You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.1 PASSWORD USAGE according to NIST United States Federal Employees' Password Management Behaviors – A Department of Commerce Case Study According to United States Federal Employees' Password Management Behaviors – A Department of Commerce Case Study, 3.1 PASSWORD USAGE: On average, DOC employees had nine (range: 1 to 400) accounts at work that require logins. Due to the wide range of the data, medians were used for calculating the central tendency. The median of frequently used passwords was five (range: 0 to 105) and the median of occasionally used passwords was four (range: 0 to 245). Further breaking down the number of accounts requiring logins, showed that 21.8 % of the employees had less than or equal to five accounts, 41.5 % had between six to ten accounts, 25.4 % had between 11 to 20 accounts, and 11.0 % had more than 20 accounts.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: United States Federal Employees' Password Management Behaviors – A Department of Commerce Case Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 2017 NIST_ITL Cybersecurity Program Annual Report provide? (Section 302) us actors. The draft describes methods to improve the security of the PMS, and how these methods can help protect the business from network intrusions that might lead to data breaches and fraud. Based on industry research and in collaboration with hospitality industry stakeholders, the NCCoE is starting a project that aims to help hospitality organizations implement stronger security measures within and around the PMS, with a focus on the POS system through network segmentation, pointto-point encryption, data tokenization, multifactor authentication for remote and partner access, network and user behavior analytics, and business-only usage restrictions. In collaboration with the hospitality business community and technology vendors who implement standards that improve cybersecurity, the NCCoE will explore methods to strengthen the security of the PMS and its connections and will develop an example implementation composed of open-source and commercially available components. This project will produce a NIST Cybersecurity Practice Guide-a freely available description of the solution and practical steps needed to effectively secure the PMS and its many connections within the hotel IT system. Baldrige Cybersecurity Excellence Builder: Key questions for improving your organization's cybersecurity performance, v1.0 April 2017 https:/ /www.nist.gov/baldrige/products-services/ baldrige-cybersecurity-initiative The Baldrige Cybersecurity Excellence Builder is a voluntary self-assessment tool that enables organizations to better understand the effectiveness of their cybersecurity risk management efforts. It helps your organization identify strengths and opportunities for improvement in managing cybersecurity risk based on your organization's mission, needs, and objectives.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Section 292) | | PM-29 | Risk Management Program Leadership Roles | | | x | | | | PM-30 | Supply Chain Risk Management Strategy | x | x | x | x | | | PM-31 | Continuous Monitoring Strategy | | | x | x | x | | PM-32 | Purposing | | | | x | x | | PS-1 | Policy and Procedures | x | x | x | x | x | | PS-3 | Personnel Screening | x | x | | x | x | | PS-6 | Access Agreements | x | x | | x | x | | PS-7 | External Personnel Security | x | | | x | | | PT-1 | Policy and Procedures | | x | x | x | x | | RA-1 | Policy and Procedures | x | | x | x | x | | RA-2 | Security Categorization | x | | x | x | x | | RA-3 | Risk Assessment | x | | x | x | x | | RA-3 (1) | Risk Assessment | Supply Chain Risk Assessment | x | x |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives provide? (Section 39) ity - b. Message Content Standards - c. Barriers to Entry - d. Supply Chain traceability Ecosystems - e. Metrics - f. Patterns in Supply Chain Traceability - g. Ecosystem Scale and Interoperability 4. The authors encourage further research, experimentation, and discussion in manufacturing domains to explore the topics above and discover further innovations to improve traceability of manufacturing supply chains. The remaining sections of the paper are: Section 2 'Manufacturing Supply Chain Overview and Imperatives' reviews the current state of supply chain risk analysis and introduces an ecosystem perspective to complement the current per stakeholder perspective in Supply Chain Risk Management (SCRM) analysis. Section 3 'Traceability' reviews the desired benefits traceability may offer and example domains for which traceability is applicable. Section 4 'Technologies Supporting Traceability' reviews technologies, both mature and emerging, which can be used to link goods and services to data records, then share the data records across a wide set of supply chain stakeholders. Section 5 'Considerations for Adoption of Blockchain' reviews the challenges and risks associated with establishing a blockchain capability for a subset of the supply chain and the resulting ecosystem. Blockchain is one technology with features corresponding to drivers for supply chain traceability, such as pedigree and provenance for products and records. Section 6 'Industry Case Studies & Analysis' reviews the methodology for industry engagement, organizations who submitted case studies, and the summaries of the submitted case studies. Following are the analyses of the case studies viewed through perspectives or mental models selected in the methodology. Full description of the analysis methods and full case studies are found in the Appendices. Section 7 'Future Research' summarizes indications of future research needed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines on Active Content and Mobile Code? (Part 14) Control ES-1: e of Standards and Technology (NIST) developed this document in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets; but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), 'Securing Agency Information Systems,' as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III. This guideline has been prepared for use by Federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright, though attribution is desired. Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority, nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official. ## 1.2 Purpose and Scope The purpose of this document is to provide an overview of active content and mobile code technologies in use today and offer insights for making informed IT security decisions on their application and treatment. The discussion gives details about the threats, technology risks, and safeguards for end user systems, such as desktops and laptops. Although various end user applications, such as email clients, can involve active content, Web browsers remain the primary vehicle for delivery and are underscored in the discussion. The tenets presented for Web browsers apply equally well to other end user applications and can be inferred directly.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Guidelines on Active Content and Mobile Code.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Dramatically Reducing Software Vulnerabilities_ Report to the White House Office of Science and Technology Policy say about 1 Introduction? (Part 2) According to Dramatically Reducing Software Vulnerabilities_ Report to the White House Office of Science and Technology Policy, 1 Introduction: triggered or intentionally exploited and result in a violation of desired system properties. A weakness is an undesired characteristic of a system's requirements, design or implementation [Black11a]. This definition excludes - manual configuration or operational mistakes, such as installing a program as worldreadable or setting a trivial password for administrator access; - insider malfeasance, such as exfiltration by Edward Snowden; - functional bugs, such as the mixture of SI (International System of Units) and Imperial units, which led to the loss of the Mars Climate Orbiter in 1999 [Oberg99]; - purposely introduced malware or corrupting 'mis-features' in regular code, such as allowing root access if the user name is 'JoshuaCaleb' and - software weaknesses that cannot be exploited (by 'outsiders') as a result of input filtering or other mitigations. Great strides have been made in defining software vulnerabilities, cataloging them and understanding them. Additionally, great strides have been made in educating the software community about vulnerabilities, attendant patches and underlying weaknesses. This work, however, is insufficient. Significant vulnerabilities are found routinely, many vulnerabilities lie undiscovered for years and patches are often not applied. Clearly a different approach-one that relies on improving software-is needed. Strengthening protection requires increasing assurance that the products people develop and deploy are highly resistant to malicious cyber activities, because they include very few vulnerabilities … [FCRDSP16, p. 17]

