You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2014 Annual Report say about Automated Security Testing and Test Suite Development? (Part 4) According to Computer Security Division 2014 Annual Report, Automated Security Testing and Test Suite Development: The CAVP currently has algorithm validation testing for the following cryptographic algorithms: | CRYPTOGRAPHIC ALGORITHM/COMPONENT | SPECIAL PUBLICATION OR FIPS | |----------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Triple Data Encryption Standard (TDES) | SP 800-67, Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher, and SP 800-38A, Recommendation for Block Cipher Modes of Operation-Methods and Techniques | | Advanced Encryption Standard (AES) | FIPS 197, Advanced Encryption Standard, and SP 800-38A, Recommendation for Block Cipher Modes of Operation-Methods and Techniques | | Digital Signature Standard (DSS) | FIPS 186-2, Digital Signature Standard (DSS), with change notice 1 | | Digital Signature Standard (DSS) | FIPS 186-4, Digital Signature Standard (DSS) | | Elliptic Curve Digital Signature Algorithm (ECDSA) | FIPS 186-2, Digital Signature Standard (DSS), with change notice 1 and ANS X9.62 | | Elliptic Curve Digital Signature Algorithm (ECDSA) | FIPS 186-4, Digital Signature Standard (DSS), and ANS X9.62 | | RSA algorithm | ANSI X9.31 and Public Key Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography Standard-2002 | | RSA algorithm | FIPS 186-4, Digital Signature Standard (DSS), and ANSI X9.31 and Public Key Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography Standard-2002 | | Hashing algorithms SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224,

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TG-15 in Audit and Evaluation of Computer Security? (Part 26) Control TG-15: above three. The objectives of a security audit can be achieved by looking for information detailed in a log on any of the above components. would show five basic types of information: This log 1. WHO— identifies initiator of an action, 2. FUNCTION— describes the processing activity, 3. WHAT— identifies objects of processing activity, 4. STATUS— refers to FUNCTION and associated initiator and affected objects 5. TIME— gives it a date-time stamp. An example is given of the security information requirements for an EFTS system. xxvii Post-processing techniques are then described under the basic four For Access and input one would use logs of components of an audit. successes, logs of failures, and a log continuity check. For Process there are manual checking, control totals, test data, integrated test facility, tagging, extended record maintenance, tracing, mapping, recom- pilation, parallel simulation, and retrieval programs. For Output there are output listings of dispositions and authorization listings. The conclusions and recommendations of the group were: 1. Existing software tools offer much but could be made easier to use by a) publishing a catalog of these tools for the auditor. b) creating facilities to easily combine the use of two of these tools. 2. Needed techniques are a) a method for maintaining the security of the security log. (Some possibilities are using present operating systems, or using a special tamper proof recording device to record all activity, or a complete hardware monitor similar to a cockpit flight recorder). b) higher level software to access and manipulate logs. SESSION ON INTERACTIVE AUDIT TOOLS AND TECHNIQUES This group responded to the question, "What are the interactive au- dit tools and techniques available or needed to permit on-line auditing of computer security?" This session explored a subject area which is in the very early stages of development.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Audit and Evaluation of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide for Security-Focused Configuration Management of Information Systems? (Part 32) Control ES-1: omputing environments such as development, test, and production. When a new baseline configuration is established, the implication is that all of the changes from the last baseline have been approved. Older versions of approved baseline configurations are maintained and made available for review or rollback as needed. Developing and documenting the baseline configuration for a system is part of the Identifying and Implementing Configurations phase of SecCM and supports the implementation of NIST [SP 800-53] control CM-2 Baseline Configuration. ## 2.3.8 CONFIGURATION CHANGE CONTROL Configuration change control is the documented process for managing and controlling changes to the configuration of a system or its constituent CIs. Configuration change control for the system involves the systematic proposal, justification, implementation, test/evaluation, review, and disposition of changes to the system, including upgrades and modifications. Configuration change control is applied to include changes to components of the system, changes to the configuration settings for information technology products, emergency/unscheduled changes, and changes to remediate flaws. Changes are controlled from the time the change is proposed to the implementation and testing of the change. Each step in the change process is clearly articulated along with the responsibilities and authorities of the roles involved. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Configuration change control falls under the Controlling Configuration Changes phase of SecCM and supports the implementation of NIST [SP 800-53] control CM-3 Configuration Change Control and CM-5 Access Restrictions for Change .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TX-100 in Security for Dial-Up Lines? (Part 6) Control TX-100: ton Quaa. #1C07 Melville, NY 11747 (516) 752-7790 | | SITE AUTHEN- TICATION DEVICE | icable Manufacturin 4800 Dundas St. Wes Toronto. ONT M9A1B1 (416) 236-1604 | | DataLock & DataKey | MicroFrame Inc, 205 Livingston New Brunswick, (201) 828-4499 Ave NJ 0 8901 | | DL 1000 WITH DK 1125 (PPD w/ tml. authen. dev.) DL 2400 WITH DK 2400 (PPD/modem & tml. authen.) | Optimum Electronics Inc p;o. Box 250 North Haven, CT 06473 (203) 239-6098 | Note: The National Bureau of Standards (NBS) endorses NO commercial products. All devices of the types specified known to the author at the time of publication have oeen included in these tables. No endorsement, approval or recommendation of them by NBS is implied by their inclusion. ## SECURITY FOR DIAL-DP LINES ## APPENDIX B ## REFERENCES AND ADDITIONAL READING - ATKIW85 Atkins, William, "Jesse James At the Terminal," Harvard Business Review, July/August 1985. - CALHG83 Calhoun, George, "Decoding the 'Secret' Password Is An Easy Key to Computer Fraud," Telephony . April 4, 1983. - CORNH85 Cornwall, Hugo, The Hacker's Handbook , London, Century Communications, Ltd., 1985. - DATAP83 "Security for Dial-Up Systems Access," Data Processing & Communications Security . September/October, 1983. - EDWAR82 Edwards, Robert W. , and Lynda E. Edwards, "Unauthorized Entry," I CP Interface Administrative and Accounting . Winter, 1982, pp. 22 -26. - FIPS31 FIPS PUB 31, Guidelines for Automatic Data Processing Physical Security and Risk Management. - FIPS39 FIPS PUB 39, Glossary for Computer Systems Security. - FIPS41 FIPS PUB 41, Computer Security Guidelines for Implementing the Privacy Act of 1974. - FIPS46 FIPS PUB 46, Data Encryption Standard. - FIPS4 8 FIPS PUB 4 8, Guidelines on Evaluation of Techniques for Automated Personal Identification.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security for Dial-Up Lines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CA-7 in A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)? (Part 10) Control CA-7: df. [SP 800-108] NIST Special Publication (SP) 800-108, Recommendation for Key Derivation Using Pseudorandom Functions , October 2009. [SP 800-115] NIST Special Publication (SP) 800-115, Technical Guide to Information Security Testing and Assessment , September 2008. [SP 800-126] NIST Special Publication (SP) 800-126 Rev. 2, The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2 , September 2011. [SP 800-130] NIST Special Publication (SP) 800-130, A Framework for Designing Cryptographic Key Management Systems , August 2013. [SP 800-131A] Draft NIST Special Publication (SP) 800-131A Revision 1, Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths , July 2015. [SP 800-133] NIST Special Publication (SP) 800-133, Recommendation for Cryptographic Key Generation , December 2012. [SP 800-137] NIST Special Publication (SP) 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations , September 2011. ## Appendix B: Glossary This glossary defines terms that are used in this Profile, some of which may also be defined in the Framework. | Access control system | A set of procedures and/or processes, normally automated, which allows access to a controlled area or to information to be controlled, in accordance with pre-established policies and rules.

