You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) say about Appendix B: Glossary? (Part 2) According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS), Appendix B: Glossary: nology changes. | | Archive facility | A facility used for long-term key and/or metadata storage. | | Audit log | A record providing documentary evidence of specific events. | | Audit administrator | An FCKMS role that is responsible for establishing and reviewing an audit log, assuring that the log is reviewed periodically and after any security-compromise-relevant event, and providing audit reports to FCKMS managers. | | Auditor | See Audit administrator . | | Authorization | The process of verifying that a requested action or service is approved for a specific entity. | | Availability | Timely, reliable access to information or a service. | | Backup facility | A redundant system or service that is kept available for use in case of a failure of a primary facility. | | Backup (key and/or metadata) | To copy a key and/or metadata to a medium that is separate from that used for operational storage and from which the key and/or metadata can be recovered if the original values in operational storage are lost or modified. | |--------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Backup (system) | The process of copying information or processing status to a redundant system, service, device or medium that can provide the needed processing capability when needed. | | Certification path | A chain of trusted public-key certificates that begins with a certificate whose signature can be verified by a relying party using a trust anchor, and ends with the certificate of the entity whose trust needs to be established. | | Ciphertext | Data in its encrypted form.

Explanation: NIST publication on credential and access management. Topics: authorization, key management. Contains security framework guidance for authentication systems. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain SP 500-304, Conformance Testing Methodology Framework for ANSI/NIST-ITL 1-2011 Update: 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biometric Information according to NIST Computer Security Division 2015 Annual Report According to Computer Security Division 2015 Annual Report, SP 500-304, Conformance Testing Methodology Framework for ANSI/NIST-ITL 1-2011 Update: 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biometric Information: Conformance testing measures whether an implementation faithfully implements the technical requirements defined in a standard. Conformance testing provides developers, users, and purchasers with increased levels of confidence in <!-- image --> product quality and increases the probability of successful interoperability. The CSD developed a conformance testing methodology framework for ANSI/NIST-ITL 1-2011 Update: 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biometric Information (AN-2013). This testing methodology framework defines the test assertions implemented within CSD's conformance test tool, which is designed to test implementations of AN-2013 transactions and promotes biometrics conformity assessment efforts. This initial document includes comprehensive tables of AN2013 requirements and test assertions for transaction-wide requirements and Record Type 1 (which is required for all transactions). The tables of requirements and assertions indicate which assertions apply to the traditional encoding format, the National Information Exchange Model (NIEM)compliant encoding format, or both encoding formats. The testing methodology framework defines and makes use of a specific test assertion syntax, which clearly defines the assertions associated with each requirement.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Computer Security Division 2015 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings provide? (Section 172) ntaining a full set of privileges, and is configured with its own PERMIS PDP. The PDP is configured with an attribute (or role) assignment policy (RAP) [7], so that it can validate the AA requests. At initialization time the DIS will check that its AC has the indirectIssuer extension in it, otherwise it will fail to start. When an AA asks for an AC to be issued, the DIS will check that the AA is allowed to do this under the RAP policy, and also that the set of attributes requested are a subset of those held by the DIS. Validation against the RAP is done by the existing PERMIS PDP code. It is passed the (unsigned) AC requested by the AA, and it validates the credentials in the AC against the RAP. The only modification needed to PERMIS is to provide it with a null signature validation object that will return signature valid to every request to validate the unsigned ACs. If the AC passes the policy, the DIS will check that the requested attributes are a subset of those it holds in its own AC. The task of the RP is now made much simpler, since it only needs to validate 1 or 2 ACs, that of the user issued by the DIS, and optionally that of the DIS issued by the SOA. Finally we wanted to simplify the use of PMIs in organizations that do not have fully functional PKIs implemented. These organizations, which are in the majority, already have a fully functional user authentication mechanism, and only have a handful of PKCs, e.g. web server certificates. It is for this reason that we have chosen to implement communications between the user and DIS as a three tiered model via an Apache web server as in path f in Figure 2. This will allow organizations to use their existing authentication method.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control FT-128 in Status Report on the Second Round of the NIST Lightweight Cryptography Standardization Process? (Part 77) Control FT-128: the selection process. Security . The design rationale, security analysis, and proofs provided by the submission team, as well as the third-party analysis, played a significant role in the selection. Analysis that covered only small number of rounds, and required significant time and memory complexities increased confidence in the claimed security margins. In some cases, third-party results raised concerns about the validity of security claims; in particular distinguishers on the underlying permutations or weak key classes were of concern. There were also attack results that invalidated security claims, such as practical forgery attacks or key recovery attacks. Performance . Software and hardware performance comparisons of the candidates were conducted by multiple public initiatives (see Section 4). Candidates that did not demonstrate significant performance benefits over current NIST standards were not favored for advancement. NIST also considered the stated goals of the candidate, performance across a variety of input sizes, and how candidates with similar features compared. Designs that demonstrated ample flexibility in selecting implementation trade-offs and could be applied to a wide variety of use cases with acceptable performance were favored. Tweak Plans . NIST also considered the tweak plans of the candidates (in particular, their impact on the performance and the security of the candidate) as a part of the evaluation. In general, tweaks requiring significant structural changes were not looked upon favorably during the selection. Diversity of Candidates . During the selection, NIST also considered the diversity of the finalists. When there were multiple promising candidates based on the same underlying primitive (e.g., permutation, block cipher, or tweakable block cipher), they were also compared to each other, and a subset of the candidates was selected from these candidates. NIST Portfolio .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Second Round of the NIST Lightweight Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain VENDOR: according to NIST Computer Security Training & Awareness Course Compendium According to Computer Security Training & Awareness Course Compendium, VENDOR:: RSH Consulting, Inc. 29 Caroline Park Newton, MA 02168 Bob Hansel: (617) 969-9050 This workshop provides basic information about the security features and capabilities of a Banyan VINES 5.x local area network. We will begin with an introduction to the VINES Network Operating System and its component services, such as Server Service, File Services, and VINES Security Service. We will also discuss the directory service StreetTalk and its role in security. Thereafter, user identification and authentication controls including Group and User Login parameters. Next, we will address resource access control, focusing on Access Rights Lists and console security. We follow this with a discussion on controls over WAN network links. Finally, we will address security administration and monitoring, this workshop will conclude with a discussion of tools and techniques for reviewing security in a VINES network. VM COURSE TITLE: SEC02-V: VM Security for Project Managers COURSE LENGTH: 2 DAYS

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.7.1. Awareness Activities according to NIST Building a Cybersecurity and Privacy Learning Program According to Building a Cybersecurity and Privacy Learning Program, 2.7.1. Awareness Activities: Cybersecurity and privacy awareness learning activities should be conducted on an ongoing basis throughout the year to ensure that employees are aware of their roles within the organization and the appropriate steps they must take to protect information, assets, and individuals' privacy. Activities can be campaign-oriented or ad hoc based on the subject matter, threats, or vulnerabilities or take place during seasonal events. Examples of awareness activities that are appropriate for all users include: - Messages on logon screens, organizational screen savers, and email signature blocks - Employee newsletters with cybersecurity and privacy articles - Posters (physical or digital) with cybersecurity and privacy tips - A Cybersecurity Awareness Month (October) or Data Privacy Awareness Week (January) activity fair - Cybersecurity and privacy reminders and tips on employee materials (e.g., pens, notepads, etc.) - Periodic or as-needed email messages that provide timely tips or are sent in response to a cybersecurity or privacy event or issue

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Building a Cybersecurity and Privacy Learning Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Security for Full Virtualization Technologies provide? (Section 18) ty of a full virtualization solution is heavily dependent on the individual security of each of its components, from the hypervisor and host OS (if applicable) to guest OSs, applications, and storage. Organizations should secure all of these elements and maintain their security based on sound security practices, such as keeping software up-to-date with security patches, using secure configuration baselines, and using host-based firewalls, antivirus software, or other appropriate mechanisms to detect and stop attacks. In general, organizations should have the same security controls in place for virtualized operating systems as they have for the same operating systems running directly on hardware. The same is true for applications running on guest OSs: if the organization has a security policy for an application, it should apply the same regardless of whether the application is running on an OS within a hypervisor or on an OS running on hardware. The security of the entire virtual infrastructure relies on the security of the virtualization management system that controls the hypervisor and allows the operator to start guest OSs, create new guest OS images, and perform other administrative actions. Because of the security implications of these actions, access to the virtualization management system should be restricted to authorized administrators only. Some virtualization products offer multiple ways to manage hypervisors, so organizations should secure each management interface, whether locally or remotely accessible. For remote administration, the confidentiality of communications should be protected, such as through use of FIPS-approved cryptographic algorithms and modules. Securing a hypervisor involves actions that are standard for any type of software, such as installing updates as they become available.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Security for Full Virtualization Technologies.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Wireless Infusion Pumps in Healthcare Delivery Organizations provide? (Section 370) eless Infusion Pumps 230 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P 1 8 0 0 - 8 . . 04:bd:88:b6:0e:f5 Friendly 0 0 Not Heard 04:bd:88:b6:10:00 Friendly 0 0 Not Heard 04:bd:88:b6:10:10 Friendly 0 0 Not Heard 04:bd:88:b6:10:15 Friendly 0 0 Not Heard 04:bd:88:b6:10:60 Friendly 2 0 Thu Aug 18 20:06:04 2016 04:bd:88:b6:10:65 Unclassified 2 0 Thu Aug 18 20:06:04 2016 04:bd:88:b6:10:70 Friendly 0 0 Not Heard 04:bd:88:b6:10:75 Friendly 0 0 Not Heard 04:bd:88:b6:10:b5 Friendly 0 0 Not Heard 62:6d:c7:27:a6:98 Unclassified 2 0 Thu Aug 18 20:06:04 2016 6c:72:20:3e:af:26 Friendly 0 0 Not Heard 6c:72:20:3e:af:28 Friendly 0 0 Not Heard 6c:72:20:3e:af:2a Friendly 0 0 Not Heard 88:dc:96:30:d9:1b Friendly 0 0 Not Heard 8a:dc:96:30:d9:1b Friendly 0 0 Not Heard 9a:dc:96:30:d9:1b Friendly 0 0 Not Heard e0:d1:73:02:b7:ab Friendly 0 0 Not Heard e0:d1:73:02:b7:af Friendly 0 0 Not Heard e0:d1:73:02:bc:2b Friendly 0 0 Not Heard e0:d1:73:02:bc:2f Friendly 0 0 Not Heard e0:d1:73:02:f6:6b Friendly 0 0 Not Heard e0:d1:73:02:f6:6f Friendly 0 0 Not Heard e0:d1:73:02:f9:4b Friendly 0 0 Not Heard e0:d1:73:02:f9:4f Friendly 0 0 Not Heard e0:d1:73:02:fa:4b Friendly 0 0 Not Heard e0:d1:73:02:fa:4f Friendly 0 0 Not Heard e0:d1:73:02:ff:1b Friendly 0 0 Not Heard e0:d1:73:02:ff:1f Friendly 0 0 Not Heard Rogue AP RLDP Configuration Rogue Location Discovery Protocol................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 11. System Interconnections/Information Sharing according to NIST Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations, 11. System Interconnections/Information Sharing: - A list of interconnected systems and system identifiers (if appropriate); provide the system, name, organization and system type (e.g., major application or general support system); indicate if there is an ISA/MOU/MOA on file, the date of any agreement to interconnect, the FIPS 199 category, the certification and accreditation status, and the name of the authorizing official.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Recommendation for Key Management_ Part 1 – General? (Part 32) Control HA-3: iterate the information. For example, erasing the information might require overwriting that information multiple times with other non-related information, such as random bits or all zero or one bits. Keys stored in memory for a long time can become 'burned in.' Splitting the key into shares that are frequently updated can mitigate this problem (see [DiCrescenzo]). beginning of the originator-usage period to the end of the recipient-usage period, although the originator-usage period has historically been used as the cryptoperiod for the key. Note that in some cases, predetermined cryptoperiods may not be adequate for the security life of the protected data. If the required security life exceeds the cryptoperiod, then the protection may need to be reapplied using a new key. Figure 1: Symmetric-key cryptoperiod <!-- image --> Examples of the usage periods for symmetric keys include the following: - a. When a symmetric key is only used for securing communications, the period of time from the originator's application of protection to the recipient's processing may be negligible. In this case, the key is authorized for either purpose during the entire cryptoperiod (i.e., the originator-usage period and the recipient-usage period are the same). - b. When a symmetric key is used to protect stored information, the originator-usage period (when the originator applies cryptographic protection to stored information) may end much earlier than the recipient-usage period (when the stored information is processed). In this case, the cryptoperiod begins at the initial time authorized for the application of protection with the key and ends with the latest time authorized for processing using that key. In general, the recipient-usage period for stored information will continue beyond the originator-usage period so that the stored information may be authenticated or decrypted at a later time. - c.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Fingerprint Identification and Mobile Handheld Devices_ An Overview and Implementation provide? (Section 12) communications interfaces. Extracted templates use 512 bytes per print, allowing up to 1000 fingerprint templates to be stored in on-board memory. Templates can also be exported and stored elsewhere. A temporary session key is used with a nonce to encrypt communications to/from the unit and protect against replay. Encryption uses the Data Encryption Standard (DES) 56-bit data Electronic Code Book (ECB) mode. Session keys are managed by the PDA, using a shared master key. The fingerprint handler for the lightweight solution, as all MAF handlers, runs in user space. The handler manages the mechanism by communicating with the kernel, the fingerprint reader, and the Opie plug-in containing its user interface components. It guides the placement and 1 More information about the FIU-300 can be found at removal of fingers during fingerprint scans and controls all the necessary steps regarding the authentication process and verdict determination. The handler is triggered by the MAF enabled kernel when the user tries to access a specific level that the handler protects, and after obtaining a live fingerprint scan of the user, replies to the kernel with the result of the authentication (success or failure). The fingerprint handler is a nonpolling one - once a user is authenticated, the mechanism does not need continual fingerprint authentication checks, as long as the policy level remains at that of the mechanism or higher. The handler uses the Opie plug-in to tell its UI to display informative messages to guide the user through the sign-on and enrollment steps. The type of interaction with the fingerprint reader depends on the device interface used (e.g., serial, USB, etc.) and the command set of the reader. In the case of the FIU-300, it uses the on-board capabilities of the device to acquire the fingerprint images and templates, control the matching process, and obtain the scores of matches.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Fingerprint Identification and Mobile Handheld Devices_ An Overview and Implementation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does System and Network Security Acronyms and Abbreviations provide? (Section 26) identifier IIF information in identifiable form IIHI individually identifiable health information IIS Internet Information Services IKE Internet Key Exchange IM instant messaging IMAP Internet Message Access Protocol IMEI International Mobile Equipment Identity IMSI International Mobile Subscriber Identity INCITS InterNational Committee for Information Technology Standards IP Internet Protocol IPA initial privacy assessment IPComp Internet Protocol Payload Compression Protocol IPng Internet Protocol Next Generation IPS intrusion prevention system IPsec Internet Protocol Security IPv4 Internet Protocol version 4 IPv6 Internet Protocol version 6 IPX Internet Packet Exchange IR infrared IR interagency report IRC Internet Relay Chat IrDA® Infrared Data Association® IRQ interrupt request line IRS Internal Revenue Service IRTF Internet Research Task Force IS information system ISA interconnection security agreement ISA International Society of Automation ISAC information sharing and analysis center ISAKMP Internet Security Association and Key Management Protocol ISAP Information Security Automation Program ISAPI Internet Server Application Programming Interface ISATAP Intra-Site Automatic Tunnel Addressing Protocol ISF Information Security Forum ISID Industrial Security Incident Database IS-IS Intermediate System-to-Intermediate System ISM industrial, scientific, and medical ISM information security marking ISMS information security management system ISO International Organization for Standardization ISP Internet service provider ISSEA International Systems Security Engineering Association ISSO information systems security officer

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: System and Network Security Acronyms and Abbreviations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Guide to IPsec VPNs? (Part 125) Control HA-1: t such as the current sequence number - A link to the IPComp state, if present - Flags indicating various properties (TFC padding, etc.) The maximum counters and lifetimes have a soft and hard value. When the soft value is reached, the kernel will notify the IKE daemon so that it can take preventative action. When the hard value is reached, the IPsec SA is deleted by the kernel, and the IKE daemon is notified. Each time a packet is encrypted or decrypted, this state is updated appropriately. ## 5.1.2 The Security Policy Database (SPD) The kernel maintains a list of IPsec policies in the SPD. The policy describes the nature of the traffic that matches a policy rule and links it to the state used to encrypt or decrypt the packet. Policies without states are used for on-demand IPsec connections. Figure 14 shows examples of two policies corresponding to the SAs in Figure 12. ``` src 192.168.13.6/32 dst 0.0.0.0/0 dir out priority 1040383 ptype main tmpl src 198.51.100.1 dst 203.0.113.1 proto esp reqid 1 mode tunnel src 0.0.0.0/0 dst 192.168.13.6/32 dir in priority 1040383 ptype main tmpl src 203.0.113.1 dst 198.51.100.1 proto esp reqid 1 mode tunnel ``` Figure 14: Examples of Policies Corresponding to Figure 12 on Linux The IPsec security policy information consists of: - The IP addresses of the IPsec gateways - The source IP addresses allowed in the classless inter-domain routing (CIDR) format - The destination IP addresses in CIDR format - The transport protocol covered (0 for all) - The source and destination port ranges (0 for all) 41 - A link to the associated SA state - Direction (inbound, outbound, or forward 42 ) - The priority of the policy compared to other policy rules - IPsec protocol (ESP, AH, IPComp) - Mode (transport or tunnel) - IPComp information Using the SPD and SAD, packets are processed for encryption and decryption, and all of the security policies are applied.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to IPsec VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about Implementation Tip? (Part 6) According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Implementation Tip: Historic Exhibition | Low | Low | Low | 25 High where safety of radioactive materials, highly flammable fuels, or transmission channels or control processes at risk.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Threat Analysis on UOCAVA Voting Systems say about 6.3.5 Web-Based? (Part 1) According to A Threat Analysis on UOCAVA Voting Systems, 6.3.5 Web-Based: 6.3.5 Web-Based Web-based Internet voting is a form of electronic voting. The election web server would need to be trusted to accurately record voters' selections. Defects in the voting system software, or malicious code installed on the voting system by hostile individuals, could cause votes to be recorded improperly, or could modify votes at a later time. Skilled hackers may find vulnerability in the voting system software that would grant them access to voter and ballot information. This could also lead to a loss of voter secrecy, or a loss of election integrity. Sophisticated attacks would leave little or no evidence. Election officials, or other individuals with physical access to voting system equipment, may be able to gain access to election information, including cast ballots. Sophisticated attackers may also be able to delete any audit records that would leave evidence of their attack. Denial of service attacks are significant threats to Internet-based voting systems. A successful denial of service attack would overwhelm the election web server with traffic, preventing legitimate voters from casting a ballot. It is very difficult to protect against denial of service attacks from an attacker with a large amount of resources. A successful denial of service attack generally requires access to a large number of computers with high-speed Internet connections. While an attacking organization may purchase these systems, it typically would use a Botnet. A Botnet is a collection of personal computers that have been infected with a virus that gives an attacker control of the computer. Control of Botnet-infected computers is sold on the black market, given nearly anyone with financial resources the technical resources to perform a denial of service attack. Many of the potential threats to a web-based Internet voting system involve attacks on equipment that are not under election officials' control. Attacks on the DNS system could lead voters to fraudulent web sites.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Threat Analysis on UOCAVA Voting Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) say about Appendix B: Glossary? (Part 17) According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS), Appendix B: Glossary: tographic protection and removing or verifying the protection that has been applied. This includes parties relying on the public key in a public key certificate and parties that share a symmetric key. | |-------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Role-based authentication | A process that provides assurance of an entity's role by means of an authentication mechanism that verifies the role of the entity. Contrast with identity-based authentication | | Scalability testing | Testing the ability of a system to handle an increasing amount of work correctly. | | Secret key | A cryptographic key used by a secret-key (symmetric) cryptographic algorithm and that is not made public. | | Security assessment | An evaluation of the security provided by a system, device or process. | | Security strength | A number associated with the expected amount of work (that is, the base 2 logarithm of the number of operations) to cryptanalyze a cryptographic algorithm or system. | | Security testing | Testing that attempts to verify that an implementation protects data and maintains functionality as intended. | | Self testing | Testing within a system, device or process during normal operation to detect misbehavior. | | Semantics | The intended meaning of acceptable sentences of a language.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Design Alternatives for Computer Network Security say about 3.3 THE SECURITY CONTROLLER MECHANISMS FOR ESTABLISHING A CONNECTION? According to Design Alternatives for Computer Network Security, 3.3 THE SECURITY CONTROLLER MECHANISMS FOR ESTABLISHING A CONNECTION: If the requested access of a subject to an object is authorized, the SC must then create a working connection between these two parties . The notion of "creating a connection" involves several levels of protocol, and therefore is dependent upon the physical and logical organization of the network. However, we will assume that the following functions must be performed in any network, and will address the issues related to these aspects. - Control over the initial requestor-to-SC connection. - Determining the path for the control messages that are used to create a working connection between the requestor and the resource - Handling exceptional conditions on a set-up attempt. - Crossing inter-network boundaries (gateways) - Initial control message contents, e.g., should requestor profile information be sent?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Design Alternatives for Computer Network Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation say about ACKNOWLEDGMENTS? (Part 1) According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, ACKNOWLEDGMENTS: ACKNOWLEDGMENTS We are grateful to the following individuals for their generous contributions of expertise and time. | Name | Organization | |--------------------|--------------------------------------------------| | Tim Battles | AT&T | | Jay Borkenhagen | AT&T | | Chris Boyer | AT&T | | Nimrod Levy | AT&T | | Kathryn Condello | CenturyLink | | Christopher Garner | CenturyLink | | Pete r Romness | Cisco Systems | | Tony Tauber | Comcast | | Jonathan Morgan | Juniper Networks | | Carter Wyant | Juniper Networks | | Oliver Borchert | NIST ITL Advanced Networks Technologies Division | | Name | Organization | |----------------------|--------------------------------------------------| | Koti kalapudi Sriram | NIST ITL Advanced Networks Technologies Division | | Sean Morgan | Palo Alto Networks | | Tom Van Meter | Palo Alto Networks | | Andrew Gallo | The George Washington University | | Sophia Applebaum | The MITRE Corporation | | Yemi Fashina | The MITRE Corporation | | Susan Prince | The MITRE Corporation | | Susa n Symington | The MITRE Corporation | The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Telehealth Remote Patient Monitoring Ecosystem say about 5.5 Identity Management, Authentication, and Access Control (PR.AC and PR.AC-P) Protective Technology (PR.PT-P)? (Part 4) According to Securing Telehealth Remote Patient Monitoring Ecosystem, 5.5 Identity Management, Authentication, and Access Control (PR.AC and PR.AC-P) Protective Technology (PR.PT-P): ords that relate to the patient and the RPM equipment that the patient receives. Patient-provided (e.g., 'bring your own device') biometric devices were excluded in this practice guide's architecture. The telehealth platform provider manages patient home-deployed components and, thus, assures that PR.AC-6 and PR.AC-P6 are addressed. For this practice guide, the telehealth platform provider manages components that it procured and configured. The telehealth platform provider configures the devices to include authenticators that enforce component authentication. For this practice guide, only biometric devices that are managed by telehealth platform providers are provisioned authenticators. This implements PR.AC-7 and PR.AC-P6. Patient homes may include other devices, such as personally-owned devices, that are not a part of the RPM ecosystem. Devices that are not managed by telehealth platform providers do not have authentication credentials for the RPM solution. One should note that this practice guide simulated a telehealth platform provider when exploring biometric devices that communicate over broadband.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements provide? (Section 21) \_2.3.xsd Definition: The Name Matching specification defines the procedures for comparing WFNs to each other with the purpose of determining whether they refer to some or all of the same products. Definition: The Dictionary specification defines the concept of a CPE dictionary, which is a repository of CPE names and metadata, with each name identifying a single class of IT product. The Dictionary specification defines processes for using the dictionary, such as how to search for a particular CPE name or look for dictionary entries that belong to a broader product class. Also, the 7 See the Table 2: Approved OVAL Platform Schema Versions of the SCAP 1.3 annex document, [NIST SP 800-126A], for the OVAL component specification (core schema) versions and platform schema versions that are supported by SCAP 1.3. Dictionary specification outlines all the rules that dictionary maintainers MUST follow when creating new dictionary entries and updating existing entries. Schema Locations: CPE.Applicability LanguageDefinition: The Applicability Language specification defines a standardized structure for forming complex logical expressions out of WFNs. These expressions, also known as applicability statements, are used to tag checklists, policies, guidance, and other documents with information about the product(s) to which the documents apply.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Data Network Systems (SDNS) Key Management Documents provide? (Section 10) | 2.4.1. Transport Protocol (TP) Class 4 | 4 | | | | 2.4.2. Transport Protocol (TP) Class 0 | 4 | | | | 2.4.3. DoD Transmission-Control-Protocol (TCP) | 4 | | 2.5 | Network Layer Protocols | Network Layer Protocols | 5 | | | 2.5.1. ISO Connectionless-mode-Network-Protocol (CLNP) | 2.5.1. ISO Connectionless-mode-Network-Protocol (CLNP) | 5 | | | 2.5.2. DoD Connectionless-mode Internet Protocol (IP) | 2.5.2. DoD Connectionless-mode Internet Protocol (IP) | 5 | | | 2.5.3. CCITT X.25 Packet Layer Protocol (PLP) | 2.5.3. CCITT X.25 Packet Layer Protocol (PLP) | 5 | | 2.6 | Data Link and Physical Layer Protocols | Data Link and Physical Layer Protocols | 5 | | | 2.6.1. | Direct Dial Public Switched Telephone Network Data Link and Physical Layers | 5 | | | 2.6.2. | IEEE 802.x Data Link and Physical Layer Protocols | 6 | | | 2.6.3. | CCITT X.25 Data Link and Physical Layer Protocols | 6 | '] - r-. ' a , . r I i -r:' •> ' * < a - a*:' f !' ' -,r<-. ai ' "??;/ -! - ' ;- ' ' . '<J '• '] . <- . V'.. Iqo /. lo ble.n 'bnB>,5>qoa8.^\J|; V :s.i ? 0 V/ 0 1m fc 30/i )o wU;^ .3? lcn;ar/i r^n.liaOfiltjgA ,|.,S- vl ('(Si- •.•>'>o;«;;''i'^ -(ioirfsaS iojuo, laii/qSMKlT hogeiiBi'l' ; .fi.fr.S ffi.D '• nobeiniefi b iT GoCf , S^^kSr^-.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cloud Computing Synopsis and Recommendations say about Table of Contents? (Part 10) According to Cloud Computing Synopsis and Recommendations, Table of Contents: | 5.3.4 Platform Responsibilities Managed by Providers........................................ | 5-4 | | | 5.3.5 | Savings in Up-front Costs ..........................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cloud Computing Synopsis and Recommendations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-6 in NIST_SP_800-37r2_Risk_Management_Framework? (Part 234) Control AM-6: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ involve co-authorizing officials. 116 If so, agreements are established between the co-authorizing officials and documented in the security and privacy plans. Authorizing officials are responsible and accountable for ensuring that authorization activities and functions that are delegated to authorizing official designated representatives are carried out as specified. For federal agencies, the role of authorizing official is an inherent U.S. Government function and is assigned to government personnel only. ## AUTHORIZING OFFICIAL DESIGNATED REPRESENTATIVE The authorizing official designated representative is an organizational official designated by the authorizing official who is empowered to act on behalf of the authorizing official to coordinate and conduct the day-to-day activities associated with managing risk to information systems and organizations. This includes carrying out many of the activities related to the execution of the RMF. The only activity that cannot be delegated by the authorizing official to the designated representative is the authorization decision and signing of the associated authorization decision document (i.e., the acceptance of risk). ## CHIEF ACQUISITION OFFICER The chief acquisition officer is an organizational official designated by the head of an agency to advise and assist the head of agency and other agency officials to ensure that the mission of the agency is achieved through the management of the agency's acquisition activities.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Network Security Center_ a System Level Approach to Computer Network Security provide? (Section 29) ced. 1.2.4 Cryptographic Mechanisms. Development of the NBS standard encryption algorithm has made it feasible to consider using encryption techniques as a part of the reference enforcement mechanism. The tutorial recommended a close functional relationship between the NSC and the encryption mechanism. The advantages of that approach can still be obtained when the two implementation levels are more completely separated. Section 2 of this report describes in more detail these cryptographic approaches. To more clearly describe the function of the NSC and how it interacts with other components of a network, the decomposition of a network is described in terms of distinct implementation levels. This decomposition is somewhat idealized, in that many existing networks do not evidence a clean separation into levels. However, it will serve as a good framework for analysis, as well as a guideline for future network development. The levels concept is a way of examining the various communications functions existing in a computer network. This concept was originally developed to describe intercomputer networks, and in particular the logical message flow within the network. For example, a user at one network site wishes to send a message of some sort to another user at a different site and he is not particularly concerned how that message gets there, merely that it does arrive unaltered and in a timely manner. Figure 1-1. Logical Vs. Actual Message Flow <!-- image --> Therefore we can think of a user level where messages are transmitted back and forth. In actuality, however, the messages may go "down" to another level, or "down" through several levels, before the actual physical message transmission takes place. At the user level messages are composed and then handed to the next level to be handled and routed as appropriate. Each level would see the level (s) below it as the message carrier. The interface between any two levels would be relatively simple.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Network Security Center_ a System Level Approach to Computer Network Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Availability according to NIST Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Availability: The availability impact level is based on the specific mission and the data supporting that mission, not on the time required to re-establish access to worker safety information. The effects of disruption of access to most worker safety information or information systems would have a limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for worker safety information is low .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TA-0 in Guidelines for Managing the Security of Mobile Devices in the Enterprise? (Part 28) Control TA-0: violations | | Wireless eavesdropping | • Use of secure connections to resources (e.g., VPN) • Mobile threat defense | | Threats | Mitigations and Countermeasures | |-------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Mobile malware | • User education • Security-focused device selection • Rapid adoption of software updates • Application vetting • OS and application isolation • Mobile threat defense | | Information loss due to insecure lock screen | • EMMtechnologies • Mobile device security policies • User education | | User privacy violations | • User education • EMMtechnologies • Application vetting | | Data loss via synchronization | • EMMtechnologies • Mobile device security policies • User education | | Shadow IT usage | • Mobile device security policies • User education | | Exploitation of vulnerabilities within the underlyingEMM platform | • Cybersecurity recommended practices • User education | | EMMadministrator credential theft | • Additional authentication for system administrators | | Insider threat | • EMMtechnologies • Mobile device security policies • User education | ## 4.3.1.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, malware. Contains technical security guidance that could inform defensive posture. Source: Guidelines for Managing the Security of Mobile Devices in the Enterprise.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations say about Sample Level 2 Text? According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, Sample Level 2 Text: [The mission and business process's] C-SCRM Program shall: - Operate in accordance with the requirements and guidance set forth by [the enterprise's] C-SCRM Program; - Collaborate with the C-SCRM Program Management Office (PMO) to apply the C-SCRM practices and capabilities needed to assess, respond to, and monitor cybersecurity risks arising from pursuit of [the mission and business process's] core objectives; - Integrate C-SCRM activities into applicable activities to support [the enterprise's] objective to manage cybersecurity risks throughout the supply chain; - Assign and dedicate the resources needed for coordinating C-SCRM activities within [the mission and business process]; - Identify [the mission and business process's] critical suppliers, and assess the level of risk exposure that arises from that relationship; - Implement risk response efforts to reduce exposure to cybersecurity risks throughout the supply chain; and - Monitor [the mission and business process's] ongoing cybersecurity risk exposure in the supply chain profile, and provide periodic reporting to identified enterprise risk management and C-SCRM stakeholders.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about Examine? According to Assessing Security Requirements for Controlled Unclassified Information, Examine: [SELECT FROM: access control policy and procedures; privacy and security policies, procedures for system use notification; documented approval of system use notification messages; system audit records; user acknowledgements of system use notification messages; system design documentation; system configuration settings; system use notification messages; system security plan; other relevant documents or records]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cell Phone Forensic Tools_ an Overview and Analysis Update provide? (Section 189) scenarios, then completely drained of all battery power and reacquired. All data was found as reported above. (Above) The following scenarios were conducted on an unlocked Motorola V300 GSM phone. Connectivity was established using Susteen's Motorola 2 Penguin cable. Connectivity and Retrieval: Proper authentication had to be provided to the password-protected device and the SIM card had to be inserted before contents were successfully acquired. Basic subscriber information (i.e. IMEI/ESN) was found and reported. Memory size is not reported. (Meet) PIM Applications: All active phone book entries were found and reported. Active calendar entries were found. Deleted PIM data was not found. (Below) Dialed/Received Phone Calls: Dialed/received phone calls were not found. (Miss) SMS/MMS Messaging: All active incoming and outgoing SMS messages were found and reported. Deleted SMS and MMS message data (i.e., images, sound bytes) were not found. (Below) Internet Messaging: No data was found. (Miss) Web Applications: Visited URLs, search queries performed, textual Web content and graphical images of visited sites were not found. (Miss) Text File Formats: Data content associated with text files (e.g., . txt , . doc , . pdf ) was not found. (Miss) Graphics Files Format: A connection could not be established allowing the transfer of graphic files (e.g., . bmp , . jpg , . gif . png , . tif ) to the Motorola V300. Images were created by using the picture camera. Active data was found and reported. (Meet). Compressed File Archive Formats: N.A. - The Motorola V300 does not support compressed archive files (e.g., . zip , . rar , . exe , . tgz ). (NA) Misnamed Files: N.A. - The Motorola V300 does not support misnamed files (e.g., . txt file renamed with a . dll extension). (NA) Peripheral Memory Cards: N.A. - The Motorola V300 does not allow for removable media. (NA) Acquisition Consistency: N.A.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does An Introduction to Information Security say about 6.2 Select? According to An Introduction to Information Security, 6.2 Select: The second step of the RMF process involves selecting an initial set of baseline security controls for the system based on the security categorization as well as tailoring and supplementing the security control baseline as needed based on an organizational assessment of risk and local 7 The National Archives and Records Administration (NARA) has developed a Controlled Unclassified Information (CUI) Registry. The CUI Registry is an online repository for information, guidance, policy, and requirements on handling CUI, including issuances by the CUI Executive Agent. The registry is available at conditions. Security control selection guidance is provided in NIST SP 800-53 and in FIPS 200 .

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: An Introduction to Information Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-128 in A Framework for Designing Cryptographic Key Management Systems? (Part 111) Control ES-128: luding all its security functions. FR:9.5 The CKMS design shall specify all self-tests created and implemented by the designer and the corresponding CKMS functions whose correct operation they verify. ## 9.5 Scalability Testing Scalability is the ability of a system, network, or process, to correctly process increasing amounts of work in a graceful manner, or its ability to be enlarged to accommodate that increase. Scalability testing involves testing a device or system to learn how it reacts when the number of transactions to be processed or participants to be handled over a given period of time increases dramatically. Every device has its limitations, but some device designs scale better than others. If systems are not designed for modular scalability, adding additional devices may not be feasible. In addition, subtle problems often arise that cannot be solved by simply buying more equipment. Scalability testing is used to stress devices and systems so that these problems are known and mitigated before they become fully operational. FR:9.6 The CKMS design shall specify all scalability analysis and testing performed on the system to date. ## 9.6 Functional Testing and Security Testing The types of tests previously described can be performed to meet particular test goals. Functional testing attempts to verify that an implementation of some function operates correctly. A functional test might determine that a cryptographic algorithm implementation correctly computes the ciphertext from the plaintext, given the key. Security testing attempts to verify that an implementation functions securely. A security test might determine that, while a cryptographic algorithm implementation functions correctly (i.e. it produces the correct results), fluctuations in power consumption during the cryptographic process could lead to the compromise of the key.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Framework for Designing Cryptographic Key Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.3. Model according to NIST Secure Data Network Systems (SDNS) Key Management Documents According to Secure Data Network Systems (SDNS) Key Management Documents, 6.3. Model: The KMAP comprises two parts: the information processor part and the communication part represented by the KMAE. When communication is required between two KMAPs, an application association is established between invocations of the processes' KMAEs. The KMAE represents an addressable set of communication capabilities which are defined by the KMASE and the ACSE. During the use of the KMASE services, the existence of an application association between cooperating KMAEs is presumed. The nature and purpose of communication over the application association are determined by the information processing context and the application context which are established for it. Note that each application association may be identified in an end system by an internal, implementation dependent, mechanism so that the KMASE service user, the KMASE, and the ACSE can refer to it. The KMASE is driven by service request and response primitives from the KMAP and by indication primitives from the presentation service provider. The KMASE, in turn, issues indication and confirm primitives to the KMAP and request primitives to the ACSE and the presentation service provider. The KMAP administers the K-MIB and the TEK-MIB in the sense of updating data in the IB upon receipt of indications and confirms and retrieving parameters from the IB when issuing requests and responses. K-MIB is a security MIB used to store key material. TEK-MIB is a security MIB used to store TEK, key identifiers (KIDs) and attributes regarding the use of the TEK.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-8(5) in Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management? (Part 101) Control CM-8(5): s, configuration/connection requirements, and implementation guidance for organization-controlled mobile devices being established or implemented related to this control item might be the cause of ... | |------------------------------|-------------------|----------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | AC-19(a)(1) | HWAM- L01 | Devices moving into/out of the assessment boundary | devices not being adequately prepared for movement into or out of the assessment boundary. | | AC-19(a)(1) | HWAM- L06 | Subcomponents not authorized | a device with unauthorized subcomponents or a device lacking required subcomponents being found in the assessment boundary. | | AC-19(a)(1) | HWAM- L09 | Proposed changes are too old | requested changes not being addressed in a timely manner. | ## 3.3.3.2 Control Item AC-19(b): ACCESS CONTROL FOR MOBILE DEVICES ## Control Item Text: Control: The organization: - b. Authorizes the connection of mobile devices to organizational systems.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Best Practices for Privileged User PIV Authentication provide? (Section 11) ly allocated to system, network, security, and database administrators, as well as other IT administrators. Privileged accounts are exceptionally attractive targets for attackers of High Value Assets. A higher level of assurance than what is provided by single-factor authentication is therefore required for privileged users since unauthorized access to administrator capabilities can have catastrophic adverse effects on agency operations, assets, and/or individuals. As stated in the CSIP, 'The Cybersecurity Sprint directed agencies to immediately implement PIV for […] 100% of privileged users.' [1] The reason for this directive is that 'Although there is no single method by which all cyber incidents can be prevented, improving the access management of user accounts on federal information systems could drastically reduce current vulnerabilities. Privileged user accounts are a known target for malicious actors but can be protected by an existing, strong authentication solution: Personal Identity Verification (PIV) credentials. Implementing strong authentication PIV credentials, as directed in Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors (HSPD-12) and Federal Information Processing Standard (FIPS) 201-2: Personal Identity Verification (PIV) of Federal Employees and Contractors , is a costeffective and immediate action that agencies should take to drastically reduce their risk profiles. PIV credentials […] reduce the risk of identity fraud, tampering, counterfeiting, and exploitation.' [1] Agencies are required to perform a risk assessment to determine the level of assurance requirements of their systems according to OMB Memorandum 04-04 (M-04-04), EAuthentication Guidelines for Federal Agencies [7] (see Section 2.3).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Best Practices for Privileged User PIV Authentication.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Report of the Workshop on Cryptography in Support of Computer Security provide? (Section 41) to four major clusters , namely: - . Mathematical and statistical aspects, - . Engineering aspects of designing and constructing encryption/ decryption devices and their host systems and networks - . Associated protection measures integral to the employment of data encryption , and - . The technical and administrative management technologies leading to optimal use of data encryption procedures; key management; administrative security procedures; and monitoring, evaluating and auditing encryption performance. NBS has attempted to provide to the public domain, without affecting National Security , government expertise and guidance in the proper application of cryptography as an aid in the protection of information , the maintenance of privacy and the prevention of computer abuse. NBS recognized in 1971 that the lack of any market for data encryption (outside the National Security Community) would severely constrain industrial motivation to develop additional expertise . Similarly , we knew that the long history of disinterest , the lack of formal academic structure and the almost non-existent supply of teachers would severely dampen academic motivation. Indeed, the development of technology has been slow. The major constructive changes to data are exemplified by: . The development of product lines of encryption devices incorporating the proposed NBS data encryption standard by a number of commercial vendors, . The increasing number of scientific and technical papers on the several technologies associated with cryptography which are being presented at professional meetings . The development by the Federal Reserve Board of a specification for a cryptographic device using DES to secure the data links of the Federal Reserve Communications System, and .

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Report of the Workshop on Cryptography in Support of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to SSL VPNs say about 2.1 The Need for Network and Transport Layer Security? (Part 4) According to Guide to SSL VPNs, 2.1 The Need for Network and Transport Layer Security: ion layer controls because of the difficulties in adding controls to individual applications. Network layer controls also provide a way for network administrators to enforce certain security policies. Another advantage of network layer controls is that since IP information (e.g., IP addresses) is added at this layer, the controls can protect both the data within the packets and the IP information for each packet. However, network layer controls provide less control and flexibility for protecting specific applications than transport and application layer controls. SSL tunnel VPNs provide the ability to secure both TCP and UDP communications including client/server and other network traffic, and therefore act as network layer VPNs. -  Data Link Layer. Data link layer controls are applied to all communications on a specific physical link, such as a dedicated circuit between two buildings or a dial-up modem connection to an Internet Service Provider (ISP). Data link layer controls for dedicated circuits are most often provided by specialized hardware devices known as data link encryptors ; data link layer controls for other types of connections, such as dial-up modem communications, are usually provided through software. Because the data link layer is below the network layer, controls at this layer can protect both data and IP information. Compared to controls at the other layers, data link layer controls are relatively simple, which makes them easier to implement; also, they support other network layer protocols besides IP. Because data link layer controls are specific to a particular physical link, they cannot 2 Several Request for Comment (RFC) documents from the Internet Engineering Task Force (IETF) define S/MIME, as well as standards for using it to protect email messages. One example is RFC 3852, Cryptographic Message Syntax (CMS) , available at 3 TLS is the standards-based version of SSL version 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to SSL VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CS-3 in U.S. Department of Energy Risk Assessment Methodology? (Part 63) Control CS-3: 'ra, :,<..i KA b;,.. ;•'. -id! '>•- i,^*^ ;'M *j -j ;: . i- . ...v, I*' ' ' .(c- .-t'fy'fy. k. ' y\ 'i: .' r;V'.-tf# .. Wfcnv, .. i«i^(||l^ii(V-' *"•>•.'. 1 «fc ^•^il.Vi •.. wfV' ' ^''^ ..,.:r,) - ^fUf -ll : *»V' -5t;y.p/7' ,|, .f. r-lf. •'•1.'./ '^j. ' ,,-/^iii.t--- 'jrt,.' ';-/i.;. 'Y:',^..,(i!''"ft' .y :.,t *^,^ vo*st, 5i'''4l?16it^ ^,i:it^''i 'Off . ?j| . ' Tt I ^:. '.' r - y i'4 sit?''''T''.'7',. •• f'w vr«* ' n/ •. ' j',"' VN ^ ' H » 4m ;ar'^jq^r,.i((4iv "' 5 :i'rti i>a/i . ..' . . , -r., ,rr'^,^-\* *^.,7r. lnii,Sim.>SU,cLr^L -.r-f, >(n?/'ft«Sf,^' WjfltWSswef;?. $:yiM.oCiafil- '^'S tt-^'iBf^'l^fe^tt^ ,A^A</',ftvaiW "-rs' fs-ns^'sri'Sr-'sir.'- :' ' k If- <r' .•uTrffcn'w' >#*>.lV'i!''3:. -''!? 't'i- f, -^01 ) tfti '& -ifwvf aW/StVO^'*' .f4i>iwV' W' t' .»^Y<^y*ilifcrWVS ;.d j 'f-" - '3:.o- .ci'J'i.i).te. : . fe:(t^vjf| ,j.' ,f ' I>nj£ rdT nff((jL<i-^ • - ..' I ^ '<iT^i'! AU'<:'- .'^: ^ ,'; 4 -v" A', .', .f : 7 a 1 i: ^ \| I f>'ayf »i»»* 'T*T(l'lf " v* J f| V,l:» ## STEP 3 \ ## REVIEW BASELINE SECURITY REQUIREMENTS (BLSRs) AND IDENTIFY THOSE NOT MET OR PARITALLY MET ## STEP 3 GENERAL PURPOSE OF STEP 3 : The purpose of Step 3 is to determine whether your system's hardware, software, and data - as they exist today in their current operating environment and utilized by you and your organization - meet the minimum Baseline Security Requirements (BLSRs) set forth in applicable DOE Orders. In the previous step you identified whether your system was involved in sensitive unclassified or classified processing. In this step, you are asked to review brief lists of security countermeasures (requirements) that MUST be in place, per DOE order, to protect such processing.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: U.S. Department of Energy Risk Assessment Methodology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE) provide? (Section 139) d initiate the events. The threat events used for the example solution are described below. These threat events describe how the mobile devices in Orvilia might be compromised by malicious activities. All of the threat events map to both threat sources identified in Section F.1.6. Orvilia examined the sample tables in NIST SP 800-30 Revision 1-Tables E-1, E-2, E-3, E-4, and E-5-and analyzed the sources of mobile threats identified in Task 1-4. Using this process, Orvilia leadership identified the following threat events. A mobile application can attempt to collect and exfiltrate any information to which it has been granted access. This includes any information generated during use of the application (e.g., user input), usergranted permissions (e.g., contacts, calendar, call logs, camera roll), and general device data available to any application (e.g., International Mobile Equipment Identity, device make and model, serial number). Further, if a malicious application exploits a vulnerability in other applications, the OS, or device firmware to achieve privilege escalation, it may gain unauthorized access to any data stored on or otherwise accessible through the device. Malicious actors may create fraudulent websites that mimic the appearance and behavior of legitimate ones and entice users to authenticate to them by distributing phishing messages over short message service (SMS) or email. Effective use of social engineering techniques such as impersonating an authority figure or creating a sense of urgency may compel users to forgo scrutiny of the message and proceed to authenticate to the fraudulent website; it then captures and stores the user's credentials before (usually) forwarding them to the legitimate website to allay suspicion. Malicious actors may send users SMS or email messages that contain a uniform resource locator (URL) where a malicious application is hosted.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.4 Electronic Mail according to NIST Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters According to Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters, 4.4 Electronic Mail: Blank electronic ballots should be prepared as described in Section 4.2.5 to ensure the files have the best possible chance of being successfully delivered to voters, and contain the accurate candidate and ballot question information. Jurisdictions should follow their standard procedures for ensuring these blank ballots are correct before e-mailing them to voters. Jurisdictions should beware of spam filters which may inadvertently mark their messages as spam and not display it to users. It is difficult to ensure that e-mails sent by jurisdictions will not be marked as spam. As previously noted, use of DomainKeys Identified Mail [10] on the jurisdiction's e-mail server may reduce the changes of outgoing e-mail being marked as spam. Jurisdictions may also consult the Message Anti-Abuse Working Group's Sender Best Communications Practices for additional technical measures [13]. E-mails should be addressed to voters individually, rather than sending a single e-mail to a group of voters. The 'Reply-to' and 'From' fields of the outgoing e-mail should be set to an e-mail account monitored by election officials. Election officials should closely monitor this e-mail account for any error messages that indicate a message was not properly received by the voter. Some types of e-mail error messages were described in Section 2.2.2.2. Election officials should read the error message to determine the nature of the problem and remedy it if possible, as it may be a sign of a technical malfunction. If the problem cannot be remedied, election officials should apply the same procedures used by the jurisdiction when it has evidence that a mailed ballot did not reach its destination.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity of Genomic Data say about 5.5.1. Use Case Description? According to Cybersecurity of Genomic Data, 5.5.1. Use Case Description: The target stakeholder would be a small organization, such as a university or start-up, that wants to aggregate and process genomic data. A start-up has important intellectual property that needs to be protected. A university may want to utilize NIH genomic data and must implement NIH cybersecurity and privacy requirements. Both need a solution to manage the risk of aggregating and processing genomic data that can be done in a timely and cost-effective manner.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity of Genomic Data.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Executive Guide to the Protection of Information Resources say about The National Computer Systems Laboratory? According to Executive Guide to the Protection of Information Resources, The National Computer Systems Laboratory: Conducts research and provides scientific and technical services to aid Federal agencies in the selection, acquisition, application, and use of computer technology to improve effectiveness and economy in Government operations in accordance with Public Law 89-306 (40 U.S.C. 759), relevant Executive Orders, and other directives; carries out this mission by managing the Federal Information Processing Standards Program, developing Federal ADP standards guidelines, and managing Federal participation in ADP voluntary standardization activities; provides scientific and technological advisory services and assistance to Federal agencies; and provides the technical foundation for computer-related policies of the Federal Government The Laboratory consists of the following divisions:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Executive Guide to the Protection of Information Resources.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Information System Security Best Practices for UOCAVA-Supporting Systems provide? (Section 11) peration of the systems. It should also be consulted by system designers when documenting system operations and administrators when assigning individuals to fulfill roles defined by the system design. State and local election officials have various responsibilities under the Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA), many of which involve information security. These state and local jurisdictions have begun to use information technology (IT) systems and the Internet to facilitate UOCAVA voting; for example, they are required to make voter registration, absentee ballot applications, and general election information available electronically. These IT systems are often used to distribute election information to voters, send and collect voter registration and ballot request forms, and deliver blank ballots. This document provides voting jurisdictions with security best practices for IT and networked systems that are used to support UOCAVA voting by sending or receiving voter registration or ballot request materials, or by delivering blank ballots to voters. Some of these best practices are unique to voting systems, but most are similar to, or the same as, best practices in IT and networked systems in general. For the latter, this document summarizes and points to other security-related documents published by NIST. This document follows NISTIR 7551, A Threat Analysis on UOCAVA Voting Systems , which documents the threats to UOCAVA voting systems using electronic technologies for all aspects of the remote voting process. While NISTIR 7551 discusses high-level security controls capable of mitigating threats, the focus of that report was identifying technologies and associated risks. This document complements NIST 7551 by providing security best practices to help jurisdictions create UOCAVA voting systems based on security practices used in other IT applications.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Information System Security Best Practices for UOCAVA-Supporting Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Platform Firmware Resiliency Guidelines provide? (Section 34) s. Each of them may include their own expansion ROM firmware and/or microcontroller with associated firmware. In most modern platforms, host processor boot firmware is contained in a SPI flash device. BIOS and Unified Extensible Firmware Interface (UEFI) are examples of this type of firmware. In addition to boot firmware, there is platform runtime code. This is code which remains resident in memory and executable after the platform has booted. This is most typical for microcontrollers where firmware is required to execute to perform some function while the system is fully operational. An example of host processor firmware which is considered as runtime code would be System Management Mode (SMM) code. Some power supplies have their own microcontroller and associated firmware. Common battery architectures also include internal logic and firmware governing the charge and discharge behavior of the battery. Modern embedded systems use programmable logic components to provide glue logic functionality. There are two types of programmable logic components, Field Programmable Gate Arrays known as FPGAs and Complex Programmable Logic Devices known as CPLDs. FPGAs are typically loaded with bitstream programs from attached flash devices on power up. CPLDs on the other hand are programmed with a bitstream once and then they retain the function until programmed again in the field. Typically this functionality is needed for basic operations of the system and if corrupted could result in permanent denial of service of a platform. Some fans have their own microcontroller and associated firmware. The devices described above will typically contain some set of firmware and data on nonvolatile storage, either resident on the device itself or on a shared storage device (e.g., the SPI flash). This section describes firmware code and data, and briefly discusses the scope of the document related to these components.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Platform Firmware Resiliency Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Authority Key Identifier : according to NIST NIST Test Personal Identity Verification (PIV) Cards Version 2 According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Authority Key Identifier :: 8F:BE:8E:48:44:B4:DF:FA:B2:90:91:74:CD:03:57:C7:FF:E8:BD:0C

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Status Report on the Final Round of the NIST Lightweight Cryptography Standardization Process provide? (Section 81) | ◗ | ◗ | | | ◗ | | faster encryption | ◗ | ◗ | ◗ | ◗ | ◗ | ◗ ◗ | ✗ ✗ | ◗ | | faster decryption smaller (encrypt only) | ◗ ✗ | ◗ ✗ | ✗ | ✗ | ✗ | ✗ | ✗ ✗ | ✗ ✗ | | smaller (decrypt only) | ✗ | ✗ | ✗ ✗ | ✗ | ✗ | ✗ ✗ | ✗ | | | smaller (encrypt and decrypt) | ✗ | ✗ | | ✗ | ✗ | | | ✗ | | faster encryption | ✗ | ✗ | ✗ ✗ | ✗ | ✗ | ◗ | ✗ ✗ | ✗ ✗ | | faster decryption | ✗ | ✗ | | ✗ | ✗ | ✗ | | | | smaller (encrypt only) | ✗ | ✗ ✗ | ✗ ✗ | ✗ ✗ | ✗ ✗ | ✓ ✓ | ✗ ✗ | ✓ | | smaller (decrypt only) | | ✗ | ✗ | ✗ | | | | ✓ | | smaller (encrypt and decrypt) | ✗ ✗ | ✗ | ✗ | ✗ | ✗ ✗

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Final Round of the NIST Lightweight Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2013 Annual Report provide? (Section 221) , Australia, July 1-3, 2013. In Lecture Notes in Computer Science 7959, Information Security and Privacy , C. Boyd and L. Simpson, eds., Springer, Berlin (2013) 13-26. doi:10.1007/9783-642-39059-3\_2. Due to the symmetric padding used in the stream cipher Grain v1 and Grain-128, it is possible to find Key-IV pairs that generate shifted keystreams efficiently. Based on this observation, Lee et al. presented a chosen IV related Key attack on Grain v1 and Grain-128 at ACISP 2008. Later, the designers introduced Grain-128a having an asymmetric padding. As a result, the existing idea of chosen IV related Key attack does not work on this new design. In this paper, we present a Key recovery attack on Grain-128a, in a chosen IV related Key setting. We show that using around γ· 2^32 ( γ is a experimentally determined constant and it is sufficient to estimate it as 2^8) related Keys and γ· 2^64 chosen IVs, it is possible to obtain 32 ·γ simple nonlinear equations and solve them to recover the Secret Key in Grain-128a. J. Boyar, M. Find and R. Peralta , 'Four Measures of Nonlinearity,' Eighth International Conference on Algorithms and Complexity (CIAC 2013) , Barcelona, Spain, May 22-24, 2013. In Lecture Notes in Computer Science 7878, Algorithms and Complexity , P . G. Spirakis and M. Serna, eds., Springer, Berlin (2013) 61-72. doi:10.1007/978-3-642-38233-8\_6. Cryptographic applications, such as hashing, block ciphers and stream ciphers, make use of functions which are simple by some criteria (such as circuit implementations), yet hard to invert almost everywhere. A necessary condition for the latter property is to be 'sufficiently distant' from linear, and cryptographers have proposed several measures for this distance.

Explanation: NIST publication discussing classified information handling. References: secret, cui. Contains guidance on protecting sensitive government information. Source: Computer Security Division 2013 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Wireless Infusion Pumps in Healthcare Delivery Organizations provide? (Section 390) l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P 1 8 0 0 - 8 . . RFID RMF RTLS SD SEP SIEM SOC SP SSID SSO TCP TIR TLS U.S. URL USB VLAN WEP WLC WPA WPA2 Radio-Frequency Identification Risk Management Framework Real-Time Locating Systems Secure Digital Symantec Endpoint Protection Security Information and Events Management Security Operations Center Special Publication Service Set Identifier Single Sign-On Transmission Control Protocol Technical Information Report Transport Layer Security United States Uniform Resource Locator Universal Serial Bus Virtual Local Area Network Wired Equivalent Privacy Wireless LAN Controller Wi-Fi Protected Access Wi-Fi Protected Access II NIST SP 1800-8C: Securing Wireless Infusion Pumps 255 Appendix D References [1] J. Moy, OSPF Version 2, Internet Engineering Task Force (IETF) Network Working Group Request for Comments (RFC) 2328, April 1998. https://www.ietf.org/rfc/rfc2328.txt [accessed 2/7/18]. [2] Cisco Adaptive Security Virtual Appliance (ASAv) Quick Start Guide, 9.6, Cisco [Web site], asav.html [accessed 2/7/18]. [3] D. Bider and M. Baushke, SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol, Internet Engineering Task Force (IETF) Request for Comments (RFC) 6668, July 2012. https://tools.ietf.org/html/rfc6668 [accessed 2/7/18]. T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P 1 8 0 0 - 8 . . [4] [5] J. Postel, Internet Control Message Protocol: DARPA Internet Program Protocol Specification, Internet Engineering Task Force (IETF) Network Working Group Request for Comments (RFC) 792, September 1981. https://tools.ietf.org/html/rfc792 [accessed 2/7/18]. J. Case, M. Fedor, M.

Explanation: NIST publication on credential and access management. Topics: single sign-on, sso. Contains security framework guidance for authentication systems. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector? (Part 41) Control AM-1: s that allow HDOs to verify that an individual is who they claim to be, also ensuring that the individual has appropriate credentials to interact with clinical systems and medical imaging information. Regarding provisioning, this project assumed that following identity proofing, the organization can create and securely deliver credentials (e.g., user accounts in which the individual can select and update passwords or challenge responses known only to that individual). Identities may include multiple user accounts or access mechanisms that may be applied. For example, an individual may have a job function as an IT administrator. As a member of the HDO workforce, they may be credentialed to access certain systems such as email or productivity software. They may also have access to separate privileged accounts to be used when they perform IT administrative duties. Having separate credentials established based on functionality or role is a common practice in healthcare and provides a form of separation of duties. Medical devices and systems may also have identities, that are authenticated using digital certificates, keys, or other unique identifiers such as host identifiers or MAC addresses. ## 4.1.5.1 Access Control Access control is applied contextually, based on the identity type. This project implemented access control for privileged users, clinical users, devices, and systems. Subsections below provide more detail on the project's approach. ## 4.1.5.1.1 Privileged Access Management Privileged access includes those credentials that have permissions to systems that are greater than standard users. Privileged access accounts often allow greater visibility of resources stored on systems and may allow modifying configuration settings or permitting installation of software components. One measure that this guide implements is segregating privileged access accounts.

Explanation: NIST publication on credential and access management. Topics: access control, privileged access. Contains security framework guidance for authentication systems. Source: Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector.