You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is This publication is available free of charge from according to Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective? This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.IR.8074v2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Derived Personal Identity Verification (PIV) Credentials? (Part 84) Control AC-1: | | 7 | Biometric activation is out- side the bounds of NIST SP 800-157. | Biometric activation is out- side the bounds of NIST SP 800-157. | Biometric activation is out- side the bounds of NIST SP 800-157. | ## 6 Future Build Considerations Mobile technologies such as DPC are constantly evolving. This project seeks to keep reasonable pace with the changing mobile landscape while sustaining an attainable scope bound by current policies. Moving forward, we will consider additional challenges for future DPC projects, including: -  Application EnablementTo leverage DPCs, an organization needs to enable applications on its mobile devices and from the relying-party perspective. Mobile device application development is complicated by the various operating systems, cryptographic token options, and third-party software development kits provided by software containers. Further, modifying the source code of third-party closed mobile applications can be difficult or impossible. Relying parties face similar challenges with legacy systems that can be difficult to make ready for DPCs. Future work might focus on adopting native embedded cryptographic tokens provided by hardware manufacturers and on using federations for relying parties such as cloud service providers. -  Architecture ExpansionIntegrate with an identity management system (IDMS), which retains identity data that is retrieved from authoritative sources, to provide DPC subscriber PIV eligibility status information. NIST SP 800-157 recommends that the issuer of the DPC prevent further use of the DPC when the subscriber is no longer eligible for a PIV Card. Integration with an IDMS would store the eligibility of the DPC subscriber to help determine when DPC should be revoked, and it allows for DPC status to remain independent of the PIV Card status.

Explanation: NIST publication on credential and access management. Topics: identity management, token. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Criticality Analysis Process Model_ Prioritizing Systems and Components provide? (Section 68) l to help identify systems that may be further analyzed to scope the analysis. Ensure that the scope has definitive boundaries. Define any assumptions or constraints that will help limit the analysis. | |---------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Inputs | Criticality Levels of Activity(ies) and/or Workflow Path(s) from Process B.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Criticality Analysis Process Model_ Prioritizing Systems and Components.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.2.3 Determine the Testing Tools according to NIST Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities According to Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 6.2.3 Determine the Testing Tools: The design team should specify the assessment tools and procedures needed to accomplish the test. The specific tools needed may vary greatly depending upon the scope of the test. Tools might range from specialized software or hardware tools (e.g., network sniffers, vulnerability scanners) to measurement and recording devices (e.g., stopwatches, cameras, video recorders) to checklists used to measure adherence to defined processes and procedures. Tools might also include items needed by the test team for logistical support (e.g., radios, cell phones, badges).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Related Controls according to NIST_SP_800-53r5_Security_Privacy_Controls? Related Controls: AU-2, AU-5, AU-6, AU-7, AU-9, AU-11, AU-12, AU-14, SI-4.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.3.8. Challenges Posed by Aggregation Techniques according to NIST De-Identifying Government Datasets_ Techniques and Governance According to De-Identifying Government Datasets_ Techniques and Governance, 4.3.8. Challenges Posed by Aggregation Techniques: Aggregation does not necessarily provide privacy protection, especially when data are presented in multiple data releases.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: De-Identifying Government Datasets_ Techniques and Governance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Analysis of First Responder Mobile and Wearable Devices say about Mitigations:? According to Security Analysis of First Responder Mobile and Wearable Devices, Mitigations:: Properly configured mobile devices that authenticate users or roles before providing access to sensitive information can prevent unauthorized access. For local authentication, a proximity token could be used. For instance, if an officer's badge contains a proximity token, and their badge is physically separated from the phone, the phone automatically locks and requires further authentication. Other forms of authentication may include biometric or behavioral authentication methods. In terms of mitigations for remote authentication scenarios, time-based session logouts and regular reauthentication may be useful.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Security Analysis of First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does General Access Control Guidance for Cloud Systems say about 2 Cloud Access Control Characteristics? (Part 6) According to General Access Control Guidance for Cloud Systems, 2 Cloud Access Control Characteristics: the resource allocated to a consumer can be accessed by another co-located consumer or if the allocated resource, such as memory, is not wiped before being reallocated to another consumer. There is also a sense of location independence in that the consumer generally has no control over or knowledge of the exact location of the provided resources. Location may be specified at a higher level of abstraction (e.g., country, state, data center) that brings security concerns. Therefore, methods for implementing resource pooling while ensuring the isolation of shared resources should be considered in the AC design. 3. Rapid elasticity : Cloud services can be elastically provisioned and released-automatically, in some cases-to rapidly scale outward and inward commensurate with demands. To the consumer, services available for provisioning often appear to be unlimited and appropriated in any quantity at any time and are supported by adding new virtual machines (VMs) with specified computing resources. A challenge for AC design involves the capability to rapidly verify the security of new VMs and determine whether the newly added VMs are qualified to execute a specific task. 4. Measured service : Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, active end user accounts). Resource usage is monitored, controlled, and reported to provide transparency to both the provider and consumer of the utilized service. To maintain resource usage, cloud consumers should be authorized to review but not to modify their own metering data since this could lead to the falsification of payments required for cloud services. Thus, it is reasonable for AC to consider the protection of metering data. 5.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: General Access Control Guidance for Cloud Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Stateless Hash-Based Digital Signature Standard provide? (Section 66) he content is performed at the application level. For example, in the Cryptographic Message Syntax [23], a digest of the content may be computed, and that digest is signed along with other attributes. In cases in which the content is not hashed at the application level, the pre-hash version of SLH-DSA signing (Section 10.2.2) may be used. To maintain the same level of security strength when the content is hashed at the application level or when using the pre-hash version of SLH-DSA, the digest that is signed needs to be generated using an approved hash function or XOF (e.g., from FIPS 180-4 [8] or FIPS 202 [6]) that provides at least 8𝑛 bits of classical security strength against both collision and second preimage attacks [6, Table 4]. 