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, malware. Contains technical security guidance that could inform defensive posture. Source: Dramatically Reducing Software Vulnerabilities_ Report to the White House Office of Science and Technology Policy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation say about Executive Summary? (Part 2) According to Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation, Executive Summary: en two transit networks. �ere are instances in which the recommendations for interdomain traffic exchange between transit networks will vary from those for exchanges between stub and transit networks. �e provided recommendations reduce the risk of accidental attacks (caused by misconfigu ration) and malicious attacks in the routing control plane, and they help detect and prevent IP address spoofing and resulting DoS/DDoS attacks. �ese recommendations primarily cover technologies (for security and robustness) to be used in border routers that operate the Border Gateway Protocol (commonly called BGP routers). However, they also extend to other systems that support reachability on the internet (e.g., Resource Public Key Infrastructure (RPKI) repositories, Domain Name System (DNS), other open internet services). It is expected that the guidance and applicable recommendations from this publication will be incorporated into the security plans and operational processes of federal enterprise networks. Likewise, it is expected that applicable recommendations will be incorporated into the service agreements for federal contracts for hosted application services and internet transit services. �is document also contributes to the ongoing efforts by NIST and NTIA [DOC -Botnet] [BotnetRoadmap] to respond to Presidential Executive Order 13800 [PEO-13800]. Technologies recommended in this document for securing interdomain routing control traffic include Resource Public Key Infrastructure (RPKI), BGP origin validation (BGP-OV), and prefix filtering. Additionally, technologies recommended for mitigating DoS/DDoS attacks include prevention of IP address spoofing using source address validation (SAV) with access control lists (ACLs) and unicast Reverse Path Forwarding (uRPF).

Explanation: NIST publication on credential and access management. Topics: access control, pki. Contains security framework guidance for authentication systems. Source: Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Risk response constraints according to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Risk response constraints: Limited operational resources to

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Card Technology Developments and Gap Analysis Interagency Report say about Technology Issues and Standardization Gaps? (Part 2) According to Card Technology Developments and Gap Analysis Interagency Report, Technology Issues and Standardization Gaps: logical and physical access control in Federal government applications. However, the basic GSC-IS smart card service provider model is flexible enough to support a much broader range of applications. It does not preclude use of current storage technologies, including optical technologies. GSC-IS is based on the ISO 7816 standards, and NIST is pursuing formal standardization of GSC-IS on behalf of the GSC community. The following additional technology issues were identified: -  Existing standards do not address a true multi-application platform with multiple security domains that enable software applications from different vendors to share the same media. Although significant cost savings and ease of card and system management benefits might result from development of such a platform, the workshop and subsequent interviews revealed neither the validated requirements nor the technical capabilities necessary to the development. No consensus among the user community regarding additional requirements for interconnecting multiple technologies, either on a card or in a reader/processor device was identified in either workshop proceedings or user interviews. -  With respect to the design of multi-technology cards, the issue of the physical location of each technology on the same card is a concern. No standard exists that defines the technologies that may co-exist on a single card. The detailed location and layout of different combinations of components have not been specified, nor have physical and mechanical specifications for some technologies or groups of technologies been specified. Such specification of the mutual effects of co-existing technologies and varying operational requirements of each technology may prove useful in the future. For example, when chip failure occurs on a contactless smart card, the magnetic stripe also present on the card may also be affected. The life expectancy of the magnetic stripe is then reduced as a result of a chip-related problem.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Card Technology Developments and Gap Analysis Interagency Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Domain Name System-Based Electronic Mail Security say about 3.4.4 Cybersecurity Framework Functions, Categories, and Subcategories Addressed by the Project? (Part 3) According to Domain Name System-Based Electronic Mail Security, 3.4.4 Cybersecurity Framework Functions, Categories, and Subcategories Addressed by the Project: y are based upon cross-sector guidance most frequently referenced during the Framework development process. This project supported the Cybersecurity Framework's Protect, Detect, and Respond Functions. Applicability to specific Functions, Categories, and Subcategories is described in the following paragraphs.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Recommended Confidentiality Impact Level according to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices? Recommended Confidentiality Impact Level: Given potentially serious to severe legal consequences of unauthorized disclosure, the provisional confidentiality impact level recommended for legal investigation information is moderate .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Trusted Geolocation in the Cloud_ Proof of Concept Implementation say about HTCC 4.1.0 Product Documentation:? According to Trusted Geolocation in the Cloud_ Proof of Concept Implementation, HTCC 4.1.0 Product Documentation::

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trusted Geolocation in the Cloud_ Proof of Concept Implementation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Derived Personal Identity Verification (PIV) Credentials say about Figure 2-6 Certificate Profile Attributes? According to Derived Personal Identity Verification (PIV) Credentials, Figure 2-6 Certificate Profile Attributes: <!-- image --> 5. Repeat Step 4 for the PIV-Auth-1-yr-v2, PIV-CardAuth-1yr-v1, and PIV-Sig-1yr-v1 certificate profiles. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog? Discussion: Some IoT devices may have multiple users within an organization and require support for role and account management. These accounts may then be used are part of the identification, authentication, and authorization of users based on roles and privileges.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Data Integrity_ Recovering from Ransomware and Other Destructive Events provide? (Section 67) last known good | Data Integrity -1 | | CR 2 | The DI example imple- mentation shall recover when malware destroys data on user's machine. | | | | CR 2.a | | Provide file integrity monitor | Data Integrity -2 | | CR 2.b | | Revert to last known good | Data Integrity -2 | | CR 3 | The DI example imple- mentation shall recover when a user modifies a configuration file in viola- tion of established base- lines.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Requirements for Cryptographic Modules say about SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES? (Part 4) According to Security Requirements for Cryptographic Modules, SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES: formation about the CMVP can be obtained from the - a. National Institute of Standards and Technology, Information Technology Laboratory, 100 Bureau Drive, Stop 8900, Gaithersburg, MD 20899-8900. - b. Canadian Centre for Cyber Security, P.O. Box 9703, Terminal, Ottawa, Ontario K1G 3Z4 - c. CMVP URL 10. Approved Security Functions. Cryptographic modules that conform to this standard shall employ Approved security functions such as cryptographic algorithms, cryptographic key management techniques, and authentication techniques that have been approved for protecting Federal government sensitive information. Approved security functions include those that are either: - a. specified in a Federal Information Processing Standard (FIPS), - b. adopted in a FIPS and specified either in an appendix to the FIPS or in a document referenced by the FIPS, - c. specified in NIST SP 800-140C as an Approved security function, or - d. specified in NIST SP 800-140D as an Approved sensitive security parameter establishment method. 11. Interpretation. Questions concerning the content and specifications of this standard should be addressed to: Director, Information Technology Laboratory, ATTN: FIPS 140-3 Interpretation, National Institute of Standards and Technology, 100 Bureau Drive, Stop 8900, Gaithersburg, MD 20899-8900. Resolution of questions regarding this standard will be provided by the validation authorities at the National Institute of Standards and Technology and the Canadian Centre for Cyber Security. 12. Implementation Schedule. This standard becomes effective six months after approval by the Secretary of Commerce. A minimum transition period of 6 months after approval is provided for testing labs to develop and implement FIPS 140-3 testing. A test report for modules demonstrating compliance will be submitted to the CMVP for review and validation.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Security Requirements for Cryptographic Modules.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.3.4.1 SP 800-56B Key Transport according to NIST Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms According to Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms, 5.3.4.1 SP 800-56B Key Transport: SP 800-56B specifies a method for transporting keys whereby the sender uses the receiver's public key to securely transport keying material to the receiver. Figure 7 provides a simplified example of the key-transport method in SP 800-56B. The receiver must have a key pair that is used during a key-transport transaction. Key transport is accomplished as follows. The sender: 1. Obtains the public key of the intended receiver, 2. Generates a symmetric key to be transported, 3. Encrypts the symmetric key using the receiver's public key, and 4. Sends the resulting ciphertext key to the receiver. The receiver: 5. Uses the private key to decrypt the ciphertext key, thus obtaining the original plaintext key. 6. Optionally performs key confirmation; although this step is optional, it is highly recommended to provide assurance that both parties now have the same symmetric key. 85 SP 800-71, Recommendation for Key Establishment Using Symmetric Block Ciphers . Figure 7: SP 800-56B Key Transport Example <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Contacts: according to NIST Computer Security Division 2011 Annual Report According to Computer Security Division 2011 Annual Report, Contacts:: Mr. Fernando Podio fernando.podio@nist.gov Mr. Dylan Yaga dylan.yaga@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE) provide? (Section 165) ng to all three data actions identified in the privacy risk assessment. These training and support mitigations can help Orvilia appropriately inform employees about the system and its data processing. Training sessions can also highlight any privacy-preserving techniques used, such as for disclosures to third parties. Training should include confirmation from employees that they understand the actions that can be taken on their devices and the consequences-whether this involves blocking access or wiping data. Employees may also be informed of data retention periods and when their data will be disposed of. This can be more effective than sharing a privacy notice, which research has shown that individuals are unlikely to read. This can be achieved using push notifications, similar to those pictured in screenshots in Appendix H, Threat Event 6, to help directly link administrative actions on devices to relevant threats and help employees understand why an action is being taken. Notifications of changes to policies can help increase system predictability by setting employee expectations appropriately with the way the system processes data and the resulting actions. By providing employees with a point of contact in the organization who can respond to inquiries and concerns regarding the system, employees can gain a better understanding of the system's processing of their data, which enhances predictability. Detailed information and screenshots for some of this practice guide's threat events and their testing results are provided below. A part of Threat Event 1's testing conclusions is shown in the following screen capture, where the calendar access permission is being set to a risk score of 10. This allows MobileIron to automatically apply the mobile threat protection high-risk label to the device and quarantine the device until the privacy-intrusive application is removed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities say about 5. Comparing CCSS to CVSS and CMSS? (Part 2) According to The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities, 5. Comparing CCSS to CVSS and CMSS: nd CMSS, because their vulnerabilities can be exploited without exploit code and are already known to exist. Also, CMSS vulnerabilities and many CCSS vulnerabilities do not have complete remediations. So CCSS and CMSS have similar sets of temporal metrics, quite different from those of CVSS, that address the general prevalence of attacks against the vulnerability and the general effectiveness of available remediation measures, such as using antivirus software or conducting awareness activities. CCSS and CMSS also offer similar sets of environmental metrics, which are considerably more complex than CVSS's metrics. CVSS has three: Collateral Damage Potential, Target Distribution, and Security Requirements. These metrics are all part of CCSS and CMSS as well, although Target Distribution has been renamed Local Vulnerability Prevalence. Two other metrics have been added to CCSS and CMSS: Perceived Target Value, which measures how attackers value the targets in a specific local environment as opposed to other environments, and Local Remediation Level, which measures the effectiveness of mitigation measures in the local environment. CCSS and CMSS also divide their environmental metrics into two groups: Exploitability and Impact. This allows Exploitability and Impact environmental subscores to be generated for CCSS and CMSS; such subscores are not available in CVSS. 15 The other specifications are NIST IR 7435 and NIST IR 7517 ().