Explanation: NIST publication on credential and access management. Topics: access control, key management. Contains security framework guidance for authentication systems. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Policy Machine_ Features, Architecture, and Specification say about 5.1.1 Electronic Mail? (Part 3) According to Policy Machine_ Features, Architecture, and Specification, 5.1.1 Electronic Mail: r can any mail objects, if they existed, be deleted. The administrative associations and prohibitions specified for the user complement those shown above and define the remaining actions for the user. Figure 11 illustrates the authorization graph containing the additional associations and prohibitions needed. Figure 11: Authorization Graph with Administrative Associations and Prohibitions <!-- image --> The rationale behind the associations and prohibitions that are illustrated in Figure 11 is as follows: -  The association between ID u2 and Inboxes allows user u2 to create messages in any user's inbox, including its own. Since the inbox of every mail system user gets assigned to Inboxes when the user is established, and the properties over Inboxes are inherited, the association essentially grants a system-wide authority. -  The prohibition between u2 and In u2 serves as a counter to the system-wide authority granted to every user through the previous association. Prohibitions are illustrated similarly to associations, but with a different style and orientation of connector. This prohibition denies the user from creating messages within its own inbox, slightly overriding the system-wide authority to create messages in any inbox. -  The association between ID u2 and In u2 allows the user to delete messages from its own inbox. -  To create and delete messages within the containers Out ui, Draft ui, and Trash ui, an association granting such authorization is needed between ID u2 and each of those containers. A few improvements can be made to the current policy specification. For example, a user can update a copy of a sent message residing in its outbox, which can bring about an unwanted inconsistency from what was actually sent.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Policy Machine_ Features, Architecture, and Specification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Three functions are defined over WFNs according to Common Platform Enumeration_ Naming Specification Version 2.3? Three functions are defined over WFNs: new , get, and set . These functions are used in defining binding and unbinding procedures in Section 6.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Platform Enumeration_ Naming Specification Version 2.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2014 Annual Report say about C CONTACT:? According to Computer Security Division 2014 Annual Report, C CONTACT:: Mr. Stephen Quinn (301) 975-6967 stephen.quinn@nist.gov


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines on Electronic Mail Security provide? (Section 93) information, monitor users' actions (e.g., keystrokes), and perform other malicious actions. Determining whether to allow certain types of attachments can be a difficult decision for an organization. Not allowing any attachments would simplify a system and make it more secure; however, it would dramatically reduce its usefulness, and users might employ encoding tricks to work around the restriction to 'get the job done'. Ultimately, organizations choose to allow at least some email attachments. Organizations should determine which types of attachments to allow. The simplest approach is to allow all types of attachments. If this is the case, then some sort of malware scanner (e.g., anti-virus software, anti-spyware software) should be installed in the mail transit path to filter out known malware, and perhaps even some behavior blocking utility installed at the client to prevent any unwanted operations by executable attachments from occurring. A better approach is to filter potentially dangerous attachment types (e.g., .vbs, .ws, .wsc file extensions) at the mail server or mail gateway, while conducting malware scans on allowed file types. Although filtering on such extensions is a good first step, its effectiveness is limited because attackers can alter the extensions. Instead of simply checking the extension, filtering should check the file header, footer, or other identifying aspects of the file if possible to identify the attachment. Organizations might also wish to consider setting different rules for internally originated versus externally originated email or trusted versus untrusted organizations (e.g., trust .gov/.mil domains), although this latter option is subject to email address spoofing. Attachment filtering is not completely effective unless all attachments are blocked, and that is not feasible. Some of the most useful attachment types, such as those from office productivity suites, are also some of the riskiest.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-6 in NIST_SP_800-37r2_Risk_Management_Framework? (Part 253) Control AM-6: the system owner is responsible for the development and maintenance of the security and privacy plans and ensures that the system is operated in accordance with the selected and implemented controls. In coordination with the information owner/steward, the system owner decides who has access to the system (and with what types of privileges or access rights). 122 The system owner ensures that system users and support personnel receive the requisite security and privacy training. Based on guidance from the authorizing official, the system owner informs organizational officials of the need to conduct the authorization, ensures that resources are available for the effort, and provides the required system access, information, and documentation to control assessors. The system owner receives the security and privacy assessment results from the control assessors. After taking appropriate steps to reduce or eliminate vulnerabilities or security and privacy risks, the system owner assembles the authorization package and submits the package to the authorizing official or the authorizing official designated representative for adjudication. 123 121 Organizations may refer to system owners as program managers or business/asset owners. 122 The responsibility for deciding who has access to specific information within an organizational system (and with what types of privileges or access rights) may reside with the information owner/steward. 123 The authorizing official may choose to designate an individual other than the system owner to compile and assemble the information for the authorization package. In this situation, the designated individual coordinates the compilation and assembly activities with the system owner.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.5 Disposal Phase according to NIST Information Security Handbook_ A Guide for Managers According to Information Security Handbook_ A Guide for Managers, 3.5 Disposal Phase: The disposal phase of the system life cycle refers to the process of preserving (if applicable) and discarding system information, hardware, and software. This step is extremely important because during this phase, information, hardware, and software are moved to another system, archived, discarded, or destroyed. If performed improperly, the disposal phase can result in the unauthorized disclosure of sensitive data. When archiving information, organizations should consider the need and methods for future retrieval. While electronic information is relatively easy to store and retrieve, problems can arise if the technology used to create the records is no longer available in the future as a result of obsolescence or incompatibility with new technologies. Additionally, the organization should consider what measures must be taken for the future use of data that has been encrypted, such as taking appropriate steps to ensure the secure long-term storage of cryptographic keys. It is equally important to consider legal requirements for records retention when disposing of information systems. For federal systems, system management officials should consult with their office responsible for retaining and archiving federal records. The removal of information from a storage medium, such as a hard disk or tape, is called sanitization. There are four categories of media sanitization: disposal, 20 See Chapter 14, Configuration Management, of this guide for additional guidance on configuration management. clearing, purging, and destroying. 21 Because different kinds of sanitization provide different levels of information protection, organizations should use information security requirements as a guide for selecting the sanitization method that best suits their needs.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Data Network Systems (SDNS) Access Control Documents provide? (Section 35) and (when used) an Auxiliary Vector. (SDNS) ASSOCIATION -A communications interaction between peer entities, which may occur over either connection-oriented or connectionless communication services. (SDNS) AUDIT -An independent review and examination of system records and activities in order to test for adequacy of system controls, to ensure compliance with established policy and operational procedures, and to recommend any indicated changes in control, policy and procedures.(ISO 7498/2) AUTHENTICATION - The process of positively validating a claimed identity. Each authentication process has a corresponding degree of certainty as to the accuracy of the identity established. Both the authenticated identity and the degree of certainty are used by an access control process to select the correct subset of rights and privileges associated with that entity. (SDNS) AUTHORIZATION - The granting of rights or the subsequent possession of rights. (ISO 7498/2) AUXILIARY VECTOR (AV) - A holder for additional ID information which does not normally fit within the identity certificate or is optionally excluded from the identity certificate. The Auxiliary Vector is bound to the identity certificate. (SDNS) COMPOSITE ID -The assemblage of information contained in the identity certificate and the auxiliary vector. (SDNS) DATA ORIGIN AUTHENTICATION - The corroboration that the source of the data received is as claimed. (ISO 7498/2) END SYSTEM - Any computer-based system connected to the network and containing the necessary protocol interpreter software to initiate network access and carry out information exchange across the communications network. (Trusted Network Interpretation) ENFORCEMENT VECTOR (EV) -The resulting information from a successfully completed PAA process which denotes the evaluation of the two communicating entities' security policies. This vector is an intercomponent binding of security attributes of the requested communications association.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Secure Data Network Systems (SDNS) Access Control Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) provide? (Section 49) h the database or other sources to identify specific individuals. Quantity of PII: A recent estimate indicated that the database has approximately 50 records with PII out of nearly 1000 total records. Data field sensitivity: The database's narrative text field contains user-supplied text and frequently includes information such as name, mailing address, email address, and phone numbers. Context of use: Because of the nature of the submissions (i.e., reporting claims of fraud, waste, or abuse), the disclosure of individuals' identities would likely cause some of the individuals making the claims to fear retribution by management and peers. Additionally, it could negatively impact individuals about whom accusations are made. The ensuing harm could include blackmail, severe emotional distress, loss of employment, and physical harm. A breach would also undermine employee and public trust in the organization. Access to and location of PII: The database is only accessed by a few people who investigate fraud, waste, and abuse claims. All access to the database occurs only from the organization's internal systems. Taking into account these factors, the organization determines that a breach of the database's confidentiality would likely cause catastrophic harm to some of the individuals and chooses to assign the PII confidentiality impact level of high . PII should be protected through a combination of measures, including operational safeguards, privacyspecific safeguards, and security controls. Many of these measures also correspond to several of the Fair Information Practices. Organizations should use a risk-based approach for protecting the confidentiality of PII. The PII safeguards provided in this section are complementary to other safeguards for data and may be used as one part of an organization's comprehensive approach to protecting the confidentiality of PII and implementing the Fair Information Practices.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems say about 3.2.1 Base Equation? According to The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems, 3.2.1 Base Equation: The base equation is the foundation of CVSS scoring. The base equation is: ``` BaseScore = round_to_1_decimal(((0.6*Impact)+(0.4*Exploitability)-1.5)*f(Impact)) Impact = 10.41*(1-(1-ConfImpact)*(1-IntegImpact)*(1-AvailImpact)) Exploitability = 20* AccessVector*AccessComplexity*Authentication f(impact)= 0 if Impact=0, 1.176 otherwise AccessVector = case AccessVector of requires local access: 0.395 adjacent network accessible: 0.646 network accessible: 1.0 AccessComplexity = case AccessComplexity of high: 0.35 medium: 0.61 low: 0.71 Authentication = case Authentication of requires multiple instances of authentication: 0.45 requires single instance of authentication: 0.56 requires no authentication: 0.704 ConfImpact = case ConfidentialityImpact of ``` ``` none: partial: complete: 0.0 0.275 0.660 IntegImpact = case IntegrityImpact of none: 0.0 partial: 0.275 complete: 0.660 AvailImpact = case AvailabilityImpact of none: 0.0 partial: 0.275 complete: 0.660 ```

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation provide? (Section 228) rified. | |---------------------------------|----------------------------------------------------------------------------| | Actual Results | Test completed and functions as expected. | | Additional Comments (If Needed) | None | Test case SIDR-ROV-2.3.2 is identical to test case SIDR-ROV-2.3.1, except that IPv6 addresses are used instead of IPv4 addresses. The following configuration for Router AS65505 was updated prior to running the test: <!-- image --> <!-- image --> | Test Objective | Test SIDR Requirement CR-3.1.1. Show that the ROV-capable router correctly evaluates received routes in the following situation: A route is redistributed into BGP from an IGP. This route is initially evaluated as valid . The single ROA that had made the route valid is removed from the RPKI; there is no ROA that covers the route, so the route is re-evaluated as not found . ( valid  not found ) (This test case is analogous to test case SIDR-ROV-1.1.1, but this test case evaluates a route that has been redistributed into BGP from an IGP, rather than a route that was received as a BGP update.) | |------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Preconditions | The testbed is configured with the topology, IP addressing scheme, and ASNs as depicted in the Testbed Architecture in Figure E-1 and Figure E-2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.1 Fire Service according to NIST Usability and Security Considerations for Public Safety Mobile Authentication According to Usability and Security Considerations for Public Safety Mobile Authentication, 3.1 Fire Service: Many fire situations require the coordination of all levels of government: federal, state, local, and tribal levels. For example, at the federal level, the United States Department of Agriculture (USDA) works with the Federal Emergency Management Agency (FEMA) to suppress fire situations, which often involves responding to forest and wildfires. Fire stations exist throughout the country, often run at the county or local level with volunteer firefighters sometimes composing the majority of a county level fire service. This is especially true in rural areas. The general responsibilities of the Fire Service include: - The prevention and suppression of fires, - The application of emergency medical treatment as needed, and - Assisting with search, rescue, and evacuation of fires. Firefighters often carry additional equipment beyond the minimum PPE required by National Fire Protection Association (NFPA) standards [5]. A PPE ensemble usually consists of a coat, pants, boots, helmet, gloves, hood, self-contained breathing apparatus (SCBA), flashlight, and LMR and carrying a bail-out rope system. Additionally, firefighters are often dragging a hose or carrying a thermal imager, hand tools such as an axe and/or Halligan tool, a 6-foot-long (1.8 m) pike pole, and/or a power saw, in addition to other items in their pockets. The total weight can be anywhere from approximately 34 kg to 45 kg (75 lbs. to 100 lbs.) or more of equipment [6]. Figure 1 shows an example of firefighter gear. Firefighters receive specialized training and must operate in extreme environments that require quick decisions under high stress. Most members of the Fire Service are cross-trained for medical first aid, since firefighters may respond to medical emergencies [7]. Figure 1 -Example Firefighter Gear <!-- image -->

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Usability and Security Considerations for Public Safety Mobile Authentication.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about D.12 Education? According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, D.12 Education: Education refers to those activities that impart knowledge or understanding of a particular subject to the public. Education can take place at a formal school, college, university or other training program. This mission area includes all government programs that promote the education of the public, including both earned and unearned benefit programs.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations say about A process to:? (Part 13) According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, A process to:: onitored by entities other than those responsible for the system or application; entities either internal or external to t he organization where the system or application resides. See Common Control . | | Security Controls [FIPS 199] | The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. | | Security Domain [CNSSI 4009] | A domain that implements a security policy and is administered by a single authority. | | Security Impact Analysis [NIST SP 800-53] | The analysis conducted by an organizational official to determine the extent to which changes to the information system have affected the security state of the system. | | Security Incident | See Incident. | | Security Management Dashboard [NIST SP 800-128] | A tool that consolidates and communicates information relevant to the organizational security posture in nearreal-time to security management stakeholders. | |----------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Security Objective [FIPS 199] | Confidentiality, integrity, or availability.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Technical Guide to Information Security Testing and Assessment say about 1.5. Document Structure? According to Technical Guide to Information Security Testing and Assessment, 1.5. Document Structure: Outlines the ROE's structure, and describes the content of each section.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technical Guide to Information Security Testing and Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to SSL VPNs? (Part 6) Control ES-1: | | | | | | SSL VPN Planning and Implementation.........................................................................4-1 | SSL VPN Planning and Implementation.........................................................................4-1 | | | | 4.1 Identify Requirements..............................................................................................4-1 4.2 SSL VPNs and FIPS 140-2 Approval.......................................................................4-2 | 4.1 Identify Requirements..............................................................................................4-1 4.2 SSL VPNs and FIPS 140-2 Approval.......................................................................4-2 | | | | 4.2.1 | Versions of SSL............................................................................................4-3 | | | | 4.2.2 | Key Establishment Used by SSL..................................................................4-3 | | | | 4.2.3 | Hash Functions Used by | SSL.......................................................................4-4 | | | 4.2.4 | SSL Encryption.............................................................................................4-4 | | | | 4.2.5 | Certificates Used During SSL Negotiations..................................................4-4 | | | 4.3 | Design the Solution..................................................................................................4-5 | Design the Solution..................................................................................................4-5 | | | | 4.3.1 | Design the Access Control Policy.................................................................4-6 | | | | 4.3.2 | Design the Endpoint Security Policy.............................................................4-9 | | | | 4.3.3 | Select the Authentication Methods.............................................................4-11 | | | | 4.3.4 | Design the Architecture | ..............................................................................4-12 | | | | 4.3.5 Cryptography Policy and FIPS Compliance | ...............................................4-23 | |----------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| | | 4.3.6 | Other Design Decisions..............................................................................4-23 | | | | | 4.3.7 Summary of Design Decisions | ...................................................................4-24 | | | 4.4 | Implement and Test Prototype...............................................................................4-25 | | | | | 4.4.1 Application and Client Interoperability |

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Guide to SSL VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 10.1. Statement Requirements according to NIST Secure Data Network Systems (SDNS) Key Management Documents According to Secure Data Network Systems (SDNS) Key Management Documents, 10.1. Statement Requirements: An implementor shall state the following: - a) the application for which conformance is claimed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Section 169) control assessors. The assessor findings are a factual reporting of whether the controls are operating as intended and whether any deficiencies 90 in the controls are discovered during the assessment. Control assessments occur as early as practicable in the SDLC, preferably during the development phase. These types of assessments are referred to as developmental testing and evaluation, and validate that the controls are implemented correctly and are consistent with the established information security and privacy architectures. Developmental testing and evaluation activities include, for example, design and code reviews, regression testing, and application scanning. Deficiencies identified early in the SDLC can be resolved in a more cost-effective manner. Assessments may be needed prior to source selection during the procurement process to assess potential suppliers or providers before the organization enters into agreements or contracts to begin the development phase. The results of control assessments conducted during the SDLC can also be used (consistent with reuse criteria established by the organization) during the authorization process to avoid unnecessary delays or costly repetition of assessments. Organizations can maximize the use of automation to conduct control assessments to increase the speed, effectiveness, and efficiency of the assessments, and to support continuous monitoring of the security and privacy posture of organizational systems. Applying and assessing controls throughout the development process may be appropriate for iterative development processes. When iterative development processes (e.g., agile development) are employed, an iterative assessment may be conducted as each cycle is completed. A similar process is employed for assessing controls in commercial IT products that are used in the system. Organizations may choose to begin assessing controls prior to the complete implementation of all controls in the security and privacy plans.