18 Verification of a signature created in this way will require the verify function to generate a digest from the message in the same way for input to the verification function. Even if it is feasible to compute collisions on the hash functions or XOF used to instantiate H 𝑚𝑠𝑔 , PRF , PRF 𝑚𝑠𝑔 , F , H , and T 𝑙 , there is believed to be no adverse effect on the security of SLH-DSA. 19 However, if the input to the signing function is a digest of the content, then collisions on the function used to compute the digest can result in forged messages. In the pure version, the content to be signed is prepended with a one-byte domain separator, one byte that indicates the length of the context string, and the context string. The domain separator, which has a value of zero for pure signing, is included to prevent pre-hash signatures from verifying as pure signatures and vice versa. In the default case in which the context string 18 Obtaining at least 8𝑛 bits of classical security strength against collision attacks requires that the digest to be signed is at least 2𝑛 bytes in length. 19 As noted in Section 11, applications that require message-bound signatures may be adversely affected if it is feasible to compute collisions on H 𝑚𝑠𝑔 .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Stateless Hash-Based Digital Signature Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974 say about Approaches To PRIVACY and SECURITY in COMPUTER? According to Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974, Approaches To PRIVACY and SECURITY in COMPUTER: Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974 Clark R. Renninger, Editor Institute for Computer Sciences and Technology National Bureau of Standards Washington, D.C. 20234 <!-- image --> U.S. DEPARTMENT OF COMMERCE, Frederick B. Dent, Secretary NATIONAL BUREAU OF STANDARDS, Richard W. Roberts, Direcfor

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? https: //nccoe-server2.micronets.net/micronets-mud/nist-

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Section 171) forming the remaining actions. 4. Use the agreed-upon key-derivation method to derive secret keying material with the specified length from the shared secret value Z and other input (see Section 5.8). If the key-derivation method outputs an error indicator, destroy all copies of Z ; then output an error indicator, and exit this process without performing the remaining action. 5. Destroy all copies of the shared secret Z and output the derived keying material. Output: The derived keying material or an error indicator. dhEphem is summarized in Table 13. Table 13: dhEphem key-agreement scheme summary | | Party U | Party V | |----------------------------------------------------|----------------------------------------------------|-------------------------------| | ( p, q, g { , SEED, counter }) | ( p, q, g { , SEED, counter }) | Domain parameters | | N/A | N/A | Static data | | Ephemeral private key r U Ephemeral public key t U | Ephemeral private key r V Ephemeral public key t V | Ephemeral data | | Compute Z by calling FFC DH using r U and t V | Compute Z by calling FFC DH using r V and t U | Computation | | 1. Compute DerivedKeyingMaterial 2. Destroy Z | 1. Compute DerivedKeyingMaterial 2. Destroy Z | Derive secret keying material | This section describes the Ephemeral Unified Model scheme. Assurance of secure key establishment using this scheme can only be obtained when the assumptions in Section 6.1.2 are true. With the exception of key derivation, the Ephemeral Unified Model scheme is 'symmetric' in the actions of parties U and V.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1 provide? (Section 140) nyURI" use="required"/> </xsd:complexType> <xsd:simpleType name="valueTypeType"> <xsd:annotation> <xsd:documentation xml:lang="en"> Allowed data types for Values, just string, numeric, and true/false. </xsd:documentation> </xsd:annotation> <xsd:restriction base="xsd:string"> <xsd:enumeration value="number"/> <xsd:enumeration value="string"/> <xsd:enumeration value="boolean"/> </xsd:restriction> </xsd:simpleType> <xsd:simpleType name="valueOperatorType"> <xsd:annotation> <xsd:documentation xml:lang="en"> Allowed operators for Values. Note that most of these are valid only for numeric data, but the schema doesn't enforce that. </xsd:documentation> </xsd:annotation> <xsd:restriction base="xsd:string"> <xsd:enumeration value="equals" /> <xsd:enumeration value="not equal" /> <xsd:enumeration value="greater than" /> <xsd:enumeration value="less than" /> <xsd:enumeration value="greater than or equal" /> <xsd:enumeration value="less than or equal" /> <xsd:enumeration value="pattern match" /> </xsd:restriction> </xsd:simpleType> ``` ``` <xsd:simpleType name="interfaceHintType"> <xsd:annotation> <xsd:documentation xml:lang="en"> Allowed interface hint values. When an interfaceHint appears on the Value, it provides a suggestion to a tailoring or benchmarking tool about how to present the UI for adjusting a Value.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies provide? (Section 56) scope of the requirement to operate DNSSEC signed zones. SP 800-53's control SC-20 was required to be expanded to cover all FISMA information systems (including low-impact systems) in its revision 3. The plans were to ensure that all agency .gov domains were DNSSEC-signed by December 2009. OMB Memorandum M-11-33 includes 'Frequently Asked Questions on Reporting for the Federal Information Security Management Act and Agency Privacy Management.' The following frequently asked questions included with the Memorandum are relevant to cryptographic applications: Yes, for non-national security systems, DOD and ODNI are to incorporate OMB policy and NIST guidelines into their internal policies. For national security systems, the Joint Task Force Transformation Initiative (JTFTI) Interagency Working Group, with representatives from the Civil, Defense and Intelligence Communities (IC) started an on-going effort in FY2009 to produce a unified information-security framework for the Federal Government. Under this effort, DOD, ODNI and NIST jointly issued the following publications: - NIST SP 800-37, Revision 1 , Guide for Applying the Risk Management Framework to Federal Information Systems, February 2010. - NIST SP 800-38A, Recommendation for Block Cipher Modes of Operation, December 2001. - NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View, March 2011. - NIST SP 800-53 Revision 3 30 , Recommended Security Controls for Federal Information Systems and Organizations, August 2009. Because these guidelines are jointly issued, DOD and ODNI policies for national security systems should incorporate these guidelines. Yes. For non-national security programs and information systems, agencies must follow NIST standards and guidelines unless otherwise stated by OMB. For legacy information systems, agencies are expected to be in compliance with NIST standards and guidelines 29 The Memorandum referenced an earlier version, Revision 1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, risk management framework, fips. General security reference material without sensitive content. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Report on the Privilege (Access) Management Workshop say about Considerations for Implementing Access Control? (Part 2) According to A Report on the Privilege (Access) Management Workshop, Considerations for Implementing Access Control: ce of errors, usage patterns, attempted policy violations, and so on; the access control system can play an important role in log generation, for example by logging granted and denied access requests. | |------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Bypass | If some or all of the access control decisioning and enforcement will be done at the application level, is the risk of bypassing the mechanism 12 commensurate with the risk tolerance of the enterprise? | | Complexity versus simplicity | A good balance between complexity and simplicity of the access control system's architecture provides what is needed in functionality at the lowest cost in mechanism. The simpler the architecture of the access control system, the less that can go wrong, the easier to identify and fix errors, and the lower the cost of making an access request. | 12 For example, bypass through authorized or unauthorized privileged operations in the operating system. | Delegation of administrative capabilities | It may be necessary or convenient for the access control system administrator to delegate privileges to other administrators. Will the access control system being considered make it easy and secure to do that?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Report on the Privilege (Access) Management Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security for Dial-Up Lines provide? (Section 54) s used for dial-up access protection, except for encryption and inessage authentication. For the latter, the number of products and vendors is very large, and it would be impractical to list them all. The tables and their contents are as follows: - Table Is Port Protection Devices (for host-end user authentication) - Table 2s Controiled-access User "Security" Modems and Related Devices (includes multiplexers, port expanders, port contenders with security features, protocol converters, and modems with encryption capability) - Table 3s User Authentication Devices. - Table 4s Terminal Authentication Devices. The National Bureau of Standards (NBS) does not pro^/ide evaluations of canmercial products or services, ^fention of products in this publication in no way constitutes endorsement of them by NBS or the author. All products of the categories listed known to the author at time of writing have been included. / TABLE 1 PORT PROTECTION DEVICES | PRODUCT | VENDOR | NO. PORTS/LINES I PROTECTED | |---------------------------------------------|------------------------------------------------------------------------------------|-------------------------------| | GATEWAY | Adaloqic 1522 wistaria Lane Los Altos, CA 94022 (408) 996-8559 | | | AUDITOR ACC 1000 | Access Data Systems Inc. 766 Big Tree Dr. , #104 Longwood, FL 3 27 50 | 2 TO 128 | | SIGNALMAN SECURE 12 MODEM | Anchor Automation Inc 6913 Valljean Ave. Van Nuys, CA 91406 (818) "997-7758 | | | NET/GUARD | Avant-Garde Computing 80 0 Commerce Parkway Mt.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security for Dial-Up Lines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Personal Identity Verification (PIV) of Federal Employees and Contractors provide? (Section 133) ails for the subject identifier will be specified in [SP 800-217]. Processing of a federation protocol is simpler for the RP since credential validation is tasked to the IdP. The IdP in turn relies on the CSP for managing the PIV identity account, and they are often the same entity. This simplicity is further exemplified by the use of federation technologies to provide authentication and authorization to mobile applications, smart devices, and other non-traditional applications. The use of federation can increase the usability of the system by allowing the cardholder to present their credentials to the IdP instead of separately to each RP. As a consequence, the IdP can provide a Single Sign-On experience for the subscriber by using one authenticated session to create assertions to multiple RPs. This appendix is normative. It provides compliance requirements for PIV validation, certification, and accreditation. [HSPD-12] requires that PIV credentials be issued by providers whose reliability has been established by an official accreditation process. Consistent assessment guidelines are established for PIV Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) in [SP 800-79], which SHALL be followed by all credential issuers in order to achieve accreditation. The entire spectrum of activities in the PCI and DPCI accreditation methodology is divided into the following four phases: - initiation, - assessment, - accreditation, and - monitoring. The initiation phase involves communicating the goals of the assessment/accreditation to the key personnel of the PCI and DPCI organization and the review of documents, such as the PCI and DPCI operations plan.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, single sign-on. Contains security framework guidance for authentication systems. Source: Personal Identity Verification (PIV) of Federal Employees and Contractors.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2005 Annual Report provide? (Section 57) is to recommend and explain tested, secure settings for Windows XP workstations with the objective of simplifying the administrative burden of improving the security of Windows XP systems. SP 800-68 discusses Windows XP and various application security settings in technical detail. The guide provides insight into the threats and security controls that are relevant for various operational environments, such as for a large enterprise or a home office. It describes the need to document, implement, and test security controls, as well as to monitor and maintain systems, on an ongoing basis. It presents an overview of the security components offered by Windows XP, and provides guidance on installing, backing up, and patching Windows XP systems. It discusses security policy configuration, provides an overview of the settings in the accompanying NIST security templates, and discusses how to apply additional security settings that are not included in the NIST security templates. It demonstrates securing popular office productivity applications, Web browsers, e-mail clients, personal firewalls, antivirus software, and spyware detection and removal utilities on Windows XP systems to provide protection against viruses, worms, Trojan horses, and other types of malicious code. This list is not intended to be a complete list of applications to install on Windows XP system, nor does it imply NIST's endorsement of particular commercial off-the-shelf (COTS) products. SP 800-68 will be finalized in November 2005. This CSD program is in cooperation with checklist development activities at the Defense Information Systems Agency, the National Security Agency and the Center for Internet Security, and is in the process of establishing participation agreements with vendors and other checklist-producing organizations.

Explanation: NIST publication discussing classified information handling. References: national security, defense information. Contains guidance on protecting sensitive government information. Source: Computer Security Division 2005 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Acknowledgements according to NIST Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012 According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012, Acknowledgements: The editor would like to thank Suzanne Lightman, Kevin Stine (both NIST), and Mark Enstrom (Neustar) for being reviewers for this document.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings provide? (Section 299) ith base DN c=RTN ) Figure 1: Cross-Certification Between Trusting Partners <!-- image --> Figure 1 allows us to see more clearly the many and varied trust paths that can be formed. For instance, through certificate bridges and cross-certificates, the Government Institution should be able to trust digitally signed messages from the Enormous State University, regardless of whether the signer's certificate was issued from ESU's old or new PKI infrastructures. Additionally, cross-certificates would also allow the Government Institution to trust digitally signed messages from the Random Transoceanic Nation-this trust path may or may not be intentional or desired, as we will discuss later. Let us now look at the certificate/CRL directory configurations required to enable a relying party to easily discover and validate a trust path.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) say about References? (Part 1) According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP), References: References - [1] macOS Security Compliance Project (2023) macOS Security Compliance Project . Available at - [2] Quinn SD, Souppaya MP, Cook MR, Scarfone KA (2018) National Checklist Program for IT Products: Guidelines for Checklist Users and Developers. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-70, Rev. 4. - [3] Joint Task Force Transformation Initiative (2013) Security and Privacy Controls for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 4, Includes updates as of January 22, 2015. https://doi.org/10.6028/NIST.SP.800-53r4 - [4] Joint Task Force (2020) Security and Privacy Controls for Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 5. Includes updates as of December 10, 2020. - [5] Ross R, Pillitteri V, Dempsey K, Riddle M, Guissanie G (2020) Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-171, Rev. 2, Includes updates as of January 28, 2021. - [6] Department of Defense (2023) DISA STIG for macOS . Available at - [7] Committee on National Security Systems (2014) Security Categorization and Control Selection for National Security Systems. (National Security Agency, Ft. Meade, MD), Committee on National Security Systems Instruction (CNSSI) No. 1253. Available at - [8] Center for Internet Security (2023) CIS Critical Security Controls Version 8 .

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, national security. Contains guidance on protecting sensitive government information. Source: Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Smart Cards and Mobile Device Authentication_ an Overview and Implementation provide? (Section 10) dentity Number) first, to verify that the individual in possession of the card is the person to whom the card was issued. Incorrect PINs keep the card from functioning and eventually cause it to lock. Once the PIN is successfully entered, a dialogue between the PDA and smart card occurs, by which the PDA confirms that the card and the credentials of the user on the card are valid and correspond to that of the PDA owner. The underlying mechanism used to authenticate users via smart cards relies on a challenge-response protocol between the device and the smart card. The PDA challenges the smart card for an appropriate and correct response that can be used to verify that the card is the one originally enrolled by the device owner. The PDA relies on user 1 More information can be found at http://www.linuxnet.com/ credential information, obtained earlier from the smart card when the PDA owner initially enrolled the card with the device. The authentication mechanisms discussed in this report use a challenge-response protocol compliant with FIPS 196 to authenticate a user to the PDA. Figure 2 illustrates a typical exchange, omitting the requisite PIN satisfaction step that occurs. The upper part of the diagram shows the enrollment information exchange used to register a card (at right) with the PDA (at left), while the remainder show the exchanges used to verify the claimed identity. Figure 2: Challenge-Response Exchange <!-- image --> Before the smart card can be enrolled at the device, it must first be personalized for the user. The personalization step is essentially another enrollment process whereby a security administrator enrolls the user on the card (i.e., user enrollment), by populating it with the user's credentials, PIN, and other information.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Smart Cards and Mobile Device Authentication_ an Overview and Implementation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation say about E.2 Requirements? (Part 14) According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, E.2 Requirements: | | The advertised route is initially evaluated as invalid . There are two ROAs that cover this route, both of which have ASNs different from the route's origin. Only one of these ROAs | | | | Capability Requirement (CR) Identifier (ID) | Parent Requirement | Sub-Requirement 1 | Sub- Requirement 2 | Test Case | |-----------------------------------------------|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------|-------------------| | | | is deleted from the RPKI, so the route still evaluates as invalid .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to General Server Security provide? (Section 9) | Maintaining | the Security of the Server...........................................................................6-1 | | | | 6.1 | Logging ....................................................................................................................6-1 | | | | | 6.1.1 Identifying Logging Capabilities and Requirements .....................................6-1 | | | | | 6.1.2 Reviewing and Retaining Log Files | ..............................................................6-2 | | | | 6.1.3 Automated Log File Analysis Tools ..............................................................6-3 | | | | 6.2 | Server Backup Procedures......................................................................................6-4 6.2.1 Server Data Backup Policies........................................................................6-4 | | | 6.3 | 6.2.2 Server Backup Types ...................................................................................6-5 6.2.3 Maintain a Test Server .................................................................................6-6 Recovering From a Security Compromise...............................................................6-6 | |------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | Security Testing Servers..........................................................................................6-8 | | 6.4 | 6.4.1 Vulnerability Scanning..................................................................................6-9 | | | 6.4.2 Penetration Testing ....................................................................................6-10 | | 6.5 | Remotely Administering a Server ..........................................................................6-11 | | Appendices | Appendices | | Appendix B-Acronyms and Abbreviations .......................................................................B-1 | Appendix B-Acronyms and Abbreviations .......................................................................B-1 | An organization's servers provide a wide variety of services to internal and external users, and many servers also store or process sensitive information for the organization.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, penetration test. Contains technical security guidance that could inform defensive posture. Source: Guide to General Server Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CP-1 in Contingency Planning Guide for Federal Information Systems? (Part 111) Control CP-1: ilized. Recovery Phase activities focus on implementing recovery strategies to restore system capabilities, repair damage, and resume operational capabilities at the original or an alternate location. At the completion of the Recovery Phase, {system name} will be functional and capable of performing the functions identified in Section 2.1 of this plan. ## 4.1 Sequence of Recovery Activities The following activities occur during recovery of {system name}: Modify the following list as appropriate for the selected system recovery strategy. 1. Identify recovery location (if not at original location); 2. Identify required resources to perform recovery procedures; 3. Retrieve backup and system installation media; 4. Recover hardware and operating system (if required); and 5. Recover system from backup and system installation media. ## 4.2 Recovery Procedures The following procedures are provided for recovery of {system name} at the original location . Recovery procedures are outlined per team and should be executed in the sequence presented to maintain an efficient recovery effort. Provide general procedures for the recovery of the system from backup media. If an alternate location is part of the recovery strategy, include procedures for recovery to that site. Specific keystroke level procedures may be provided in an appendix. If specific procedures are provided in an appendix, a reference to that appendix should be included in this section. Teams or persons responsible for each procedure should be identified. ## 4.3 Recovery Escalation Notices/Awareness Provide appropriate procedures for escalation notices during recovery efforts. Notifications during recovery include problem escalation to leadership and status awareness to system owners and users. Teams or persons responsible for each escalation/awareness procedure should be identified. ## 5.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Contingency Planning Guide for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1.3. Objective and Scope of This Document according to NIST A Data Protection Approach for Cloud-Native Applications According to A Data Protection Approach for Cloud-Native Applications, 1.3. Objective and Scope of This Document: All services (e.g., networking, security, monitoring) for microservices-based applications are provided by a centralized infrastructure called the service mesh, and the data plane for this service mesh - which performs all runtime tasks - consists of proxies. This document outlines a practical framework for effective data protection and highlights the versatile capabilities of WebAssembly (WASM) within service mesh architectures, multi-cloud environments, and hybrid (i.e., a combination of on-premises and cloud-based) infrastructures. By focusing on inline, network traffic analysis at layers 4-7, organizations can enhance security, streamline operations, and utilize adaptive data protection measures.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Data Protection Approach for Cloud-Native Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Smart Cards and Mobile Device Authentication_ an Overview and Implementation provide? (Section 37) ifd.o). Therefore, by just putting the new smart card reader driver with the ifd\_server.c source file, and building them together, results in a BSC server that supports a different smart card reader. Card personalization involves populating information such as the user's name and credentials into files maintained on the smart card, before issuing to a user. In addition, the procedure usually entails recording a PIN on the card, which the user later enters to enable the card to confirm that the holder is the same person who was issued the card. The personalization procedure can also involve physical preparation of the card, such as imprinting pictures, names, and address information on the surface. In the case of programmable cards, additional programs and data files can be installed to enable specific functions for a user. Personalization of the Secure MMC token and Bluetooth Smart Card token is performed by an Enrollment Station. The Enrollment Station is a Windows platform that runs the CardEnroller application. The CardEnroller application performs the following tasks when personalizing a token: - Loads a Javacard applet, named Enroller, onto the XMC card - Sets the user PIN as selected by the user - Verifies the user PIN (required in subsequent operations) - Stores the private RSA key and the certificate containing the public key on the card - Generates a pair of RSA keys and obtains a corresponding X.509 certificate for the user. - Destroys its copy of the user private key The CardEnroller application also performs the functions of a Certificate Authority when obtaining a certificate, generating and signing the certificate itself. Its (root) certificate is exported to any PDAs needing to verify a user's credentials that it issues. In a production environment, this function would be performed by a Certificate Authority operating within a Public Key infrastructure for the organization.

Explanation: NIST publication on credential and access management. Topics: authentication, certificate authority, token. Contains security framework guidance for authentication systems. Source: Smart Cards and Mobile Device Authentication_ an Overview and Implementation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Guidelines for Storage Infrastructure say about 4.2.4 Continuous Data Protection? According to Security Guidelines for Storage Infrastructure, 4.2.4 Continuous Data Protection: DP-SS-R12 - Security considerations for using continuous data protection: Other than the functional benefits (e.g., improved RPO, finer-grained retention), the use of continuous data protection techniques (e.g., CDP, versioning of source data or of replicas in cloud file- and object-storage, and transaction log shipping) can also assist in improving forensics for sensitive data. While potentially extremely time consuming, replaying to previous versions of data can help learn more about the attack profile, its timing, etc.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Guidelines for Storage Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process provide? (Section 11) referred to as the NIST Post-Quantum Cryptography Standardization Process hereafter in this document. NIST issued a public call for submissions to the PQC Standardization Process in December 2016 [4]. Prior to the November 2017 deadline a total of 82 candidate algorithms were submitted. Shortly thereafter, the 69 candidates that met both the submission requirements and the minimum acceptability criteria were accepted into the first round of the standardization process. Submission packages for the first-round candidates were posted online for public review and comment [5]. After a year-long review of the candidates, NIST selected 26 algorithms to move on to the second round of evaluation in January 2019 [6]. These algorithms were viewed as the most promising candidates for eventual standardization, and were selected based on both internal analysis and public feedback. During the second round, there was continued evaluation by NIST and the broader cryptographic community. After careful deliberation, NIST selected seven finalists and eight alternates to move on to the third round in July 2020 [7]. NIST's intent was to standardize a small number of the finalists at the end of the third round, as well as a small number of the alternate candidates after a fourth round. The third round began in July 2020 and continued for approximately 18 months. During the third round, there was a more thorough analysis of the theoretical and empirical evidence used to justify the security of the candidates. There was also careful benchmarking of their performance using optimized implementations on a variety of software and hardware platforms. Similar to the first two rounds, NIST also held the (virtual) Third NIST PQC Standardization Conference in June 2021. Each of the finalists and alternates were invited to present an update on their candidate algorithm. In addition, several researchers presented work that was relevant to the PQC standardization process.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Requirements and Conformance Test Assertions for ANSI_NIST-ITL 1-2011 Record Type 18 - DNA Record say about B.1 Record Type 18 - DNA Record Requirements and Test Assertions? (Part 74) According to Requirements and Conformance Test Assertions for ANSI_NIST-ITL 1-2011 Record Type 18 - DNA Record, B.1 Record Type 18 - DNA Record Requirements and Test Assertions: Support | Supported Range | Applicable to (T, X, B, B*, or X*) | | |----------------------------------------------------------|------------------------------------------------|----------------------------------|----------------------------------|----------------------------------|---------------------------------------------------------------------|----------------------------------|----------------------------------|----------------------------------|--------------------------------------|----------------------------------| | 8.18: Record Type-18: DNA record | 8.18: Record Type-18: DNA record | 8.18: Record Type-18: DNA record | 8.18: Record Type-18: DNA record | 8.18: Record Type-18: DNA record | 8.18: Record Type-18: DNA record | 8.18: Record Type-18: DNA record | 8.18: Record Type-18: DNA record | 8.18: Record Type-18: DNA record | 8.18: Record Type-18: DNA record | 8.18: Record Type-18: DNA record | | 18.009- Pedigree Information | | | | SID, FID, MID, PCM]- Value | | | | | | | | Value | | 1 | M | 18.009- PMS-Value | {InfoItem:3 in 18.009} MO[ASCII(K, U)] | | | | B* | | | RT18.29 - Field: 18.010- | 8.18.10 <Table 79 lists valid values for STY.> | 1 | M | 18.010- SCT-Value | {InfoItem:1 in 18.010} MO[0 to 11] | | | | B* | | | Sample Type Value | | 1 | O | 18.010- SMO-Value | {InfoItem:2 in 18.010} MO[ASCII(NS, WB, BP)] | | | | B* | | | RT18.30 - Field: 18.011- Sample Typing Information Value | 8.18.11 <Table 79

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Requirements and Conformance Test Assertions for ANSI_NIST-ITL 1-2011 Record Type 18 - DNA Record.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to IPsec VPNs say about 7.2.7 Summary of Design Decisions? (Part 1) According to Guide to IPsec VPNs, 7.2.7 Summary of Design Decisions: 7.2.7 Summary of Design Decisions Table 2 provides a checklist that summarizes the major design decisions made during the first two phases of the IPsec planning and implementation process.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to IPsec VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation say about Contents? (Part 2) According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, Contents: | 1 | Summary..............................................................................................1 | Summary..............................................................................................1 | |-----|--------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | 1.1 | Challenge.......................................................................................................................2 | | | 1.2 | Solution..........................................................................................................................3 | | | 1.3 | Benefits..........................................................................................................................4 | | 2 | How to Use This Guide.........................................................................4 | How to Use This Guide.........................................................................4 | | | 2.1 | Typographic Conventions..............................................................................................6 | | 3 | Background..........................................................................................6 | Background..........................................................................................6 | | 4 | Approach ...........................................................................................10 | Approach ...........................................................................................10 | | | 4.1 | Audience......................................................................................................................10 | | | 4.2 | Scope ...........................................................................................................................10 | | | 4.3 | Assumptions................................................................................................................11 | | | 4.4 | Risk Assessment ..........................................................................................................12 | | | 4.4.1 | Threats ........................................................................................................................13 | | | 4.4.2 | Vulnerabilities .............................................................................................................15 | | | 4.4.3 | Risk..............................................................................................................................16 | | | 4.4.4 | Cybersecurity Framework Functions, Categories, and Subcategories Addressed by the SIDR Project.................................................................................................................16 | | 4.5 | Technologies................................................................................................................21 | Technologies................................................................................................................21 | | | 4.5.1 | ROV-Enabled Routers..................................................................................................23 | | | 4.5.2 | RPKI C A..........................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Technology Assessment_ Methods for Measuring the Level of Computer Security provide? (Section 132) rol group ensures that all output is properly distributed. Determine that the terms of reference and established practices of the control group are adequate and relate to the size of the installation. Particular attention should be directed to ascertaining that the control group cannot be bypassed, except in circumstances subject to prior approval and, that in such cases, adequate alternative arrangements have been made for the performance of the necessary control activities. <!-- image --> Determine, through observation, that self-checking digits are being used on key codes not otherwise controlled. Ascertain, through the use of test data, that they are being effectively employed, either at the data conversion stage or as a computer edit routine. Verification Guide Excerpt [CIC75, p. 211] Reprinted with permission from Computer Audit Guidelines, 1975, published by the Canadian Institute of Chartered Accountants, Toronto, Canada. 6. Control group Control group receives input, verifies authorization, reconciles processing, distributes output, and ensures errors corrected. ( See Control Technique /J-J) 2. Self-checking digit Self-checking digits used on key codes not otherwise controlled. Next, non-processing controls sucli as manual controls or controls from other checklists are evaluated. The reason given for this step is that the control objectives and techniques listed are specific to computer-based systems. It is not clear, however, that "traditional manual system controls" warrant separate handling. For example, an example given of a manual system control is: "Credit notes for returns and allowances should be approved by an employee who has no access to cash receipts or other company funds" [p. 176] . This would seem readily encompassed by the general need for segregation of duties. It would seem both desirable and feasible to eliminate this step from an implementation of this methodology.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technology Assessment_ Methods for Measuring the Level of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Information Security Handbook_ A Guide for Managers say about Q. What is role-based training?? According to Information Security Handbook_ A Guide for Managers, Q. What is role-based training?: - A. Individuals need security training based on their particular job functions. Over time, individuals acquire different roles relative to the use of IT within an organization or as they make a career move to a different organization. Sometimes they will be users of applications, in other instances they may be involved in developing a new system, and in some situations, they may serve on a source selection board to evaluate vendor proposals for IT systems. An individual's security knowledge and skills, and therefore training needs, change as their role changes. To address this reality, knowledge and skill needs have been categorized by job functions into six role-based specialties, which represent categories of generic organizational roles: Manage, Acquire, Design and Develop, Implement and Operate, and Review and Evaluate. Actual positions within your agency are then assigned to a role to determine the actual training requirements for that position. For example, personnel in positions with duties and tasks for contracting officer, contracting officer's technical representative, and source selection board member would be aligned with the 'acquire' role. The authorizing official, information security officer, and inspector general auditor are aligned with the 'review and evaluate' role, as they deal primarily with compliance activities.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TD-7935 in Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach? (Part 11) Control TD-7935: d and these required audits may use up the Hmited audit resources available. In this case, the priority scheme may still be useful for determining audit approaches and where and when to focus efforts. If, on the other hand, additional audit resources are available for discretionary audits, the risk evaluation of the work priority scheme can be used to identify and rank the systems in greatest need of audit coverage. Ultimately, back-end qualifiers may need to be considered for the discretionary audits, as described in Section 3.5. ## 3.4.4 Risk Evaluation Levels and Dimensions As stated on pages 45 and 46, the work priority scheme expresses the risk concerns in terms of two levels and five dimensions. The risk concerns in Level I are reviewed first and those in Level II are reviewed second. Level I has one dimension and Level II has four dimensions. Each dimension is defined as a related set of characteristics which can estimate or measure the amount of risk posed by that dimension to a failure of the system. The chief concern of each dimension can be stated in the form of a question as follows: 1. What is the Impact/Criticality of the system to the organization? A poorly developed or controlled system that is mission critical could jeopardize an organization's basic operational or programmatic effectiveness; therefore, an impact/critical system commands audit attention. The larger the impact, the more important it is to audit. 2. How Complex is the system? (This includes size considerations.) The more complex the system, the more difficuh is communication and control, and consequently, the higher the risk of failure. The greater the chance for failure, the more important it is to audit the system. 3. How Stable is the system internally (structure) and externally (environment)? The less stable the system, the more difficult it is to develop procedures for communication and control, the greater the chance for failure, and the greater the need to audit. 4.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Secure Web Services? (Part 122) Control ES-1: ry to become a single point of failure. To remedy this, UDDI supports replication. Through replication, UDDI registries can support multiple nodes, where each node is an instance of the UDDI registry. This way, backup nodes can be used when an individual node is faced with a DoS attack. ## 3.8.2 Quality of Service Most Web services deployed do not provide guarantees for QoS. QoS defines what the expected level of performance a particular Web service will have. By prioritizing traffic, overall performance of the system 51 Software rejuvenation was first proposed by Y. Huang, C. Kintala, N. Kolettis, and N. D. Fulton in Software Rejuvenation: Analysis, Module and Applications , in Proc. of 25th Symposium on Fault Tolerant Computing, FTCS-25, pages 381-390, Pasadena, California, June 1995. can be improved, allowing the system to make informed decisions when faced with few resources. For example, a Web service operating on a saturated network may use prioritization to allow only the highest priority traffic to be processed while letting the other traffic wait until network traffic returns to normal. Standards are beginning to be developed and released to support availability of Web services. In particular, two competing standards are available that provide reliable messaging support: WS-Reliability and WS-ReliableMessaging, discussed in Section 3.8.3. Standards and techniques for providing QoS, detecting, resisting and recovering from DoS attacks are still under development. Sections 3.8.4 and 3.8.5 discuss two common design or implementation defects that can lead to a loss of availability without the malicious intent: deadlock and recursion. The standards state that other QoS parameters, such as rate of failure or average latency, are out of scope because they are usually dealt with by lower layer protocols.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Diabetes Treatment according to NIST Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT) According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT), Diabetes Treatment: Alice has decided to travel outside of the United States but is diabetic and wants to monitor her blood glucose levels and receive updates on her condition from her primary care provider. Figure 7 - Diabetes Treatment/Allergen Identification <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.5.1. Self-Monitoring of the ICD Operation according to NIST Design Alternatives for Computer Network Security According to Design Alternatives for Computer Network Security, 4.5.1. Self-Monitoring of the ICD Operation: The ICD should be designed in a manner that will detect with a high degree- of confidence any operational errors such as improper encipherment (in particular, the sending of clear text when it was intended to be enciphered), and an imbalance in the randomization; at least to the level of 1/0 statistics. Other tests are probably available, but are outside the scope of this investigation.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Design Alternatives for Computer Network Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Managing the Security of Information Exchanges provide? (Section 6) ange information. An approach for securely managing information exchange between systems and organizations is presented. The following four phases of information exchange management are addressed: 1. Planning the information exchange: The participating organizations perform preliminary activities; examine all relevant technical, security, and administrative issues; and develop an appropriate agreement to govern the management and use of the information and how it is to be exchanged (e.g., via a dedicated circuit or virtual private network, database sharing, cloud- or web-based services, or simple file exchange). 2. Establishing the information exchange: The organizations develop and execute a plan for establishing the information exchange, including implementing or configuring appropriate security controls and developing and signing appropriate agreements. 3. Maintaining the exchange and associated agreements: The organizations actively maintain the security of the information exchange after it is established and ensure that the terms of the associated agreements are met and remain relevant, including reviewing and renewing the agreements at an agreed-upon frequency. 4. Discontinuing the information exchange: Information exchange may be temporary, or at some point, the organizations may need to discontinue the information exchange. Whether the exchange was temporary or long-term, the conclusion of an information exchange is conducted in a manner that avoids disrupting any other party's system. In response to an incident or other emergency, however, the organizations may decide to discontinue the information exchange immediately. This publication provides recommended steps for completing each phase with an emphasis on the security measures necessary to protect the shared data. Also included is information for selecting and developing appropriate information exchange agreements and agreement templates.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Managing the Security of Information Exchanges.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control provide? (Section 46) PCC. The organizational risk tolerance of the ground segment (and the potential residual risk that may be inherited) may then be used in risk management of the space and user segments as appropriate. | [NIST-SP800-53r5] PM-9 | | ID.RM-3 : The organization's determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis | Organizations should determine their risk tolerance related to the ground segment. An organization may determine its risk tolerance across all the segments that it operates. Risk tolerance will be determined by the entire organization (to include the space and user segment), and the risks of the ground segment should be included in that determination, including the MOCand the PCC.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings say about 4.1 Performance Metrics? According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, 4.1 Performance Metrics: We use a set of metrics to evaluate performance in terms of time and space. For time, we measure the number of cryptographic operations involved, the resulting CPU cycles, and the BGP convergence time: the time it takes the system to reachieve a stable state after a perturbation, such as a new route announcement, a route withdrawal, or a router reboot. For each security scheme, we compare its convergence time with convergence time that original BGP achieves for the same perturbation. (Given the distributed

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to LTE Security provide? (Section 79) VoIP | Voice over IP | | VPN | Virtual Private Network | | WiMAX | Worldwide Interoperability for Microwave Access | | XRES | Expected result | | [1] | 3 rd Generation Partnership Project, Releases , http://www.3gpp.org/specifications/67-releases [accessed 12/13/17].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to LTE Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 833) ive, and resilient system components and systems, including the application of the security design principles implemented as part of life cycle-based systems security engineering processes (see SA-8). Related Controls: CA-2, CP-4, IR-4, MA-2, MA-6, PE-16, PL-2, PM-9, PM-30, RA-3, RA-7, SA-8, SI-4. Control Enhancements: (1) SUPPLY CHAIN RISK MANAGEMENT PLAN | ESTABLISH SCRM TEAM CHAPTER THREE PAGE 364 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ Establish a supply chain risk management team consisting of [Assignment: organization- defined personnel, roles, and responsibilities] to lead and support the following SCRM activities: [Assignment: organization-defined supply chain risk management activities]. Discussion: To implement supply chain risk management plans, organizations establish a coordinated, team-based approach to identify and assess supply chain risks and manage these risks by using programmatic and technical mitigation techniques. The team approach enables organizations to conduct an analysis of their supply chain, communicate with internal and external partners or stakeholders, and gain broad consensus regarding the appropriate resources for SCRM. The SCRM team consists of organizational personnel with diverse roles and responsibilities for leading and supporting SCRM activities, including risk executive, information technology, contracting, information security, privacy, mission or business, legal, supply chain and logistics, acquisition, business continuity, and other relevant functions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is This publication is available free of charge from according to Transitioning the Use of Cryptographic Algorithms and Key Lengths? This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-131Ar2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Transitioning the Use of Cryptographic Algorithms and Key Lengths.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does PIV Data Model Test Guidelines provide? (Section 260) ------------------------------------------------------------------------------| | TE05.02.10.01 | 9.3.1 General Record Heade Conformance r | e Size of rection. The tester shall verify the larger size of the two fingerprint templates is recorded in th Scanned Image in X and Y Di | | TE05.02.11.01 | 9.3.1 General Record Heade Conformance r | The tester shall verify the Number of Views values is 2. | | TE05.02.12.01 | 9.3.1 General Record He Conforma ader nce | The tester shall verify the Reserved Byte value is 0. | | TE05.02.13.01 | 9.3.2 View Header Conformance | ber value of the The tester shall verify the View Num Single Finger View Record is 0. | | TE05.02.14.01 | Header 9.3.2 View Conformance | 0 or 2 and is The tester shall verify the value is either consistent with vendor reporting. | | TE05.02.16.01 | eader 9.3.2 View H Conformance | the Number of Minutiae is The tester shall verify that between 0 and 128. | | TE05.02.17.01 | Data 9.3.3 Fingerprint Minutiae | The tester shall verify minutia type is either 00b, 01b, or 10b. | | TE05.02.19.01 | 9.3.3 Fingerprint Minutia Data e | The tester shall verify that the value of Extended Data Block Length is zero. | | TE05.03.01.01 | 9.4.1 Facial Image Header Conformance 9.4.2 Facial Image Data Conformance | to verify The tester shall review the documentation compliance with the assertion. | | TE05.03.02.01 | r 9.4.2 Facial Image Data 9.4.1 Facial Image Heade Conformance Conformance | is The tester shall verify that the size of the record such that it will be in compliance with the assertion.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Technology Assessment_ Methods for Measuring the Level of Computer Security provide? (Section 237) t it to meet the management, organization, and situation-specific characteristics, resources, needs, and objectives. The method must not obscure the mission. There are no absolute "units" of security. As a result, security "measurements" must be stated in relative terms. The background and scale against which this measurement takes place is that defined by security policy. A technology assessment on security evaluation would not be complete without an examination of policy impacts on the evaluation process. Security policy discussion is divided into two components: sensitivity distinctions and acceptance criteria. Sensitivity refers to the consequences of loss. The greater the potential loss if data (or equipment) is disclosed, changed, destroyed, or delayed [45] , the greater the sensitivity of that data (or equipment). It follows that the greater the sensitivity involved, the greater the need for security. Of course the need for, say, increased application security might be satisfied by system or installation controls, not application controls. There are two generic structural types of sensitivity distinction: horizontal and vertical. Both are typically used together. Horizontal distinctions are sometimes referred to as communities of interest. Examples of such horizontal categories for data include proprietary, financial, personal, medical, psychological, political, investigatory, system controls, test answers, and national security (perhaps further broken down as plans, capabilities, and intelligence sources). Vertical distinctions are sometimes referred to as security or sensitivity levels. Examples are Top Secret / Secret / Confidential / Unclassified as used in DoD and the Office of [45] Sensitivity is often interpreted as applying primarily (or only) to disclosure losses. This can be very misleading. Some organizations (e.g. many banks) regard data integrity (resistance to data modification or insertion) as the primary type of loss; others (e.g.

Explanation: NIST publication discussing classified information handling. References: classified, secret, top secret. Contains guidance on protecting sensitive government information. Source: Technology Assessment_ Methods for Measuring the Level of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Test Activity according to Mobile Device Security_ Bring Your Own Device (BYOD)? Test Activity: Attempt to directly access enterprise services, e.g., Exchange email server or corporate VPN, on a mobile device that is not enrolled in the EMM system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance say about System Recovery Plan Document? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance, System Recovery Plan Document: The System Recovery Plan is designed to ensure the continuation of vital manufacturing/business processes in the event a cybersecurity incident occurs. Its purpose is to provide a structured approach for responding to cybersecurity incidents by leveraging the infrastructure inventory and configuration information relevant to the organization's IT and OT environments to restore operational capabilities. This plan has been developed to accomplish the following objectives: - limit the magnitude of any loss by minimizing the duration of a manufacturing interruption, - assess damage, repair the damage, and restore manufacturing system, - manage the recovery operation in an organized and effective manner, and - prepare personnel to respond effectively in system recovery situations.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Code Organization according to NIST Codes for Identification of Federal and Federally-Assisted Organizations According to Codes for Identification of Federal and Federally-Assisted Organizations, Code Organization: | 9530 | Advisory Council On Historic Preservation | |--------|--------------------------------------------------------------------| | 1141 | African Development Foundation | | 7200 | U.S. Agency for International Development | | 7400 | American Battle Monuments Commission | | 4602 | Appalachian Regional Commission | | 9532 | Architectural and Transportation Barriers Compliance Board | | 4965 | Arctic Research Commission | | 84AF | Armed Forces Retirement Home | | 97NH | United States Naval Home | | 8400 | United States Soldiers' and Airmen's Home | | 9560 | Barry Goldwater Scholarship and Excellence in Education Foundation | | 9563 | Financial Crisis Inquiry Commission | | 9568 | Broadcasting Board of Governors | | 9522 | Centennial of Flight Commission | | 5600 | Central Intelligence Agency | | 9565 | Chemical Safety and Hazard Investigation Board | | 7635 | Christopher Columbus Fellowship Foundation | | 9567 | Commission for the Preservation of America's Heritage Abroad | | 9537 | Commission of Fine Arts | | 9517 | Commission on Civil Rights |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Codes for Identification of Federal and Federally-Assisted Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Glossary of Computer Security Terminology provide? (Section 51) e network. In this mode, system users need not be cleared for all types of compartmented information processed, but they must be fully cleared for at least the highest level of classified information. (NCSC'TG-004-88) - 2) Utilization of a resource-sharing computer system for the concurrent processing and storage of: (1) two or more types of SCI or (2) one type of SCI with other than SCI. For DON purposes, the compartmented mode should be considered equivalent to multilevel mode. (OPNAVINST 5239.1 A) Authority recognized by the DAA as having sufficient knowledge (individually or corporately) to make a valid determination. (AFR 205-16) Refers to a review and examination of records, procedures, and review activities at a site in order to assess the unclassified computer security posture and ensure compliance with this order. This review is normally conducted by the CPPC at an operations office having cognizance over the site and management responsibilities for implementing this Order. Forthose sites not reporting to an operations office, this review is normally conducted by the Office of ADP Management. (DOE 1360.2A) compromise compromising emanations - 1) The disclosure of classified data to persons who are not authorized to receive such data. (DOE 5637.1; DOE 5635.1 A) - 2) An unauthorized disclosure or loss of sensitive information. (FIPS PUB 39) - 3) [Passwords] Disclosing a password, or part of a password, to someone not authorized to know, have or use the password. (FIPS PUB 1 1 2) - 4) The known or suspected exposure of clandestine personnel, installations or other assets, or of classified information or material, to an unauthorized person. (NCSC-9) - 5) An unauthorized disclosure or loss of sensitive defense data. (OPNAVINST 5239.1 A; AR 380-380) - 6) A violation of the security policy of a system such that unauthorized disclosure ofsensitive information may have occurred.

Explanation: NIST publication discussing classified information handling. References: classified, compartmented. Contains guidance on protecting sensitive government information. Source: Glossary of Computer Security Terminology.