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems say about B. CONCEPT OF EMERGENCY RESPONSE? According to Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems, B. CONCEPT OF EMERGENCY RESPONSE: The following list provides emergency phone numbers for use during a crisis:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity? (Part 45) Control AC-1: Table 5-1 Mapping of Device Cybersecurity Capabilities and Nontechnical Supporting Capabilities to NIST Cybersecurity Framework Subcategories of the IIoT Project | Cybersecurity Framework v1.1 Subcategory | Device Cybersecurity Capabilities | Manufacturer Nontechnical Supporting Capabilities | Related NERC CIP ID(s) | |---------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------| | PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Securing Distributed Energy Resources_ An Example of Industrial Internet of Things Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain ASSESSMENT OBJECTIVE according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, ASSESSMENT OBJECTIVE: Determine if: A.03.04.11.a[01]: the location of CUI is identified and documented. A.03.04.11.a[02]: the system components on which CUI is processed are identified and documented. A.03.04.11.a[03]: the system components on which CUI is stored are identified and documented. A.03.04.11.b[01]: changes to the system or system component location where CUI is processed are documented. A.03.04.11.b[02]: changes to the system or system component location where CUI is stored are documented.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to IPsec VPNs provide? (Section 288) | Public Law | | PAKE | Password Authenticated Key Exchange | | PAP | Password Authentication Protocol | | PFS | Perfect Forward Secrecy | | PKCS | Public Key Cryptography Standards | | PKI | Public Key Infrastructure | | PMTUD | Path Maximum Transmission Unit Discovery | | POP | Post Office Protocol | | PPK | Post-quantum Pre-shared Key | | PPP | Point-to-Point Protocol | | PPTP | Point-to-Point Tunneling Protocol | | PRF | Pseudorandom Function | | PSK | Pre-shared Key | | PSS | Probabilistic Signature Scheme | | QoS | Quality of Service | | RADIUS | Remote Authentication Dial In User Service | | RAM | Random Access Memory | | RFC | Request for Comment | | RMON | Remote Monitoring | | S/MIME | Secure/Multipurpose Internet Mail Extensions | | SA | Security Association | | SAD | Security Association Database | | SAN | subjectAltName | | SDN | Software Defined Networking | | SDP | Session Description Protocol | | SDWAN | Software Defined Wide Area Network | | SHA | Secure Hash Algorithm | |---------|--------------------------------------------------------| | SHS | Secure Hash Standard | | SIP |

Explanation: NIST publication on credential and access management. Topics: authentication, pki, sso. Contains security framework guidance for authentication systems. Source: Guide to IPsec VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Advanced Identity Workshop on Applying Measurement Science in the Identity Ecosystem_ Summary and Next Steps provide? (Section 1) Summary and Next Steps Michael E. Garcia Paul A. Grassi This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.IR.8103 <!-- image --> Summary and Next Steps Michael E. Garcia Paul A. Grassi Applied Cybersecurity Division Information Technology Laboratory This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.IR.8103 September 2016 <!-- image --> U.S. Department of Commerce Penny Pritzker, Secretary National Institute of Standards and Technology Willie May, Under Secretary of Commerce for Standards and Technology and Director This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.IR.8103 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Advanced Identity Workshop on Applying Measurement Science in the Identity Ecosystem_  Summary and Next Steps.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Domain Name System-Based Electronic Mail Security say about Zones that pre-publish the new public key should observe the following:? (Part 1) According to Domain Name System-Based Electronic Mail Security, Zones that pre-publish the new public key should observe the following:: Zones that pre-publish the new public key should observe the following: 31. Checklist item 31: The secure zone that pre-publishes its public key should do so at least one TTL period before the time of the key rollover. 32. Checklist item 32: After removing the old public key, the zone should generate a new signature (RRSIG RR), based on the remaining keys (DNSKEY RRs) in the zone file. 33. Checklist item 33: A DNS administrator should have the emergency contact information for the immediate parent zone to use when an emergency KSK rollover must be performed. 34. Checklist item 34: A parent zone must have an emergency contact method made available to its delegated child subzones in case of emergency KSK rollover. There also should be a secure means of obtaining the new KSK. 35. Checklist item 35: Periodic re-signing should be scheduled before the expiration field of the RRSIG RRs found in the zone. This is to reduce the risk of a signed zone being rendered bogus because of expired signatures. 36. Checklist item 36: The serial number in the SOA RR must be incremented before re-signing the zone file. If this operation is not done, secondary name servers may not pick up the new signatures because they are refreshed purely on the basis of the SOA serial number mismatch. The consequence is that some security-aware resolvers will be able to verify the signatures (and thus have a secure response) but others cannot. 37. Checklist item 37: Recursive servers/resolvers should be placed behind an organization's firewall and configured to only accept queries from internal hosts (e.g., Stub Resolver host). 38. Checklist Item 38: Whenever Aggregate Caches are deployed, the forwarders must be configured to be Validating Resolvers. 39. Checklist item 39: Each recursive server must have a root hints file containing the IP address of one or more DNS root servers. The information in the root hints file should be periodically checked for correctness. 40.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Expected Outputs according to NIST_SP_800-37r2_Risk_Management_Framework? Expected Outputs: Documented authorization boundary.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Purpose: according to NIST Government Smart Card Interoperability Specification, Version 2.1 According to Government Smart Card Interoperability Specification, Version 2.1, Purpose:: Computes a symmetric key cryptogram in response to a challenge. In cases where the card reader authenticates the smart card, this function does not return a cryptogram. In these cases a BSI\_TERMINAL\_AUTH will be returned if the card reader successfully authenticates the smart card. BSI\_ACCESS\_DENIED is returned if the card reader fails to authenticate the smart card. ``` Prototype: ( ``` Parameters: ``` unsigned long gscBsiSkiInternalAuthenticate IN unsigned long hCard , IN string AID , IN octet algoID , IN sequence<byte> challenge , INOUT sequence<byte> cryptogram ); ``` hCard: AID: algoID:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain COMMON ABBREVIATIONS according to NIST Guide for Conducting Risk Assessments According to Guide for Conducting Risk Assessments, COMMON ABBREVIATIONS: APT Advanced Persistent Threat BCP Business Continuity Plan BIA Business Impact Analysis CNSS Committee on National Security Systems COOP Continuity of Operations DoD Department of Defense DHS Department of Homeland Security DNI Director of National Intelligence EA Enterprise Architecture FIPS Federal Information Processing Standards FISMA Federal Information Security Management Act ICS Industrial Control System IEC International Electrotechnical Commission ISO International Organization for Standardization IT Information Technology JTF Joint Task Force NIST National Institute of Standards and Technology NOFORN Not Releasable to Foreign Nationals ODNI Office of the Director of National Intelligence OMB Office of Management and Budget RAR Risk Assessment Report RMF Risk Management Framework SCAP Security Content Automation Protocol SP Special Publication TTP Tactic Technique Procedure U.S.C. United States Code \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, rmf, fips. General security reference material without sensitive content. Source: Guide for Conducting Risk Assessments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations provide? (Section 44) 10 specifies how TLS is to be used in government applications. | | Trust anchor | An authoritative entity represented by a public key and associated data (see RFC 5914 11 ). | | Unauthorized disclosure | An event involving the exposure of information to entities not authorized access to the information. | | User | A human entity. | | Validity period | The period of time during which a certificate is intended to be valid; the period of time between the start date and time and end date and time in a certificate. | 8 RFC 5246, The Transport Layer Security (TLS) Protocol Version 1.2. 