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Security-Focused Configuration Management of Information Systems say about Acknowledgments? According to Guide for Security-Focused Configuration Management of Information Systems, Acknowledgments: The authors, Arnold Johnson, Kelley Dempsey, and Ron Ross of NIST, and Sarbari Gupta and Dennis Bailey of Electrosoft, wish to thank their colleagues Murugiah Souppaya, Karen Scarfone, John Banghart, David Waltermire, and Blair Heiserman of NIST who reviewed drafts of the document and provided insightful recommendations. Nedim Goren and Jody Jacobs completed the errata update. A special note of thanks goes to Peggy Himes and Elizabeth Lennon for their superb technical editing and administrative support. We would also like to thank all those who responded to our call for public comments for lending their time and effort to make this a better document. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Specification for the Open Checklist Interactive Language (OCIL) Version 2.0 provide? (Section 12) irements that producers of OCIL-supporting software and OCIL documents (questionnaires) must meet to claim conformance with the OCIL 2.0 specification. This report only applies to version 2.0 of OCIL. All other versions are out of the scope of this report. The remainder of this document is organized into the following major sections and appendices: - Section 2 defines terms used within this specification and provides a list of common acronyms and other abbreviations. - Section 3 defines the conformance rules for this specification. - Section 4 provides an overview of related specifications and standards. - Section 5 presents the primary components of the OCIL data model. - Section 6 provides requirements and recommendations for OCIL content syntax, structures, and development. - Section 7 describes OCIL document processing requirements. - Appendix A discusses possible use cases for OCIL. - Appendix B defines requirements for using OCIL as a check system for the eXtensible Configuration Checklist Description Format (XCCDF). The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in Request for Comment (RFC) 2119. 1 Text intended to represent computing system input, output, or algorithmic processing is presented in fixed-width Courier font . OCIL currently does not address: - A specific method for identifying the subject or role to present an OCIL-based assessment to. This might be addressed by another specification in the future. - Specific guidelines on how to report on the evaluation of OCIL questionnaires relating to a population of IT assets - A reference architecture for integrating OCIL with other XCCDF check systems to perform a more complete assessment of a checklist - Specific guidelines on using questionnaires to collect answers strictly for informational purposes, instead of for compliance purposes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Specification for the Open Checklist Interactive Language (OCIL) Version 2.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to SSL VPNs provide? (Section 28) packets and the IP information for each packet. However, network layer controls provide less control and flexibility for protecting specific applications than transport and application layer controls. SSL tunnel VPNs provide the ability to secure both TCP and UDP communications including client/server and other network traffic, and therefore act as network layer VPNs. -  Data Link Layer. Data link layer controls are applied to all communications on a specific physical link, such as a dedicated circuit between two buildings or a dial-up modem connection to an Internet Service Provider (ISP). Data link layer controls for dedicated circuits are most often provided by specialized hardware devices known as data link encryptors ; data link layer controls for other types of connections, such as dial-up modem communications, are usually provided through software. Because the data link layer is below the network layer, controls at this layer can protect both data and IP information. Compared to controls at the other layers, data link layer controls are relatively simple, which makes them easier to implement; also, they support other network layer protocols besides IP. Because data link layer controls are specific to a particular physical link, they cannot 2 Several Request for Comment (RFC) documents from the Internet Engineering Task Force (IETF) define S/MIME, as well as standards for using it to protect email messages. One example is RFC 3852, Cryptographic Message Syntax (CMS) , available at 3 TLS is the standards-based version of SSL version 3. More information on TLS is available in RFC 4346, The TLS Protocol Version 1.1 , available at Another good source of information is NIST SP 800-52, Guidelines on the Selection and Use of Transport Layer Security , available from http://csrc.nist.gov/publications/nistpubs/.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Guide to SSL VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Extended Key Usage : according to NIST NIST Test Personal Identity Verification (PIV) Cards Version 2 According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Extended Key Usage :: TLS Web Client Authentication, Microsoft Smartcard Login, PKINIT Client Auth

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RA-1 in Securing Wireless Infusion Pumps in Healthcare Delivery Organizations? (Part 90) Control RA-1: 1800-8C: Securing Wireless Infusion Pumps 46 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P 1 8 0 0 - 8 . . 3. In the Java console, click Policies. 4. Under the Policies tab, click Prevention or Detection. 5. On the Policies page, in the Workspace Folders, select the Workspace folder, and then right- click Add Folder. Look for a new policy folder with the name New Folder. Rename this folder as Pump Server. 6. Copy an existing policy to the Pump Server folder. 7. From the default Symantec folder, find a proper policy example, and copy it to the Pump Server folder. 8. In the Workspace pane, select a policy (e.g., “windows-baseline-detection” policy in Symantec folder for Detection), and then right-click Move To. In the MoveFolder dialog box, select Pump Server to receive the policy, and then click MoveTo. 9. To edit a policy, right-click a policy, and then click Edit Policy. Configure the setting based on your security protection needs. DCS:SA provides a variety of configurable protection from application data protection, to application protection, to network protection. For example, the Windows prevention policies have a Protected Whitelisting strategy that lets you specify an application to which you always want to allow access or give permission to run. When you whitelist a process or an application, all of the other processes and applications that are not included in the list are denied access. To allow a program to run by using the Protected Whitelisting strategy, follow these steps: 1. 2. 3. 4. 5. In the management console, click the Policies tab, and then click Prevention. In the Policies workspace, click Add. In the Select a Prevention Policy Builder wizard, in the New Policy Builder section, click Launch.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does United States Federal Employees' Password Management Behaviors – A Department of Commerce Case Study provide? (Section 43) | | Getting locked out of an account | | | | | | Mistyping a password | | | | | | Getting error messages when trying to change a password | | | | | | Getting error messages when trying to recover a password | | | | | | Dealing with slow or unhelpful system support | | | | | | Valid password rejected for unclear reason | | | | | | Single task requiring different logins to multiple applications, i.e., task flow interrupted by multiple logins | | | | | 17.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: United States Federal Employees' Password Management Behaviors – A Department of Commerce Case Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations provide? (Section 33) em when required. Information System Owner (ISO)/Information Owner/Steward . The ISO establishes processes and procedures in support of system -level implementation of the organization's ISCM program. This includes developing and documenting an ISCM strategy for the information system; participating in the organization's configuration management process; establishing and maintaining an inventory of components associated with the information system; conducting security impact analyses on changes to the information system; conducting, or ensuring conduct of, assessment of security controls according to the ISCM strategy; preparing and submitting security status reports in accordance with organizational policy and procedures; conducting remediation activities as necessary to maintain system authorization; revising the system-level security control monitoring process as required; reviewing ISCM reports from common control providers to verify that the common controls continue to provide adequate protection for the information system; and updating critical security documents based on the results of ISCM. Common Control Provider. 23 The common control provider establishes processes and procedures in support of ongoing monitoring of common controls.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012 provide? (Section 12) to be reviewed to determine adequacy of the protection mechanisms while balancing the needs of patient safety in emergency situations and the utility of the IMD within a patient's environment. This is a non-trivial exercise since the security and privacy requirements for IMDs frequently conflict with the requirements stemming from emergency access to patient data and device utility in hospital and home settings. Creative approaches may be devised to decouple data essential for patient safety in emergency conditions from patient personally identifiable information/data to allow different authentication and access control mechanisms to apply to each group of data. Alternately, identifying different modes of operation (such as home health setting versus open environment versus emergency situation) to allow the IMD to apply different authentication and access control mechanisms in different modes. Cryptographic techniques are potentially very useful to improve the security and privacy properties of IMDs through stronger authentication protocols and (confidentiality and integrity) protected communications over wireless channels. However, since IMDs operate in very constrained environments (such as device size, cost, and power availability,) traditional cryptographic techniques and protocols may be inappropriate. More compatible cryptographic suites and protocols need to be devised for use on IMDs and applied in a very selective manner to optimize the security protection from these power intensive operations. The body of research conducted for cryptography for sensor networks are directly applicable [8] to applying cryptographic techniques to IMDs. Audit logs are essential for tracking patient history and IMD behavior over a period of time. The audit records provide information needed for adequate patient care as well as updates to patient therapy delivered through the IMD.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: [SP 800-56A], [SP 800-56B], and [SP 800-56C] provide guidance on cryptographic

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2012 Annual Report provide? (Section 220) at, or both encoding formats. The testing methodology makes use of specific test assertion syntax to clearly GLYPH(cmap:df00)efine the assertions associateGLYPH(cmap:df00) with each requirement. Mr. Fernando Podio fernanGLYPH(cmap:df00)o@nist.gov Mr. Dylan Yaga GLYPH(cmap:df00)ylan.yaga@nist.gov Mr. Christofer McGinnis christofer.mcginnis@nist.gov This document outlines the security components and security guiGLYPH(cmap:df00)elines neeGLYPH(cmap:df00)eGLYPH(cmap:df00) to establish a secure Basic Input/Output System (BIOS) integrity measurement anGLYPH(cmap:df00) reporting chain. UnauthorizeGLYPH(cmap:df00) moGLYPH(cmap:df00)ification of BIOS firmware constitutes a significant threat because of the BIOS's unique anGLYPH(cmap:df00) privilegeGLYPH(cmap:df00) position within the PC architecture. The GLYPH(cmap:df00)ocument focuses on two scenarios: GLYPH(cmap:df00)etecting changes to the system BIOS coGLYPH(cmap:df00)e storeGLYPH(cmap:df00) on the system flash, anGLYPH(cmap:df00) GLYPH(cmap:df00)etecting changes to the system BIOS configuration. The GLYPH(cmap:df00)ocument is intenGLYPH(cmap:df00)eGLYPH(cmap:df00) for harGLYPH(cmap:df00)ware anGLYPH(cmap:df00) software venGLYPH(cmap:df00)ors that GLYPH(cmap:df00)evelop proGLYPH(cmap:df00)ucts that can support secure BIOS integrity measurement mechanisms, and may also be of use for organizations developing enterprise procurement or deployment strategies for these technologies. Contact: Mr. AnGLYPH(cmap:df00)rew RegenscheiGLYPH(cmap:df00) anGLYPH(cmap:df00)rew .regenscheiGLYPH(cmap:df00)@nist.gov A wireless local area network (WLAN) is a group of wireless networking GLYPH(cmap:df00)evices within a limiteGLYPH(cmap:df00) geographic area, such as an office builGLYPH(cmap:df00)ing, that exchange GLYPH(cmap:df00)ata through radio communications.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in Blockchain Technology Overview? (Part 10) Control HA-256: trict read access to authorized individuals. They also may allow anyone to submit transactions to be included in the blockchain or, again, they may restrict this access only to authorized individuals. Permissioned blockchain networks may be instantiated and maintained using open source or closed source software. Permissioned blockchain networks can have the same traceability of digital assets as they pass through the blockchain, as well as the same distributed, resilient, and redundant data storage system as a permissionless blockchain networks. They also use consensus models for publishing blocks, but these methods often do not require the expense or maintenance of resources (as is the case with current permissionless blockchain networks). This is because the establishment of one's identity is required to participate as a member of the permissioned blockchain network; those maintaining the blockchain have a level of trust with each other, since they were all authorized to publish blocks and since their authorization can be revoked if they misbehave. Consensus models in permissioned blockchain networks are then usually faster and less computationally expensive. Permissioned blockchain networks may also be used by organizations that need to more tightly control and protect their blockchain. However, if a single entity controls who can publish blocks, the users of the blockchain will need to have trust in that entity. Permissioned blockchain networks may also be used by organizations that wish to work together but may not fully trust one another. They can establish a permissioned blockchain network and invite business partners to record their transactions on a shared distributed ledger. These organizations can determine the consensus model to be used, based on how much they trust one another. Beyond trust, permissioned blockchain networks provide transparency and insight that may help better inform business decisions and hold misbehaving parties accountable.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain Technology Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE) say about Appendix B Glossary? (Part 9) According to Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE), Appendix B Glossary: | The act of deceiving an individual into revealing sensitive information, obtaining unauthorized access, or committing fraud by associating with the individual to gain confidence and trust [55]. | | Threat | Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, or modification of information, and/or denial of service [12]. | | Threat Events | An event or situation that has the potential for causing undesirable consequences or impact [12]. | | Threat Intelligence | Threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes [62]. | |--------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Threat Sources | The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally trigger a vulnerability. Synonymous with threat agent [11]. | | Transport Layer | Layer of the TCP/IP protocol stack that is responsible for reliable connection-oriented or connectionless end-to-end communications [49]. | | Transport Layer Security (TLS) | A security protocol providing privacy and data integrity between two communicating applications. The protocol is composed of two layers: the TLS Record Protocol and the TLS Handshake Protocol [54]. | | Trusted Certificate | A certificate that is trusted by the Relying Party on the basis of secure and authenticated delivery.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Securing Web Transactions_ TLS Server Certificate Management? (Part 69) Control HA-1: n place and managed. | The system supports replacement of large numbers of TLS server certificates and private keys in response to CA compromises, vulnerable algorithms, or cryptographic library bugs. | CP-2, CP-7, CP-12, CP-13, IR-7, IR- 8, IR-9, PE-17 | PR-CDA-001 Cyber Defense Analyst PR-CIR-001 Cyber Defense Incident Responder PR-VAM-001 Vulnerability Assessment Analyst AN-TWA-001 | | Cybersecurity Framework Function | Cybersecurity Framework Category | Cybersecurity Framework Subcategory | Applicability to TLS Server Certificates | NIST SP 800-53 Rev.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations say about Publication History? According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, Publication History: Approved by the NIST Editorial Review Board on 2024-09-25 Supersedes NIST Special Publication 800-161r1 (May 2022)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations say about Vulnerability Analysis? (Part 1) According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, Vulnerability Analysis: Vulnerability Analysis For C-SCRM, a vulnerability is a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source [SP80053r5]. A vulnerability analysis is an iterative process that informs risk assessments and countermeasure selection. The vulnerability analysis works alongside the threat analysis to help inform the impact analysis and to help scope and prioritize the vulnerabilities to be mitigated. 68 Note that the threat characterization of suppliers, developers, system integrators, external system service providers, and other ICT/OTrelated service providers may be benign. Vulnerability analysis in the Assess step should use the approaches defined during the Frame step to update and refine assumptions about supply chain cybersecurity vulnerabilities. Vulnerability analysis should begin by identifying vulnerabilities that are applicable to critical mission and business processes and the systems or system components identified by the criticality analysis. An investigation of vulnerabilities may indicate the need to raise or at least reconsider the criticality levels of processes and components identified in earlier criticality analyses. Later iterations of the vulnerability analysis may also identify additional threats or opportunities for threats that were not considered in earlier threat assessments. Table 38 provides examples of applicable supply chain cybersecurity vulnerabilities that can be observed within the three levels. Table 38.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Appendix A. List of Symbols, Abbreviations, and Acronyms according to NIST Using Business Impact Analysis to Inform Risk Prioritization and Response According to Using Business Impact Analysis to Inform Risk Prioritization and Response, Appendix A. List of Symbols, Abbreviations, and Acronyms: Selected acronyms and abbreviations used in this paper are defined below.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Using Business Impact Analysis to Inform Risk Prioritization and Response.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols say about 2 References? According to Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols, 2 References: | ISO 8473 | 01 March 1986 Final Text of DIS 8473, Protocol for Providing the Connectionless-mode Network Service | |----------------|-----------------------------------------------------------------------------------------------------------------------------------------------| | ISO 8348 | 15 July 1987 Final Text of DIS 8348: Information processing systems - Data communications - Network service definition | | ISO 7498 | 15 Oct. 1987 Information Processing Systems - Open Systems Interconnection - Basic Reference Model | | ISO 7498/2 | March 1987 Information Processing Systems - Open Systems Interconnection - Security Architecture | | ISO 8348/DAD 1 | Information Processing Systems - Data 07 Aug. 1985 Communications - Network Service Definition - Addendum 1 | | ISO 8348/DAD2 | Information Processing Systems - Data 29 Feb. 1986 Communications - Network Service Definition - Addendum 2 Covering Network Layer Addressing | | ISO 8648 | Information Processing Systems - Data Communications - Internal Organization of the Network Layer | |--------------|-----------------------------------------------------------------------------------------------------| | ISO TR 8509 | Technical Report 8509, OSI Service Conventions | | RFC 986 | Guidelines for the use of Internet-IP addresses in the ISO Connectionless - Mode Network Protocol | | MIL-STD-1777 | Military Standard Internet Protocol 12 Aug 1983 - |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IP-2 in Engineering Trustworthy Secure Systems? Control IP-2: PERFORM IMPLEMENTATION - IP-2.1 Realize or adapt system elements in accordance with the security aspects of the implementation strategy and implementation procedures, as well as security-relevant constraints. Note: System elements can include: - -Hardware and Software: Hardware and software elements are either acquired or fabricated. Custom hardware fabrication and software development enable insight into the details of design and implementation. These insights often translate to increased assurance. Acquired hardware and software elements may not provide the opportunity to achieve the same insight into design and implementation and may offer more functionality and capability than required. The limits of what can be known about the internals of the elements translate to a level of uncertainty about vulnerability and the maximum assurance that can be achieved. - -Firmware: Firmware exhibits properties of hardware and software. Firmware elements may be acquired or developed to realize the software aspects and then fabricated to realize the physical form of the hardware aspects. Firmware elements, therefore, adhere to the security implementation considerations of both hardware and software elements. - -Services: System elements implemented by obtaining or leasing services are subject to the same criteria used to acquire hardware, firmware, and software but must also address the security considerations associated with utilization and support resources. - -Utilization and Support Resources: The security considerations of acquired or leased services account for the specific roles and responsibilities of individuals of the service/lease provider and their ability to account for all of the security requirements and constraints associated with the delivery, utilization, and sustainment of the service or capability being leased.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Requirements for Cryptographic Modules say about U.S. Department of Commerce? According to Security Requirements for Cryptographic Modules, U.S. Department of Commerce: Wilbur L. Ross, Jr., Secretary National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary for Standards and Technology

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Requirements for Cryptographic Modules.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cell Phone Forensic Tools_ an Overview and Analysis Update say about Appendix G: SIM Seizure - External SIM Results? According to Cell Phone Forensic Tools_ an Overview and Analysis Update, Appendix G: SIM Seizure - External SIM Results: The scenarios were performed on a Forensic Recovery of Evidence Device (FRED) running Windows XP SP2. SIM Seizure version 1.0 build 2468.18222 was used with Paraben's SIM Card Reader to acquire data from a populated SIM.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.2 Relations according to NIST A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N According to A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N, 4.2 Relations: NGAC does not express policies through rules, but instead through configurations of relations of four types: assignments (define membership in containers), associations (derive privileges), prohibitions (specify privilege exceptions), and obligations (dynamically alter access state).

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Security for Full Virtualization Technologies say about 4.3 Virtualized Infrastructure Security? (Part 2) According to Guide to Security for Full Virtualization Technologies, 4.3 Virtualized Infrastructure Security: control, shape, and monitor the VM network communications in a centralized location. Hypervisors sometimes offer virtual storage networks and virtual interfaces to existing hardware storage networks. These features offer the same security problems as virtual networks, namely that organizations whose security policies require monitoring those connections cannot use the same methods for virtual storage as they do for physical storage. Using physical interfaces to existing networked storage can eliminate this problem, but also reduces some of the flexibility that hypervisors offer.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Security for Full Virtualization Technologies.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain digital twin instance according to NIST Security and Trust Considerations for Digital Twin Technology According to Security and Trust Considerations for Digital Twin Technology, digital twin instance: A digital data structure, object, or entity in a computer software environment that represents a specific physical instance of a real-world object whose type or class is given by an associated digital twin definition.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Trust Considerations for Digital Twin Technology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Content Filtering according to User's Guide to Telework and Bring Your Own Device (BYOD) Security? Content Filtering: The process of monitoring communications such as email and web pages, analyzing them for suspicious content, and preventing the delivery of suspicious content to users.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: User's Guide to Telework and Bring Your Own Device (BYOD) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain DISCLAIMER according to NIST Data Integrity_ Recovering from Ransomware and Other Destructive Events According to Data Integrity_ Recovering from Ransomware and Other Destructive Events, DISCLAIMER: Certain commercial entities, equipment, products, or materials may be identified by name or company logo or other insignia in order to acknowledge their participation in this collaboration or to describe an experimental procedure or concept adequately. Such identification is not intended to imply special status or relationship with NIST or recommendation or endorsement by NIST or NCCoE; neither is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose. National Institute of Standards and Technology Special Publication 1800-11B, Natl. Inst. Stand. Technol. Spec. Publ. 1800-11B, 54 pages, (September 2020), CODEN: NSPUE2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 501) ecurity Objectives/Requirements  Confidentiality may or may not be an issue depending on whether information is public (date, time) or private (password change, Personally Identifiable Information). Some items must be confidential due to laws and regulations; confidentiality of other items, such as firmware or GPS coordinates, may be left up to local policy,  Integrity of meter maintenance repairs and updates is essential to prevent malicious intrusions  Availability is important, but only in terms of hours or maybe days to provide synchronization and coherence of devices on the network, i.e. all devices acting together for entire population 3.1 Data Privacy Considerations 82 The Customer Information Systems (CIS), Meter Data Management Systems (MDMS) and Outage Management Systems (OMS) may contain multiple types of personal data that may be impacted by meter reading and configuration changes or updates. Utility resources and authorized Third Parties should follow utility privacy policies to safeguard any personal data, including energy usage data. For example, a connectivity ping that is negative may trigger a request to an OMS and/or workforce management system to schedule an onsite repair visit. Personal data in the form of customer name and address would be needed to schedule that repair with utility or authorized Contracted Agents. That connectivity ping may also generate a report identifying unresponsive meters. Care should be exercised to minimize personal data that appears in these reports, and limits on the access to these reports by resources trained in privacy policies and practices. 3.2 Care should be exercised to ensure authorized Third Parties or other service providers do not have unnecessary access to customer information that is not required for completion of their responsibilities.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Use of ISO_IEC 24727 say about 2. ISO/IEC 24727 Discussion? (Part 2) According to Use of ISO_IEC 24727, 2. ISO/IEC 24727 Discussion: rd data and services. Through these distinct abstractions, client-applications can use identification services in real time, while the Generic Card Interface accommodates differences in card behavior. This feature of ISO/IEC 24727 enables developers to discover card capabilities and to write a client-application once and use it with different credential systems. + Platform Independence - This feature of ISO/IEC 24727 enables independence from interface devices, such as card readers, allowing compliant implementations to be used in different configurations and environments. The common device interface defined in ISO/IEC 24727 provides a generic interface for readers. This facilitates translation from a common device interface to device specific commands. + Extensible architecture - ISO/IEC 24727 includes a normative collection of basic services for authentication, signature, encryption, key establishment, and session establishment. It allows for the addition of new security protocols and authentication mechanisms to perform a variety of interoperable services. Because these services are normative, cards enabled with one or several service(s) will interoperate with ISO/IEC 24727 applications. 3 Part 3 of ISO/IEC 24727 defines services as representations of action requests and action responses to be supported at the client-application interface. Essentially, it provides a high-level interface for a clientapplication making use of information storage and processing operations of a card-application.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Use of ISO_IEC 24727.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SR-12 in Security and Privacy Controls for Information Systems and Organizations? (Part 88) Control SR-12: s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ threat [SP 800-30] threat assessment [CNSSI 4009] threat modeling [SP 800-154] threat source [FIPS 200] transmission [CNSSI 4009] trusted path trustworthiness [CNSSI 4009] trustworthiness (system) user Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the Nation through a system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. Formal description and evaluation of threat to an information system. A form of risk assessment that models aspects of the attack and defense sides of a logical entity, such as a piece of data, an application, a host, a system, or an environment. The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally trigger a vulnerability. See threat agent. The state that exists when information is being electronically sent from one location to one or more other locations. A mechanism by which a user (through an input device) can communicate directly with the security functions of the system with the necessary confidence to support the system security policy. This mechanism can only be activated by the user or the security functions of the system and cannot be imitated by untrusted software.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments say about List of Acronyms? (Part 2) According to Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments, List of Acronyms: A&A Assessment & Authorization ACL Access Control List ADCS Active Directory Certificate Services AWS Amazon Web Services BGP Border Gateway Protocol BIOS Basic Input/Output System CA Certificate Authority CloudSPF Cloud Security Policy Framework COSO Committee of Sponsoring Organizations of the Treadway Commission CRADA Cooperative Research and Development Agreement CSA Cloud Security Alliance DCG Data Center Group DD VE Data Domain Virtual Edition DFW Distributed Firewall DHCP Dynamic Host Configuration Protocol DISA Defense Information Systems Agency DLR Distributed Logical Router DNS Domain Name System ECMP Equal-Cost Multi-Path ESG Edge Services Gateway FAIR Factor Analysis of Information Risk FedRAMP Federal Risk and Authorization Management Program FIPS Federal Information Processing Standard FISMA Federal Information Security Modernization Act FOIA Freedom of Information Act FT Fault Tolerance GB Gb Gigabyte Gigabit GKH Good Known Host GRC Governance, Risk, and Compliance HIPAA Health Insurance Portability and Accountability Act HSM Hardware Security Module HTBC HyTrust BoundaryControl HTCA HyTrust CloudAdvisor HTCC HyTrust CloudControl HTDC HyTrust DataControl HTKC HyTrust KeyControl I/O Input/Output IaaS Infrastructure as a Service ICSV IBM Cloud Secure Virtualization IEEE Institute of Electrical and Electronics Engineers Intel AES-NI Intel Advanced Encryption Standard - New Instructions Intel CIT Intel Cloud Integrity Technology Intel TPM Intel Trusted Platform

Explanation: NIST publication on credential and access management. Topics: access control, authorization, certificate authority. Contains security framework guidance for authentication systems. Source: Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments.