You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identity and Access Management for Electric Utilities provide? (Section 337) @ozone local]# mv ~/admin2.cer authority/bin/ [root@ozone local]# cd authority/bin/ [root@ozone bin]# ./startAuthority.sh Configuration file not found, would you like to create a new installation? [Y] Y ***WARNING*** NIST SP 1800-2C: Identity and Access Management for Electric Utilities 233 This product MUST be installed by an Ozone Certified Engineer. Pericore, Inc. cannot be held liable for damages resulting from negligent or fraudulent actions of unauthorized or unqualified administrators. Please review all documentation thoroughly before continuing. Continuation of this configuration process represents an agreement to abide by the Pericore EULA. Do you wish to continue? [N] : y Please select the license file for this Ozone Authority.: 1: /usr/local/authority/conf/AuthorityLicense.xml 2: Other... Choice [1] : 1 Please select the configuration file for this Ozone Authority.: 1: /usr/local/authority/conf/AuthorityConfiguration.xml 2: Other... Choice [1] : 1 Do you wish to set any passphrase complexity requirements? [N] : N Note: If you require passphrase at start, you will not be able to restart this Ozone Authority without user intervention. Do you wish to require a passphrase to start this Ozone Authority? [N] N Using keystore type: RSA T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . Do you have an existing keystore you wish to use for this Ozone Authority? [Y] : Y Please select the keystore file for this Ozone Authority:: 1: /usr/local/authority/keystores/authority.jks NIST SP 1800-2C: Identity and Access Management for Electric Utilities 234 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . 2: Other... Choice [1] : 1 Please enter the passphrase.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CP-6 in Security and Privacy Controls for Information Systems and Organizations? (Part 2) Control CP-6: s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ omission or commission. Organizations determine what is considered a sufficient degree of separation between primary and alternate storage sites based on the types of threats that are of concern. For threats such as hostile attacks, the degree of separation between sites is less relevant. Related Controls: RA-3. (2) ALTERNATE STORAGE SITE | RECOVERY TIME AND RECOVERY POINT OBJECTIVES Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives. Discussion: Organizations establish recovery time and recovery point objectives as part of contingency planning. Configuration of the alternate storage site includes physical facilities and the systems supporting recovery operations that ensure accessibility and correct execution. Related Controls: None. (3) ALTERNATE STORAGE SITE | ACCESSIBILITY Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions. Discussion: Area-wide disruptions refer to those types of disruptions that are broad in geographic scope with such determinations made by organizations based on organizational assessments of risk. Explicit mitigation actions include duplicating backup information at other alternate storage sites if access problems occur at originally designated alternate sites or planning for physical access to retrieve backup information if electronic accessibility to the alternate site is disrupted.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Tip according to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information? Tip: State agencies commonly manage user accounts and credentials for their state CJIS portal, serving as the IdP for users across the state. The cost of this function, both in upfront costs of procuring and implementing MFA and in ongoing costs in help desk support and authenticator lifecycle management, might be alleviated if local, tribal, and territorial agencies had the option to integrate their local identity services with the state portal using identity federation protocols. Section 3.4.2.3 details an example architecture that supports this functionality.

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, mfa. Contains security framework guidance for authentication systems. Source: Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about Integrity? According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Integrity: The integrity impact level is based on the specific mission and the data supporting that mission, not on the time required to detect the modification or destruction of information. The consequences of unauthorized modification or destruction of information management information (e.g., configuration settings, passwords, authorization codes, cryptographic keying material) can compromise the effectiveness of the system and impair agency operations. The level of impact depends on the criticality of system functionality to the agency mission Special Factors Affecting Integrity Impact Determination : The loss of integrity for some information management information (e.g., encryption keys) can be very serious for agency operations and can have serious consequences for public confidence in the agency. The integrity impact level recommended for information management information associated with highly critical information is high . Recommended Integrity Impact Level: Potentially serious adverse effects can be expected in most government organizations resulting from the unauthorized modification or deletion of information management information. Therefore, the provisional integrity impact level recommended for information management information is moderate .

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide say about 5.3.4. Person or Entity Authentication (§ 164.312(d)) 139? (Part 6) According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide, 5.3.4. Person or Entity Authentication (§ 164.312(d)) 139: • Has the organization researched available MFA options and made a selection based on risk to ePHI? • Is outside vendor support required to implement the process? • Are there password-less authentication options (e.g., biometric authentication) available that can sufficiently address the risk to ePHI? | | 3. Select and Implement Authentication Options | • Consider the results of the analysis conducted under Key Activity 2 and select appropriate authentication methods based on the results of the risk assessment and risk management processes. • Implement the methods selected in organizational operations and activities. | • Has the organization's selection of authentication methods been made based on the results of the risk assessment? • If passwords are being used as an authentication element, are they of sufficient length and strength to protect ePHI? Is this enforced by technical policies? • Has necessary user and support staff training 141 been completed? • Have a formal authentication policy and procedures been established and communicated? • Has necessary testing been completed to ensure that the authentication system is working as prescribed? • Do the procedures include ongoing system maintenance and updates? • Is the process implemented in such a way that it does not compromise the authentication information (e.g., password file encryption)? | 141 See Section 5.1.5, HIPAA Standard: Security Awareness and Training.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa. Contains security framework guidance for authentication systems. Source: Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IA-32 in Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases? (Part 61) Control IA-32: ustworthiness. ## D.3.1.1 Arm Realms CCA provides architecture support for dynamically created entities called Realms. A Realm [66] [67] contains both user (EL0) and kernel space (EL1) code and data. The higher-privileged entity that manages Realm resources is the NW hypervisor. Realm tenants do not need to trust either the hypervisor or existing SW code. Realms are protected from each other; a Realm does not need to trust other Realms. The CCA RoT enforces authenticity of the CCA platform by attesting to the boot state and security state of a Realm, the authenticity of the Realm content through verification and measurement, and the confidentiality of the guest data through Physical Address Space (PAS) protection and encryption. Realm world is a world separate from both the NW and the SW which already exist in TrustZone. Realm world is designed for the exclusive use of Realms. A Realm protects the information within it from other system entities. Higher-privileged software retains responsibility for allocating and managing the resources utilized by Realms but cannot access their contents. Higher-privileged software also retains responsibility for scheduling within its Realms, but cannot otherwise control or directly observe their execution flow. Specifically, CCA provides: - Additional memory access control, orthogonal to the existing controls enforced using translation tables - Execution state protection - Trustworthy measurement (attestation) of the initial state - A guarantee that the system configuration (for example, whether external debug is permitted) does not change during the lifetime of the Realm (immutability) Realm data remains confidential even after Realm destruction or system reset. Realms are explicitly designed to be created and destroyed on demand. A Non-secure hypervisor can create a new Realm at any time, much like it can create a new VM at any time.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control MP-128 in Security Guidance for First Responder Mobile and Wearable Devices? (Part 31) Control MP-128: or PIN is recommended on most devices. Even if a biometric authentication method is used, such as fingerprint or facial recognition, a PIN or password is required to unlock a device at power-on/reset. Choosing a sufficiently strong password or PIN is important to ensuring strong device encryption. What is suitably strong also depends on device capabilities. Devices that include hardware-backed key stores for device encryption greatly reduce the risk of brute force attacks on the device encryption keys, particularly when these devices automatically delete locally stored mobile data after too many successive failed password/PIN attempts. Gaps : No observable gaps were found concerning data and device encryption. Vender guidance provided clear configuration instructions, where possible. Since encryption is offered during device setup, it is easily user-configurable. Online resources through the vendor or OS manufacturer offered clear instructions on how to set up encryption or where to check the status of the device's encryption. App-based encryption and configuration varies according to the app developer, this is not considered a notable gap for the device. Guidance: Out-of-the-box most devices are encrypted, however, devices that are not encrypted have setup wizards that provide the option to encrypt the device upon initial setup. It is recommended to enable device encryption whenever possible. Application or app-based specific encryption is only recommended in situations where greater data privacy is required, e.g. evidence data, state secrets, or personally identifiable data. App-based encryption is not typical or available for every app and is usually implemented by the app developer. The level and degree of encryption and authentication complexity is also dependent on the device use, user role, and privacy requirements. Device encryption can be enabled through the setup menu of the device, typically under the security configuration section.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Guidance for First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2014 Annual Report? (Part 53) Control HA-3: plan. The resulting plan included the following areas of focus: - Coordination with Office of Management and Budget (OMB), and other federal agencies, such as National Security Agency (NSA) and U.S. Department of Homeland Security (DHS), on all matters relating to information security and privacy; - Cybersecurity technical transfer and implementation interests, considering items of particular note to individual industry sectors; - Updates from the Privacy and Civil Liberties Oversight Board (PCLOB); - Updates from NIST's CSD regarding cybersecurity and cryptographic work; - Updates regarding embedded software security, including medical device security; - Considerations surrounding Trusted Internet Connections, DHS Enhanced Cybersecurity Services (ECS) and special needs for critical infrastructures; - Procurement and requirements to reduce supply-chain risk; - Cross-Agency Priority Goals (CAP Goals) for cybersecurity; - Information sharing with a focus on information security and privacy; - Updates regarding FISMA, the related security controls (SP 800-53), and FedRAMP; and - Updates of other critical NIST publications. In addition to the work-plan focus areas, the Board also considered the following topics during FY 2014: - Internet of Things (IOT); - Cryptography and NIST Cryptography processes; - Transportation Sector and Vehicle-to-Vehicle Communication; - GAO reports relating to information security and privacy; - Big Data and Privacy; - Controlled Unclassified Information (CUI) Program; - Federal Cloud Credential Exchange (FCCX) and the NSTIC; and - National Cybersecurity Center of Excellence (NCCoE) Updates. The presenters at each Board meeting were leaders and experts representing private industry; academia; federal agency CIOs, IGs and CISOs. Copies of the current list of members and their biographies, the Board's charter and past Board activities are located at http:/ /csrc.nist.gov/groups/SMA/ispab.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Guidelines for Smart Grid Cybersecurity? (Part 548) Control SI-11: P M G S . ( n o i t c e t o r P a d e M i ) . S P G S ( y t i r u c e S l e n n o s r e P y t i r u c e S l a t n e m n o r i v n E d n a ) . E P G S ( l i a c s y h P ) L P G S . ( l i g n n n a P c g e t a r t i S n o i t a z i r o h t u A d n a t n e m s s e s s A y t i r u c e S ) . A C G S ( ) M P G S . ( t n e m e g a n a M m a r g o r P y t i r u c e S ) L P G S . ( i g n n n a P l d n a m e t s y S n o i t a m r o f n I d i r G t r a m S ) . C S G S ( n o i t c e t o r P n o i t a c n u m m o C i d n a m e t s y S n o i t a m r o f n I d i r G t r a m S ) I . S G S ( y t i r g e t n I n o i t a m r o f n I d n a m e t s y S n o i t a m r o f n I d i r G t r a m S ) . A S G S i ( n o i t i s u q c A s e c v r e S i m e t s y S n o i t a m r o f n I d i r G t r a m S ) A M G S . ( e c n a n e t n a M d n a i t n e m p o e v e D l X X X X X X X X X X X X X X 145 ) . C A G S ( l o r t n o C s s e c c A Security Protocols Synchrophasors Certificates: Time and Date Issues Event Logs and Forensics Security for Radio-Controlled Distribution Devices Weak Protocol Stack Implementations Insecure Protocols Unmanaged Call Home Function Patch Management System Trust Model User Trust Model Security Levels Distributed versus Centralized Model of Management Intrusion Detection for Power Equipment ) T A G S . i i ( g n n a r T d n a s s e n e r a w A ) . U A G S ( y t i l i b a t n u o c c A d n a t i d u A ) M C G S . ( t n e m e g a n a M n o i t a r u g i f n o C ) . P C G S ( s n o i t a r e p O f o y t i u n i t n o C ) A I . G S ( n o i t a c i t n e h t u A d n a n o i t a c i f i t n e d I ) R I . G S ( e s n o p s e R t n e d c n I i t n e m e g a n a M t n e m u c o D d n a n o i t a m r o f n I ) D I . G S ( ) P M G S . ( n o i t c e t o r P a d e M i ) .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PM-9 in Guide to Operational Technology (OT) Security? Control PM-9: Risk Management Strategy No OT Discussion for this control.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does National Online Informative References (OLIR) Program_ Submission Guidance for OLIR Developers provide? (Section 2) ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax Approved by the NIST Editorial Review Board on 2024-02-23 Supersedes NIST IR 8278A (November 2020) https://doi.org/10.6028/NIST.IR.8278A Barrett M, Keller N, Quinn S, Smith MC, Scarfone K, Johnson V (2024) National Online Informative References (OLIR) Program: Submission Guidance for OLIR Developers. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Internal Report (IR) NIST IR 8278Ar1. Matthew Barrett: 0000-0002-7689-427X Nicole Keller: 0000-0003-4761-6817 Stephen Quinn: 0000-0003-1436-684X Matthew C. Smith: 0000-0003-1004-7171 Karen Scarfone: 0000-0001-6334-9486 Vincent Johnson: 0000-0002-7363-996X olir@nist.gov National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000 Additional information about this publication is available at including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). The National Online Informative References (OLIR) Program is a NIST effort to facilitate standardized definitions of Online Informative References (OLIRs) by subject matter experts.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: National Online Informative References (OLIR) Program_ Submission Guidance for OLIR Developers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does PDA Forensic Tools_ an Overview and Analysis say about Scripts? According to PDA Forensic Tools_ an Overview and Analysis, Scripts: EnCase has built-in scripts that allow the examiner to perform the following tasks: - Consecutive Sectors: This script searches the disk for sectors that are filled entirely with a specified character. The results of the scan are saved in the bookmarks. - Find Unique E-mail Address List: This script searches through selected files for a "basic" e-mail signature, this is further checked out using a built-in EnScript function. Once a good hit is found, it is added to a list, so that if the same address is found, it will not be added again. - Graphics File Finder: This script searches for user specified graphics files of the following types: . emf , . jpg , . gif , and . bmp files. After the script has been compiled and run, all graphics files of the specified type are displayed in the graphics library. In addition examiners can craft a customized graphics file finder for additional graphics files (e.g., . png files). - Valid Credit Card Finder: This script will bookmark valid VISA, MasterCard and AmEx numbers. All valid credit card (CC) hits will be bookmarked in the folder "All CC Hits". The first occurrence of each CC hit will be bookmarked in "Unique CC Hits". Each of the above scripts are run producing a bookmark of the results, which allow the forensic examiner to evaluate the following: a table view of the data, a gallery for pictures (e.g., . jpg , . bmp , . emf , . gif , etc.), a timeline, and the generated report from the script.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PDA Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does CVSS Implementation Guidance say about 2.1.3 Authentication? According to CVSS Implementation Guidance, 2.1.3 Authentication: The Authentication metric measures the access an attacker requires to exploit a vulnerability. As the number of times an attacker must authenticate increases the CVSS base score will decrease. There are three possible values for this metric: Multiple (Au:M), Single (Au:S), and None (Au:N). A value for the Authentication metric is assigned to a vulnerability based upon the number of authentication instances required to exploit the vulnerability. To receive a value of Au:M, the attacker must be required to successfully authenticate more than once in order to exploit a vulnerability. For instance, the requirement of authenticating to exploit a vulnerability within a restricted area of a web application, an attacker may need to first authenticate to gain access to the web application, and authenticate another time to gain privileged access. If an attacker must only prove their identity a single time, the Authentication metric is set to 'Single.' Note that this includes authenticating via the command line, a desktop session, or a web interface. Vulnerability CVE-2012-6530 references remote authenticated users; in this case an attacker is required to authenticate to the server (among other considerations) to exploit the vulnerability. Examples of terms that should trigger a vulnerability analyst to believe the vulnerability is AV:S are authenticated users or authenticated attackers . If authentication is not required to successfully exploit a vulnerability it receives a value of Au:N. Many vulnerabilities, such as CVE-2012-3754 and CVE-2011-4583, within Appendix A do not require authentication.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, cve-. Contains technical security guidance that could inform defensive posture. Source: CVSS Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.2.1.17 BDB Format Owner/Type according to NIST Common Biometric Exchange Formats Framework (CBEFF) According to Common Biometric Exchange Formats Framework (CBEFF), 5.2.1.17 BDB Format Owner/Type: In a CBEFF structure the BDB Format Owner and Format Type, when used in combination, uniquely identify the specific format of the BDB content. The format and content of the BDB is 'owned' by the CBEFF Client (see Clause 6.1 ). This BDB format definition may be published (public) or unpublished (non-public). When transforming a CBEFF record from an initial Format to a target Format, the values of these fields shall identify the target BDB format.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Biometric Exchange Formats Framework (CBEFF).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Conformance Test for FDDI Medium Access Control (MAC) say about FDDI MAC Conformance Test TTCN Machine Processable Form? (Part 2) According to A Conformance Test for FDDI Medium Access Control (MAC), FDDI MAC Conformance Test TTCN Machine Processable Form: pe INTEGER (4000 TO 167772) $PICS_PIXIT $Comment Tester's Requested TTRT. $End_TS_PARdcl $TS_PARdcl $TS_PARid T_Req_IUT $TS_PARtype INTEGER (4000 TO 167772) $PICS_PIXIT $Comment lUT' s Requested TTRT. $End_TS_PARdcl $TS_PARdcl $TS_PARid T_Bid_Max $TS_PARtype INTEGER (4000 TO 167772) $PICS_PIXIT $Comment Highest Bidding Value of Tester in Claim Token Process. $End_TS_PARdcl $TS_PARdcl $TS_PARid T_Bid_Min $TS_PARtype INTEGER (4000 TO 167772) $PICS_PIXIT $Comment Lowest Bidding Value of Tester in Claim Token process. $End_TS_PARdcl $TS_PARdcl $TS PARid M FCS Rev ``` ``` $TS_PARtype BITSTRING $PICS_PIXIT $End_TS_PARdcl $TS_PARdcl $TS_PARid M_FCS_Tramt $TS_PARtype BITSTRING $PICS_PIXIT $End_TS_PARdcl $End_TS_PARdcls $Begin_CONSTdcls $CONSTdcl $CONSTid T_Max $CONSTtype INTEGER $CONSTvalue 167772 $Cornment The maximum value (default value) of TRT . $End_CONSTdcl $CONSTdcl $CONSTid T_Min $CONSTtype INTEGER $CONSTvalue 4000 $Comment The minimum value (default value) of TRT.

Explanation: NIST publication on credential and access management. Topics: access control, token. Contains security framework guidance for authentication systems. Source: A Conformance Test for FDDI Medium Access Control (MAC).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain REFERENCES according to NIST Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, REFERENCES: Source Control: AC-05 Supporting Publications: SP 800-162 [22], SP 800-178 [23]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Secure Web Services say about 3.8.3 Reliable Messaging? According to Guide to Secure Web Services, 3.8.3 Reliable Messaging: The WS-Reliability and WS-ReliableMessaging standards provide guaranteed message delivery using one of the following semantics: - At-Least-Once semantics, which is a guarantee that a message will be delivered. - At-Most-Once semantics, which is a guarantee that a duplicate message will not be delivered. - Exactly-Once semantics, which is a guarantee that a message will be delivered without duplication. In addition to the message guarantee semantics, both standards provide a mechanism for sending messages in order. These features are crucial for critical applications that may rely on Web services. Previously, implementers would have to develop their own reliability mechanisms, which could prove costly or ineffective in practice. With the advent of these standards, robust implementations can be developed and used in the development of reliable Web services. Nevertheless, the existence of two competing standards makes it difficult for organizations to fully adopt either standard.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Smart Card Technology_ New Methods for Computer Access Control say about REFERENCES? (Part 2) According to Smart Card Technology_ New Methods for Computer Access Control, REFERENCES: . "Taking the Media to Task," Personal Identification News, April 1986, page 4. - [MCTl 85] Micro Card Technologies, Incorporated, Micro Card (Mask: M4) Designer's Guide, Version 1.8, October 9, 1985. - [MCT2 85] Micro Card Technologies, Incorporated, Micro Card (Mask: M4) Technical Overview, Version 1.0, November 13, 1985. - [MCIV 85l Mclvor, Robert. "Smart Cards," Scientific American, November 1985, pages 152-159. - [PRRY 88l Perry, John G., Technical Support Manager, Ultron Labs Corporation. Private Communication, April 19, 1988. - [RANT 861 Rant, Jon. "Intel's EPROMs: Lasting Memories for the Long Haul," Solutions, March/April 1986, pages 2-7. - fRSKI 871 Rosinski, John J. "Smart Card Puts a Database in Your Pocket," AT&T Technology Products, Systems and Services, Volume 2, ^2, 1987. - fSVGL 85] Svigals, Jerome. Smart Cards: The Ultimate Personal Compufer, MacMillan Publishing Company, New York, 1985. - fSVGL 871 Svigals, Jerome. "Wall Street Journal Offers How-To Course in ATM/PIN Fraud," Smart Cards and Comments, June 1987, page 4. - [TASK 88l Taskett, John, Customer Support Manager, Micro Card Technologies, Incorporated. Private Communication, June 8, 1988. - fWLSN 85l Wilson, John W. "Superchips: The New Frontier," Business Week, June 10, 1985, pages 82-85. U.S. DEPT. OF COMM. BIBLIOGRAPHIC DATA SHEET (See instructions) - 1, PUBLICATION OR REPORT NO. NIST/SP-Bnn/1.S7 2. Performing Orgzui. Report NoJ 3. Publication Date September 1988 4. TITLE AND SUBTITLE Smart Card Technology: New Methods for Computer Access Control 5. AUTHOR(S) Martha E. Haykin and Robert B.J. Warnar 6. PERFORMING ORGANIZATION (If joint or other than NBS, see instructions) NATIONAL BUREAU OF STANDARDS U.S. DEPARTMENT OF COMMERCE GAITHERSBURG, MD 20899 7. Contract/Grant No. 8. Type of Report & Period Covered Final 9. SPONSORING ORGANIZATION NAME AND COMPLETE ADDRESS (Street. City. Stole. ZIP) Same as item 6 10.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Smart Card Technology_ New Methods for Computer Access Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Overview and Considerations of Access Control Based on Attribute Encryption say about 5.1.1. Key Management? (Part 2) According to Overview and Considerations of Access Control Based on Attribute Encryption, 5.1.1. Key Management: s one of the attributes and explicitly defining policies so that user identification is required for access requests, or 2) using schemas that assign IDs to keys as used by multi-authority mechanisms. Key escrow: Because a user's private key is generated through the key management service, ABE has the capability of key escrow. However, such a capability can be a positive or negative feature depending on the usages, such as a private organization using it for security control while sacrificing the privacy of its users. Several variant ABE systems have been proposed that remove the escrow by replacing encryption or key generation processes with certificate-based encryption [CRAI], secure key issuing cryptography [BCEKJS], or certificateless cryptography [AP]. Key revocation: One of the major advantages of any identity encryption scheme is that a third party's secret key can be destroyed after all users have been issued keys and if there is only a finite number of users. This can also take place for ABE systems because it assumes that keys are always valid once issued, and there is no method for key revocation to handle secret keys due to expiry of embedded attributes, faulty access policies, or key compromise. Key revocation for ABE can be handled by including the expiry time and date among the attributes, periodic refreshing, and revocation lists [GOLIC].

Explanation: NIST publication on credential and access management. Topics: access control, key management. Contains security framework guidance for authentication systems. Source: Overview and Considerations of Access Control Based on Attribute Encryption.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-3 in Guide to Operational Technology (OT) Security? Control SI-3: MALICIOUS CODE PROTECTION CNTL NO. CONTROL NAME Control Enhancement Name CONTROL BASELINES LOW MOD HIGH


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services say about 4.3.2. Security Continuous Monitoring Category? (Part 8) According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services, 4.3.2. Security Continuous Monitoring Category: Consider subscribing to or enabling user community and PNT | DOT CMPS 3 GPS IS-200 3 GPS IS-705 3 GPS IS-800 3 | | Detect Security Continuous Monitoring Subcategory | Applicability to PNT | References (PNT-Specific) | |-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.6 PKI according to NIST Personal Identity Verification Demonstration Summary According to Personal Identity Verification Demonstration Summary, 3.6 PKI: Six of the companies provided PKI functionality. Most of these companies provided card issuance capabilities and partnered with a Certificate Authority (CA). Eighty percent indicated that their CA was part of the Federal Bridge, and the remaining twenty percent stated that joining their CA to the Federal Bridge was in their future plans. At the time of the demonstration, sixty-seven percent of the companies issued certificates following the Common Policy. Eighty-three percent indicated that the FASC-N was contained in the subject alternative name extension of the PIV Authentication X.509 certificate.

Explanation: NIST publication on credential and access management. Topics: authentication, pki, certificate authority. Contains security framework guidance for authentication systems. Source: Personal Identity Verification Demonstration Summary.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EC-1 in A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments? (Part 14) Control EC-1: authorization during each service request and response. Deploying identity-tier policies requires a standardized infrastructure for creating, issuing, and maintaining tamper-proof service identities. Some of the components of this infrastructure are outlined below and also discussed in [5]: - Creation of application identity: The fundamental requirement to enable this is the assignment of a unique identity to each application or service, just like how each user carries a unique identity (e.g., userid). Prior to the era of cloud-based applications, application requests were validated based on the IP subnet or IP address from which they originated. Since ubiquitous access and multi-clouds have eliminated the concept of network perimeters, authentication and authorization based on those parameters are neither feasible nor scalable. Further, the presence of proxies, network address translations, dynamic infrastructures (e.g., migration of applications between VMs), and load balancers make it impossible for the called application to know the IP address of the calling application in order to make authentication or authorization decisions. A unique application identity is required. - Establishment of trust in application identity: The created application (i.e., workload or service) identity should not be subject to spoofing and should be continuously verifiable. An example of workload identity is a SPIFFE ID [4], which is a string that uniquely and specifically identifies a workload and is encoded as a Uniform Resource Identifier (URI). The SPIFFE ID is carried in a cryptographically verifiable document called a SPIFFE Verifiable Identity Document (SVID). SPIFFE supports multiple SVID formats, but the most commonly used is an X.509 certificate. - Discovery of application resources: There should be a robust and secure method for discovering all of the application dependencies consumed over the network (e.g., services, SaaS endpoints, network appliances).

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Intrusion Detection and Prevention Systems (IDPS) say about 8.3 Other Technologies with IDPS Capabilities? According to Guide to Intrusion Detection and Prevention Systems (IDPS), 8.3 Other Technologies with IDPS Capabilities: In addition to dedicated IDPS technologies, organizations typically have several other types of technologies that offer some IDPS capabilities and complement the primary IDPSs. This section discusses common types of complementary technologies: network forensic analysis tools, anti-malware technologies (antivirus software and antispyware software), firewalls and routers, and honeypots. 49 For each, a brief overview of the technology is provided, and its use in intrusion detection and prevention and its relationship to IDPSs are explained. Recommendations are also made as applicable for how the complementary technologies should be used alongside of IDPSs.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure say about 5.3.1. Anomalies and Events? (Part 9) According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure, 5.3.1. Anomalies and Events: siderations. | ISO/SAE 21434 Clause 8 and clause 13.3 | | AE-5 | XFC/EVSE | Applicable, but no additional EVSE-specific considerations. | ISA/IEC 62443-2- 1:D4E1 EVENT 1.1, EVENT 1.7 | | AE-5 | Cloud/Third-Party | Applicable, but no additional Cloud/Third-Party-specific considerations. | [NIST-SP800-53r5] IR-4, IR-5, IR-8 | | AE-5 | Utility/Building Management System | Applicable, but no additional Utility/Building Management System-specific considerations. | ISA/IEC 62443-2- 1:D4E1 EVENT 1.1, EVENT 1.7 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain C.2.e There were Varying Perspectives Regarding Additional External Security Requirements according to NIST A Study of Federal Agency Needs for Information Technology Security According to A Study of Federal Agency Needs for Information Technology Security, C.2.e There were Varying Perspectives Regarding Additional External Security Requirements: The study team observed varying attitudes regarding whether security should br 'required" (i.e., mandated) or, rather, whether it should be the subject of guidance. The security people interviewed understood the value of protecting sensitive information and resources, and doing so was their direct responsibility. Some of these people wanted to be able to point to some documented authority when they are told by others, "Show me where it says I have to do it. Otherwise, 1 have more pressing things to do." They felt although there are existing laws and directives (e.g., the Computer Security Act and OMB Circular A-130), these did not fully serve the security people In these circumstances. Some of these people felt that in their own environments security was well ingrained in the culture. They therefore were less likely to view external requirements to implement security as a burden. The requirements were more likely to be viewed in a larger IT context. It also appeared that such a view permitted a person requesting additional resources to do so more confidently. Other interviewees, however, felt very strongly that additional requirements were not needed and current requirements were adequate. These people felt what would be helpful was meaningful guidance that would make it easier to do what they already know they needed to do. They felt additional security requirements would be burdensome and would make their jobs harder, not easier.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of Federal Agency Needs for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines for Securing Radio Frequency Identification (RFID) Systems? (Part 215) Control ES-1: ed equipment is configured to meet operational and security requirements, RFID data is integrated with legacy enterprise systems, and staff are trained in the proper use and maintenance of the system. - GLYPH<c=31,font=/MCAMJE+Webdings> Phase 4: Operations/Maintenance . This phase includes security-related tasks that an organization should perform on an ongoing basis once the RFID system is operational, including conducting periodic security assessments, applying security-related software patches, and reviewing RFID event logs. - GLYPH<c=31,font=/MCAMJE+Webdings> Phase 5 : Disposition . This phase encompasses tasks that occur when a system or its components have been retired, perhaps as a result of a significant upgrade. These tasks include preserving information to meet legal requirements and disabling or destroying tags and other components when they are taken out of service. The practices presented in this section are provided in tables corresponding to the life cycle phases. Each practice is accompanied by a brief explanation of the rationale for its inclusion and is rated as 'recommended' or 'should consider.' Organizations are strongly encouraged to adopt the 'recommended' practices. Failure to implement them significantly increases the risk of an RFID security failure. Organizations should also examine each of the 'should consider' practices to determine their applicability to the target environment. A 'should consider' practice should be rejected only if it is infeasible or if the reduction in risk from its implementation does not justify its cost. Organizations should develop their RFID security controls based not only on the practices in the tables, but also using other guidelines on security controls.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Section 10) ............................................ 5 | | 2.1 DEVELOPMENTAPPROACH ...................................................................................................... | 5 | | 2.2 ORGANIZATIONANDSTRUCTURE | ............................................................................................. 7 | | 2.3 FLEXIBLE APPLICATION | ............................................................................................................. 9 | | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11 | CHAPTER THREE THE REQUIREMENTS......................................................................................... 11 | | 3.1 ACCESSCONTROL | .................................................................................................................. 12 | | 3.2 AWARENESSANDTRAINING | ...................................................................................................

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.4.2 Virtual Machine Configuration according to NIST IT Asset Management According to IT Asset Management, 4.4.2 Virtual Machine Configuration: The Openswan virtual machine is configured with two network interface cards, 8 GB of RAM and one CPU core.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IT Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements say about Required Vendor Information:? According to Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements, Required Vendor Information:: SCAP.V.4200.1: The vendor SHALL provide instructions on where the CVE IDs can be located within the product output. The vendor SHALL provide procedures and a test environment (if necessary) so that the product will output vulnerabilities with associated CVE IDs. Instructions SHALL include where the CVE IDs and the associated vendor-supplied and official CVE descriptions can be located within the product output. It is acceptable to have CVEs in the form of a specific link for each CVE to the NVD.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommended Cybersecurity Requirements for Consumer-Grade Router Products say about A.6.17. Software Update 3 †? According to Recommended Cybersecurity Requirements for Consumer-Grade Router Products, A.6.17. Software Update 3 †: The integrity of data, including configuration, is preserved when an update is applied. In the case of a failed update, the product should revert to a usable state.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommended Cybersecurity Requirements for Consumer-Grade Router Products.