You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Review of the Advanced Encryption Standard say about 3.1 Security Requirements? (Part 1) According to Review of the Advanced Encryption Standard, 3.1 Security Requirements: 3.1 Security Requirements The AES call for submissions [41] stated that one of the factors on which algorithms would be judged is 'the extent to which the algorithm output is indistinguishable from a random permutation on the input block.' This means that AES encryption must behave as a 'pseudorandom permutation' (PRP). It is often implicit that the inverse operation (decryption) should be indistinguishable from random as well, but this requirement can be made explicit by using the term 'strong PRP' or 'super PRP.' Consider, for example, a challenge-response protocol where the challenge is the plaintext, and the response is the ciphertext of the AES operation. 1 An attacker may generate a certain number of challenges (and observe the responses) while having access to the device. If the AES output is distinguishable from random, the attacker would be able to predict the response to a new challenge with a probability higher than 2 -128 (i.e., higher than the probability of guessing a randomly generated 128-bit ciphertext). Clearly, the indistinguishability property implies that it should not be possible for the attacker to recover the secret key, which would make it trivial to compute the response to any challenge. This requires an evaluation of whether the AES key lengths (i.e., 128, 192, and 256 bits) are sufficiently long to resist exhaustive key search in the foreseeable future, taking the advent of quantum computing into consideration. To quantify security in this setting, the number of input-output pairs available to the attacker and the success probability of the attack are relevant as well. Applications may implicitly or explicitly assume that the number of input-output pairs available to the attacker is limited.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Review of the Advanced Encryption Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Derived Personal Identity Verification (PIV) Credentials provide? (Section 2) er statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-157 Natl. Inst. Stand. Technol. Spec. Publ. 800-157, 33 pages (December 2014) http://dx.doi.org/10.6028/NIST.SP.800-157 CODEN: NSPUE2 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. All NIST publications, other than the ones noted above, are available at

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Framework for Emergency Response Officials (ERO)_ Authentication and Authorization Infrastructure provide? (Section 23) nication between relying parties (such as an Incident Commander) and Authoritative source of Credential (ASC) - the EMA that provides the responding EROs often takes place through these trust brokers. From a standards perspective, this communication has two characteristics: It has to use any of the standard protocol, such as de-facto federated web-based protocols such as SAML, WS-* or SOAP The credentialing schema, while it could be customized for the ERO domain, should be based on a standard data modeling scheme such as a Relational Schema, LDAP schema or XML Schema. With a customized data schema for credential repositories, a Meta Data Service that provides a common view of the syntax and semantics of various ERO capabilities may be required. As previously stated, examples of capabilities include Qualification, Training, Licensing, and Skill Certification documents for various Emergency Response functions as well as apriori deployment agreements among the ERO-AA infrastructure players such as Emergency Management Assistance Compacts (EMACs). A number of technical and procedural standards are central to specifying the components of the framework for ERO-AA infrastructure described in this document. The primary standards are: - Federal Information Processing Standard 201 - Personal Identity Verification (FIPS 201) and its companion documents : These documents specify procedures for identity proofing, the set of credentials and authentication use cases for identity verification, the standardized formats for representation of credentials, procedures for digitally signing credentials and attesting the digital signatures and credentials. and - ISO/IEC 24727- Identification Cards - integrated circuit card programming interfaces,, which provides a set of interfaces for secure, interoperability among diverse applications with normative processes for Identity, Authentication, and Signature (IAS)services.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Framework for Emergency Response Officials (ERO)_ Authentication and Authorization Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.4.2.2. MFA Implemented at State Agency Identity Service according to NIST Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information, 3.4.2.2. MFA Implemented at State Agency Identity Service: Alternatively, agencies may seek to integrate their state portal with a dedicated identity service platform, as Fig. 12 depicts. This option will likely provide agencies with a greater level of authenticator optionality and potential for authenticator reuse. Fig. 12. Common architecture for implementing MFA at state agency identity service. <!-- image --> Agencies should consult with their vendor to determine which authenticator types -including phishing-resistant authenticators -are supported, as well as which identity federation protocols the vendor can implement. State agencies should discuss with vendors and local jurisdictions the possibility of integrating the state identity solution with local agency identity services so that local agency users accessing the state portal can reuse any MFA they have implemented at their home agency. <!-- image --> Tip: State agencies commonly manage user accounts and credentials for their state CJIS portal, serving as the IdP for users across the state. The cost of this function, both in upfront costs of procuring and implementing MFA and in ongoing costs in help desk support and authenticator lifecycle management, might be alleviated if local, tribal, and territorial agencies had the option to integrate their local identity services with the state portal using identity federation protocols. Section 3.4.2.3 details an example architecture that supports this functionality.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, mfa. Contains security framework guidance for authentication systems. Source: Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3 say about Selected References? (Part 2) According to NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3, Selected References: Available: | Brief Description | Safety Level 1 | Safety Level 2 | Safety Level 3 | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Support for user annotation, notification, advisories | Support for user annotation, notification, advisories | Support for user annotation, notification, advisories | Support for user annotation, notification, advisories | | To address user and enterprise safety concerns, a Big Data system should support consumer, "user," subscriber natural language annotations, notifications, and explanations.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cell Phone Forensic Tools_ an Overview and Analysis say about Graphics Library? According to Cell Phone Forensic Tools_ an Overview and Analysis, Graphics Library: The graphics library enables examiners to examine the collection of graphics files present on the device. Each image present can be viewed internally with the Picture Window application, allowing examiners to enlarge images if necessary. Additionally, images collected can be exported and inspected with a third party tool, if necessary. Figure 33 shows a screen shot of images acquired from a Nokia 6610i. Figure 33: Graphics Library <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Validating the Integrity of Computing Devices say about 3.6 Technologies? (Part 2) According to Validating the Integrity of Computing Devices, 3.6 Technologies: Table 3-5 Products and Technologies | Component | Product/Technology | Function/Capability | Cybersecurity Framework Subcategories | |-------------------------------------|-----------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------| | Component or Subsystem Manufacturer | Intel Transparent Supply Chain | Tools and processes to ensure supply chain security from the manufacturer to the purchasing organization | ID.SC-4, PR.DS- 6 | | Component or Subsystem Manufacturer | Seagate EXOS X18 18 Terabyte Hard Drive | Secure device authentication, firmware attestation | ID.SC-4, PR.AC- 6, PR.DS-6, PR.DS-8 | | OEM or VAR | Dell Technologies | Manufactures computing devices and binds them to verifiable artifacts | ID.SC-4 | | OEM or VAR | Hewlett Packard Enterprise | Manufactures computing devices and binds them to verifiable artifacts | ID.SC-4 | | OEM or VAR | HP Inc.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Validating the Integrity of Computing Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case say about Training for Users and Managers? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case, Training for Users and Managers: Employees must perform online computer-based training or classroom-based training per management approval. Below is an example list of potential training options. Trade organization subscriptions to newsletters and magazines will offer more industry specific training classes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Domain Name System (DNS) Deployment Guide provide? (Section 40) | | | | Guidelines on Securing Recursive Servers (Resolver) & Stub Resolvers ............ 12.1 Setting up the Recursive | Service........................................................................12-14 | | | 12.1.2 Securing the Host Platform for Recursive Servers/Resolvers................. 12.2 Guidelines for Establishing Servers....................................................................12-15 ................................................................................. | 12-14 | | | 12.2.1 Aggregate Caches | 12-15 | | | 12.3 Setting up the Root Hints 12.5 Recommendations Summary | File.............................................................................12-17 | | 13.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Domain Name System (DNS) Deployment Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.1.3 FIDO and Authenticator Types according to NIST Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders According to Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders, 4.1.3 FIDO and Authenticator Types: When considering MFA implementations, PSFR organizations should carefully consider organizationally defined authenticator requirements. These requirements are detailed in Section C.3 of Appendix C. FIDO provides a standard framework within which vendors have produced a wide range of interoperable biometric, hardware, and software authenticators. This will enable PSFR organizations to choose authenticators suitable to their operational constraints. The FIDO Alliance has published specifications for two types of authenticators based on UAF and U2F. These protocols operate agnostic of the FIDO authenticator, allowing PSOs to choose any FIDO-certified authenticator that meets operational requirements and to implement it with this solution. The protocols, FIDO key registration, FIDO authenticator attestation, and FIDO deployment considerations are also detailed in Section C.3 of Appendix C.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Card Technology Developments and Gap Analysis Interagency Report say about STANDARDS MATRIX? (Part 5) According to Card Technology Developments and Gap Analysis Interagency Report, STANDARDS MATRIX: Methods - Part 5: Optical Memory Cards | Optical Data Storage | | Standard | ISO/IEC 11693 | 1993 ID Cards - Optical Memory Cards | Optical Data Storage | | Standard | ISO/IEC 11694-1 | 1994 ID Cards - Optical Memory Cards Linear recording method Part 1: Physical Characteristics | Optical Data Storage | | Standard | ISO/IEC 11694-2 | 1994 ID Cards - Optical Memory Cards Linear recording method Part 2: Dimensions and location of the accessible op | Optical Data Storage | | Standard | ISO/IEC 11694-3 | ID Cards - Optical Memory Cards Linear recording method Part 3: Optical properties and characteristics | Optical Data Storage | | Standard | ISO/IEC 11694-4 | ID Cards - Optical Memory Cards Linear recording method Part 4: Logical data structures | Optical Data Storage | E-2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Card Technology Developments and Gap Analysis Interagency Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Cloud Computing Forensic Reference Architecture say about cloud consumer? According to NIST Cloud Computing Forensic Reference Architecture, cloud consumer: A person or organization that maintains a business relationship with and uses service from cloud providers. [22]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Cloud Computing Forensic Reference Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RA-1 in Securing Wireless Infusion Pumps in Healthcare Delivery Organizations? (Part 129) Control RA-1: reless Infusion Pumps 96 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P 1 8 0 0 - 8 . . timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 user-identity default-domain LOCAL aaa authentication ssh console LOCAL snmp-server host-group management SNMPHOSTS poll community ***** no snmp-server location no snmp-server contact snmp-server community ***** crypto ipsec security-association pmtu-aging infinite crypto ca trustpoint _SmartCallHome_ServerCA no validation-usage crl configure crypto ca trustpool policy auto-import crypto ca certificate chain _SmartCallHome_ServerCA certificate ca 6ecc7aa5a7032009b8cebcf4e952d491 308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130 0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117 30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b 13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504 0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72 20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56 65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043 65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31 30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b 30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20 NIST SP 1800-8C: Securing Wireless Infusion Pumps 97 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i .

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Labels for Open Systems_ an Invitational Workshop provide? (Section 34) ti-(set-)labelling (N-l)-facility | 11 | | 7. Summary of (N)-Facility Support | 11 | | 8. Support of a Fixed Label-Set Association | 13 | | 9. Support of Variable or Multiple Label-Set Associations | 14 | | 9.1 Support by variable- and multi- set-labelling facilities | 14 | | 9.2 Support by single-labelling facilities | 14 | | 10. Implementation Choices and Rationale | 16 | | References | 17 | C Gray Girling - 25 April 1990 This document provides some investigation of the means to provide the access control service, given a specific requirement: that access control should be providing using security labels at the application layer. This document investigates the options visible within an endsystem for the use of security labels in the implementation of an OSI communications protocol stack. Its scope is broader than that implied by the term Open System Interconnection because that would normally address issues visible only outside an endsystem. This document categorizes the strategies within an endsystem which can be used to support labelling. Although access control is an application layer requirement, the problem is examined from the point of view of a general layer (referred to as the (N>layer). The interaction between solutions chosen for separate layers is then constrained so that the combination of layer solutions can support access control at the application layer. It is required that access control be exercised on the basis of a set of partially ordered SECURITY labels. The access control mechanism is to associate security labels with transmitted data, and ranges of security labels with application-process-invocations (apis).

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Security Labels for Open Systems_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide? (Section 32) Threats to software update systems primarily target the evidence generation process so as to erase the trail of updates and prevent the ability to determine whether the updates were legitimate or not. There are several types of software update systems [11]: - Package managers that are responsible for all of the software installed on a system - Application updaters that are only responsible for individual installed applications 4 See https://securityscorecards.dev/ . - Software library managers that install software that adds functionality, such as plugins or programming language libraries. The primary task performed by a software update system is to identify the files that are needed for a given update ticket and download trusted files. At first glance, it may appear that the only checks needed to establish trust in downloaded files are the various integrity and authenticity checks performed by verifying the signatures on the metadata associated with individual files or the package. However, the very process of signature generation may be vulnerable to known attacks, so software update systems require many other security measures related to signature generation and verification. The evolving framework for providing security for software update systems has incorporated many of these required security measures into its specification and prescribed some others for future specifications. A framework is a set of libraries, file formats, and utilities that can be used to secure new and existing software update systems. The framework should protect the signing operation by requiring the policy defined in Sec. 5.1.1 to be satisfied prior to performing the signing operation.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD) provide? (Section 54) DigiCert are also used. The logical architectures and detailed descriptions of the builds mentioned above are in Section 6 (Build 1), Section 7 (Build 2), Section 8 (Build 3), and Section 9 (Build 4). 4.2 Physical Architecture Figure 4-2 depicts the high-level physical architecture of the NCCoE laboratory environment. As depicted, the NCCoE laboratory network is connected to the internet via the NIST data center. Access to NIST SP 1800-15B: Securing Small-Business and Home Internet of Things Devices 16 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 This publication is available freeof charge from:https://doi.org/10.6028/NIST.SP.1800-15 and from the NCCoE network is protected by a firewall. The NCCoE network includes a shared virtual environment that houses an update server, a MUD file server, an unapproved server (i.e., a server that is not listed as a permissible communications source or destination in any MUD file), a Message Queuing Telemetry Transport (MQTT) broker server, and a Forescout enterprise manager. These components are hosted at the NCCoE and are used across builds where applicable. DigiCert provided the Transport Layer Security (TLS) certificate and Premium Certificate used by the MUD file server. All four builds, as depicted in the diagram, have been implemented:  Build 1 network components consist of a Cisco Catalyst 3850-S switch, a Cisco MUD manager, a FreeRADIUS server, and a virtualized Forescout appliance on the local network. Build 1 also requires support from all components that are in the shared virtual environment, including the Forescout enterprise manager.  Build 2 network components consist of a MasterPeace Solutions, Ltd. Yikes! router on the local network. Build 2 requires support from the MUD file server, Yikes! cloud, and a Yikes! mobile application that are all resident on the Build 2 cloud. The Yikes!

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Web Transactions_ TLS Server Certificate Management provide? (Section 67) TLS server certificates is infeasible due to the large number of certificates in most enterprises. It is also not feasible for each certificate owner to create their own certificate management system. The most efficient and effective approach is for the Certificate Services team to provide a central Certificate Service that includes technology-based solutions that provide automation and that support certificate owners in effectively managing their certificates. This service should include the technology/services for CAs, certificate discovery, inventory management, reporting, monitoring, enrollment, installation, renewal, revocation, and other certificate management operations. The central Certificate Service should also provide self-service access for certificate owners so they are able to configure and operate the services for their areas without requiring significant interaction with the Certificate Services team. Furthermore, the central Certificate Service should be able to integrate with other enterprise systems, including identity and access management systems, ticketing systems, configuration management databases, email, workflow, and logging and auditing. Approved CAs should be designated and made available to certificate owners for requesting public and internal certificates. If, as is common, different CAs will be used for issuing public and internal certificates, then instructions should be provided to certificate owners to help them select the correct CA based on the purpose of the server where the certificate will be used. Establish backup CAs for both public and internal certificates, including completing contracts with backup public CAs so an immediate cutover is possible in case of a CA compromise, for business reasons, or because of some other motivation. An up-to-date inventory of deployed TLS server certificates is the foundation of an effective certificate management program.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TE-1 in Mobile Device Security_ Bring Your Own Device (BYOD)? (Part 3) Control TE-1: .1.2.1 Privacy Risk Examples and Mitigation Methodologies The example solution contained in this guide identifies and helps to mitigate some common privacy risks that a BYOD deployment may encounter. The privacy risks and their accompanying problematic data actions were identified using NIST-developed methodologies. The NIST PRAM [9] and accompanying Catalog of Problematic Data Actions and Problems [12] (see Section 4.1.2) are standardized methodologies for identifying privacy challenges that were used to conduct our privacy risk analysis. This publication provides the results of our privacy risk analysis for a f ictional organization as an exemplar for the reader's use, as well as suggested privacy architecture enhancements. See Appendix G of the Supplement for an example of how the privacy risks for this practice guide's BYOD deployment example solution were deve loped. The following section, 4.1.3, outlines the security and privacy objectives of this publication's example solution architecture. ## 4.1.3 Security and Privacy Objectives To address the challenges stated in the previous sections, the architecture for this build addresses the high-level security and privacy objectives illustrated in Figure 4-1. Figure 4-1 Security and Privacy Objectives <!-- image --> The following are a list of security and privacy objectives (as highlighted above in Figure 4-1, with a green exclamation mark): 1. Separate organization and personal information. BYOD deployments can place organizational data at risk by allowing it to travel outside internal networks and systems when it is accessed on a personal device. BYOD deployments can also place personal data at risk by capturing information from employee devices. To help mitigate this, organizational and personal information can be separated by restricting data flow between organizationally managed and - unmanaged applications.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control BE-4 in IT Asset Management? (Part 62) Control BE-4: ki and two Windows 2012 Active Directory servers. One serves as primary while the other serves as a backup. Puppet Enterprise Master enforces security and configuration baselines across all endpoints. Physical Security -The physical security network houses the devices that operate and manage physical security, such as badge readers and cameras, along with their management consoles. The devices include Router4, iStar Edge, CCure controller, two badge readers and two Internet Protocol (IP) cameras. Physical Asset Management -The physical asset management network contains devices that provide and collect information regarding physical assets. The devices include Router3, AssetCentral and CA Technologies IT Asset Manager. AssetCentral is a physical asset inventory and analysis system from AlphaPoint Technology. It allows users to view assets from multiple viewpoints, including building, room, floor, rack, project, collection, or owner. AssetCentral is running on CentOS Linux. CA IT Asset Manager allows users to holistically manage IT hardware assets, from planning and requisition to retirement and disposal. ## 1.2.3 Operating Systems All machines used in the build had either Windows 7 enterprise, Windows server 2012 R2, Ubuntu 14.04, RedHat Enterprise Linux 7.1 or CentOS 7 operating systems (OSs) installed. ## 1.2.3.1 Base Windows Installation and Hardening Details The NCCoE base Windows OS images are Server 2012 R2 x86\_64 and Windows 7 Enterprise x86\_64 Department of Defense (DoD) Security Technical Implementation Guide (STIG) images. The installation of both Windows systems was performed using installation media provided by the Defense Information Systems Agency (DISA). These images were chosen because they are standardized, hardened and fully documented. ## 1.2.3.2 Base Linux Installation and Hardening Details The NCCoE base Linux OS is CentOS 7. This OS is available as an open source image. The OS was configured to meet the DoD CentOS 6, STIG.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IT Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Software Asset Management say about 2.7 SWAM Specific Roles and Responsibilities? (Part 3) According to Automation Support for Security Control Assessments_ Software Asset Management, 2.7 SWAM Specific Roles and Responsibilities: or group of devices, device managers are (for HWAM) responsible for adding/removing devices from the network, and for configuring the hardware of each device (adding and removing hardware components). The device managers are specified in the desired state inventory specification. The device manager may be a person or a group. If a group, there is a group manager in charge. In the absence of a Software Manager (SWMan), the DM may be assigned the task of removing unauthorized software. | Operational | | Auth | Authorizers | Authorizers have the responsibility of authorizing specific items (e.g., devices, software, software installers, software locations, or settings), and thereby define the desired state. In special cases they authorize people to authorize other items. The desired state manager oversees and organizes the activity of authorization. | Operational | | DSM | Desired State Managers (DSM) | Desired State Managers are needed for both the ISCM Target Network and each assessment object. The desired state managers ensure that data specifying the desired state of the relevant capability is entered into the ISCM system's desired state data and is available to guide the actual state collection subsystem and to identify defects. The DSM for the ISCM Target Network also resolves any ambiguity about which system authorization boundary has defects (if any). Authorizers share some of the responsibilities by authorizing specific items (e.g., devices, software, or settings), and thus defining the desired state, as delegated by the DSM. The DSM oversees and organizes this activity. | Operational | | ISCM- Ops | ISCM Operators (ISCM-Ops) | ISCM operators are responsible for operating the ISCM system (see ISCM-Sys).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Data Network Systems (SDNS) Key Management Documents provide? (Section 65) | A.6. State Tables 33 | A.6. State Tables 33 | A.6. State Tables 33 | A.6. State Tables 33 | n. ^;tU't.' i/UKj i! , - •4' OV ^ jii-3yj.;-'i'^l'^a;^ta3ifi K !.r^ '.) 'yaLj-'^O • '3 a/5.rb*S 'itlH 't ..'... f/'. ;.'0' ^ '1 :Ki3i'ts>(!;ireMv3'!! b&Jq ci...i,iA . ^ r . . ' bJu'.'*] I'/t , vi SaO . . bboM.gJW ' >i>.i,fi -'-j i-i / i>f 3™ h" m % i 'le&ii-- .-n Lr,m':?^OC>8 .X •* ^ ' ', ii\_Li , wxjiva^iddA =,|-J ^4inU V '\' }f'^ '•'tv'i'fddA. '.hS.. jo, '' \ 5 ( '.» 0-3-^ 'v- ' M 0. This document specifies the protocol for the services provided to the Key Management Application Process (KMAP) by an application service element - the Key Management Application Service Element (KMASE) - to support applications in a distributed open systems environment. 1. Key management provides for the generation, distribution, and updating of traffic encryption keys (TEKs). Some management capabilites for authentication and access control are provided by the KMAP. This document specifies the protocol and procedures for the Key Management Application Service Element. The KMASE services are provided in conjunction with the Association Control Service Element (ACSE) and the presentation service. 2. The KMASE procedures are defined in terms of: - a) the interactions between cooperating KMASE protocol machines through the use of the presentation service; and - b) the interactions between the KMASE protocol machine and its service user. This document specifies conformance requirements for systems implementing these procedures. | ISO 7498/1 | Information Processing Systems - Open Systems Interconnection - Basic Reference Model.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, key management. Contains security framework guidance for authentication systems. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NSTIC Pilots_ Catalyzing the Identity Ecosystem say about Existing practice and the need for a standard:? According to NSTIC Pilots_ Catalyzing the Identity Ecosystem, Existing practice and the need for a standard:: In order to establish a more effective market that is responsive to the complicated requirements that service providers face today, standardized performance metrics and reporting procedures need to be developed. Once created, these standards would allow organizations, government agencies, and other service providers to effectively implement risk-based access solutions to meet cybersecurity needs, protect users, and ensure availability of services. In order to help establish a common understanding of KBA and remote identity proofing services, it is proposed that standardized approaches are developed to: - 1) determine the accuracy and efficacy of KBA and remote proofing techniques. This may include requirements for the currency and validity of the information used in the proofing or the development of the KBA questions; and - 2) report failure rates of KBA systems. In addition to standardizing validity criteria for data and processes used in the proofing process or KBA question development, this standard will establish reporting requirements for false acceptance, false rejections, and failure to enroll.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NSTIC Pilots_ Catalyzing the Identity Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) provide? (Section 116) eriods for the original certificate and all renewed certificates for the same key must not exceed the cryptoperiod of the key used to apply protection (i.e., the key with the originator usage period). An FCKMS could notify the owner of a certificate when a certificate is about to expire so that the certificate could be renewed prior to the end validity date on the certificate. FR:6.34 The CKMS design shall specify how and the conditions under which a public key can be renewed. FR:6.35 For each key type, the CKMS design shall specify requirements for advance notification of the key type renewal, including which parties are notified, how they are notified, what security services are applied to the notification, and the time-frames for notification(s). | PR:6.30 | A Federal CKMS shall not renew the validity period of a public key certificate beyond the cryptoperiod of the key of the key pair used to apply cryptographic protection (i.e., the originator usage period). | |-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | PF:6.3 | A Federal CKMS could notify the owner of a public-key certificate that the certificate is about to expire. | | PF:6.4 | A Federal CKMS could provide notification to the relying parties of a public key certificate that the certificate has been renewed. | When a key is derived from other information (some of which is secret) in a non-reversible manner, the process is called key derivation. Key update is a special case of key derivation in which the secret information includes a symmetric key (K1), and the derived symmetric key (K2) replaces K1 for the next key-update process. Key updating could result in a security exposure if an adversary obtains a key and knows the update process used. Key update is not supported in this Profile.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Small Business Information Security_ The Fundamentals say about Appendix B-References? (Part 2) According to Small Business Information Security_ The Fundamentals, Appendix B-References: rting of Cyber Incidents , version 1.0, April 2015, ccips/legacy/2015/04/30/04272015reporting-cyber-incidents-final.pdf (accessed October 7, 2016). | | [EY14] | Ernst &Young, How to Use Cybersecurity to Generate Business Value , 2014, _How_to_use_cybersecurity_to_generate_business_value/$FILE/EY-CIO- How-to-use-cybersecurity.pdf (accessed October 7, 2016). | | [FBI] | Federal Bureau of Investigation, Identity History Summary Checks [Web page] , (accessed October 7, 2016). | | [FTC] | Federal Trade Commission, Data Security [Web page] , security (accessed October 7, 2016). | | [Grady05] | Grady, Mark F. and Francesco Parisi (eds.), The Law and Economics of Cybersecurity , Cambridge University Press, November 28, 2005. | |---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [HSPD23] | The White House, Cybersecurity Policy , National Security Presidential Directive (NSPD)-54/Homeland Security Presidential Directive (HSPD)-23, January 2008. | | [InfraGard] | InfraGard [Web site], (accessed October 7, 2016). | | [ISACA] | ISACA [Web site], https://isaca.org/ (accessed October 7, 2016). | | [ISO7498-2] | International Standardization Organization/International Electrotechnical Commission (ISO/IEC), Information processing systems-Open Systems Interconnection-Basic Reference Model-Part 2: Security Architecture , ISO/IEC 7498-2:1989, February 2, 1989.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Small Business Information Security_ The Fundamentals.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Section 126) ations to be changed at organizational time intervals; system component inventory; change control records; configuration management records; system audit records; other relevant documents or records]. Interview : [ SELECT FROM: Organizational personnel responsible for information security; organizational personnel responsible for changing processing and/or storage locations; system/network administrators]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Test : [ SELECT FROM: Mechanisms supporting and/or implementing changing processing and/or storage locations]. | |------------------------------------------------------------------------------------------------------------------| | 3.14.1e | ENHANCED SECURITY REQUIREMENT Verify the integrity of [ Assignment: organization-defined security critical or essential software ] using root of trust mechanisms or cryptographic signatures. | ENHANCED SECURITY REQUIREMENT Verify the integrity of [ Assignment: organization-defined security critical or essential software ] using root of trust mechanisms or cryptographic signatures.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about C.1. Preparing for Assessments? (Part 3) According to Assessing Security Requirements for Controlled Unclassified Information, C.1. Preparing for Assessments: ----------------------------------------------------------------------------------------------------------------| | OUTCOMES | • The objective, scope, and time frame of the assessment are determined. • Key organizational stakeholders are notified, and the necessary resources are allocated. • Assessors are identified and selected. • Artifacts are collected and provided to assessors. • Mechanisms to minimize ambiguities and misunderstandings about the security requirements, implementation issues, and weaknesses/deficiencies identified during the assessment are established. • The organization's operations, structure, objective, scope, and time frame of assessment are understood by assessors. |

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control OA-3 in Best Practices for Privileged User PIV Authentication? (Part 23) Control OA-3: grace period until transitioning to products that support direct or indirect verification architectures at LOA-3 or LOA-4 is possible. Figure 2 shows a high-level depiction of the proxy architecture. The proxy is placed between the user (Claimant) and the Relying Party, so that it is only possible to gain privileged access to the Relying Party after successfully authenticating to the proxy. The proxy needs to be PIV-enabled, and it may be PIV-enabled either by acting as the Verifier itself (direct verification) or by accepting identity assertions from a separate PIV-enabled Verifier (indirect verification). Figure 2: High-Level Transitional Proxy Architecture <!-- image --> Proxy architectures will typically provide at most LOA-2 authentication, as these architectures are limited by the strength of the identity assertions made by the Verifier to the Relying Party. As such, transition away from the Proxy architecture is needed. Agencies should establish a POA&M to help with the transition to a technology that supports PIV using the direct or indirect 16 SAML also supports holder-of-key assertions, which require the Claimant to prove possession of a key to the Relying Party. Holder-of-key assertions can be implemented in a way that provides up to LOA-4 to the Relying Party. verification architecture at the appropriate level of assurance (see the Section 2 introduction and Section 2.3). Implementers of the proxy architecture should ensure that they: - Isolate the Relying Party system from all untrusted systems. This includes designing and configuring network architectures so that all privileged access to the Relying Party system flows through the Proxy. - Segment internal networks to restrict the ability for a compromise of the Proxy to spread to other systems. - Authenticate and encrypt all communications between users (Claimants) and the Proxy.

Explanation: NIST publication on credential and access management. Topics: authentication, privileged access. Contains security framework guidance for authentication systems. Source: Best Practices for Privileged User PIV Authentication.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PM-8200 in Cell Phone Forensic Tools_ an Overview and Analysis Update? (Part 4) Control PM-8200: | | NOKIA 6200............................................................................................................................. | 128 | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------| | SANYO PM-8200 ..................................................................................................................... | 129 | | APPENDIX E: PHONEBASE2 RESULTS............................................................................ | 131 | | ERICSSON T68I ........................................................................................................................ | 131 | | MOTOROLA V66...................................................................................................................... | 132 | | MOTOROLA V300.................................................................................................................... | 133 | | NOKIA 6610I ............................................................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Building Secure Microservices-based Applications Using Service-Mesh Architecture say about 5 Summary and Conclusions? (Part 3) According to Building Secure Microservices-based Applications Using Service-Mesh Architecture, 5 Summary and Conclusions: .getambassador.io/the-importance-of-control-planes- with-service-meshes-and-front-proxies-665f90c80b3d | | [8] | Kirschner E (2017) Proxy Based Service Mesh . Available at https://medium.com/@entzik/proxy-based-service-mesh-96cd4b74c198 | | [9] | Tiwari A (2017) A sidecar for your service mesh . Available at tiwari.com/a-sidecar-for-your-service-mesh/ | | [10] | Sridharan C (2018) The Three Pillars of Observability. Distributed Systems Observability (O'Reilly Media, Inc., Sebastopol, CA), Chapter 4. Available at observability/9781492033431/ch04.html | | [11] | Jaeger Project (2020) Jaeger: open source, end-to-end distributed tracing . Available at https://www.jaegertracing.io/ | | [12] | Zipkin Project (2020) Zipkin . Available at https://zipkin.io/ | | [13] | Leong A (2019) A guide to distributed tracing with Linkerd . Available at https://linkerd.io/2019/10/07/a-guide-to-distributed-tracing-with-linkerd/ | - [14] Stafford GA (2019) Kubernetes-based Microservice Observability with Istio Service Mesh: Part 1 (ITNEXT).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Building Secure Microservices-based Applications Using Service-Mesh Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Annual Report 2018_ NIST_ITL Cybersecurity Program say about AUTOMATING CRYPTOGRAPHIC TESTING? According to Annual Report 2018_ NIST_ITL Cybersecurity Program, AUTOMATING CRYPTOGRAPHIC TESTING: Several years ago, NIST launched a project to automate much of the testing required under its cryptographic validation programs. Automated cryptographic algorithm testing was completed in 2018, and NIST is now developing methods to automate the testing of cryptographic modules. These efforts in automation are intended to provide a higher trust in the assurance claims made by the product developers in an efficient and cost-effective manner that allows the vendors' conformance efforts to keep pace with the changing IT landscape. By investing in a more robust testing infrastructure, NIST anticipates that product vendors will take advantage of this service by validating their products more often, which will produce more secure products. In FY19, NIST will put more responsibility for generating evidence of conformance in the hands of industry by leveraging automated test processes that will reduce time to market, slice costs to maintain compliance, and ensure that the Federal Government has effective and up-todate technologies.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Annual Report 2018_ NIST_ITL Cybersecurity Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings provide? (Section 363) decision to implement a smart card-based PKI meant that many users were issued a CAC months prior to receiving a smart card reader and without any application requiring use of their new certificates. As a result, most usersÕ experience with PKI consisted of waiting in line to get a CAC and then using the CAC the same way they had used the ID card they had prior to the CAC. These users did not see any real benefit to the new technology. Although smart card readers are being deployed and applications are beginning to incorporate support for public key technology, the DoD PKI continues to struggle to attain widespread user acceptance. Application owners need policy, budget guidance, and a business justification for adopting public key technology. Within the DoD, funding for PKI core components and card stock is centrally managed. However, individual applications, including email, networks, and web servers, are very decentralized. Therefore, rolling out the PKI required a few decisions by policy makers, but integrating public key technology into applications requires many decisions by many application owners. These managers must consider multiple demands when determining how to allocate limited resources: Getting support from application managers requires providing managers with the information they need to make decisions including the following: - ∞ Ensure that published policy is consistent with the organizationÕs goals for integrating public key technology. Policy enables early adopters of new technology to justify their investments. - ∞ Provide direction for requesting funding for public key enabling as a part of the standard budget cycle. Getting out of cycle funding to meet security driven requirements is difficult and almost always means that other planned functionality must be sacrificed to meet PKI requirements.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0 say about Appendix A: Framework Core? (Part 47) According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0, Appendix A: Framework Core: ement agencies. | RS.CO-4: Coordination with stakeholders occurs consistent with response plans | • ISA 62443-2-1:2009 4.3.4.5.5 • NIST SP 800-53 Rev. 4 CP-2, IR-4, IR-8 | | RESPOND (RS) | Response activities are coordinated with internal and external stakeholders, as appropriate, to include external support from law enforcement agencies. | RS.CO-5: Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness | • NIST SP 800-53 Rev. 4 PM-15, SI-5 | | RESPOND (RS) | Analysis (RS.AN): Analysis is conducted to ensure adequate response and support recovery activities. | RS.AN-1: Notifications from detection systems are investigated | • COBIT 5 DSS02.07 • ISA 62443-2-1:2009 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8 • ISA 62443-3-3:2013 SR 6.1 • ISO/IEC 27001:2013 A.12.4.1, A.12.4.3, A.16.1.5 • NIST SP 800-53 Rev.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Electronic Health Records on Mobile Devices provide? (Section 30) -2 High-Level Architecture T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P . 1 8 0 0 - 1 . The use case scenario was not intended to include a complete set of components but rather to start a discussion about the issue and to provide an opportunity for vendors of security products to participate in the solution. From this use case scenario, we identified the architecture components that are likely in an organization’s enterprise (see Table 3-1). The table also includes the security characteristics that we derived from the use case. These are the security characteristics that defined our problem. Table 3-1 Use Case Architecture Components Mobile Devices / Client Side Networks Back End / Server Side Secure Infrastructure mobile device Wi-Fi mobile device management client intrusion detection system firewall software certified [7] EHR system firewall storage encryption VPN gateway antivirus authentication, authorization, and accounting server intrusion detection system certificate authority and enrollment NIST SP 1800-1B: Securing Electronic Health Records on Mobile Devices 12 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P . 1 8 0 0 - 1 . Mobile Devices / Client Side Networks Back End / Server Side Secure Infrastructure provisioning system for mobile devices client healthcare mobile device application storage encryption Security Characteristics provisioning system for mobile devices server mobile device management server auditing mobile device From the use case scenarios, we derived a set of security characteristics as the high-level requirements for our build.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, certificate authority. Contains security framework guidance for authentication systems. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.1.2.3 Doubt: Consistency according to NIST Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS) According to Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS), 3.1.2.3 Doubt: Consistency: It was with regard to appropriateness to the first assurance step that our serious doubts first began to be raised. If a set of rules is to provide a useful basis for assurance of an invariant property, they must be clearly defined and internally consistent. We found the definition of an IVP ambiguous with regard to purpose, in that it was not clear (nor resolved in the plenary sessions) whether the IVP was to check internal consistency, external consistency, or both. We were also uncertain about logging requirement of rule C4 , in which the purpose of the log (accountability, backup, or both) was not clear. Again, this ambiguity was not resolved in the plenary session. We also felt rule E2 was possibly inconsistent with other rules. Its wording strongly implies the binding of individual names to programs while other discussions indicated that it was the organizational role (a derivative value) that should be the determinant of who may initiate a given TP. While we were not able to point out internal inconsistencies in the short time available, we noted areas of overlap in the rules that we felt could lead to such inconsistencies. We questioned the need for rule CI and the need to distinguish IVPs from TPs at this high level of abstraction. Likewise, we felt that rule C5 was subsumed by C2 , and again questioned the need for the distinction between a UDI and a GDI, or indeed the ability to state criteria which would enable us to distinguish one from another. We felt that rule El was subsumed by rule E2, and that rule E4 was an instance of rule C3 applied to the enforcement mechanism. The latter case raises the interesting question of circularity in the definitions, which we will touch upon in a later section.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Volume 1_ Overview say about 3. Focusing Security Control Assessments on Security Results? (Part 1) According to Automation Support for Security Control Assessments_ Volume 1_ Overview, 3. Focusing Security Control Assessments on Security Results: 3. Focusing Security Control Assessments on Security Results This section introduces three abstraction layers that focus on achieving security results (as security capabilities) above the level of individual security controls/control items (see Section 3.5). The following security capability abstraction layers are introduced and are traceable 12 to security requirements and the individual security controls/control items that support them: - (1) Attack Step Layer - Desired Result: Block or delay attacks (see Section 3.2). - (2) Functional Capability Layer - Each capability is a grouping of controls and control items from SP 800-53. Desired Result: Make a broad area of the system more secure (see Section 3.3). - (3) Sub-Capability Layer - Each capability is decomposed into sub-capabilities necessary and sufficient to support the purpose of the larger capability. Each sub-capability is tested with one corresponding defect check. Desired Results: a) To support blocking of attack steps and provide functional security capability; and b) provide clearly testable outcomes (see Section 3.4). The control items themselves provide a fourth abstraction layer: - (4) Control Items Layer - see Section 3.5. The four abstraction layers serve the following purposes: - Support strong systems engineering of security capabilities; - Support guidance for control selection; - Simplify understanding of the overall protection process; - Enable assessment of security results at a higher level than individual controls; and - Improve risk management by measuring security results that are more closely aligned with desired business results. To address the purposes, NIST introduced the concept of information security capabilities in SP 800-53. Information security capabilities (discussed in more detail below) are groups of controls that work together to achieve an information security purpose and enable/protect the organization's ability to perform its mission.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Volume 1_ Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Use of Passwords for Controlled Access to Computer Resources say about Password 'transmission? (Part 3) According to The Use of Passwords for Controlled Access to Computer Resources, Password 'transmission: tect customer passwords in transit. In this application, the customer selects a 16 character password, which is then scrambled twice before reaching the computer where it is filed as a six-digit code. The scrambling, which is claimed to be irreversible, is handled by integrated circuits built into relay boxes at the terminals and computer center [NEWS 76] Branstad notes that encryption keys and authentication codes may be in effect the same item. In his proposed network access control machine, these keys are never transmitted through the network, but rather are loaded simultaneously by interface units into a primary encryption device. Thus, authentication can be considered complete at that level (at least) if a message can be encrypted, transmitted, and correctly decrypted [BRAND 73] , [BRAND 75]. In a master 's thesis on protocols, Stephen Kent distribution [RENTS 76]. transmission techniques: encryption-based protection considers encryption key He identifies two basic - o chained key changes - o two-level key distribution systems. Under the chained key system, each new key is enciphered using the last key issued. This new key is then used until another change occurs. Under the two-level distribution system, a special key is used solely for transmitting new keys to remote users. Kent describes protocols for using these two schemes and considers the use of magnetically encoded cards for distribution of keys. He presents the following example of a login sequence incorporating two-way authentication: 1. The user enables the terminal and establishes a connection to the host, 2. The host responds in cleartext confirming the connection by sending the host name. 3. The user transmits in cleartext the login identifier, and then inserts a magnetic stripped plastic card containing his or her (primary) key and enables the encryption module, 4.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: The Use of Passwords for Controlled Access to Computer Resources.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Technical Guide to Information Security Testing and Assessment say about 4.5 Summary? (Part 2) According to Technical Guide to Information Security Testing and Assessment, 4.5 Summary: olations | There are risks associated with each technique and combination of techniques. To ensure that all are executed safely and accurately, each assessor should have a certain baseline skill set. Table 4-2 provides guidelines for the minimum skill set needed for each technique presented in Section 4. Table 4-2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technical Guide to Information Security Testing and Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for API Protection for Cloud-Native Systems say about 1.4. Relationship to Other NIST Documents? According to Guidelines for API Protection for Cloud-Native Systems, 1.4. Relationship to Other NIST Documents: Today, most software development and integration are based on APIs. Section 1.2 articulated the close relationship between software and APIs, demonstrated that API development and deployment follow the same iterative life cycle as the software, and provided NIST guidelines on DevSecOps. Another distinguishing feature of the controls recommended for protecting APIs is the capacity to provide assurance for conforming to the principles of zero trust. This is because there is no distinction between internal and external API requests or calls due to the absence of an identifiable network perimeter and the distributed nature of applications on-premises and in multiple clouds. This security assurance can be achieved with authentication and authorization controls using identity-based segmentation [2]. Documents that provide recommendations on the configuration of authentication and authorization controls in the context of cloud-native applications (e.g., [2][3]) are also relevant in the context of configuring controls for API protection.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Guidelines for API Protection for Cloud-Native Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Test Personal Identity Verification (PIV) Cards Version 2 say about Table of Contents? (Part 7) According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Table of Contents: 33 | | | D.1.1 | Self-Signed Trust Anchor Certificate ...............................................33 | | | D.1.2 | RSA 2048 Issuing CA Certificate ....................................................34 | | | D.1.4 | RSA 4096 Issuing CA Certificate ....................................................36 | | |-----|-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------| | | D.1.5 | ECC P-256 Issuing CA Certificate...................................................37 | | | | D.1.6 | ECC P-384 Issuing CA Certificate...................................................38 | | | | D.1.7 | RSA 2048 PIV-I Issuing CA Certificate............................................39 | | | D.2 | Content Signer Certificates | Content Signer Certificates | ..........................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Severity - Law Enforcement: High Confidentiality Impact according to NIST Security Analysis of First Responder Mobile and Wearable Devices According to Security Analysis of First Responder Mobile and Wearable Devices, Severity - Law Enforcement: High Confidentiality Impact: Justification: This classification of this data depends on the immediate type of incident at hand. The high impact level is used since there exists the possibility of loss of life. For instance, sensitive information shared at a crime scene or an undercover officer communicating with law enforcement could lead to loss of life. It is of note that much of a law enforcement officer's traffic is routinely sent in in the clear, making this extremely situation-dependent. Source: N/A

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Analysis of First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.2.7. Error Handling according to NIST Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface According to Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface, 4.2.7. Error Handling: The SW processing status is the status word of the overall secure messaging command and response processing. It indicates whether the secure messaging was performed successfully. If the processing was successful, it SHALL be '90 00'. Otherwise, it SHALL be as follows: - '68 82' - Secure messaging not supported - '69 82' - Security status not satisfied 24 - '69 87' - Expected secure messaging data objects are missing - '69 88' - Secure messaging data objects are incorrect If the command processing was unsuccessful, the card SHALL return one of the above status words without performing further secure messaging.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide for Conducting Risk Assessments provide? (Section 68) , individuals, other organizations, or the Nation. Organizations can update risk assessments on an ongoing basis using security-related information from organizational continuous monitoring processes. 41 Continuous monitoring processes evaluate: (i) the effectiveness of security controls; (ii) changes to information systems and environments of operation; and (iii) compliance to federal legislation, regulations, directives, policies, standards, and guidance. As risk assessments are updated and refined, organizations use the results to update the risk management strategy, thereby incorporating lessons learned into risk management processes, improving responses to risk, and building a solid foundation of threat and vulnerability information tailored to organizational missions/business functions. 41 NIST Special Publication 800-137 provides guidance on information security continuous monitoring for information systems and organizations. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ The risk assessment process entails ongoing communications and information sharing among stakeholders to ensure that: (i) the inputs to such assessments are as accurate as possible; (ii) intermediate assessment results can be used, for example, to support risk assessments at other tiers; and (iii) the results are meaningful and useful inputs to the risk response step in the risk management process. The manner and form in which risks are communicated are an expression of organizational culture as well as legal, regulatory, and contractual constraints. To be effective, communication of information security risks and other risk-related information produced during the risk assessment is consistent with other forms of risk communication within organizations.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Guide for Conducting Risk Assessments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings say about · Banking Kiosk? According to 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings, · Banking Kiosk: A bank operates an ATM (auto-teller machine) network and requires the use of digital signatures for high-value transfers. The ATM can be deployed with finger-vein or palm-vein biometrics to serve as a stronger form of authentication. In this case, the end-user can use biometrics to authenticate to the OTPK CA (via the bank's internal ATM network) to get the certificate.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers say about 7.1.5 Test Case MFA-4 (Accounts Automatically Locked After Failed Login Attempts)? (Part 2) According to Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers, 7.1.5 Test Case MFA-4 (Accounts Automatically Locked After Failed Login Attempts): mple implementation shall lock a purchaser's account upon detection of that account exceeding a predetermined number of failed login attempts for the cost threshold and risk engine example lab builds. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Test Case Field | Description | |--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Testable Requirement | (CR 4.a) Magento | | Description | Show that the MFA example implementation can lock a purchaser account if the allowed number of customer ID and password-authentication attempts is exceeded.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls provide? (Section 288) eir use, but they can also misuse it for undesirable purposes. It is often very difficult to determine whether their use of the sytem is in accordance with the legitimate performance of their job. 12. -An employee may convert Government information to an unauthorized use; for example, he may sell privileged data about an individual to a prospective employer, credit agency, insurance company, or competitor; or he may use Government statistics for stock market transactions before their public release. 13. -A user whose job requires access to individual records in a file may manage to compile a complete listing of the file and then make unauthorized use of it (e.g., sell a listing of employees' home addresses as a mailing list). 14. -Unauthorized altering of information may be accomplished for an unauthorized end user (e.g., altering of personnel records). 15. -An authorized user may use the system for personal benefit (e.g., theft of services) . 16. -A supervisor may manage to approve and enter a fraudulent transaction. 17. -A disgruntled or terminated employee may destroy or modify records - possibly in such a way that backup records are also corrupted and useless. 18. -An authorized user may accept a bribe to modify or obtain information. 3. UNCONTROLLED SYSTEM ACCESS. Organizations expose themselves to unnecessary risk if they fail to establish controls over who can enter the ADP area, who can use the ADP system, and who can access the information contained in the system. - -Data or programs may be stolen from the computer room or other storage areas. - -ADP facilities may be destroyed or damaged by either intruders or employees. - -Individuals may not be adequately identified before they are allowed to enter - ADP area. - -Remote terminals may not be adequately protected from use by unauthorized - persons - -An unauthorized user may gain access to the system via a dial-in line and an authorized user's password.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance say about 2.2.1 Recommended Key Sizes and Algorithms? (Part 2) According to Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance, 2.2.1 Recommended Key Sizes and Algorithms: gorithms and key sizes are approved for use beyond the year 2013. However, a digital signature or key establishment certificate may expire at any time, depending on the organization's security policy. Table 2-1: Recommended Algorithms and Key Sizes | Key Type | Algorithms and Key Sizes | |------------------------------------------------------------------------|-------------------------------------------------------------------------| | Digital Signature keys used for authentication (for Users or Devices) | RSA (2048 bits) ECDSA (Curve P-256) | | Digital Signature keys used for non-repudiation (for Users or Devices) | RSA (2048 bits) ECDSA (Curves P-256 or P-384) | | CA and OCSP Responder Signing Keys | RSA (2048 or 3072bits) ECDSA (Curves P-256 or P-384) | | Key Establishment keys (for Users or Devices) | RSA (2048 bits) Diffie-Hellman (2048 bits) ECDH (Curves P-256 or P-384) | Note that some approved algorithms and key sizes, such as DSA 2048, are omitted to enhance interoperability. RSA and ECDSA, which are included in Table 2-1 above, have been widely deployed in PKIs. Therefore, they are recommended for use to enhance interoperability. However, DSA (2048 and 3072) as specified in [FIPS 186-4] are allowed as long as the required security strength is satisfied. For ECDSA, only the two elliptic curves listed in Table 2-1 above of the elliptic curves are recommended for use in PKIs for digital signatures [FIPS 186-4]. Similarly, Elliptic Curve Diffie-Hellman (ECDH) is recommended to support key establishment, rather than Elliptic Curve MQV. While Table 2-1 is focused on the strength of the public key contained in a certificate, the strength of the digital signature on a certificate itself is equally important.

Explanation: NIST publication on credential and access management. Topics: authentication, pki, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Section 15) | | | D.3.1.14. Attachments.....................................................................................................................216 | | | D.3.1.15. C-SCRM Plan and Life Cycles ............................................................................................216 | | | D.4.1. C-SCRM Template ....................................................................................................................218 | | | D.4.1.1. Authority and Compliance..................................................................................................218 | | | D.4.1.2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Considerations for Remote Electronic UOCAVA Voting provide? (Section 24) cation of voters, system operators, election officials, and system components. Issues related to the identification and authentication of voting system users and components are discussed in Section 7. These areas were chosen to break the discussion of security issues into closely related topic areas. Issues related to any one of these topic areas are closely bound to those associated with other topics. For instance, an insufficient authentication mechanism could allow an unauthorized individual to access sensitive information (a confidentiality violation) or modify key voting system records (an integrity violation). For each topic area, this report discusses the following: -  Potential Benefits: The move from the current mail-in absentee voting process to a remote electronic voting system can provide some benefits to security, such as in the areas of automated forms of strong authentication, timeliness of delivery, and ballot secrecy. For each of the topic areas, this report will describe the advantages of remote electronic voting. -  Properties: In order to facilitate discussion of threats to remote electronic voting systems, this report provides lists of desirable security properties. In general, threats identified in this report are actions that can violate one or more of those properties. The security properties identified in this report are based on properties and requirements identified in other electronic remote voting system documents including the Secure Electronic Registration and Voting Experiment (SERVE) Project documentation [10], the Common Criteria Protection Profile for online voting systems [8], and the Council of Europe's standards for online voting systems [9]. Policymakers ultimately must decide which properties must be met by voting systems to be acceptable in their jurisdictions.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Security Considerations for Remote Electronic UOCAVA Voting.