You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cell Phone Forensic Tools_ an Overview and Analysis provide? (Section 65) | TULP 2G | BITpim | |------|---------------|---------------|----------------|------------|------------------|-----------|-----------------| | 8910 | | | | | | X | Audiovox | | X | | | | | | | BlackBerry 7750 | | X | | | | | | | BlackBerry 7780 | | | | X | X | | X | X | Ericsson T68i | | X | X | | | | | | Kyocera 7135 | | | | X | | | X | X | Motorola C333 | | X | | | | | | | Motorola MPX220 | | | | X | X | | X | X | Motorola V66 | | | | | X | | X | X | Motorola V300 | | | | X | | X | | | Nokia 3390 | | | | X | X | X | X | X | Nokia 6610i | | | | | X | X | | X | Nokia 6200 | | | | | X | X | | | Nokia 7610 | | X | | | | | | | Samsung i700 | | | | | | |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards provide? (Section 2) d publications, visit the Computer Security Resource Center. Information on other efforts at NIST, in the Information Technology Laboratory (ITL), and on the NIST Smart Grid Program is also available. Visit NERC for information about NERC programs, projects, and initiatives. National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000 Email: NISTCSF-NERCCIP-Mapping@nist.gov All comments are subject to release under the Freedom of Information Act (FOIA). The final mapping between the NERC CIP standards and the NIST Cybersecurity Framework (CSF) v1.1 referenced in this white paper can be found at https://doi.org/10.18434/mds2-2348 The file named 'NIST CSF v1.1 to NERC CIP FINAL.XLSX' is the complete mapping. There is also a README file explaining the mapping data set and its background and uses. Every organization in the electricity sector knows that cybersecurity is already a major challenge. There are a variety of standards and resources that organizations are either required or encouraged to use in managing their unique cybersecurity-related risks. A recent mapping initiative between two major cybersecurity guidance documents can help organizations mature and align their compliance and security programs and better manage risks. The North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) Reliability Standards [NERC CIP] are a set of requirements designed to mitigate the risk of a compromise that could lead to misoperation or instability in the Bulk Electric System (BES). The scope of the CIP Cyber Security Standards is restricted to BES Cyber Systems that would impact the reliable operation of the BES.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, csf, fips. General security reference material without sensitive content. Source: Benefits of an Updated Mapping between the NIST Cybersecurity Framework and the NERC Critical Infrastructure Protection Standards.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Technical Capabilities Provided by Solution according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case, Technical Capabilities Provided by Solution: Microsoft Active Directory provides components of the following Technical Capabilities described in Section 6 of Volume 1: - Credential Management - Authentication and Authorization

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, credential management. Contains security framework guidance for authentication systems. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-05(03) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control CM-05(03): ACCESS RESTRICTIONS FOR CHANGE | SIGNED COMPONENTS [WITHDRAWN: Moved to CM-14.]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Sample Level 2 Text according to NIST Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, Sample Level 2 Text: - C-SCRM Leads shall be responsible for: - o Representing the interests and needs of C-SCRM PMO members. - o Leading and/or coordinating the development and execution of program or business-line C-SCRM plans. This shall include ensuring that such plans are appropriately aligned to and integrated with the enterprise-level C-SCRM plan. - The mission and business process C-SCRM staff shall be responsible for: - o The primary execution of C-SCRM activities (e.g., supplier or product assessments) and - o Support for mission- and business-specific C-SCRM activities driven by non-CSCRM staff.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Test according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Test: [SELECT FROM: mechanisms for implementing least privilege functions]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.4 Risk Assessment according to NIST Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events According to Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events, 3.4 Risk Assessment: NIST SP 800-30 Revision 1, Guide for Conducting Risk Assessments states that risk is 'a measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.' The guide further defines risk assessment as 'the process of identifying, estimating, and prioritizing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. Part of risk management incorporates threat and vulnerability analyses, and considers mitigations provided by security controls planned or in place.' The NCCoE recommends that any discussion of risk management, particularly at the enterprise level, begins with a comprehensive review of NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations -material available to the public. The Risk Management Framework (RMF) guidance, as a whole, proved to be invaluable in giving us a baseline to assess risks, from which we developed the project, the security characteristics of the build, and this guide. We performed two types of risk assessments: -  Initial analysis of the risk factors discussed with financial, retail, and hospitality institutions: this analysis led to creation of the DI project and desired security posture. See NISTIR 8050, Executive Technical Workshop on Improving Cybersecurity and Consumer Privacy, for additional participant information. . -  Analysis of how to secure the components within the solution and minimize any vulnerabilities they might introduce: see Section 5, Security Characteristic Analysis.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Conformance Test for FDDI Medium Access Control (MAC) say about FDDI MAC Conformance Test C Language Test Generated by the TTCN Translator? (Part 41) According to A Conformance Test for FDDI Medium Access Control (MAC), FDDI MAC Conformance Test C Language Test Generated by the TTCN Translator: Verdict (FAIL) ; return (TRUE) } /* line 1699 "FDDI.MP" [5]? TIMEOUT */ if (Timeout ("TRT. ") ) { _level += 1; SetfVerdict (FAIL) return (TRUE) } } /* end of level [5] */ } /* line 1702 "FDDI.MP" [4]? OTHERWISE */ if (_buffer) { _level +' 1; SetfVerdict (FAIL) ; return (TRUE) } /* line 1705 "FDDI.MP" --[4]? TIMEOUT */ if (Timeout ("TRT. ") ) { _level +' 1; SetfVerdict (FAIL) ; return (TRUE) ) /* end of level [4] */ } /* end of level [3] */ } } _level » _lastlevel; /* end of level [2] */ return (FALSE) /* end of level [1] */ /* * DetectFrameBody2 Testing MAC Frame Error Detection 8: Detecting Frame * Body 2 */ int DetectFrameBody2 () ( int _time -0; _level -1; lastlevel; ``` ``` strcpy(R, "NONE") Result -NONE; _timername -(char *} 0; _bufferlen --1; /* line 1713 "FDDI.MP" (1)+ */ /* Initializing Connection */ _lastlevel _level; if (INITCONNECT 0 return (TRUE) else if (_level > _lastlevel) { _level +-1; while (TRUE) ( /* line 1716 "FDDI.MP" [2]! DATA */ /* * Tester sends the frame (DA-IUT Address; a symbol (not Idle or data) in * INFO) */ pDATA -DATA_T10(); Send_PDU_DATA (pDATA) ; _level +-1; while (TRUE) { /* line 1720 "FDDI.MP" [3]! TOKEN */ /* followed by To)cen. */ pTOKEN » T0KEN_T1 () ; Send_PDU_TOKEN (pTOKEN) _level +-1; _timername -"TRT."; while (TRUE) { /* line 1724 "FDDI.MP" [4]? DATA_Strip */ /* PA, SD, FC, DA, SA and Idles returned, */ pDATA_Strip -DATA_Strip_R2 () _buffer = Receive_PDU (_timername) if (Is_PDU_DATA_Strip (pDATA_Strip, _buffer) ) { _level +» 1; _timername -"TRT."; while (TRUE) { /* line 1728 "FDDI.MP" [5]? TOKEN */ /* followed by Tolcen */ pTOKEN -T0KEN_R1 () ; _buffer ' Receive_PDU (_timername) if ( I s_PDD_TOKEN (pTOKEN, _buffer) ) { _level +-1; SetfVerdict (PASS) ; return (TRUE) ) /* line 1734 "FDDI.MP" --[5]? OTHERWISE */ if (_buffer) ( _level +-1; SetfVerdict (FAIL) return (TRUE) } /* line 1737 "FDDI.MP" [5]? TIMEOUT */ if (Timeout ("TRT.

Explanation: NIST publication on credential and access management. Topics: access control, token. Contains security framework guidance for authentication systems. Source: A Conformance Test for FDDI Medium Access Control (MAC).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 2017 NIST_ITL Cybersecurity Program Annual Report provide? (Section 215) The software identification (SWID) data model defined by this standard describes an XML format for software publishers to provide authoritative identification, categorization, software relationships (e.g., dependency, bundling, and patching), executable and library footprint details, and other metadata for software. This information can be used to support operational and cybersecurity use cases around managing software deployments, managing software licenses, managing software vulnerabilities and related software patches, and assessing secure software configurations. To supplement the requirements in ISO/IEC 19770-2:2015, CSD collaborated with DHS, NSA, and MITRE on the development of NISTIR 8060, Guidelines for the Creation of Interoperable Software Identification (SWID) Tags . NISTIR 8060, published in April 2016, provides an overview of the capabilities and usage of SWID tags as part of a comprehensive software lifecycle. This report introduces SWID tags in an operational context, provides guidelines for the creation of interoperable SWID tags, and highlights key usage scenarios for which SWID tags are applicable. Figure 39 illustrates several types of SWID tags (as indicated in the legend) and how these support multiple elements of the software product life cycle, including deployment, installation, patching, upgrading and removal. Figure 39: SWID Tags Support the Software Product Lifecycle <!-- image --> Additionally, in FY 2017, NIST has worked with the IETF to integrate SWID tags into the Network Endpoint Assessment (NEA) protocol, through the Software Inventory Message and Attributes (SWIMA) for PA-TNC specification (see https:/ /datatracker.ietf. org/doc/draft-ietf-sacm-nea-swima-patnc/).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Acknowledgments according to NIST Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, Acknowledgments: The authors gratefully acknowledge and appreciate the significant contributions from individuals and organizations in the public and private sectors whose constructive comments improved the overall quality, thoroughness, and usefulness of this publication. The authors also wish to thank the NIST technical editing and production staff - Jim Foti, Jeff Brewer, Eduardo Takamura, Isabel Van Wyk, Cristina Ritfeld, Derek Sappington, and Carolyn Schmidt - for their outstanding support in preparing this document for publication. Finally, a special note of thanks goes out to Kelley Dempsey for the initial research and development of the content used in the prototype CUI overlay.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT) say about 7.7 Network Security? (Part 1) According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT), 7.7 Network Security: 7.7 Network Security Network security standards provide security requirements and guidelines on processes and methods for the secure management, operation and use of information, information networks, and their inter-connections. Such standards-based technologies can help to assure the confidentiality and integrity of data in motion, assure electronic commerce, and provide for a robust, secure and stable network and Internet. IoT networks are deployed using a multitude of protocols and physical links. Selecting the appropriate messaging and communication protocols depends on the use case and security requirements for each system. One characteristic of IoT is the potential for spontaneous connections (due to the networking) without a system view. Viewed in this way the IoT could not be 'planned' nor secured well using traditional approaches to security since system compositional or emergent properties would never be seen by a risk manager. The network interfaces in these loosely coupled systems represent attack surfaces. Therefore, without a system asset definition and subsequent threat analysis the security design is very unlikely to be useful. Radio Frequency (RF) connections may be based on industrial, scientific, and medical (ISM) radio band, cellular data, or other standards. RF interference should be considered as a source of risk for IoT deployments. Individual sensors may be disabled or degraded by RF interference. This could be inadvertent, e.g., use of a poorly shielded microwave oven near an IP based security camera; or malicious, e.g., use of a cell-phone jammer to prevent long-term evolution (LTE)-connected motion sensors from transmitting activity to a security officer monitoring station Annex D lists the standards of the common protocols that support IoT communications and establish the security of the underlying network connections.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management_ Part 1 – General provide? (Section 286) rivate signature key and corresponding public key could be generated and the public key distributed in accordance with Section 8.1.5.1 for use if the primary private signature key becomes unavailable. It is appropriate to backup or archive a public signature-verification key for as long as required in order to verify the information signed by the corresponding private signature key. In the case of a public key that has been certified (e.g., by a Certification Authority), saving the public-key certificate would be an appropriate form of storing the public key; backup or archive storage may be provided by the infrastructure (e.g., by a certificate repository). The public key should be stored in backup storage until the end of the private key's cryptoperiod and should be stored in archive storage as long as required for the verification of signed data. A symmetric authentication key is used to provide assurance of the integrity and source of information. A symmetric authentication key can be used: 1. By an originator to create a message authentication code (MAC) that can be verified at a later time to determine the integrity (and possibly the source) of the authenticated information; the authenticated information and its MAC could then be stored for later retrieval or transmitted to another entity; 2. By an entity that retrieves the authenticated information and the MAC from storage to determine the integrity of the stored information (note: this is not a communication application); 3. Immediately upon receipt by a receiving entity to determine the integrity of transmitted information and the source of that information (the received MAC and the associated authenticated information may or may not be subsequently stored); or 4.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-18(05) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control SI-18(05): PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS | NOTICE OF CORRECTION OR DELETION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Networks of 'Things' say about 6 Summary? (Part 1) According to Networks of 'Things', 6 Summary: 6 Summary This document offers an underlying and foundational science for IoT-based technologies on the realization that IoT involves sensing , computing , communication , and actuation . We presented a common vocabulary to foster a better understanding of IoT and better communication between those parties discussing IoT. We acknowledge that the Internet is a network of networks, but we believe that focusing on restricted NoTs in a bounded way gives better traction to addressing trustworthiness problems that an unbounded Internet does not. Some may argue that every 'thing' in a NoT is ultimately a service. The primitives definitely offer services, however because of the combinatorics of mixtures of hardware and software 'things', and we prefer to distinguish. Five primitives and six elements that impact IoT trustworthiness have been presented. Primitives are the building blocks; elements are the less tangible trust factors impacting NoTs. Primitives also allow for analytics and formal arguments of IoT use case scenarios. Without an actionable and universally-accepted definition for IoT, the model and vocabulary presented here expresses how IoT, in the broad sense, behaves . Use case scenarios employing the primitives afford us quicker recommendations and guidance concerning a NoT's potential trustworthiness. For example, authentication can be used in addressing issues such as geo-location and sensor ownership, but authentication may not be relevant if an adversary owns the sensors and can obtain that information based on proximity. Encryption can protect sensor data transmission integrity and confidentiality including cloud-tocloud communication, but it might render the IoT sensors unusable due to excessive energy requirements. While fault-tolerant techniques can alleviate reliability concerns associated with inexpensive, replaceable, and defective third party 'things', they can also be insecure and induce communication overhead and increased attack surfaces.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Networks of 'Things'.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Managing Information Security Risk_ Organization, Mission, and Information System View provide? (Section 57) quisite to building mission/business processes sufficiently resilient to withstand a wide variety of threats including routine and sophisticated cyber attacks, errors/accidents, and natural disasters. An important part of achieving risk-aware processes is the understanding of senior leaders/executives of: (i) the types of threat sources and threat events that can adversely affect the ability of organizations to successfully execute their missions/business functions); (ii) the potential adverse impacts/consequences on organizational operations and assets, individuals, other organizations, or the Nation if the confidentiality, integrity, or availability of information or information systems used in a mission/business process is compromised; and (iii) the likely resilience to such a compromise that can be achieved with a given mission/business process definition, applying realistic expectations for the resilience of information technology. A key output from the Tier 2 definition of mission/business processes is the selected risk response strategy 35 for these processes within the constraints defined in the risk management strategy. The risk response strategy includes identification of information protection needs and the allocation of those needs across components of the process (e.g., allocation to protections within information systems, protections in the operational environments of those systems, and allocation to alternate mission/business execution paths based on the potential for compromise). A significant risk-related issue regarding the ability of organizations to successfully carry out missions and business functions is the complexity of the information technology being used in information systems.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Managing Information Security Risk_ Organization, Mission, and Information System View.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain DRAFT NISTIR 7275 Revision 4, Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2 according to NIST Computer Security Division 2010 Annual Report According to Computer Security Division 2010 Annual Report, DRAFT NISTIR 7275 Revision 4, Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2: Group: Systems and Emerging Technologies Security Research This report specifies the data model and Extensible Markup Lan guage (XML) representation for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2. An XCCDF document is a structured collection of security configuration rules for some set of target systems. The XCCDF specification is designed to support information interchange, document gener ation, organizational and situational tailoring, automated com pliance testing, and compliance scoring. The specification also defines a data model and format for storing results of security guidance or checklist compliance testing. XCCDF provides a uni form foundation for expression of security checklists and other configuration guidance, and thereby fosters more widespread application of good security practices. Contact: Mr. David Waltermire david.waltermire@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2010 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Study of Federal Agency Needs for Information Technology Security say about Appendix A? According to A Study of Federal Agency Needs for Information Technology Security, Appendix A: oversight for OMB/NIST/NSA - Congress needs to be kept informed

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of Federal Agency Needs for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Limited Delegation for Client-Side SSL ∗ according to NIST 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings According to 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings, Limited Delegation for Client-Side SSL ∗: Nicholas Santos nicholas.j.santos@gmail.com Sean W. Smith sws@cs.dartmouth.edu

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research provide? (Section 99) 800-164 Related controls: CM-2, CM-4, CM-5, CM-6, CM-9, SA-10, SI-2, SI-12 References: NIST SP 800-128 Related controls: AC-2, AC-3, AC-14, AC-17, AC-18, IA-4, IA-5, IA-8 References: HSPD-12; OMB M-04-04, 06-16, 11-11; FIPS 201; NIST SPs 800-63, 800-73, 800- 76, 800-78; Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance; idmanagement.gov Related controls: AC-2, IA-2, IA-3, IA-5, IA-8, SC-37 References: FIPS 201; NIST SPs 800-73, 800-76, 800-78 Related controls: AC-2, AC-3, AC-6, CM-6, IA-2, IA-4, IA-8, PL-4, PS-5, PS-6, SC-12, SC-13, SC-17, SC-28 References: OMB M-04-04, 11-11; FIPS 201; NIST SPs 800-63, 800-73, 800-76, 800-78; FICAM Roadmap and Implementation Guidance; idmanagement.gov 47 Security and Privacy Controls for Federal Information Systems and Organizations , Related controls: AC-17, PE-4 References: FIPS 140-2, 197; NIST SPs 800-52, 800-77, 800-81, 800-113; Committee on National Security Systems (CNSS) Policy 15; National Security Telecommunications and Information Systems Security (NSTISSI) No.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance) say about Required Vendor Information? According to PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance), Required Vendor Information: VE03.03.01: The vendor shall provide in its documentation a list of all the authenticators along with their tags and possible values, when applicable.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Process: according to NIST Recommendation for Random Bit Generator (RBG) Constructions According to Recommendation for Random Bit Generator (RBG) Constructions, Process:: 1. Obtain the current internal state of DRBG1 to get its instantiated security strength (shown as RBG1\_DRBG1\_security\_strength in step 2). 2. If ( s > RBG1\_DRBG1\_security\_strength ) , then return ( ERROR\_FLAG , Invalid\_state\_handle ) . 3. If the length of the personalization\_string > max\_personalization\_string\_length , return ( ERROR\_FLAG, Invalid\_state\_handle ) . 4. If ( s > 192) , then s = 256 Else, if ( s ≤ 128) , then s = 128 . Else, s = 192 . 5. ( status, seed\_material ) = DRBG\_Generate ( RBG1\_DRBG1\_state\_handle, number\_of\_bits\_to\_generate, s ) . 6. If ( status ≠ SUCCESS) , return ( status , Invalid\_state\_handle ) . 7. working\_state\_values = Instantiate\_algorithm ( seed\_material, personalization\_string ) . 8. Get the sub-DRBGx\_state\_handle for a currently empty internal state. If an empty internal state cannot be found, return ( ERROR\_FLAG, Invalid\_state\_handle ) . Comment: See the instructions below for the value of number\_of\_bits\_to\_generate . 9. Set the internal state for the new instantiation (e.g., as indicated by sub-DRBGx\_state\_handle ): 2. 9.1 Record the working\_state\_values returned from step 7. 3. 9.2 Record any administrative information (e.g., the value of s ).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Bit Generator (RBG) Constructions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3 provide? (Section 108) ethodologies have not been incorporated as part of a cohesive security fabric. They are | | 1422 | potentially valuable checklist-style elements that can solve specific security or privacy needs. These | | 1423 | methodologies could be better integrated with risk management guidelines developed by others (e.g., | | 1424 | NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to | | 1425 | Federal Information Systems [92], NIST Internal Report (NISTIR) 8062, An Introduction to Privacy | | 1426 | Engineering and Risk Management in Federal Systems [93], and COBIT Risk IT Framework [94]. | | 1427 | In the proposed operational taxonomy, broad considerations of the conceptual taxonomy appear as | | 1428 | recurring features. For example, confidentiality of communications can apply to governance of data at rest | | 1429 | and access management, but it is also part of a security metadata model [95]. | | 1430 | The operational taxonomy will overlap with small data taxonomies while drawing attention to specific | | 1431 | issues with Big Data [96], [97]. | c For further information, see the frameworks suggested by the Association for Information and Image Management (AIIM; http://www.aiim.org /) and the MIKE 2.0 Information Governance Association (). Figure 5: Security and Privacy Operational Taxonomy <!-- image --> - Device, User, Asset, Services, and Applications Registration: Includes registration of devices in machine to machine (M2M) and IoT networks, DRM-managed assets, services, applications, and user roles - Security Metadata Model - o The metadata model maintains relationships across all elements of a secured system. It maintains linkages across all underlying repositories.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, risk management framework, fips. General security reference material without sensitive content. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines on Security and Privacy in Public Cloud Computing provide? (Section 32) ce agreement are usually stipulated in multiple documents, which can typically include a Service Level Agreement (SLA), privacy policy, acceptable use policy, and terms of use [Bra10]. An SLA represents the understanding between the cloud consumer and cloud provider about the expected level of service to be delivered and, in the event that the provider fails to deliver the service at the level specified, the compensation available to the cloud consumer. The privacy policy documents information handling practices and the way consumer information is collected, used, and managed by the cloud provider, while the acceptable use policy identifies prohibited behaviors by cloud consumers. The terms of use cover other important details such as licensing of services, 2 The process to perform a risk analysis and manage risks is not discussed in this publication. For additional information, see NIST SP 800-30, Risk Management Guide for Information Technology Systems , and SP 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems , at limitations on liability, and modifications to the terms of the agreement. Privacy and security risks depend to a great extent on the terms established in the service agreement. Two types of service agreements exist: predefined non-negotiable agreements and negotiated agreements [Bra10, UCG10]. Non-negotiable agreements are in many ways the basis for the economies of scale enjoyed by public cloud computing. The terms of service are prescribed completely by the cloud provider. They are typically not written with attention to federal privacy and security requirements [CIO10a].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, risk management framework, fips. General security reference material without sensitive content. Source: Guidelines on Security and Privacy in Public Cloud Computing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST Cloud Computing Forensic Science Challenges provide? (Section 104) (Metadata) | N/A | [27], [35] | | FC-08 | Log capture | OD/BNA/RP/RE /MS | S (only applies to network logs involving dynamically assigned IP addresses) | Analysis (Metadata) | N/A | [24], [4], [34] | | FC-09 | Interoperability issues among Providers | RE | G (applies to most capabilities) | Architecture | Standards (Interoperabilit y) | [24], [4], [29], [36], [37], [38] | | FC ID | Short Title | Relevance of Essential Cloud Characteristics | Labeling of Challenge/Functional- Capabilities Correlation | Primary Category (Subcategory) | Related Category (Subcategory) | References | |---------|--------------------------------|------------------------------------------------|----------------------------------------------------------------------------------------------|----------------------------------|----------------------------------|------------------| | FC-11 | No single source for criminals | OD/BNA/RP/RE | S (only applies when multiple clouds are involved) | Architecture | Data Collection | [39], [40] | | FC-12 | Detection of the malicious act | OD/BNA/RP/RE | Q (applicability is limited to capabilities that may be vulnerable to steppingstone attacks) | Architecture | N/A | [39], [41], [15] | | FC ID | Short Title | Relevance of Essential Cloud Characteristics | Labeling of Challenge/Functional- Capabilities Correlation | Primary Category (Subcategory) | Related Category (Subcategory) | References | |---------|-------------------------------------------------------------|------------------------------------------------|--------------------------------------------------------------|----------------------------------|----------------------------------|-----------------------------------------| | FC-13 | Criminals access to low cost computing power | OD/BNA/RP/RE /MS

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Cloud Computing Forensic Science Challenges.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events provide? (Section 103) | 2.30.9 Symantec DLP ...........................................................................................................481 | | 2.30.10 Cisco WSA .................................................................................................................481 | | 2.30.11 Tripwire IP360...........................................................................................................482 | | 2.30.11.1 Tripwire Log Center, Tripwire IP360, Tripwire Enterprise, and ArcSight ESM...........................................................................................................483 | | 2.30.12 FileZilla and ArcSight.................................................................................................485 | | 2.30.13 Cisco ISE and ArcSight...............................................................................................485 | | 2.30.14 Cisco WSA and ArcSight............................................................................................486 | | 2.30.15 Semperis DSP and ArcSight.......................................................................................486 | | 2.30.16 Symantec DLP and ArcSight ......................................................................................487 | .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Policy Machine_ Features, Architecture, and Specification say about C.1 Semantic Definitions? (Part 1) According to Policy Machine_ Features, Architecture, and Specification, C.1 Semantic Definitions: C.1 Semantic Definitions The semantic description of an administrative command differs from a syntactic description or programming language representation. The semantic descriptions define the correct behavior expected of administrative commands, which is essential for maintaining the integrity of the PM as it transitions between states. The specifications should not be interpreted as programming statements, and instead should be interpreted as changes to model structures representing the authorization state, which occur when a command is correctly carried out. Behavioral aspects other than those related to access control are outside the scope of these descriptions, including other facets of security such as authentication and audit. Preconditions are defined for each administrative command. Preconditions denote requirements. They are expressed as a logical expression that must be satisfied for the command to be carried out. The preconditions for administrative commands ensure that the arguments supplied for the formal parameters of the command are of the correct type, and that the basic properties of the model are observed. The following conventions are observed in the semantic descriptions given below: -  The behavior of administrative commands is atomic; their effects are indivisible and uninterruptable. -  The main body of an administrative command specifies state changes for those model elements and relations that are affected by its conduct-the state of any unspecified element or relation is unaffected and remains unchanged. -  Model elements and relations, whose states are affected by the behavior of an administrative routine or command, are indicated with the prime symbol. -  All specified preconditions must be satisfied for the change of state described in the body of the routine or command to occur.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Policy Machine_ Features, Architecture, and Specification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2003 Annual Report say about SCALABLE QUANTUM INFORMATION NETWORK? (Part 1) According to Computer Security Division 2003 Annual Report, SCALABLE QUANTUM INFORMATION NETWORK: SCALABLE QUANTUM INFORMATION NETWORK Q uantum mechanics, the strange behavior of matter on the atomic scale, provides entirely new and uniquely powerful tools for computing and communications. This field could revolutionize many aspects of computing and secure communications, and could have enormous impacts in homeland security. Quantum computers could perform processing tasks that would take billions of years on conventional computers. They also could solve problems that conventional computers could not manage given realistic amounts of time, memory, and processing power. Exploiting quantum properties would be particularly valuable in cryptography, making codes that would be unbreakable by the best supercomputers of tomorrow, or breaking codes in seconds that could not be cracked in millions of years by the most powerful binary computers. Quantum information also can be used for remarkably secure communications. In this particular area, we are partnering closely with the Defense Advanced Research Projects Agency (DARPA). The objective of this NIST project is to develop an extensible quantum information test-bed and the scalable component technology essential to the practical realization of a quantum communication network. The test-bed will demonstrate quantum communication and quantum cryptographic key distribution with a high data rate. This test-bed, once developed, will provide a measurement and standards infrastructure that will be open to the DARPA QuIST (Quantum Information Science and Technology) community and will enable wideranging experiments on both the physical- and network-layer aspects of a quantum communication system. The infrastructure will be used to provide calibration, testing, and development facilities for the QuIST community. This project is one part of the broader Quantum Information Program at NIST.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2003 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Identity and Risk Related Standards according to NIST Developing Trust Frameworks to Support Identity Federations According to Developing Trust Frameworks to Support Identity Federations, Identity and Risk Related Standards: - ISO/IEC 24760 Parts 1 - 3: A Framework for Identity Management. Explores core concepts of identity and identity management and their relationships and is applicable to any information system that processes identity information. http://www.iso.org/. - ISO 31000:2009: Risk management principles and guidelines . Provides principles, framework and a process for managing risk. 43170. - ISO/IEC DIS 29003: Identity Proofing and Verification . Currently under development. 62290.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Developing Trust Frameworks to Support Identity Federations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-6 in NIST_SP_800-37r2_Risk_Management_Framework? (Part 42) Control AM-6: xisting common control providers and associated security and privacy plans; information security and privacy program plans; organization- and system-level security and privacy risk assessment results. Expected Outputs: List of common control providers and common controls available for inheritance; security and privacy plans (or equivalent documents) providing a description of the common control implementation (including inputs, expected behavior, and expected outputs). Primary Responsibility: Senior Agency Information Security Officer; Senior Agency Official for Privacy. Supporting Roles: Mission or Business Owner; Senior Accountable Official for Risk Management or Risk Executive (Function); Chief Information Officer; Authorizing Official or Authorizing Official Designated Representative; Common Control Provider; System Owner. Discussion: Common controls are controls that can be inherited by one or more information systems. 60 Common controls can include controls from any [SP 800-53] control family, for example, physical and environmental protection controls, system boundary and monitoring controls, personnel security controls, policies and procedures, acquisition controls, account and identity management controls, audit log and accountability controls, or complaint management controls for receiving privacy inquiries from the public. Organizations identify and select the set of common controls and allocate those controls to the organizational entities designated as common control providers. Common controls may differ based upon a variety of factors, such as hosting location, system architecture, and the structure of the organization. The organization-wide list of common controls takes these factors into account. Common controls can also be identified at different levels of the organization (e.g., corporate, department, or agency level; bureau or subcomponent level; or individual program level).

Explanation: NIST publication on credential and access management. Topics: identity management, sso. Contains security framework guidance for authentication systems. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Managing Information Security Risk_ Organization, Mission, and Information System View provide? (Section 26) Resources. The guidelines in this publication are applicable to all federal information systems other than those systems designated as national security systems as defined in 44 U.S.C., Section 3542. The guidelines have been broadly developed from a technical perspective to complement similar guidelines for national security systems and may be used for such systems with the approval of appropriate federal officials exercising policy authority over such systems. State, local, and tribal governments, as well as private sector organizations are encouraged to consider using these guidelines, as appropriate. This publication is intended to serve a diverse group of risk management professionals including: - Individuals with oversight responsibilities for risk management (e.g., heads of agencies, chief executive officers, chief operating officers); - Individuals with responsibilities for conducting organizational missions/business functions (e.g., mission/business owners, information owners/stewards, authorizing officials); - Individuals with responsibilities for acquiring information technology products, services, or information systems (e.g., acquisition officials, procurement officers, contracting officers); - Individuals with information security oversight, management, and operational responsibilities (e.g., chief information officers, senior information security officers, 10 information security managers, information system owners, common control providers); 9 An executive agency is: (i) an executive department specified in 5 U.S.C., Section 101; (ii) a military department specified in 5 U.S.C., Section 102; (iii) an independent establishment as defined in 5 U.S.C., Section 104(1); and (iv) a wholly owned government corporation fully subject to the provisions of 31 U.S.C., Chapter 91. In this publication, the term executive agency is synonymous with the term federal agency .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RS-0010 in Biometric Specifications for Personal Identity Verification? (Part 30) Control RS-0010: | | Tag | Len. | Value | | | | | | | | | 81 | 1 | Biometric type (i.e., modality, 08 = fingerprint) | 08 | | | | | | | | 82 | 1 | Biometric subtype (e.g., finger position) - These values shall be from ISO/IEC 19785-3:2007, NOT from [CARD-MIN].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Biometric Specifications for Personal Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Architecture Design Process for Health Information Exchanges (HIEs) say about NIST Special Publications (SPs)? According to Security Architecture Design Process for Health Information Exchanges (HIEs), NIST Special Publications (SPs): NIST SP 800-25, Federal Agency Use of Public Key Technology for Digital Signatures and Authentication , October 2000. NIST SP 800-30, Risk Management Guide for Information Technology Systems, January 2002. NIST SP 800-39, Draft Managing Risk from Information Systems: An Organizational Perspective , April 2008. NIST SP 800-45, Version 2, Guidelines on Electronic Mail Security , February 2007. NIST SP 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations , June 2005. NIST SP 800-53, Revision 3, Recommended Security Controls for Federal Information Systems and Organizations, August 2009. NIST SP 800-57, Recommendation for Key Management , March 2007. NIST SP 800-58, Security Considerations for Voice Over IP Systems , January 2005. NIST SP 800-63 Rev. 1, Draft Electronic Authentication Guide, December 2008. NIST SP 800-66, Revision 1, An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule , October 2008. NIST SP 800-77, Guide to IPsec VPNs , December 2005. NIST SP 800-92, Guide to Computer Security Log Management , September 2006. NIST SP 800-106, Randomized Hashing Digital Signatures , July 2008. NIST SP 800-111, Guide to Storage Encryption Technologies for End User Devices , November 2007. NIST SP 800-113, Guide to SSL VPNs , July 2008. NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) , April 2010.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Security Architecture Design Process for Health Information Exchanges (HIEs).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.3.4 Pre-shared Secret Key (PSK) Authentication according to NIST Guide to IPsec VPNs According to Guide to IPsec VPNs, 3.3.4 Pre-shared Secret Key (PSK) Authentication: PSK-based authentication is often deployed because it is the easiest to configure. Each end of the communication has the identity of the other end and their PSK. It does not require generating public keys or certificates or running an EAP infrastructure. It is most commonly used for gateway-to-gateway deployments as it does not involve adding a third-party trust anchor to the VPN gateway device. Some deployments use a PSK for authentication that is shared between the VPN server and all of the remote access VPN clients. Once the PSK has been obtained by an attacker, it can be used to impersonate any client or the remote access VPN server itself. Even if the clients are using onetime passwords (OTPs), a man-in-the-middle attacker can obtain an OTP and log in as the remote user to the real remote access VPN. Therefore, group PSKs are strongly discouraged. 29 DNSSEC is a system of digital signatures to authenticate DNS content. The DNSSEC core specifications are defined in IETF RFCs 4033, 4034, and 4035. PSKs are often derived from dictionary words and are less than 32 characters long. Such insecure deployments are vulnerable to offline dictionary attacks. 30 PSKs must have a high entropy value. A good PSK is pseudorandomly created and has at least 128 bits of entropy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to IPsec VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is NOTICE according to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities? NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 929) ations include policy or regulatory, technology, physical infrastructure, system component allocation, public access, scalability, common control, operational or environmental, and security objective. APPENDIX A PAGE 415 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ security [CNSSI 4009] security attribute security categorization security category [OMB A-130] security control [OMB A-130] A condition that results from the establishment and maintenance of protective measures that enable an organization to perform its mission or critical functions despite risks posed by threats to its use of systems. Protective measures may involve a combination of deterrence, avoidance, prevention, detection, recovery, and correction that should form part of the organization’s risk management approach. An abstraction that represents the basic properties or characteristics of an entity with respect to safeguarding information. Typically associated with internal data structures— including records, buffers, and files within the system—and used to enable the implementation of access control and flow control policies; reflect special dissemination, handling or distribution instructions; or support other aspects of the information security policy. The process of determining the security category for information or a system. Security categorization methodologies are described in CNSS Instruction 1253 for national security systems and in FIPS Publication 199 for other than national security systems. See security category.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for Derived Personal Identity Verification (PIV) Credentials say about 1.2 Purpose and Scope? (Part 1) According to Guidelines for Derived Personal Identity Verification (PIV) Credentials, 1.2 Purpose and Scope: 1.2 Purpose and Scope This document provides guidelines for cases in which the use of PIV Cards with mobile devices, using either contact card readers or NFC, is deemed impractical. This guideline specifies the use of tokens with alternative form factors to the PIV Card that may be inserted into mobile devices, such as Secure Digital (SD) cards, USB tokens, Universal Integrated Circuit Cards (UICC, the new generation of SIM cards), or that are embedded in the mobile device. The embedded tokens may be either hardware or software cryptographic modules. The use of tokens with alternative form factors greatly improves the usability of electronic authentication from mobile devices to remote IT resources, while at the same time maintaining the goals of HSPD-12 for common identification that is secure, reliable and interoperable governmentwide. The scope of the Derived PIV Credential is to provide PIV-enabled authentication services on the mobile device to authenticate the credential holder to remote systems as illustrated in Figure 1-1. This publication also includes an informative annex that provides recommendations for the inclusion of digital signature and key management keys on mobile devices. To achieve interoperability with the PIV infrastructure and its applications, public key infrastructure (PKI) technology has been selected as the basis for the Derived PIV Credential. The PKI-based Derived PIV Credentials specified in this document are issued at levels of assurance (LOA) 3 and 4. 3 <!-- image --> Figure 1-1 Use of Derived PIV Credential Derived PIV Credentials are based on the general concept of derived credential in [SP800-63], which leverages identity proofing and vetting results of current and valid credentials. When applied to PIV, identity proofing and vetting processes do not have to be repeated to issue a Derived PIV Credential. Instead, the user proves possession of a valid PIV Card to receive a Derived PIV Credential.

Explanation: NIST publication on credential and access management. Topics: authentication, pki, key management. Contains security framework guidance for authentication systems. Source: Guidelines for Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IA-10 in Security and Privacy Controls for Information Systems and Organizations? Control IA-10: ADAPTIVE AUTHENTICATION Control: Require individuals accessing the system to employ [Assignment: organization-defined supplemental authentication techniques or mechanisms] under specific [Assignment: organization-defined circumstances or situations]. Discussion: Adversaries may compromise individual authentication mechanisms employed by organizations and subsequently attempt to impersonate legitimate users. To address this threat, organizations may employ specific techniques or mechanisms and establish protocols to assess suspicious behavior. Suspicious behavior may include accessing information that individuals do not typically access as part of their duties, roles, or responsibilities; accessing greater quantities of information than individuals would routinely access; or attempting to access information from suspicious network addresses. When pre-established conditions or triggers occur, organizations can require individuals to provide additional authentication information. Another potential use for adaptive authentication is to increase the strength of mechanism based on the number or types of records being accessed. Adaptive authentication does not replace and is not used to avoid the use of multi-factor authentication mechanisms but can augment implementations of multi-factor authentication. Related Controls: IA-2, IA-8. Control Enhancements: None. References: [SP 800-63-3].

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor. Contains security framework guidance for authentication systems. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings say about References? (Part 1) According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, References: References - [1] ISO 9594-8/ITU-T Rec. X.509 (2000) The Directory: Public-key and attribute certificate frameworks - [2] ISO SC 6 N12596 'Proposed Draft Amendment on Enhancements to PublicKey and Attribute Certificates', Geneva output, March 2004 - [3] C. Adams, S. Farrell. 'Internet X.509 Public Key Infrastructure Certificate Management Protocols'. RFC 2510, March 1999 - [4] Kaliski, B., "PKCS #10: Certificate Request Syntax, Version 1.5." RFC 2314, March 1998. - [5] D.W.Chadwick, A. Otenko, E.Ball. 'Role-based access control with X.509 attribute certificates', IEEE Internet Computing, March-April 2003, pp. 62-69. [6] ITU-T Recommendation X.680 (1997) | Information Technology - Abstract Syntax Notation One 6. ISO/IEC 8824-1:1998, (ASN.1): Specification of Basic Notation - [7] D.W.Chadwick, A. Otenko. 'RBAC Policies in XML for X.509 Based Privilege Management' in Security in the Information Society: Visions and Perspectives: IFIP TC11 17 th Int. Conf. On Information Security (SEC2002), May 7-9, 2002, Cairo, Egypt. Ed. by M. A. Ghonaimy, M. T. ElHadidi, H.K.Aslan, Kluwer Academic Publishers, pp 39-53. - [8] T.Parker, D.Pinkas. 'Sesame V4 Overview', Issue 1, Dec 1995. Available from 9. me/html/sesame\_documents.html - [9] Standard ECMA-219 "Authentication and Privilege Attribute Security Application with Related Key Distribution Functions" Parts 1, 2 and 3, December 1994. - [10] J. Kohl, C. Neuman. 'The Kerberos Network Authentication Service (V5).' RFC 1510, Sept 1993. - [11] C. Ellison, B. Frantz, B. Lampson, R. Rivest, B. Thomas, T. Ylonen. 'SPKI Certificate Theory'. RFC 2693, Sept 1999. - [12] Ron Rivest and Butler Lampson, "SDSI -A Simple Distributed Security Infrastructure [SDSI]", See < - [13] S. Tuecke, V. Welch, D. Engert, L. Pearlman, M. Thompson.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain B.4 Additional Properties on Existing Data Elements according to NIST Specification for Asset Identification 1.1 According to Specification for Asset Identification 1.1, B.4 Additional Properties on Existing Data Elements: The XML schema also provides extension points on most XML elements to allow for tracking metadata about Asset Identification information, such as classification level, sensitivity, or other organizationspecific data. As long as Asset Identification elements are able to validate against the core schema and conform to the requirements of this specification, these extensions and the Asset Identification elements are valid.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Specification for Asset Identification 1.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.16.6 Policy Enforcement: Developing Policy Conditions according to NIST Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events According to Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events, 2.16.6 Policy Enforcement: Developing Policy Conditions: 1. Navigate to Policy > Policy Elements > Conditions > Posture. 2. Expand the Posture section. This will reveal a list of categories for conditions. (Note: These conditions allow you to select or define requirements that endpoints should meet. In typical enterprises, these conditions can be used as requirements to gain network access-however, this strongly depends on the capabilities of your network device.) 3. As an example, we will require that Cisco AMP be installed on all Windows devices. If you are using a different anti-malware software, locate that instead. Click Anti-Malware Condition. <!-- image --> 4. Click Add. 5. Enter a name. 6. Enter a description if desired. 7. Select Windows All for Operating System. 8. Select Cisco Systems, Inc. for Vendor. 9. Under Products for Selected Vendor, check the box next to Cisco Advanced Malware Protection with the version number you have installed. <!-- image --> 10. Click Submit.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Additional Information according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Additional Information: Additional information about this publication is available at including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report of the Workshop on Cryptography in Support of Computer Security say about 4.2 Discussion? (Part 2) According to Report of the Workshop on Cryptography in Support of Computer Security, 4.2 Discussion: o suggest that the present algorithm can be used in much more secure ways, for instance cascading, which doubles the effective key. TUCHMAN: The algorithm as published is precisely what IBM submitted. The responsibility for the algorithm rests solely with IBM, not with NSA, and certainly not with NBS. We analyzed the algorithm extensively, and found no short cuts at all. The purpose of the structure in the S-boxes is to make a stronger algorithm. It is only an accident that NSA has an interest in keeping the design principles secret. There is no collusion. DIFFIE ( Stanford University): How can we have a FIPS standard based on classified design principles? HELLMAN: We have brought up many questions. When will they be addressed? I am prepared to agree that the DES is probably the best standard that could be promulgated at the present time. But I feel it necessary that the classified material involved be declassified. SCANTLIN: I would like to review with you the work that we have done privately on the algorithm. It is clear that the S-boxes are critical to the strength of the algorithm. There are many choices of S-boxes that would certainly result in a weak algorithm and it is by no means clear that the present choice is not weak. The strong potential of a trap door puts us in the place of an antagonist. Since important information was withheld, we tried to evaluate the strength of the algorithm. The results were not reassuring. The NBS position is that the algorithm resists all attacks except brute force, but we are able to reduce the work by a factor of two using analytical methods and we see much potential for further reduction. We are concerned about possible trap doors and about the short key. We feel that a standard must be completely visible. We also feel that IBM is placed at an advantage in producing the chip because it is keeping the design secret. We do not think this is proper for a standard.

Explanation: NIST publication discussing classified information handling. References: classified, secret. Contains guidance on protecting sensitive government information. Source: Report of the Workshop on Cryptography in Support of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications provide? (Section 44) but supplied by the testing code: - ε The sequence of bits as generated by the RNG or PRNG being tested; this exists as a global structure at the time of the function call; ε = ε 1 , ε 2 , … , ε n . - sobs : The absolute value of the sum of the Xi (where, Xi = 2 ε - 1 = ± 1) in the sequence divided by the square root of the length of the sequence. The reference distribution for the test statistic is half normal (for large n ). (Note: If z (where z = 2 ; see Section 3.1) is distributed as normal, then | z | is distributed as half normal.) If the s obs sequence is random, then the plus and minus ones will tend to cancel one another out so that the test statistic will be about 0. If there are too many ones or too many zeroes, then the test statistic will tend to be larger than zero. - (1) Conversion to ± 1: The zeros and ones of the input sequence ( ε ) are converted to values of -1 and +1 and are added together to produce Sn = X1 + X2 +  + Xn , where Xi = 2 ε i - 1. <!-- formula-not-decoded --> <!-- formula-not-decoded --> 2 For the example in this section, sobs = = .632455532. 10 <!-- formula-not-decoded --> <!-- formula-not-decoded --> If the computed P-value is < 0.01, then conclude that the sequence is non-random. Otherwise, conclude that the sequence is random. Since the P-value obtained in step 3 of Section 2.1.4 is ≥ 0.01 (i.e., P-value = 0.527089), the conclusion is that the sequence is random. Note that if the P-value were small (< 0.01), then this would be caused by or being large. Sn s obs Large positive values of Sn are indicative of too many ones, and large negative values of Sn are indicative of too many zeros. It is recommended that each sequence to be tested consist of a minimum of 100 bits (i.e., n ≥ 100 ).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2017 NIST_ITL Cybersecurity Program Annual Report say about EXTERNAL PUBLICATIONS? According to 2017 NIST_ITL Cybersecurity Program Annual Report, EXTERNAL PUBLICATIONS: The following journal articles and conference papers were published during FY 2017. For conference papers, the contributions listed below were either i) accepted for a conference held during FY 2017, or ii) accepted for a conference held prior to FY 2017 with final proceedings published in FY 2017 (and not listed in an earlier Annual Report). All NIST authors are identified using italics ; publications are arranged alphabetically by author. Links to document preprints are available at https:/ /csrc.nist.gov/publications.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2012 Annual Report say about  Enumerations:? According to Computer Security Division 2012 Annual Report,  Enumerations:: -  Common Platform Enumeration (CPE), a nomenclature anGLYPH(cmap:df00) GLYPH(cmap:df00)ictionary of harGLYPH(cmap:df00)ware, operating systems, and applications; -  Common Configuration Enumeration (CCE), a nomenclature anGLYPH(cmap:df00) GLYPH(cmap:df00)ictionary of software security configurations; anGLYPH(cmap:df00) -  Common Vulnerabilities and Exposures (CVE), a nomenclature and dictionary of security-relateGLYPH(cmap:df00) software flaws;

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TA-0 in Guidelines for Managing the Security of Mobile Devices in the Enterprise? (Part 32) Control TA-0: ted supply chain attack against a single organization or group of individuals, choosing validated devices and software and using a vetted system integrator can help mitigate the risk of broad attacks. NIST's Cryptographic Algorithm Validation Program (CAVP) 'provides validation testing of [Federal Information Processing Standards] FIPS-approved and NIST-recommended cryptographic algorithms and their individual components [13],' while the NIST Cryptographic Module Validation Program (CMVP) validates cryptographic module implementations against the Security Requirements for Cryptographic Modules [17]. The National Security Agency's (NSA) National Information Assurance Partnership (NIAP) [7] is responsible for implementation of the internationally recognized Common Criteria. throughout the Federal Government. Products certified through the Common Criteria program are evaluated for conformance with specific security protection profiles. NIAP's product compliance list identifies evaluated products and may be searched by vendor, technology type, protection profiles, and certifying country [8]. NSA's Commercial Solutions for Classified Program (CSfC) [9][10] also 'requires specific, selectable requirements to be included in the Common Criteria evaluation' and provides a list of software or hardware systems [33], including MDM and mobile platforms, that meet these more stringent requirements. In addition, CSfC provides a Trusted Integrator List [11], which identifies companies that have met its criteria for trustworthy systems integration capabilities. Organizations are encouraged to use lists of validated products and vetted system integrators to reduce the risk of acquiring devices or software with embedded vulnerabilities.

Explanation: NIST publication discussing classified information handling. References: classified, national security. Contains guidance on protecting sensitive government information. Source: Guidelines for Managing the Security of Mobile Devices in the Enterprise.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.2 Functions according to NIST Guide to Computer Security Log Management According to Guide to Computer Security Log Management, 3.2 Functions: Log management infrastructures typically perform several functions that assist in the storage, analysis, and disposal of log data. These functions are normally performed in such a way that they do not alter the original logs. 23 The following items describe common log management infrastructure functions:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Computer Security Log Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PA-220 in Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE)? (Part 211) Control PA-220: the management interface, domain name system (DNS), and network time protocol (NTP). The management interface allows the administrator to configure and implement security rules through this interface. ## 2.5.2.1 Configure Management Interface The following steps will configure the Palo Alto Networks appliance management interface. 1. In the Palo Alto Networks portal, navigate to Device > Setup > Interfaces. 2. On the Interfaces tab, enable the Management option; the Management Interface Setting page opens. 3. On the Management Interface Setting screen: - a. In the IP Address field, enter the IP address for the Palo Alto Networks appliance. - b. In the Netmask field, enter the netmask for the network. - c. In the Default Gateway field, enter the IP address of the router that provides the appliance with access to the internet. - d. Under Administrative Management Services: Enable the Hypertext Transfer Protocol (HTTP) , Hypertext Transfer Protocol Secure (HTTPS) , Secure Shell (SSH) , and Ping options. - e. Click OK. Figure 2-29 Palo Alto Networks Management Interface Enabled <!-- image --> Figure 2-30 Management Interface Configuration <!-- image --> 4. To verify the configuration, navigate to Palo Alto Networks Portal > Dashboard; the General Information section should reflect the appliance's network configuration. Figure 2-31 Palo Alto Networks Firewall General Information <!-- image --> ## 2.5.2.2 Configure DNS and NTP 1. In the Palo Alto Networks Portal , navigate to Device > Setup > Services. 2. In the Services tab, select the gear icon. Figure 2-32 Palo Alto Networks Services Configuration <!-- image --> 3. On the Services > Services tab: - a. For the Primary DNS Server field, enter the primary DNS server IP address. - b. For the Secondary DNS Server field, enter the secondary DNS server IP address, if applicable. 4. Select the NTP tab. Figure 2-33 DNS Configuration <!-- image --> ## 5. On the NTP tab: - a.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-09 in A Report on the Privilege (Access) Management Workshop? (Part 24) Control AM-09: entifies a number of factors to consider when planning an enterprise's access control system. This report pays quite a bit of attention to access control even though the focus is privilege management. This is because the characteristics and features of an access control system determine the requirements for the associated privilege management system. At the same time, an organization's capabilities to perform privilege management functions, if they cannot meet those requirements, limit the capabilities of the access control system to what is feasible. Practitioners and researchers in computer security generally distinguish among access control policies, mechanisms, and models. Policies are high-level requirements that specify how access is managed, expressing who or what should be granted or denied access to what resources. Mechanisms implement policies in a system. For example, policies might be captured as rules that a policy decision point uses, in addition to attributes about the requester and the resources, to determine whether an access request should be granted or denied. Models are used to describe and, in some cases to prove, security properties of an access control system. In short, a policy specifies access control requirements, a mechanism implements the requirements, and a model proves or describes things about the system that uses that policy and mechanism. The interested reader will find extensive discussion of these points in [FERR-07]. However, for our purposes in this report, we do not need to distinguish models and mechanisms from each other; it suffices to think about access control methods-that is, ways of doing access control. So, while an access control list (ACL) is a mechanism and role-based access control (RBAC) is a model, both are methods of access control. For the remainder of this report, then, we will refer to both models and mechanisms as methods of access control.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: A Report on the Privilege (Access) Management Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Metrics and Key Performance Indicators for Robotic Cybersecurity Performance Analysis say about 5 APPENDIX A - DESCRIPTION OF MEASUREMENTS AND KPI? (Part 3) According to Metrics and Key Performance Indicators for Robotic Cybersecurity Performance Analysis, 5 APPENDIX A - DESCRIPTION OF MEASUREMENTS AND KPI: | | ID | 1.2 | |-----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Name | Station Timers ( 𝑠𝑠 𝑃𝑃 𝑆𝑆 , 𝑠𝑠 𝐹𝐹 𝑆𝑆 , 𝑠𝑠 𝐼𝐼 𝑆𝑆 ) | | Description | Accumulation of time a station is in any valid state | | Unit of measure | seconds | | Notes | Simulated machining stations have three operating states: • Processing - station is loaded and the part is being processed • Finished - station is loaded and waiting for the robot to remove the part • Idle - station is unloaded and waiting for a part to be delivered | | ID | 1.3 | |-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Name | Batch Timer ( 𝑏𝑏 𝑃𝑃 ) | | Description | Total amount of time required for the batch to be produced | | Unit of measure | seconds | | Notes | The timer is started after the operator puts the enclave into the operational state, and is stopped when enclave operations end (automatic or operator shutdown).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Metrics and Key Performance Indicators for Robotic Cybersecurity Performance Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EC-62443 in 2017 NIST_ITL Cybersecurity Program Annual Report? (Part 143) Control EC-62443: with its Internet Engineering Task Force (IETF) partners, completed the design and standardization of the BGPsec Protocol Specification (RFC8205) and <!-- image --> supporting specifications. BGPsec provides the ability to use digital signatures to prevent both malicious and accidental unauthorized routing messages from effecting Internet global routing operations. <!-- image --> In addition to standards development, NIST developed and released an open source reference implementation of emerging IETF BGPsec specifications, on-line test tools to foster their adoption and measurement systems to track their operational deployment. Figure 37 is a visualization generated by one such monitoring tool that shows the current state of Route Origin Authorizations (ROAs) in the global Resource Public Key Infrastructure (RPKI). The RPKI has been designed to provide the trust infrastructure upon which Internet routing security technologies can be based. In FY 2017, as BGPsec and RPKI technology specifications and implementations matured, ITL shifted its efforts to focus on technology transition and operational issues associated with the new secure routing technologies. The ITL staff and its collaborators published research results on highspeed BGPsec implementations that attempt to minimize the operational performance impact of routing security. Figure 38 illustrates a prototype model for investigating and validating the emerging BGP security extensions and supporting protocols. Figure 37: Measurement of global networks with most BGP announcements protected by RPKI.

Explanation: NIST publication on credential and access management. Topics: authorization, pki, sso. Contains security framework guidance for authentication systems. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.