You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective say about A. Level of Effort? (Part 2) According to Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective, A. Level of Effort: ractors , (2005) and the Registered Traveler Interoperability Consortium (RTIC) Specification (2006) are examples of high levels of effort that resulted in standards being developed within six months. Such timing was possible because of the resources dedicated to the work and the fact that both of these standards profiled already available base standards. Example: The U.S. High Definition Television (HDTV) standard was developed quickly by industry in the early 1990s. The impetus for this rapid standards development was the declaration by the Federal Communications Commission (FCC) that industry had a specific deadline to produce such a standard and demonstrate its viability or the FCC would develop the standard. Industry quickly collaborated to develop the digital specification, established a testing facility, and demonstrated interoperable digital technology.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Domain Name System (DNS) Deployment Guide provide? (Section 124) ey for dynamic updates: ``` zone 'example.com' { type master; file 'zonedb.example.com'; allow-update { key dhcp-server.example.com.; }; }; ``` Note that although the string dhcp-server.example.com. looks like a FQDN, it actually denotes the name of the TSIG key. The implication of the configuration statement example is that any host that possess the key named dhcp-server.example.com. can submit dynamic update requests (adding, deleting, or modifying RRs) to the zone file (for the zone example.com) that resides in the primary authoritative name server. To use SIG(0) to authenticate dynamic update messages, the key used must first have its public component stored in the DNS, so a validating client can obtain it 10 . See section 9.5 on publishing keys. The previous steps above need to be performed to control access (if desired). After that is done, the updating name server (i.e., primary authoritative name server) should be able to obtain the key and process the dynamic update request (if the name server supports SIG(0) with dynamic update). Dynamic updates are allowed on the copy of the zone file in the primary authoritative name server only because that is the only 'writable' copy. This does not automatically imply that the primary authoritative name server is the only one allowed to accept dynamic update requests. In fact, BIND 9.1.0 and later versions allow secondary name servers to accept dynamic update requests and forward them to the primary authoritative name server. In this scenario, if there are no restrictions on the basis of the identity of hosts from whom the secondary name server can forward such dynamic update requests, it is equivalent to circumventing the dynamic update restrictions specified in the primary name server because the request can literally originate from any host to the secondary name server and be forwarded to the primary name server.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Domain Name System (DNS) Deployment Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain e. GUIDANCE FOR CALCUUATINQ SOFTWARE AND DATA REPLACEMENT COSTS: according to NIST U.S. Department of Energy Risk Assessment Methodology According to U.S. Department of Energy Risk Assessment Methodology, e. GUIDANCE FOR CALCUUATINQ SOFTWARE AND DATA REPLACEMENT COSTS:: - For "Off-the-shelf" Software Prices: - For Software and Data Development Costs: - -Consult computer catalogs and advertisements, as well as government price schedules and local vendor price lists available from your organization's computer support group or Procurement Office - Consult contract labor cost rates available from the Procurement Office or the contract's COTR OR - -Develop the total cost by multiplying approx, hours spent times average labor cost per hour. Accepted labor costs for your use are provided: - · Clerclal: $5-10/hr. - · Junior Professional or Programmer: .. Senior Professional or Programmer: - Approximate No. of work hours per: - (Holidays and weekends are not - Included) - 1 Year: 2,080 6 Months: 1,040 1 Month: 170 - . Personnel Management - . Manufacturing/Control - . Mathematics/Statistical - . Security - . Training $1 5-20/hr. $20-30/hr.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: U.S. Department of Energy Risk Assessment Methodology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain The organization prevents the unauthorized exfiltration of information across managed interfaces. according to NIST Trustworthy Email According to Trustworthy Email, The organization prevents the unauthorized exfiltration of information across managed interfaces.: Supplemental Guidance: Safeguards implemented by organizations to prevent unauthorized exfiltration of information from information systems include, for example: (i) strict adherence to protocol formats; (ii) monitoring for beaconing from information syste ms; (iii) monitoring for steganography; (iv) disconnecting external network interfaces except when explicitly needed; (v) disassembling and reassembling packet headers; and (vi) employing traffic profile analysis to detect deviations from the volume/types of traffic expected within organizations or call backs to command and control centers. Devices enforcing strict adherence to protocol formats include, for example, deep packet inspection firewalls and XML gateways. These devices verify adherence to protocol formats and specification at the application layer and serve to identify vulnerabilities that cannot be detected by devices operating at the network or transport layers. This control enhancement is closely associated with cross-domain solutions and system guards enforcing information flow requirements.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Implementing a Zero Trust Architecture_ High-Level Document provide? (Section 56) semanaged endpoint. -  Scenario C-8: Stolen credential using BYOD - a legitimate user's federated ID credential is stolen and is used to request access to an enterprise resource from a BYOD endpoint. Use Case D demonstrates a subject with an Other-ID (i.e., an ID that is issued and maintained by another enterprise but known or registered by the first enterprise) requesting access to a resource. Its scenarios are: -  Scenario D-1: Full/limited resource access using an enterprise endpoint - the subject is granted full, limited, or no access to the requested resource as determined by its authentication status and endpoint compliance status. -  Scenario D-2: Full/limited internet access using an enterprise endpoint - the subject is granted full, limited, or no access to the requested internet domain as determined by enterprise policy. -  Scenario D-3: Stolen credential using BYOD or enterprise endpoint - a legitimate user's Other-ID credential is stolen and is used to request access to an enterprise resource from either an enterprise-managed endpoint or a BYOD. -  Scenario D-4: Full/limited resource access using BYOD - a subject using a bring-your-own device (BYOD) is granted full or limited access to the requested resource as determined by authentication status and enterprise policy. -  Scenario D-5: Full/limited internet access using BYOD - the subject is granted or denied access to an internet domain as determined by enterprise policy. -  Scenario D-6: Stolen credential using BYOD - a legitimate user's Other-ID credential is stolen and is used to request access to an enterprise resource from a BYOD endpoint. -  Scenario D-7: Just-in-Time Access Privileges - An enterprise provisions access privileges to a resource based on a single business process flow. Temporary privileges are granted to perform a portion of the business process and then revoked when the process is complete.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Implementing a Zero Trust Architecture_ High-Level Document.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RS-232 in Validating the Correctness of Hardware Implementations of the NBS Data Encryption Standard? (Part 15) Control RS-232: Appendix B: The DES Test Set ## IP AND E TEST ## PLAIN 95F8A5E5DD31D900 DD7F121CA5015619 2E8653104F3834EA 4BD388FF6CD81D4F 20B9E767B2FB1456 55579380D77138EF 6CC5DEFAAF04512F 0D9F279BA5D87260 D9031B0271BD5A0A 424250B37C3DD951 B8061B7ECD9A21E5 F15D0F286B65BD28 ADD0CC8D6E5DEBA1 E6D5F82752AD63D1 ECBFE3BD3F591A5E F356834379D165CD 2B9F982F20037FA9 889DE068A16F0BE6 E19E275D846A1298 329A8ED523D71AEC E7FCE22557D23C97 12A9F5817FF2D65D A484C3AD38DC9C19 FBE00A8A1EF8AD72 750D079407521363 64FEED9C724C2FAF F02B263B328E2B60 9D64555A9A10B852 D106FF0BED5255D7 E1652C6B138C64A5 E428581186EC8F46 AEB5F5EDE22D1A36 E943D7568AEC0C5C DF98C8276F54B04B B160E4680F6C696F FA0752B07D9C4AB8 CA3A2B036DBC8502 5E0905517BB59BCF 814EEB3B91D90726 4D49DB1532919C9F ## CIPHER 8000000000000000 4000000000000000 2000000000000000 1000000000000000 0800000000000000 0400000000000000 0200000000000000 0100000000000000 0080000000000000 0040000000000000 0020000000000000 0010000000000000 0008000000000000 0004000000000000 0002000000000000 0001000000000000 0000800000000000 0000400000000000 0000200000000000 0000100000000000 0000080000000000 0000040000000000 0000020000000000 0000010000000000 0000008000000000 0000004000000000 0000002000000000 0000001000000000 0000000800000000 0000000040000000 0000000200000000 0000000100000000 0000000080000000 0000000040000000 0000000020000000 0000000010,000000 0000000008000000 0000000004000000 0000000002000000 0000000001000000 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 0101010101010101 25EB5FC3F8CF0621 AB6A20C0620D1C6F 79E90DBC98F92CCA 866ECEDD8072BB0E 8B54536F2F3E64A8 EA51D3975595B86B CAFFC6AC454 2DE31 8DD45A2DDF90796C 1029D55E880EC2D0 5D86CB23639DBEA9 1D1CA853AE7C0C5F CE332329248F3228 8405D1ABE24FB942 E643D78090CA4207 48221B9937748A23 DD7C0BBD61FAFD54 2FBC291A570DB5C4 E07C30D7E4E26E12 0953E2258E8E90A1 5B711BC4CEEBF2EE CC083F1E6D9E85F6 D2FD8867D50D2DFE 06E7EA22CE92708F 166B40B44ABA4BD6 0000000000800000 0000000000400000 0000000000200000 0000000000100000 0000000000080000 0000000000040000 0000000000020000 0000000000010000 0000000000008000 0000000000004000 0000000000002000 0000000000001000 0000000000000800 0000000000000400 0000000000000200 0000000000000100 0000000000000080 0000000000000040 0000000000000020 0000000000000010 0000000000000008 0000000000000004 0000000000000002 0000000000000001 !

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validating the Correctness of Hardware Implementations of the NBS Data Encryption Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-200901022 in Assessing Enhanced Security Requirements for Controlled Unclassified Information? (Part 25) Control PD-200901022: Included in the definition of each assessment method are types of objects to which the method can be applied. The application of each method is described in terms of the attributes of depth and coverage, progressing from basic to focused to comprehensive. The attribute values correlate to the assurance requirements specified by the organization. T The depth attribute addresses the rigor and level of detail of the assessment. For the depth attribute, the focused attribute value includes and builds upon the assessment rigor and level of detail defined for the basic attribute value; the comprehensive attribute value includes and builds upon the assessment rigor and level of detail defined for the focused attribute value. The coverage attribute addresses the scope or breadth of the assessment. For the coverage attribute, the focused attribute value includes and builds upon the number and type of assessment objects defined for the basic attribute value; the comprehensive attribute value includes and builds upon the number and type of assessment objects defined for the focused attribute value. Tables C-1 through C-3 provide complete descriptions of the examine , interview , and test assessment methods. The use of bolded text in the assessment method description indicates the content that was added to and appears for the first time in the description, signifying greater rigor and level of detail for the attribute value. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ TABLE C-1: EXAMINE ASSESSMENT METHOD | Method | EXAMINE The process of checking, inspecting, reviewing, observing, studying, or analyzing one or more assessment objects to facilitate understanding, achieve clarification, or obtain evidence.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Test Personal Identity Verification (PIV) Cards Version 2 say about Authority Information Access :? According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Authority Information Access :: CA Issuers - CA Issuers - ldap://smime2.nist.gov/cn=Test%20ECC%20P- 256%20CA%20for%20Test%20PIV%20Cards%20v2,ou=Test%20CA,o=Test%20Certific ates%202020,c=US?cACertificate;binary,crossCertificatePair;binary OCSP -

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N say about Table of Contents? (Part 14) According to A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N, Table of Contents: | 44 | | 5.5 | Administrative Review and Resource Discovery........................................... | Administrative Review and Resource Discovery...........................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers provide? (Section 75) ble 7-7 contains test case requirements, associated test cases, and descriptions of the test scenarios for the e-commerce platform system administrator MFA capabilities of the example implementations. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Table 7-7 Test Case MFA-5 (System Administrator MFA) | Test Case Field | Description | |--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Parent Requirement | (CR 5) The MFA example implementations shall strongly authenticate e-commerce platform administrators before the administrators perform administration activities. | | Testable Requirement | (CR 5.a) Magento and TokenOne | | Description | Show that the MFA example implementation requires the e-commerce platform administrator to authenticate with TokenOne before logging in and performing administration.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa, token. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Reference control parameter P1 according to NIST Government Smart Card Interoperability Specification, Version 2.1 According to Government Smart Card Interoperability Specification, Version 2.1, Reference control parameter P1: The reference control parameter P1 shall be used to indicate the type of requested ACR properties information. The following P1 values are possible: 0x00: All ACR table entries are to be extracted. 0x01: Only one entry of the ACR table is extracted based on ACRID. 0x10: All Applet/Object ACR table entries are to be extracted. 0x11: Only the entries of the Applet/Object ACR table for one applet are extracted based on applet AID. 0x12: Only one entry of the Applet/Object ACR table for an object is extracted based on object ID. 0x20: The Access Method Provider table is extracted. 0x21: The Service Applet table is extracted.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface provide? (Section 91) me the key and algorithm. Table 23 shows the GENERAL AUTHENTICATE card commands sent to the PIV Card Application to realize mutual authentication using AES - ECB (algorithm identifier '08'). Table 23. Mutual authentication of client application and PIV Card Application | Command | Response | Comment | |----------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | '00 87 08 9B 04 7C 02 80 00 00' | | The client application requests a witness from the PIV Card Application.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cell Phone Forensic Tools_ an Overview and Analysis say about Supported Phones? According to Cell Phone Forensic Tools_ an Overview and Analysis, Supported Phones: The make, model, and type of CDMA phone determine what data BitPIM can acquire. Some common data fields that BitPIM can recover are: Phonebook, Wallpapers (Graphic files present on the phone), Ringers (sound bytes), Calendar entries, and Memo entries. BitPIM also captures a dump of the filesystem, where data related to Incoming/Outgoing/Missed/Attempted calls and SMS/MMS messages can be found. Figure 52 shows a screen shot of the phones listed in the Settings window under a menu item that allows selection of the specific make and model of the device for acquisition. The Read Only box should always be checked to avoid writing to the phone. Figure 52: Supported Phone Selection <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does ANSI_NIST-ITL 1-2011 Requirements and Conformance Test Assertions provide? (Section 128) pe(Record) EQ 20) t-2 t-2 90 B* B* B* B B B* B B* B* Source Type- 20 Field: 10.024- Subject Quality Scores Type- 20 Field: 10.025- Subject Pose Angles Value included in the transaction. 8.10.22, Table 53, 7.7.7 <Table 53 lists the value constraints for SQS.> D 10.024-SQS <See Requirement ID: “Field: Sample Quality Subfield 1” and “Field: Sample Quality Subfield 2” and “Field: Sample Quality Subfield 3”.> t-2 8.10.23, Table 53 <Table 53 lists the value constraints for SPA.> 1 M ⇑ 1 M ⇑ 1 M ⇑ 1 O ⇑ 10.025- SPA- Value Subfield 1 10.025- SPA- Value Subfield 2 10.025- SPA- Value Subfield 3 10.025- SPA- Value Subfield 4 to 6 {US_Subfield:1 in 10.025} GTE -180 AND LTE 180 {US_Subfield:2 in 10.025} GTE -90 AND LTE 90 {US_Subfield:3 in 10.025)} GTE -180 AND LTE 180 {US_Subfields:4 to 6 in 10.025)} GTE 0 AND LTE 90 Field: 10.026- Subject Facial Description Value Field: 10.027- Subject Eye Color Value Field: 10.028- Subject Hair Color Value 8.10.24, Table 53, Table 58 8.10.25, Table 53, Table 14 8.10.26, Table 53, Table 59 8.10.27, Table 53 Field: 10.029- 2D Facial Feature Points Value The value should be selected from the “Attribute code” column of Table 58. D 10.026-SXS <Cannot check for values because the standard allows user-defined Alphabetic Text. See Requirement ID: “Field: Type10-Subfield CharType” and “Field: Type10-Subfield CharCount”> t-2 <Table 53 lists the value constraints for SEC.> D 10.027-SEC <See Requirement ID: “Field: Image ECL Value”>. t-2 <Table 53 lists the value constraints for SHC.> When the subject is predominantly bald, but hair color is discernible, then the appropriate hair color attribute code shall follow “BAL” in a second entry. For streaked hair, use “STR” in the first entry; use the second entry to describe the principal color of the hair. <Table 53 lists the value constraints for FFP.> The first information item, feature point type / FPT is a one character value.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: ANSI_NIST-ITL 1-2011 Requirements and Conformance Test Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does An Overview of Mobile Application Vetting Services for Public Safety say about 5 Mobile Application Vetting Service Feature Descriptions? According to An Overview of Mobile Application Vetting Services for Public Safety, 5 Mobile Application Vetting Service Feature Descriptions: The goal of this exercise is to gain understanding of the features offered by services in the mobile application vetting space. The following list of features was derived from the analysis of the mobile application vetting services mentioned in the previous section. Features were established according to common characteristics found within each mobile application vetting service. This section describes each feature and provides details on how the information may be beneficial to public safety.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: An Overview of Mobile Application Vetting Services for Public Safety.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide for Security-Focused Configuration Management of Information Systems? (Part 31) Control ES-1: , databases, etc.) used to build the system. For example, a secure configuration for selected IT products used within the system or organization could incorporate the principle of least functionality. Least functionality helps to minimize the potential for introduction of security vulnerabilities and includes, but is not limited to, disabling or uninstalling unused/unnecessary operating system (OS) functionality, protocols, ports, and services, and limiting the software that can be installed and the functionality of that software. Implementing secure configurations is part of the Identifying and Implementing Configurations phase of SecCM and supports the implementation of NIST [SP 800-53] controls CM-6 Configuration Settings and CM-7 Least Functionality. ## 2.3.7 BASELINE CONFIGURATION A baseline configuration is a set of specifications for a system, or Configuration Item (CI) within a system, that has been formally reviewed and agreed on at a given point in time, and which can be changed only through change control procedures. The baseline configuration is used as a basis for future builds, releases, and/or changes. The baseline configuration of a system may evolve over time depending on the stage of the system development life cycle (SDLC). Early in the SDLC when a system is being initiated and acquired, the baseline may be a set of functional requirements. As the system is developed and implemented, the baseline may expand to include additional configuration items such as the technical design, the software load, the architecture, and configurations of the system and its individual components. A baseline configuration may also represent different information computing environments such as development, test, and production. When a new baseline configuration is established, the implication is that all of the changes from the last baseline have been approved.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 18. Recipient denies receiving information (Repudiate\_Receive) according to NIST IT Security for Industrial Control Systems According to IT Security for Industrial Control Systems, 18. Recipient denies receiving information (Repudiate\_Receive): The recipient of a message denies receiving the message, to avoid accountability for receiving the message or to avoid obligations incurred as a result of receiving the message.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IT Security for Industrial Control Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-4009 in NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3? (Part 62) Control SI-4009: See Security Label.' | | SLA for Privacy | | TBD | | | Signed data (applied to privacy) | CNSSI-4009 | | | | Privacy Spillage | CNSSI-4009 | | 'Security incident that results in the transfer of classified or CUI information onto an information system not accredited (i.e., authorized) for the appropriate security level.' | | Status (for privacy components) monitoring | NIST SP 800-137 | Person or s/w agent | 'Monitoring the information security metrics defined by the organization in the information security ISCM strategy.' | | Term | Sources | Security and Privacy Fabric | Comments | |----------------------------------------------------------------------------|---------------------------------------------------------|------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Suppression measure (applied to privacy) | CNSSI-4009 | | 'Action, procedure, modification, or device that reduces the level of, or inhibits the generation of, compromising emanations in an information system.' | | Privacy Integrity | NIST SP 800-27 | | Adapt from System Integrity?

Explanation: NIST publication discussing classified information handling. References: classified, cui. Contains guidance on protecting sensitive government information. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data say about 3.2 Classifying Vulnerabilities Based on Hypervisor Functionality? (Part 4) According to A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data, 3.2 Classifying Vulnerabilities Based on Hypervisor Functionality: Interrupt Controller (APIC). It was discovered in Xen 4.8.x through 4.10.x. This vulnerability allows an x86 PVH guest OS user to cause a DoS attack (a NULL pointer dereference and hypervisor crash). | | Hypercalls | An example of hypercall vulnerability is CVE-2017-8903, which is reported through Xen 4.8.x on 64-bit platforms that might allow a PV guest OS user to execute arbitrary code on the host OS by mishandling page tables after an IRET hypercall. | | VMExit | The exploit of a VMExit-handling code usually leads to a DoS attack. An example of a VMExit vulnerability is CVE-2017-2596, in which the 'nested_vmx_check_vmptr' function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly emulates the VMXONinstruction that puts the processor in Virtual Machine Extensions (VMX) root mode. This then | | Hypervisor Functionality | Sample Vulnerability | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | allows a KVM L1 guest OS user to cause a DoS attack (the host OS memory consumption) by leveraging the mishandling of page references.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, cve-. Contains technical security guidance that could inform defensive posture. Source: A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Electronic Mail Security say about Appendix B-Email-Related RFCs? (Part 1) According to Guidelines on Electronic Mail Security, Appendix B-Email-Related RFCs: Appendix B-Email-Related RFCs This appendix contains lists of IETF RFCs that are related to email and email security. The first list contains an extensive list of RFCs, sorted by RFC number. The subsequent lists contain subsets of the first list, focused on particular protocols such as IMAP4, POP, SMTP, and MIME. Email-Related RFCs by RFC Number | RFC No. | RFC Cat.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 193) successful logon aempts, or both is deﬁned; AC-09(02) the user is noﬁed, upon successful logon, of the number of <AC-09(02)_ODP[01] SELECTED PARAMETER VALUE> during <AC-09(02)_ODP[02] me period>. POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-09(02)-Examine [SELECT FROM: Access control policy; procedures addressing previous logon noﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records]. AC-09(02)-Interview [SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers]. AC-09(02)-Test [SELECT FROM: Mechanisms implemenng access control policy for previous logon noﬁcaon]. AC-09(03) PREVIOUS LOGON NOTIFICATION | NOTIFICATION OF ACCOUNT CHANGES ASSESSMENT OBJECTIVE: Determine if: AC-09(03)_ODP[01] changes to security-related characteriscs or parameters of the user’s account that require noﬁcaon are deﬁned; AC-09(03)_ODP[02] the me period for which the system noﬁes the user of changes to security- related characteriscs or parameters of the user’s account is deﬁned; AC-09(03) the user is noﬁed, upon successful logon, of changes to <AC-09(03)_ODP[01] security-related characteriscs or parameters> during <AC-09(03)_ODP[02] me period>. POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-09(03)-Examine [SELECT FROM: Access control policy; procedures addressing previous logon noﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records]. AC-09(03)-Interview [SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Special Factors Affecting Integrity Impact Determination according to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices? Special Factors Affecting Integrity Impact Determination: Impacts to some population health management and consumer safety information and supporting information systems associated with quality assurance of food, animal, plant and pharmaceuticals may affect the security of critical agriculture and food and public health infrastructures. Additionally, unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and public confidence in the agency and the agency mission. In such cases, unauthorized modification or destruction of information can result in loss of human life. This can result in assignment of a high impact level to such information.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Available at https according to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations? Available at https: //www.cnss.gov/CNSS/issuances/Instructions.cfm

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Random Bit Generator (RBG) Constructions say about 2.5. RBG Security Boundaries? (Part 2) According to Recommendation for Random Bit Generator (RBG) Constructions, 2.5. RBG Security Boundaries: BG3 constructions in Sec. 5 and 6, respectively, use this model. Fig. 2. Example of an RBG security boundary within a cryptographic module <!-- image --> In the case of the RBG1 construction in Sec. 4, the security boundary containing the DRBG does not include a randomness source (shown as an entropy source in Fig. 2). For an RBGC construction, the security boundary is the computing platform on which the tree of DRBGs is used. A cryptographic primitive (e.g., an approved hash function or block cipher) used by an RBG may be used by other applications within the same cryptographic module. However, these other applications shall not modify or reveal the RBG's output, intermediate values, or internal state.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Bit Generator (RBG) Constructions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Integrity according to NIST Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Integrity: The integrity impact level is based on the specific mission and the data supporting that mission, not on the time required to detect the modification or destruction of information. Judicial hearings activities are not typically time-critical. Modification or destruction of court records can result in disruption or jeopardy to legal proceedings. In most cases, the adverse effects of unauthorized modification or destruction of judicial hearings information on agency mission functions and/or public confidence in the agency will be limited. Recommended Integrity Impact Level: The provisional integrity impact level recommended for judicial hearings information is low .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.4.3 Follow-Up Interviews according to NIST Report_ Authentication Diary Study According to Report_ Authentication Diary Study, 3.4.3 Follow-Up Interviews: Within one month after the 'diary day,' we met with each participant to interview them about their experiences with authentication. During this time, basic demographic information, including profession, gender, and age range, was collected from each participant. The interview focused on retrospectively reviewing diary events to ensure the researchers understood the data collected, as well as the context for problem events. Because of the retrospective nature of the interview, participant diaries were used in combination with a list of open-ended questions (see Sec. 3.2 ), to set the framework for the exchange. Initially, participants were asked what they thought the big insights were from their 'diary day,' what surprises they encountered, and what questions they had. The rest of the interview investigated: - The number and frequency of authentications throughout the day, and how participants felt about these measures. - How much control and autonomy participants felt they had in authentication and where they exercised it, e.g., whether they could do certain things to control how often they authenticated. - Where participants encountered frustration, and what were the factors contributing to that frustration, i.e., what participants found frustrating and why. - When participants authenticated during the day and why. - How participants felt about the effectiveness of authentication, including perceived tradeoffs of security versus usability and convenience. - How participants decided on their coping strategies, if used. - How typical the timing of recorded authentication events was. - What participants considered the major impediments related to authentication. Participants' responses to these inquiries are related in Sec. 4 and Sec. 6 . Appendix C provides a catalog of participants' direct quotes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report_ Authentication Diary Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain ERRATA according to NIST Metrics and Key Performance Indicators for Robotic Cybersecurity Performance Analysis According to Metrics and Key Performance Indicators for Robotic Cybersecurity Performance Analysis, ERRATA: ERRATA This table contains changes that have been incorporated into NISTIR 8177. Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature. | Date | Type | Change | Page | |------------|-------------|-------------------------------------------------------------------------------------------------------------------------|--------| | 04-24-2019 | Editorial | General formatting. | All | | 04-24-2019 | Substantive | Updated description for KPI 4.1 ( Actuation Latency ) in Table 4. | 9 | | 04-24-2019 | Substantive | Added new KPI 4.6 ( Job Execution Time ) in Table 4. | 9 | | 04-24-2019 | Substantive | Incorporated the original notes for Throughput Rate (KPI 2.3) into the general formulas and fixed a mathematical error. | 15 | | 04-24-2019 | Substantive | Fixed variable terms for KPI 3.2 ( Joint Setpoint ). | 18 | | 04-24-2019 | Substantive | Updated the description, formula, and notes for KPI 4.1 ( Actuation Latency ). | 19 | | 04-24-2019 | Substantive | Updated the formula and notes for KPI 4.2 ( Pose Travel Time ). | 20 | | 04-24-2019 | Editorial | Restructured formula layout for KPI 4.3 ( Position Accuracy ). | 20 | | 04-24-2019 | Substantive | Added new KPI 4.6 ( Job Execution Time ). | 22 | | 04-24-2019 | Substantive | Added bar accent to formula for KPI 6.6 to denote the calculation produces an average value. | 26 | | 04-24-2019 | Substantive | Added bar accent to formula for KPI 6.7 to denote the calculation produces an average value. | 27 | | 04-24-2019 | Substantive | Fixed error in formula for KPI 8.2 ( CPU Utilization Distribution) . | 29 | | 04-24-2019 | Editorial | Fixed formatting error, separating tables for KPI 8.2 and KPI 9.1. | 30 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Metrics and Key Performance Indicators for Robotic Cybersecurity Performance Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 242) Instead, the interface characteristics between the systems (e.g., how the information is being exchanged. how the information is protected) are described in the respective security and privacy plans. If the systems that exchange information have different authorizing officials within the same organization, the organizations can develop agreements or provide the same information that would be provided in the appropriate agreement type from CA-3a in the respective security and privacy plans for the systems. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (including service providers, contractors, system developers, and system integrators). Risk considerations include systems that share the same networks. Related Controls: AC-4, AC-20, AU-16, CA-6, IA-3, IR-4, PL-2, PT-7, RA-3, SA-9, SC-7, SI-12. Control Enhancements: (1) SYSTEM CONNECTIONS | UNCLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS [Withdrawn: Moved to SC-7(25).] (2) SYSTEM CONNECTIONS | CLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS [Withdrawn: Moved to SC-7(26).] (3) SYSTEM CONNECTIONS | UNCLASSIFIED NON-NATIONAL SECURITY SYSTEM CONNECTIONS [Withdrawn: Moved to SC-7(27).] (4) SYSTEM CONNECTIONS | CONNECTIONS TO PUBLIC NETWORKS [Withdrawn: Moved to SC-7(28).] (5) SYSTEM CONNECTIONS | RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS CHAPTER THREE PAGE 87 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV.

Explanation: NIST publication discussing classified information handling. References: classified, national security. Contains guidance on protecting sensitive government information. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: Although policies to control for authorized use can be applied to information

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3. The guest OS networking information on the VM's was set as follows: according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case, 3. The guest OS networking information on the VM's was set as follows:: Virtual Machine: GTB-Inspector Network interface:eth0 IP address: 10.100.0.175 Gateway: 10.100.0.1 Subnet Mask: 255.255.255.0 DNS:10.100.0.17 Network interface:eth2-> connected to Monitor Port1 of a Network Aggregator device Network interface:eth3-> connected to WAN interface of our Cisco-ASA firewall. Virtual Machine: GTB-Central Network interface:eth0 IP address: 10.100.0.176 Gateway: 10.100.0.1 Subnet Mask: 255.255.255.0 DNS:10.100.0.17

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Maintenance Testing for the Data Encryption Standard say about 1. INTRODUCTION? According to Maintenance Testing for the Data Encryption Standard, 1. INTRODUCTION: The Federal Information Processing Data Encryption Standard (DES) is the standard cryptographic algorithm for use within the Federal Government for protecting nonclassified transmission and storage of computer data. The DES algorithm is normally implemented in hardware and commercial DES devices are presently available from eight different sources. The National Bureau of Standards has validated the designs of the various hardware implementations with a validation test, i. e., a collection of input-keyoutput triplets which, when applied as a test to a device, and if successfully executed, insures that the device being tested in fact correctly executes the DES algorithm. A Monte-Carlo test using random data is also a part of this test [8], A small maintenance test, residing in read only memory and executed by the same microprocessor that controls the DES device provides a means of testing the operation of the DES hardware in the field. Since one criterion for a field test is that it be economical, the tests are designed so that only a partial test may be needed in a given application. The test is so designed that a full functional test can be executed if it is convenient and desirable to do so. The maintenance test provides results which are a combination of the validation test and of the Monte-Carlo test described in [8]. The maintenance test uses an initial fixed input-key pair and the resulting ciphertext is then fed back as input or as key, as in the Monte-Carlo test, and this cycling process is repeated. By simply checking the output of this process against four known results the test determines if the DES algorithm is properly functioning. A maximum of 192 cycles has been determined to test completely the DES device but three earlier check points are defined which result in specific partial tests. In all, four categories of tests have been defined. They range from a simple test for stuck-faults of the 54 output bits of the DES to a complete functional test.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Maintenance Testing for the Data Encryption Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services? https: //www.afrl.af.mil/News/Article/2874807/afrls-pnt-agilepod-achieves-flight-testobjectives/https://doi.org/10.21236/ADA290597 or

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Timing Channels according to NIST Guidelines for Evaluating Differential Privacy Guarantees According to Guidelines for Evaluating Differential Privacy Guarantees, Timing Channels: In some cases, the time it takes to run a query may reveal something about the underlying data. This risk is especially pronounced if untrusted analysts are allowed to write their own queries and measure how long it takes to receive the answer. For example, it might be possible to write a program whose running time reveals whether or not Joe is a part of the data with 100% certainty: ``` Example: Timing Channel Attack. if Joe in Data: return slowQuery() else: return fastQuery() ``` In many settings, timing is not an issue because analysts are not allowed to design and submit their own queries, or they are not able to observe how long those queries take to run. If analysts can submit their own queries and measure running time, careful implementations must be used to hide the information revealed by the running time.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Evaluating Differential Privacy Guarantees.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Fiscal Year 2021 Cybersecurity and Privacy Annual Report say about ABSTRACT? According to Fiscal Year 2021 Cybersecurity and Privacy Annual Report, ABSTRACT: During Fiscal Year 2021 (FY 2021) - from October 1, 2020, through September 30, 2021 - the NIST Information Technology Laboratory (ITL) Cybersecurity and Privacy Program successfully responded to numerous challenges and opportunities in security and privacy. This annual report highlights the FY 2021 research agenda and activities for the ITL Cybersecurity and Privacy Program, including the ongoing participation and development of international standards; the enhancement of privacy and security risk management models, including those for the protection of controlled unclassified information (CUI), systems engineering and cyber resiliency, supply chains, and mobile technologies; the continued advancement of cryptographic technologies, including updates to Federal Information Processing Standard (FIPS) Publication 140-3, Security Requirements for Cryptographic Modules, and preparation for post-quantum cryptographic methods; and improved infrastructure protection in areas such as zero trust architectures and advanced networking security. NIST maintained a strong focus on supporting small and medium-sized businesses (SMBs), including updates to the Small Business Cybersecurity Corner website to make resources easier to find and use and drawing on contributed cybersecurity resources and feedback received from federal partners and the public.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Fiscal Year 2021 Cybersecurity and Privacy Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Trust Model for Security Automation Data 1.0 (TMSAD) say about 7. Processing Requirements? According to Trust Model for Security Automation Data 1.0 (TMSAD), 7. Processing Requirements: All implementations MUST implement the processing requirements specified in [XMLDSIG]. This section describes additional general processing requirements that implementations of the trust model MUST follow to correctly process the trust model.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trust Model for Security Automation Data 1.0 (TMSAD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.2.1 Base Equation according to NIST The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities According to The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities, 3.2.1 Base Equation: The base equation is the foundation of CCSS scoring. The CCSS base equation is identical to the CVSS base equation: ``` BaseScore = round_to_1_decimal(((0.6 * Impact) + (0.4 * Exploitability) - 1.5) * f(Impact)) Impact = 10.41 * (1 - (1 - ConfImpact) * (1 - IntegImpact) * (1 - AvailImpact)) Exploitability = 20 * AccessVector * Authentication * AccessComplexity f(Impact) = 0 if Impact = 0, 1.176 otherwise AccessVector = case AccessVector of requires local access: 0.395 adjacent network accessible: 0.646 network accessible: 1.0 Authentication = case Authentication of requires multiple instances of authentication: 0.45 ``` ``` requires single instance of authentication: 0.56 requires no authentication: 0.704 AccessComplexity = case AccessComplexity of high: 0.35 medium: 0.61 low: 0.71 ConfImpact = case ConfidentialityImpact of none: 0.0 partial: 0.275 complete: 0.660 IntegImpact = case IntegrityImpact of none: 0.0 partial: 0.275 complete: 0.660 AvailImpact = case AvailabilityImpact of none: 0.0 partial: 0.275 complete: 0.660 ``` The base equation does not include two of the base metrics: Exploitability Method and Privilege Level. Exploitability Method is used in the definitions for some of the base metrics, so it is used in choosing the associated values. Privilege Level is used by analysts when calculating certain environmental metrics.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.4 SECCM ROLES AND RESPONSIBILITIES according to NIST Guide for Security-Focused Configuration Management of Information Systems According to Guide for Security-Focused Configuration Management of Information Systems, 2.4 SECCM ROLES AND RESPONSIBILITIES: The set of roles (at the organization, mission/business process, and system level) that are relevant to the SecCM program are defined along with the responsibilities. The responsibilities are in the context of SecCM only and are not inclusive of other non-SecCM responsibilities the roles may also have. Typically, SecCM roles and responsibilities include:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Section 2.3 The Four-Party Model according to NIST A Credential Reliability and Revocation Model for Federated Identities According to A Credential Reliability and Revocation Model for Federated Identities, Section 2.3 The Four-Party Model: Recommendation 8: The types of attributes accepted by the federation are usually defined by the service providers of the federation. Attributes can be assigned by the identity provider to its users as either self-asserted or verified attributes. Where attributes serve a critical part in the roles or the functions a user is permitted to perform, it is important for attributes to be verified and upto-date. The identity provider, therefore, should check the authoritative source(s) for attribute updates (e.g., changes in the attribute qualification, revocation, suspension). Recommendation 9: As a benefit of using the same credential, and taking into account service provider feedback mechanisms, the authentication decisions by the attribute provider and identity provider should be based on the same status of the credential.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Credential Reliability and Revocation Model for Federated Identities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does National Online Informative References (OLIR) Program_ Submission Guidance for OLIR Developers say about Supportive Relationship Mapping OLIR? According to National Online Informative References (OLIR) Program_ Submission Guidance for OLIR Developers, Supportive Relationship Mapping OLIR: An OLIR that indicates how a supporting concept can or does help achieve a supported concept, with one of the concepts being a Focal Document Element and the other a Reference Document Element.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: National Online Informative References (OLIR) Program_ Submission Guidance for OLIR Developers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives provide? (Section 164) n the other hand, attractiveness of an intermediary function (by requirement holders, i.e., government) reference central authority. - o 'Decentralized' is quite overloaded in meaning and application. - Traceability Consideration - o Free and open-source software plays into the prime's deliveries (end deliveries to government and acceptance from suppliers). - o Is a supply chain traceability solution for software products a complete risk reduction solution? Knowing that software hasn't changed and where it came from may only cover a portion of risks specific to software products. - Company/Business Drivers - o Business Driver: rising incidence of counterfeit parts, resulting in increased support costs and brand reputation losses, among other things - o Focused on Identity and works out from it: central to broader array of traceability solutions - o Physical identity: gap in assurance between physical item and data about the physical item. - Supply Chain Risk Management - o Addresses risk associated with asserting genuineness and maintaining physical and digital data connections - o NIST 800-171 given as a reference for cyber security guidance in securing information and access. - Marketplace Positioning Model (Lens and Diffusion) - o Innovator tackling traditionally hard problem of object identification (as in serialized parts) and partnering with blockchain developers (e.g., Manufacturer X). - o Traditional solutions (serial numbers, stickers, barcodes, etc.) are not secure and are separable from objects, leaving them a mystery, and some parts are not subjectable to markings. - Win/Win and Production Possibility - o In addition to aiding a generalized security and sharing win/win by providing a way to uniquely identify objects, this technology moves the PPF by enabling ecosystem participants to maintain and share all their data, and also protect their IP by having a detailed and agile permissioning approach for the data.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist 800, fips, security control. General security reference material without sensitive content. Source: Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways say about 3.4.5 Scenario 4: Emergency mitigation (and backout if needed)? According to Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways, 3.4.5 Scenario 4: Emergency mitigation (and backout if needed): This is the emergency procedure in a crisis situation to temporarily mitigate risk for vulnerabilities prior to a vendor releasing a patch. It is typically required when the vulnerability is being actively exploited in the wild. The mitigation can vary and may or may not need to be rolled back afterward. The scope of targets is the same as Scenario 1. Organizations need to be prepared to quickly implement a wide variety of emergency mitigations to protect vulnerable devices. Without processes, procedures, and tools in place to implement emergency mitigations, too much time may be lost and vulnerable devices may be compromised before mitigations are in place. This may require disabling system functionality, having automated mechanisms to apply these changes, and having capabilities to revert back these changes when a permanent and approved patch is released.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Design Alternatives for Computer Network Security provide? (Section 58) , based on network topology, geographic distribution, or administrative boundries.* Such subdivisions would form the individual domains for the various Security Controllers as indicated in Figure 3-1. ' S ' ' ;' One other entity that would be needed if a network were to be interconnected with other dissimilar networks is also shown in Figure 3-1. This internetwork interface will be referred to as a "gateway" and would be needed due to differences between two nets in one or more protocol levels. These differences would be mediated by the gateway via transformations of the message * For purposes of discussion, we will typically consider the subdivision to be on the basis of topological structure, i.e., one SC per local subnet, but there is no inherent need for physical subsetting. For excimple, an ARPA-like network could be arbitrarily divided into subsets of HOST'S, with each subset forming the domain for one Security Controller. This flexibility is due to the way in which an entity is "attached" to an SC, namely by providing that SC (and only j that SC) with the value of a private code (key) that is associated with that entity. I I leaders, formats, etc. with the gateway appearing in an intermediate destination HOST (to limit the affected protocol levels to those of a HOST) . If such transformations are feasible for the two nets, the gateway would effectively reflect a foreign HOST as a pseudo-HOST at the local subnet. The gateway will be considered further in Section 3.3.4. The primary concern of this chapter will be with the specification of the Security Controller. Other entities such as users at terminals, HOST's, etc. will be considered as they affect the SC, but will not be our concern per se. The next lower level entities, the Intelligent Cryptographic Devices, will be mentioned as needed to define the interface and the requirements that are passed down by the SC, but will otherwise be deferred to Section 4.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Design Alternatives for Computer Network Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST_SP_800-37r2_Risk_Management_Framework say about ONGOING AUTHORIZATION? (Part 3) According to NIST_SP_800-37r2_Risk_Management_Framework, ONGOING AUTHORIZATION: or organizational policies. The authorizing official conveys updated risk determination and acceptance results to the senior accountable official for risk management or the risk executive (function). The use of automated support tools to capture, organize, quantify, visually display, and maintain security and privacy posture information promotes near real-time risk management regarding the risk posture of the organization. The use of metrics and dashboards increases an organization's capability to make riskbased decisions by consolidating data in an automated fashion and providing the data to decision makers at different levels within the organization in an easy-to-understand format. References: [SP 800-30]; [SP 800-39] (Organization, Mission/Business Process, and System Levels); [SP 800-55]; [SP 800-160 v1] (Risk Management Process); [IR 8011 v1]; [IR 8062].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance) provide? (Section 166) s power. 2. Tester brings the PIV Card back into range of the contactless reader. 3. Set sharedConnection := true 4. Set connectionDescription := <<valid connection>> 5. Create cardHandle reference 6. Call pivConnect with • (IN) sharedConnection • (INOUT) connectionDescription • (INOUT) CDLength • (OUT) cardHandle 7. Call pivSelect with (AID of the PIV Card) • (IN) cardHandle • (IN) applicationAID • (IN) AIDLength • (OUT) applicationProperties • (INOUT) APLength 8. Call pivGetData with (OID of the X.509 Certificate for Card Authentication) • (IN) cardHandle • (IN) OID • (IN) oidLength | | Expected Result(s) | • (INOUT) DataLength 1. Step 6 returns with status_word of PIV_OK and initialized cardHandle . 2. Step 7 returns PIV_OK and the initialized application properties reference. 3. Step 8 returns PIV_SM_FAILED . | | Postcondition(s) | Secure Messaging is not established | This appendix specifies the tests that shall be performed on PIV Card Applications. Unless otherwise specified: - Tests within a subsection titled 'Contact Interface' shall be performed over the contact interface of the PIV Card without the use of secure messaging. These tests shall be performed for all PIV Card Applications being tested.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security_ Selected Articles say about security? According to Computer Security_ Selected Articles, security: support of an attempted theft. Thus, it is inappropriate that the DP staff be put in the position of defining the controls through which such problems can be identified and minimized.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security_ Selected Articles.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1 say about 4. SCAP Processing Requirements and Recommendations? According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1, 4. SCAP Processing Requirements and Recommendations: This section defines the processing requirements that tools MUST follow in order to correctly process SCAP 1.1 content. This section also provides recommendations that are not mandatory; organizations are encouraged to adopt them to promote stronger interoperability and greater consistency. The topics covered in this section are legacy support, SCAP content validation, the <xccdf:Profile> element, and check system usage. The end of the section covers result-related topics: SCAP result data streams, XCCDF results, OVAL results, and OCIL results.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain hash function according to NIST Recommendation for Random Bit Generator (RBG) Constructions According to Recommendation for Random Bit Generator (RBG) Constructions, hash function: A (mathematical) function that maps values from a large (possibly very large) domain into a smaller range. The function satisfies the following properties: 1. (One-way) It is computationally infeasible to find any input that maps to any pre-specified output. 2. (Collision-free) It is computationally infeasible to find any two distinct inputs that map to the same output.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Bit Generator (RBG) Constructions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Situational Awareness for Electric Utilities provide? (Section 181) ovides a description of the risk analysis we performed. - Section 3.4.2, Security Control Map, maps the security characteristics of this example solution to cybersecurity standards and best practices. You might share the Executive Summary, NIST SP 1800-7A, with your leadership team members to help them understand the importance of adopting a standards-based situational awareness solution. IT professionals who want to implement an approach like this will find this whole practice guide useful. You can use the How-To portion of the guide, NIST SP 1800-7C, to replicate all or parts of the build created in our lab. The How-To guide provides specific product installation, configuration, and integration instructions for implementing the example solution. We do not recreate the product manufacturers' documentation, which is generally widely available. Rather, we show how we incorporated the products together in our environment to create an example solution. This guide assumes that IT professionals have experience implementing security products within the enterprise. While we have used a suite of commercial products to address this challenge, this guide does not endorse these particular products. Your organization can adopt this solution or one that adheres to these guidelines in whole, or you can use this guide as a starting point for tailoring and implementing parts of a solution that includes physical access control systems (PACS) operational technology (OT), IT systems, and business processes . Your organization's security experts should identify the products that will best integrate with your existing tools and IT system infrastructure. We hope that you will seek products that are congruent with applicable standards and best practices. Volume B, Section 3.5, Technologies, lists the products that we used and maps them to the cybersecurity controls provided by this reference solution.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Situational Awareness for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Automation Support for Security Control Assessments_ Software Vulnerability Management provide? (Section 9) mary focus of the VUL capability is on known vulnerabilities (e.g., CVEs), risk associated with unknown vulnerabilities is also addressed by the focus on common sources of software flaws (e.g., CWEs). NISTIR 8011, Volume 4 outlines detailed, step-by-step processes to automate the assessment of security controls that support vulnerability management implemented for a given assessment boundary (target network) and to apply the results to the assessment of all authorization boundaries within that network. A process is also provided to implement the assessment (diagnosis) and response to a discovered vulnerability. Automated testing related to the controls for the VUL capability, as outlined herein, is consistent with other NIST guidance. NISTIR 8011, Volume 4 documents a detailed assessment plan to evaluate the effectiveness of controls related to vulnerability management. Included are specific tests that form the basis for such a plan, how the tests apply to specific controls, and the resources needed to operate and use the assessment to mitigate defects found. For the VUL capability, it can be shown that the assessment of 87.5 % 2 of determination statements for controls in the NIST SP 800-53 Low- 2 Derived from the Control Allocation Tables (CAT) in this volume. With respect to security controls selected in the NIST SP 800-53 [SP800-53] Low-Medium-High baselines that support the VUL capability, 42 of 48 determination statements (87.5 %) can be fully or partially automated. Medium-High baselines can be fully or partially automated. The methods outlined here are designed to provide objective, timely, and complete identification of defects in the effectiveness of security controls supporting the VUL capability, facilitating risk management at a lower cost than manual assessment methods. Using security control defect information can drive the most efficient and effective responses to the security defects found.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Automation Support for Security Control Assessments_ Software Vulnerability Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: Security marking refers to the application or use of human-readable security

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-512 in Computer Security Division 2009 Annual Report? (Part 12) Control HA-512: s used in their small businesses. The draft of NISTIR 7621 was released for public comment in September 2009 and is planned for release as a final document in the first quarter of FY2010. Contact: Mr. Richard Kissel (301) 975-5017 richard.kissel@nist.gov ## Cryptographic Technology Group ## STRATEGIC GOAL Develop and improve mechanisms to protect the integrity, confidentiality, and authentic ity of federal agency information by developing security mechanisms, standards, testing methods, and supporting infrastructure requirements and procedures. ## Overview The Cryptographic Technology (CT) Group continues to make an impact in cryptography within and outside the federal government. Strong cryptography can be used to improve the security of systems and the information they process. IT users enjoy the enhanced availability of secure applications in the marketplace that is made possible by the appropriate use of cryptography. Our main work in this area addresses topics such as hash algorithms, symmetric and asymmetric cryptography techniques, key management and transport, authentication, cryptographic protocols, Internet security services, security applications, biometrics, and smart tokens. A few examples of the impact of our work are changes to how users authenticate their identities for online government services and new methods for authentication and key management of wireless applications. This work also supports the NIST's Personal Identity Verification (PIV) project in response to the Homeland Security Presidential Directive 12 (HSPD-12). The CT Group collaborates with national and international agencies, academic and research organizations, and standards bodies to develop interoperable security standards and guidelines.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, token. Contains security framework guidance for authentication systems. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet provide? (Section 189) | | T | | Req. # - ID | Ref. in Base Std. | Requirement Summary | L e v e l | Assertion ID | Test Assertion | N o t e s | Imp. Required | Imp. Support | Supporte d Range | Test Result | E n c .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Quarantine decision and enforcement according to Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways? Quarantine decision and enforcement: 6) The vulnerability management system shares the device patch level with the network access management system to be used for network access control. 7) The network access management system applies one of the following two enforcement actions: 7a) If the network device does not exceed the organizational patch threshold, the device is given network access and does not need to go through the remainder of the diagram. 7b) If the network device exceeds the organizational patch threshold, the network access management system performs quarantine actions on the endpoint and restricts network access. 8) The network access management system shares the missing patch information with the software and configuration management system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings provide? (Section 84) ; while ri = 1 means 'granted'. The set C is the crucial authorization decisions in R , which means any element rj in the set C must be 'granted', in order that the access be authorized. The above process can be generalized as [0,1] ∈ i r and 0 ≥ s F , when the provider is not so sure about his decision. In XPOLA-enabled Web services, when a user makes a remote call from the client side, the client program first performs a preliminary authorization check by matching the capability policy with the SOAP body content and the user's identity. If nothing violates the policy, it inserts the appropriate tokens into the SOAP header, including the signatures; otherwise, the client is refrained from invoking the request. Figure 6 The Processing Stack on the Service Side <!-- image --> On the resource side, when the Web service receives a remote call through a SOAP message, the processing node first authenticates it by checking the validity of the user's signature against the whole message. If nothing is wrong, the authorization processing node verifies the signature of the embedded capability token. It then does a series of matching operations, such as the capability issuer's DN and the actual resource provider's DN, the actual caller's DN and the allowed users' DNs, the operations specified in the capability and the ones in the SOAP body. It also checks whether the capability has expired against the time. At last, it peels off the capability token and passes the rest of the SOAP message on to the next processing node. The detailed diagram is showed in Figure 6. The client side policy checking prevents those unauthorized requests from reaching services and is able to prompt appropriate error information immediately to the users. Services thus need not waste their resources on processing these requests.

Explanation: NIST publication on credential and access management. Topics: authorization, pki, token. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessment of Access Control Systems provide? (Section 79) nforcing separation, consider the capabilities of a cashier and a cashier supervisor, where the capability to void erroneous cashier transactions is assigned to the cashier supervisors. Clearly, a user's ability to execute the capabilities of both cashier and cashier supervisor within a single subject would constitute a conflict of interest (i.e., a user acting as cashier would be able to void his or her own transactions). One prescribed approach to this security issue is to restrict any user from simultaneously obtaining membership to both cashier and cashier supervisor. However, such an approach could impose unacceptable operational restrictions (i.e., the users authorized for the role and capabilities of cashier supervisor would never be able to perform the functions of the cashier). Examples of SSOD policies are RBAC and RuBAC (Sections 3.4 and 3.5). SOD constraints may require that two roles be mutually exclusive, because no user should have the privileges from both roles. This might be done, for example, to deny any user the ability to both enter and authorize an order for disbursement of funds. However, permission 'escalation,' violating SOD requirements, may occur if a third role is assigned the requisite permissions without being included in SOD constraints. A user might have one of the mutually exclusive roles, yet acquire this third role and thereby gain the ability to violate the requirement that no individual can both enter and authorize funds disbursement. In an environment where there are numerous users, attributes, objects, and relations, safety needs to be carefully considered. Separation of duties can be enforced dynamically (i.e., at access time), and the decision to grant access refers to the past access history.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Assessment of Access Control Systems.