9 RFC 8446, The Transport Layer Protocol (TLS) Version 1.3. 10 SP 800-52, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations . 11 RFC 5914, Trust Anchor Format. Wrapped keying material Keying material that has been encrypted and its integrity protected using an approved key wrapping algorithm and a key wrapping key in order to disguise the value of the underlying plaintext key. X.509 certificate The X.509 public-key certificate or the X.509 attribute certificate, as defined by the ISO/ITU-T 12 X.509 standard. Most commonly (including in this document), an X.509 certificate refers to the X.509 public-key certificate.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks? (Part 44) Control AM-1: | IoT devices may be complex and dynamic, with sensing functionality that can collect PII being frequently added and removed. Consideration 1 | PA-3, Purpose Specification | • PII may be hard to track such that individuals, as well as device owners/operators, may not have reliable assumptions about how PII is being processed, causing informed decision making to be more difficult. | | Challenges for Individual IoT Devices | Challenges for Individual IoT Devices | Affected Draft NIST SP 800-53 Revision 5 Controls | Implications for the Organization | |-----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 43. | The IoT device may be accessed remotely, allowing the sharing of PII outside the control of the administrator. | PA-4, Information Sharing with External Parties | • PII may be shared in ways that are out of compliance with regulatory requirements or an organization's policies.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide say about 5.3.4. Person or Entity Authentication (§ 164.312(d)) 139? (Part 4) According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide, 5.3.4. Person or Entity Authentication (§ 164.312(d)) 139: es, such as a fingerprint • MFA utilizes two or more authentication approaches to enforce stronger authentication. • Consider implementing MFA solutions 140 when the risk to ePHI is sufficiently high. | • What are the strengths and weaknesses of each available option? • Which can be best supported with assigned resources (e.g., budget/staffing)? • What level of authentication is appropriate for each access to ePHI based on the assessment of risk? • Has the organization identified all instances of access to ePHI (including by services, vendors, or application programming interfaces [APIs]) and considered appropriate authentication requirements based on the risk assessment? | 139 See Sec. 5.3.1, HIPAA Standard: Access Control ; Sec. 5.3.2, HIPAA Standard: Audit Controls ; and [SP 800-63B], Digital Identity Guidelines: Authentication and Lifecycle Management . 140 Some MFA implementations may offer greater protection than others. Consider the pros and cons of each MFA option in light of the risk to ePHI.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, mfa. Contains security framework guidance for authentication systems. Source: Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Fingerprint Identification and Mobile Handheld Devices_ An Overview and Implementation provide? (Section 14) n the fingerprint template information file, and the user gains access to the device. Note that for the lightweight variant, fingerprint templates are maintained in the memory of the fingerprint unit. Once enrolled, subsequently powering on or booting up the device prompts the user to provide a live fingerprint image for verification. The verification process uses information from the mechanism settings file to encrypt information between the device and the fingerprint reader. A correct match against the enrolled fingerprint templates in the fingerprint information file results in successful authentication and access is granted to the device. If too many authentication failures occur, further attempts are blocked temporarily to prevent unrestricted password guessing attempts. Any time after gaining access, a user can update the set of enrolled fingerprints by using an available icon to launch the process and providing a live fingerprint image for verification, which then follows the same procedure described above for verification at power on or boot up. In Figure 3, the 'Verify Fingerprint' boxes associated with fingerprint update do not show the information flows discussed above, but are present implicitly. Successful verification allows the user to enroll new fingerprint images adding to or replacing the existing set. A successful enrollment updates the fingerprint template information file and the user regains access to the device. For user authentication the fundamental threat is an attacker impersonating a user and gaining control of the device and its contents. Fingerprint units should be embedded into devices that are designed to resist physical tampering and avoid exposing the communications channel between the device and the unit.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Fingerprint Identification and Mobile Handheld Devices_ An Overview and Implementation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Key Management Documents say about 7.3.3 Confidentiality and Integrity Algorithm? According to Secure Data Network Systems (SDNS) Key Management Documents, 7.3.3 Confidentiality and Integrity Algorithm: The confidentiality and integrity algorithm option is used for negotiating use of algorithms other than that used to form the TEK for data security. This option includes the negotiation of the algorithm mode and the icv length, as defined above.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain allowlist according to NIST Digital Identity Guidelines_ Federation and Assertions According to Digital Identity Guidelines_ Federation and Assertions, allowlist: A documented list of specific elements that are allowed, per policy decision. In federation contexts, this is most commonly used to refer to the list of RPs that are allowed to connect to an IdP without subscriber intervention. This concept has historically been known as a whitelist .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Digital Identity Guidelines_ Federation and Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Zero Trust Architecture say about 2.1 Principios de la confianza cero? (Part 3) According to Zero Trust Architecture, 2.1 Principios de la confianza cero: nte puede incluir la cuenta de usuario (o la identidad del servicio) y cualquier otra característica asociada asignada por la empresa a esa cuenta o artefacto para autenticar las tareas automatizadas. El estado de los activos solicitados puede incluir características del dispositivo como las versiones de software instaladas, la ubicación de la red, la hora y la fecha de la solicitud, el comportamiento observado previamente y las credenciales instaladas. Los factores de comportamiento incluyen, entre otros, análisis automatizados del sujeto, análisis del dispositivo y mediciones de las desviaciones de los patrones de utilización observados. La política es el conjunto de reglas de acceso basado en los atributos que una organización asigna a un sujeto, a una base de datos o a una aplicación. Las características del entorno pueden incluir factores como la ubicación de la red del solicitante, la hora, los ataques activos notificados, etc. Estas reglas y particularidades se basan en las necesidades del desarrollo empresarial y en un nivel de riesgo aceptable. Las políticas de acceso a los recursos y los permisos de acción pueden variar en función de la sensibilidad de estos y de los datos. Además, se aplican los principios de mínimo privilegio para restringir tanto la visibilidad como la accesibilidad. 5. La empresa supervisa y mide la integridad y la postura de seguridad de todos los activos propios y de los asociados. Ningún activo es intrínsecamente confiable, por lo que la empresa examina la postura de seguridad de cada uno de ellos cuando evalúa la solicitud de un recurso. Una organización que implemente una ZTA debe establecer un programa de Diagnóstico y Mitigación Continuos (CDM) o un sistema similar para supervisar el estado de los dispositivos y las aplicaciones. A su vez, debe aplicar parches o correcciones si es necesario.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Zero Trust Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to IPsec VPNs say about 8.3 WireGuard? (Part 2) According to Guide to IPsec VPNs, 8.3 WireGuard: (continuous packet sequence numbers). It supports PPK and has the same seamless reconnection properties as IKEv2 MOBIKE, where a device can switch network interfaces without losing the VPN connection. WireGuard takes advantage of multiple CPUs when present, unlike typical SSL VPNs that are bound to one CPU. The protocol does not allow for DHCP-style IP address allocation, and IP addresses are hardcoded in its configuration file on the client and server. DNS configuration has to be conveyed via a provisioning protocol. WireGuard lacks authentication support using certificates or PSKs. It does not support a transport mode configuration, making it less suitable for mesh encryption. It does not support AES-GCM. WireGuard is mostly intended as a remote access VPN even though it leaves most of the configuration of such functionality to an additional, unspecified provisioning protocol. While it can be used in a gateway-to-gateway or host-to-host architecture, it misses the optimizations and flexibility of IPsec in these architectures.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to IPsec VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Digital Identity Guidelines provide? (Section 70) igital Identity Guidelines selection, additional assessments and evaluations that are specific to the baseline controls for the assurance levels may be required for the underlying information system. • Customer Experience – Determine whether implementation of the initial assurance levels may create substantial or unacceptable barriers to individuals seeking to access services. Customer experience assessments SHALL consider impacts that result from the identity management controls to ensure that they do not cause undue burdens, frustrations, or frictions for individuals and that there are pathways to provide service to users of all capabilities, resources, technology access, and economic statuses. • Threat Resistance – Determine whether the defined assurance level and related controls will address specific threats to the online service based on the operational environment, its threat actors, and known tactics, techniques, and procedures (TTPs). Threat assessments SHALL consider specific known and potential threats, threat actors, and TTPs within the implementation environment for the identity management functions. For example, certain benefits programs may be more subject to familial threats or collusion. Based on their assessments, organizations MAY implement supplemental controls specific to the communities served by their online service. Conversely, organizations MAY tailor their assessed xAL down or modify their baseline controls if their threat assessment indicates that a reduced threat posture is appropriate based on their environment. Organizations SHOULD leverage consultation and feedback from the entities and communities served to ensure that the tailoring process addresses their known constraints. Organizations SHOULD also conduct additional business-specific assessments as appropriate to fully represent mission- and domain-specific considerations that have not been captured here.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Digital Identity Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CP-08(03) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control CP-08(03): TELECOMMUNICATIONS SERVICES | SEPARATION OF PRIMARY AND ALTERNATE PROVIDERS

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document say about Appendix A Glossary? (Part 2) According to Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document, Appendix A Glossary: thority | An authorized entity that stores, signs, and issues digital cryptographic key certificates. It acts to validate identities and bind them to cryptographic key pairs with digital certificates. | | Certificate and Key | Functions for securely issuing, monitoring, facilitating, and executing | | Governance | digital X .509 certificates and managing the cryptographic keys exchanged using the certificates. | | Client | System entities that request and use a service provided by another system entity called a server. Usually, it is understood that the client and server are automated components of the system, and the client makes the request on behalf of a human user. Clients may initiate encrypted traffic. They are interfaces for human users, devices, applications, and processes to access network functions, including the requesting of certificates and keys. | | Cryptography | The discipline that embodies the principles, means, and methods for the transformation of data to hide their semantic content, prevent their unauthorized use, or prevent their undetected modification. It embodies the principles, means, and methods for providing information security, including confidentiality, data integrity, non- repudiation, and authenticity. | | Decryption | The process of a confidentiality mode that transforms encrypted data into the original usable data.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Addressing Visibility Challenges with TLS 1.3 within the Enterprise_ High-Level Document.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Bring Your Own Device (BYOD) say about 3.3 Assumptions? (Part 2) According to Mobile Device Security_ Bring Your Own Device (BYOD), 3.3 Assumptions: has the technology in place to support this implementation or has access to the off-the-shelf technology used in this build, which we assume will perform as described by the respective product vendor. - The organization has familiarized itself with existing standards and any associated guidelines (e.g., NIST Cybersecurity Framework [1]; NIST Privacy Framework [2]; NIST SP 800-124 Revision 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise [6]; NIST SP 1800-4 Mobile Device Security: Cloud and Hybrid Builds [7]) relevant to implementation of the example solution proposed in this practice guide. We also assume that any existing technology used in the example solution has been implemented in a manner consistent with these standards. - The organization has instituted relevant mobile device security and privacy policies, and these will be updated based on implementation of this example solution. - The organization will provide guidance and training to its employees regarding BYOD usage and how to report device loss or suspected security issues in which their devices are involved. This guidance will be periodically reviewed and updated, and employees will be regularly trained on BYOD usage.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Security for Full Virtualization Technologies provide? (Section 20) lines, including minimum requirements, for providing adequate information security for all agency operations and assets; but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), 'Securing Agency Information Systems,' as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III. This guideline has been prepared for use by Federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright, though attribution is desired. Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority, nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official. The purpose of the guide is to discuss the security concerns associated with full virtualization technologies for server and desktop virtualization, and to provide recommendations for addressing these concerns. All forms of virtualization other than server and desktop full virtualization are outside the scope of this document. Most existing recommended security practices remain applicable in virtual environments. The practices described in this document build on and assume the implementation of practices described in other NIST publications. The intended audience for this document is system and security administrators, security program managers, information system security officers, and others who have responsibilities for or are otherwise interested in the security of server or desktop full virtualization technologies. This document assumes that readers have some operating system, networking, and security expertise.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Guide to Security for Full Virtualization Technologies.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 795) hash, and using the public key to verify the hash information. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions. Related Controls: SC-12, SC-13. (7) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRATION OF DETECTION AND RESPONSE Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined security-relevant changes to the system]. Discussion: Integrating detection and response helps to ensure that detected events are tracked, monitored, corrected, and available for historical purposes. Maintaining historical records is important for being able to identify and discern adversary actions over an extended time period and for possible legal actions. Security-relevant changes include CHAPTER THREE PAGE 346 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ unauthorized changes to established configuration settings or the unauthorized elevation of system privileges. Related Controls: AU-2, AU-6, IR-4, IR-5, SI-4. (8) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | AUDITING CAPABILITY FOR SIGNIFICANT EVENTS Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection (one or more): generate an audit record; alert current user; alert [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined other actions]].

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: adversary, incident response. Contains technical security guidance that could inform defensive posture. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Attribute Metadata_ A Proposed Schema for Evaluating Federated Attributes say about Table of Contents? (Part 6) According to Attribute Metadata_ A Proposed Schema for Evaluating Federated Attributes, Table of Contents: | 8 | | | | 3.2.1 Metadata Categories | ............................................................................8 | | 4 | Use Cases.............................................................................................................19 | Use Cases.............................................................................................................19 | | | | 4.1 Federated Access to Classified Document in an Information Sharing Environment.......................................................................................................... | 4.1 Federated Access to Classified Document in an Information Sharing Environment..........................................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Attribute Metadata_ A Proposed Schema for Evaluating Federated Attributes.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Fiscal Year 2021 Cybersecurity and Privacy Annual Report say about Foreword? (Part 2) According to Fiscal Year 2021 Cybersecurity and Privacy Annual Report, Foreword: ge risk (for example, we are launching an update process for the Cybersecurity Framework and reviewing a host of other NIST frameworks and guidance documents with an eye on improving their alignment). We have also made selections of finalists and alternate candidates to be considered for PQC standardization. Stay tuned for updates to our foundational digital identity guidelines and for information on some of our new projects related to cybersecurity workforce and privacy (and be on the lookout for a Workforce Framework). We also will unveil a new tool that will make it simpler and quicker for users of NIST cybersecurity and privacy products to navigate content across NIST resources. While Picasso was famous for a completely different form of art, cybersecurity and privacy is our 'art'-and our science-and we are ready for 50 more years of innovation, collaboration, and action.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Fiscal Year 2021 Cybersecurity and Privacy Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Recovering from Ransomware and Other Destructive Events say about Notes:? According to Data Integrity_ Recovering from Ransomware and Other Destructive Events, Notes:: - a. It is recommended that you install Tripwire Log Center on a separate system from Tripwire Enterprise. - b. You will need to install JRE8 and the Crypto library. Instructions are also in the Tripwire Log Center Installation Guide. - c. You may need to unblock port 9898 on your firewall for the Tripwire enterprise agents. - d. Do not install PostgreSQL if you wish to use a database on another system. - e. When it finishes installing there should be a configuration wizard.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain ASSESSMENT OBJECTIVE according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, ASSESSMENT OBJECTIVE: Determine if: A.03.14.02.ODP[01]: the frequency at which malicious code protection mechanisms perform scans is defined . A.03.14.02.a[01]: malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code. A.03.14.02.a[02]: malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code. A.03.14.02.b: malicious code protection mechanisms are updated as new releases are available in accordance with configuration management policy and procedures. A.03.14.02.c.01[01]: malicious code protection mechanisms are configured to perform scans of the system <A.03.14.02.ODP[01]: frequency> . A.03.14.02.c.01[02]: malicious code protection mechanisms are configured to perform real-time scans of files from external sources at endpoints or system entry and exit points as the files are downloaded, opened, or executed. malicious code protection mechanisms are configured to block malicious code, quarantine malicious code, or take other actions in response to A.03.14.02.c.02: malicious code detection.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines say about References? (Part 3) According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines, References: 1d872639 - [19] GitLab Docs (2023) Dependency Scanning . Available at - [20] GitLab Docs (2023) Secret Detection . Available at - [21] GitLab Docs (2023) Push Rules . Available at

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Trustworthy Email provide? (Section 148) y trust only a specific certificate or public key. Essentially, DANE replaces reliance on the security provided by the CA system with reliance on the security provided by DNSSEC. DANE complements TLS. �e TLS handshake yields a n encrypted connection between a server and a client and provides a server's X.509 certificate to the client. 22 �e TLS protocol does not define how the certificate should be authenticated . Some implementations may do this as part of the TLS handshake, and some may leave it to the application to perform authentication. Whichever way is used , there is still a vulnerability: a CA can issue certificates for any domain, and if that a CA is compromised (as has happened more than once all too recently), an attacker can have it can issue a replacement certificate for any domain and take control of a server's connections. Ideally, issuance and delivery of a certificate should be tied absolutely to the given domain. DANE creates this explicit link by allowing the server domain owner to create a TLSA resource record in the DNS [RFC6698] [RFC7671] , which identifies the certificate, its public key, or a hash of either . When the client receives an X.509 cer tificate in the TLS negotiation, it looks up the TLSA RR for that domain and matches the TLSA data against the certificate as part of the client' s certificate validation procedure . DANE has a number of usage models (called Certificate Usage s) to accommodate users who require different forms of authentication. �ese Certificate Usages are given mnemonic names [RFC7218]: - With Certificate Usage DANE-TA(2), the TLSA RR designates a trust-anchor that issued one of the certificates in the PKIX chain . [RFC7671] requires that DANE-TA(2) trust anchors be included in the server "certificate message" unless the entire certificate is specified in the TLSA record ( i.e., usage 2 0 0, indicating the TLSA RR contains a local root certificate ).

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Graphics Files Format according to Cell Phone Forensic Tools_ an Overview and Analysis Update? Graphics Files Format: N.A. - The Motorola C333 does not support graphic files (e.g., . bmp , . jpg , . gif , . png , . tif ). (NA)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Inter-Chapter Dependencies according to NIST Proceedings of the Workshop of the Federal Criteria for Information Technology Security According to Proceedings of the Workshop of the Federal Criteria for Information Technology Security, Inter-Chapter Dependencies: The discussion included global perspectives on the expression of requirements. Since we don't want to be too general or too prescriptive, the requirement for expressing what to build and what counts for success remains an issue. From the discussion, we still seem to have bi-polar views endorsing on the one hand, increased generalization to allow vendor flexibility, and on the othCT hand, increased detailed specifications to constrain evaluator interpretations. Since the criteria written to date, including the PC. provide mostly generalized expression of requirements, the criteria themselves mandate both vendor and evaluator interpretation. This is a natural process, but it has led to adversarial relationships and some ''leligious' conflicts between vendors and evaluators. It was noted that dependency linkages between and among functional, developmental, and evaluation requirements should be explicitly noted at ^propriate points in conjunction with a requirement statement One thing that did seem important to the discussicxi was the need to express the functional and development requirements in measurable (qualitative and/or quantitative) terms and directly link both vendor and evaluator actions to these requirements. This action linkage is important whenever the requirements are qualitative, and subjective judgement must be applied. Additionally, the issue of proprietary information contained in evaluator criteria interpretations was discussed. Since many, if not most, of these evaluator interpretations involve assessments of one or more vendor's solutions (expressed in proprietary terms) against a particular TCSEC requirement, these interpretations are not available to the vendors at large. Since the evaluators' interpretations provide a measure (in some cases an extremely significant measure) of what counts for success, a means to publicly express this measure, without compromising propHietary information, must be devised.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Proceedings of the Workshop of the Federal Criteria for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Confidentiality_ Detect, Respond to, and Recover from Data Breaches say about 2.4.3 Add Stealthwatch Flow Collector to the Management Console? According to Data Confidentiality_ Detect, Respond to, and Recover from Data Breaches, 2.4.3 Add Stealthwatch Flow Collector to the Management Console: 1. Navigate to the Stealthwatch Flow Collector Console from a web browser. The URL will be address of Stealthwatch FC >>. 2. Login using the default username and password (should be provided by product vendor). 3. Click Continue . <!-- image --> <!-- image --> 4. Change the passwords for the admin and root accounts. 5. Click Next . 6. Confirm the networking information is correct and click Next . 7. Confirm the domain name for Flow Collector is correct. <!-- image --> <!-- image --> 8. Click Next . 9. Add the DNS server(s) Stealthwatch should be using. 10. Click Next . 11. Enter the NTP server(s) Stealthwatch should use. <!-- image --> <!-- image --> 12. Click Next . 13. Click Restart and Proceed . <!-- image --> <!-- image --> 14. After it restarts, log in again, and click Continue . 15. Enter the IP of the Stealthwatch Management Console. 16. Click Save . <!-- image --> <!-- image --> 17. Accept the certificate by clicking Yes . 18. Enter the username and password for the Stealthwatch Management Console. 19. Click Next . 20. Enter the Domain and Flow Collection Port . <!-- image --> <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Confidentiality_ Detect, Respond to, and Recover from Data Breaches.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Situational Awareness for Electric Utilities? (Part 174) Control AM-1: Radiflow iSID Web Dashboard <!-- image --> Allow learning to take place for 5 to 7 days. - Toggle the Detection switch on the left bar under Main Network. - Setup and configuration are now complete. ## 2.12 RSA Archer Security Operations Management (E13) Governance, risk, and compliance (GRC) platforms allow an organization to link strategy and risk, adjusting strategy when risk changes, while remaining in compliance with laws, regulations, and security policies. RSA Archer Security Operations Management, based in part on the RSA Archer GRC platform, was used to perform the task of the Analysis Workflow Engine and Security Incident Response and Management. For more information, visit … - - - ## 2.12.1 System Requirements This build installed a multihost RSA Archer GRC platform node on a VMware VM with the Microsoft Windows Server 2012R2 operating system to provide the Security Incident Response Management environment needed. Note: All components, features, and configurations presented in this guide reflect what we used based on vendors' best practices and requirements. Please refer to vendors' official documentation for complete instructions for other options. ## 2.12.2 Preinstallation We chose the multihost deployment option for installing and configuring the GRC platform on multiple VMs under the Microsoft Windows Server 2012R2 Operating System. The web application and services are running on one server, instance database/Microsoft SQL Server is running on one server, and integration components for Security Incident Response are running on a third server.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Situational Awareness for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 116) h [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions. Discussion: Information flow enforcement mechanisms compare security and privacy attributes associated with information (i.e., data content and structure) and source and destination objects and respond appropriately when the enforcement mechanisms encounter information flows not explicitly allowed by information flow policies. For example, an information object labeled Secret would be allowed to flow to a destination object labeled Secret, but an information object labeled Top Secret would not be allowed to flow to a destination object labeled Secret. A dataset of personally identifiable information may be tagged with restrictions against combining with other types of datasets and, thus, would not be allowed to flow to the restricted dataset. Security and privacy attributes can also include source and destination addresses employed in traffic filter firewalls. Flow enforcement using explicit security or privacy attributes can be used, for example, to control the release of certain types of information. Related Controls: None. (2) INFORMATION FLOW ENFORCEMENT | PROCESSING DOMAINS Use protected processing domains to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions. Discussion: Protected processing domains within systems are processing spaces that have controlled interactions with other processing spaces, enabling control of information flows between these spaces and to/from information objects. A protected processing domain can be provided, for example, by implementing domain and type enforcement.

Explanation: NIST publication discussing classified information handling. References: secret, top secret. Contains guidance on protecting sensitive government information. Source: NIST_SP_800-53r5_Security_Privacy_Controls.