Federal Computer Security Program Managers' Forum: T he FCSPM Forum is covered in detail in the Outreach section of this report. Membership is free and open to federal employees. For further information, contact Ms. Marianne Swanson, (301) 975-3293, marianne. swanson@nist.gov.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2008 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 1034) nal personnel with responsibilies for managing DNS]. [SELECT FROM: Mechanisms supporng and/or implemenng data origin authencaon and data integrity veriﬁcaon for name/address resoluon services]. SC-21(01) SECURE NAME/ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER) | DATA ORIGIN AND INTEGRITY [WITHDRAWN: Incorporated into SC-21.] CHAPTER FOUR PAGE 564 Reference produced from open data hps://github.com/usnistgov/oscal-content T h i s p u b l i c a  o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h  p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P. 8 0 0 - 5 3 A r 5 NIST SP 800-53A, REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS SC-22 ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION SERVICE ASSESSMENT OBJECTIVE: Determine if: SC-22[01] SC-22[02] SC-22[03] the systems that collecvely provide name/address resoluon services for an organizaon are fault-tolerant; the systems that collecvely provide name/address resoluon services for an organizaon implement internal role separaon; the systems that collecvely provide name/address resoluon services for an organizaon implement external role separaon. POTENTIAL ASSESSMENT METHODS AND OBJECTS: SC-22-Examine [SELECT FROM: System and communicaons protecon policy; procedures addressing architecture and provisioning for name/address resoluon services; access control policy and procedures; system design documentaon; assessment results from independent tesng organizaons; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records]. SC-22-Interview [SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibilies for managing DNS].

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does General Access Control Guidance for Cloud Systems say about 5.8 Guidance for APIs? According to General Access Control Guidance for Cloud Systems, 5.8 Guidance for APIs: An API in the SaaS model serves as an interface between the cloud server and its users. The API should be designed to protect against both accidental and malicious attempts to circumvent any AC policy. Applications for organizations and third parties often build upon the APIs, which introduce the AC complexity of the new layered API. For example, if the APIs do not require memory access for their tasks, then the AC policy for the APIs should enforce the non-memory access. Additionally, AC policies should be specified to manage the authorization process for web APIs. For example, when APIs connect through SOAP and REST protocols, the AC should control whether to allow end users to interface between Microsoft or non-Microsoft tools and technologies. For authorized API connections through Simple Object Access Protocol (SOAP) and Representational State Transfer (REST) protocols, the AC should grant all related access requested by the protocols. For unauthorized API connections through these protocols, no access or partial access should be granted by the AC.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: General Access Control Guidance for Cloud Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for the Use of PIV Credentials in Facility Access say about A.8 Authentication Using On-Card Biometric Comparison (OCC-AUTH)? According to Guidelines for the Use of PIV Credentials in Facility Access, A.8 Authentication Using On-Card Biometric Comparison (OCC-AUTH): The PIV Card may optionally implement on-card biometric comparison (OCC). With OCC, biometric comparison data is stored on the card and cannot be read but may be used by the card to authenticate the cardholder. The OCC-AUTH authentication mechanism is implemented by performing OCC over secure messaging. The PACS authenticates the PIV Card as part of the process of establishing secure messaging, and the response from the PIV Card indicating that OCC was successful can be verified since the response includes a message authentication code. Therefore, OCC-AUTH provides two-factor authentication - something you have (i.e., the card via establishment of the secure messaging protocol with the PACS application) and something you are (i.e., a fingerprint via OCC). The OCC-AUTH authentication mechanism is highly resistant to cloning. However, it does not protect against use of a revoked card. Additionally, not all PIV Cards support OCCAUTH, as both secure messaging and OCC are optionally card capabilities. The recommendations in Section A.5 also apply to OCC-AUTH.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Use of PIV Credentials in Facility Access.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Digital Signature Standard (DSS) provide? (Section 88) of a sequence corresponds to the most significant bit of the corresponding integer, and the last bit corresponds to the least significant bit. 1. b 1 , b 2 , … , bn The bit string to be converted. 1. C The requested integer representation of the bit string. 1. Let ( b 1 , b 2 , … , bn ) be the bits of b from leftmost to rightmost. 2. 𝐶𝐶 = ∑ 2 ( 𝑛𝑛-𝑖𝑖 ) 𝑝𝑝 𝑖𝑖 𝑛𝑛 𝑖𝑖=1 3. Return C . In this standard, the binary length of an integer C is defined as the smallest integer n satisfying C < 2 n . An integer x in the range 0 ≤ x < 2 n may be converted to an n -long sequence of bits by using its binary expansion as shown below: <!-- formula-not-decoded --> Note that the first bit of a sequence corresponds to the most significant bit of the corresponding integer, and the last bit corresponds to the least significant bit. 1. C 1. b 1, b 2, … , bn The bit string representation of the integer C . The non-negative integer to be converted. 1. Let ( b 1, b 2, … , bn ) represent the bit string, where bi = 0 or 1, and b 1 is the most significant bit, while bn is the least significant bit. 2. For any integer n that satisfies C < 2 n , the bits bi shall satisfy: <!-- formula-not-decoded --> 3. Return b 1, b 2, … , bn . In this standard, the binary length of the integer C is defined as the smallest integer n that satisfies C < 2 n . An integer may be converted to octet strings according to the following procedure: 1. Non-negative integers C and L , where C <256 L . 1. Octet-string X of length L . 1. The integer C can be uniquely written as C = CL -1 256 L -1 + CL -2 256 L -2 + … + C 1 256 + C 0, where each coefficient Ci is an integer in the interval [0,255]. 2. Set X to the octet string ( CL -1 , CL2, …, C 1, C 0); 3. Output X . An n -long sequence of bits { x 1 , … , x n } may be converted to an octet string according to the following procedure: 1. b 1 , b 2 , … , bn , the bit string to be converted. 2. N , an integer modulus. 1. Octet-string X of length L .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Digital Signature Standard (DSS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations provide? (Section 75) a server to check whether the key size and algorithms presented in a client public-key certificate are acceptable is for the server to examine the public key and algorithm in the client's certificate. An indirect mechanism is to check that the certificate policies extension in the client public-key certificate indicates the minimum cryptographic strength of the signature and hashing algorithms used and for the server to perform certificate policy processing and checking. The server shall check the client key length if client authentication is performed and the server implementation provides a mechanism to do so. Federal agencies shall use the key size guidelines provided in SP 800-131A [10] to check the client key size. Clients may use the list of trust anchors sent by the server in the CertificateRequest message to determine if the client's certification path terminates at one of these trust anchors. The list sent by the server is known as a 'hints list.' When the server and client are in different PKI domains and the trust is established via direct cross-certification between the two PKI domains (i.e., the server PKI domain and the client PKI domain) or via transitive cross-certification (i.e., through cross-certifications among multiple PKI domains), the client may erroneously decide that its certificate will not be accepted by the server since the client's trust anchor is not sent in the hints list. To mitigate this failure, the server shall either: 1) maintain the trust anchors of the various PKIs whose subscribers are the potential clients for the server and include them in the hints list or 2) be configured to send an empty hints list so that the client can always provide a certificate it possesses. The hints list shall be distinct from the server's trust anchor store.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Engineering Trustworthy Secure Systems say about The Problem Context? (Part 1) According to Engineering Trustworthy Secure Systems, The Problem Context: The Problem Context The problem context defines the basis for an adequately secure system. It focuses on stakeholders' concerns about unacceptable losses given their mission, operational capability, and performance needs and concerns, as well as all associated cost, schedule, performance, and riskdriven constraints. The problem context enables the engineering team to focus on acquiring as complete an understanding of the stakeholder problem as practical, to explore all feasible solution class options, and to select the solution class option or options to be pursued. The problem context includes: - Defining security objectives - Defining security requirements - Determining measures of success - Determining life cycle security concepts 52 The security objectives are foundational, establishing and scoping what it means to be adequately secure in terms of protection against asset loss and the significance of such loss. The security objectives have associated measures of success. These measures of success constitute specific and measurable criteria relative to operational performance measures and stakeholder concerns. Measures of success include both the strength of protection and the level of assurance in the protection capability that has been engineered. These measures influence developing security requirements and assurance claims. Protection needs are determined based on the security objectives, life cycle concepts, and stakeholder concerns. The protection needs are subsequently transformed into stakeholder security requirements and associated constraints, as well as the measures needed to validate that all requirements have been met. A well-defined and stakeholder-validated problem definition and context provide the foundation for all systems engineering and systems security engineering and supporting activities.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Intrusion Detection and Prevention Systems (IDPS) provide? (Section 77) nsive logging of data related to detected events. This data can be used to confirm the validity of alerts, to investigate incidents, and to correlate events between the IDPS and other logging sources. Data fields commonly logged by network-based IDPSs include the following: - GLYPH<c=31,font=/HHCKCL+Webdings> Timestamp (usually date and time) - GLYPH<c=31,font=/HHCKCL+Webdings> Connection or session ID (typically a consecutive or unique number assigned to each TCP connection or to like groups of packets for connectionless protocols) - GLYPH<c=31,font=/HHCKCL+Webdings> Event or alert type 21 - GLYPH<c=31,font=/HHCKCL+Webdings> Rating (e.g., priority, severity, impact, confidence) - GLYPH<c=31,font=/HHCKCL+Webdings> Network, transport, and application layer protocols - GLYPH<c=31,font=/HHCKCL+Webdings> Source and destination IP addresses - GLYPH<c=31,font=/HHCKCL+Webdings> Source and destination TCP or UDP ports, or ICMP types and codes - GLYPH<c=31,font=/HHCKCL+Webdings> Number of bytes transmitted over the connection - GLYPH<c=31,font=/HHCKCL+Webdings> Decoded payload data, such as application requests and responses - GLYPH<c=31,font=/HHCKCL+Webdings> State-related information (e.g., authenticated username) 21 In the console, the event or alert type often links to supporting information for the specific vulnerability or exploit, such as references for additional information and associated Common Vulnerabilities and Exposures (CVE) numbers. - GLYPH<c=31,font=/HHCKCL+Webdings> Prevention action performed (if any). Most network-based IDPSs can also perform packet captures. Typically this is done once an alert has occurred, either to record subsequent activity in the connection or to record the entire connection if the IDPS has been temporarily storing the previous packets. Network-based IDPSs typically offer extensive and broad detection capabilities.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).