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Blockchain Networks_ Token Design and Management Overview say about Appendix A-Base Layer Consensus and Compute? (Part 4) According to Blockchain Networks_ Token Design and Management Overview, Appendix A-Base Layer Consensus and Compute: provide such guarantees on their own, and zero-knowledge proofs can add privacy features to them. Frameworks have been developed to assess whether a specific use case is suitable for blockchain [168]. Blockchain platforms can provide highly modular and configurable protocols (e.g., pluggable consensus models) that are intended to allow different types of use cases. Per EEA's Client Specification [84], transaction finality 'occurs when a transaction is definitely part of the blockchain and cannot be removed. A transaction reaches finality after some event defined for the relevant blockchain occurs. For example, an elapsed amount of time or a specific number of blocks added.' In a consortium blockchain, where nodes are partially trusted to behave appropriately, transaction finality can usually be considered deterministic (or absolute ). When deterministic, a transaction is deemed final as soon as it provably satisfies an explicit condition, such as being added to a block. In a permissionless blockchain, transaction finality is often probabilistic . The more blocks are added after a transaction is posted, the more final the transaction. This has fundamental ramifications for participants' expectations of data integrity and risks. Additionally, blockchain protocols enable virtual machines for smart contracts that offer application-specific instruction sets (e.g., Bitcoin Script) or general-purpose programming languages (e.g., Solidity [169], Move [9]), which may be Turing-complete . Note that blockchain protocols' execution environments (e.g., Ethereum Virtual Machine [4], WebAssembly open standard (Wasm) [170]) do not interact with the smart contracts themselves but with the bytecodes that the smart contracts compile into. High expressiveness can enable a variety of use cases, but low expressiveness may be a desirable feature too depending on security models.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems say about 2.1.5 Integrity Impact (I)? According to The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems, 2.1.5 Integrity Impact (I): 2.1.5 Integrity Impact (I) This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information. The possible values for this metric are listed in Table 5. Increased integrity impact increases the vulnerability score. Table 5. Integrity Impact Scoring Evaluation | Metric Value | Description | |----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | None (N) | There is no impact to the integrity of the system. | | Partial (P) | Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited. For example, system or application files may be overwritten or modified, but either the attacker has no control over which files are affected or the attacker can modify files within only a limited context or scope. | | Complete (C) | There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised. The attacker is able to modify any files on the target system. |

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Validating the Integrity of Computing Devices say about 3.2.1 Scenario 1: Creation of Verifiable Platform Artifacts? According to Validating the Integrity of Computing Devices, 3.2.1 Scenario 1: Creation of Verifiable Platform Artifacts: An OEM, VAR, or other authoritative source creates a verifiable artifact that binds reference platform attributes to unique, trusted, hardware-based components of the computing device. The platform attributes in this artifact (e.g., serial number, embedded components, firmware and software information, platform configuration) are used by the purchasing organization during acceptance and provisioning of the computing device. Customers may also create their own platform artifacts to establish a baseline that could be used to validate devices in the field.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validating the Integrity of Computing Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SA-17(01) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control SA-17(01): DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | FORMAL POLICY MODEL ASSESSMENT OBJECTIVE: Determine if:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i say about 4.3.2 Counter Mode with Cipher Block Chaining MAC Protocol (CCMP)? (Part 1) According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i, 4.3.2 Counter Mode with Cipher Block Chaining MAC Protocol (CCMP): 4.3.2 Counter Mode with Cipher Block Chaining MAC Protocol (CCMP) CCMP is the second data confidentiality and integrity protocol that may be negotiated as a cipher suite for the protection of user traffic in an RSNA. Like TKIP, CCMP was developed to address all known inadequacies of WEP; however, CCMP was developed without the constraint of requiring the use of existing hardware. CCMP is considered the long-term solution for the creation of RSNs for WLANs. It is mandatory for RSN compliance. CCMP is based on CCM, a generic authenticated encryption block cipher mode of AES. 43 CCM is a mode of operation defined for any block cipher with a 128-bit block size. CCM combines two wellknown and proven cryptographic techniques to achieve robust security. First, CCM uses CTR for confidentiality and Cipher Block Chaining MAC (CBC-MAC) for both authentication and integrity protection. CCMP protects the integrity of both the packet data and portions of the IEEE 802.11 header. CCM for IEEE 802.11 employs a single 128-bit session key (TK) to protect the duplex data channel. The 42 The existence of the countermeasures, which include temporary termination of service, enables an attacker to perform a denial of service attack by generating MIC errors. In this case, TKIP preserves integrity at the expense of availability. 43 CCM is defined by RFC 3610, Counter with CBC-MAC (CCM) (http://www.ietf.org/rfc/rfc3610.txt). AES is defined by FIPS PUB 197 (http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf). CCMP key space has size 2 128 and uses a 48-bit packet number (PN) to construct a nonce to prevent replay attacks. The construction of the nonce allows the key to be used for both integrity and confidentiality without compromising either.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Improving Enterprise Patching for General IT Systems: according to NIST Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways According to Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways, Improving Enterprise Patching for General IT Systems:: Utilizing Existing T ools and Performing Processes in Better Ways

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain C.2.2.3 Regulatory Creation Information Type according to NIST Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, C.2.2.3 Regulatory Creation Information Type: Regulatory Creation involves the activities of researching and drafting proposed and final regulations. Subject to exception conditions described below, the recommended security categorization for the regulatory creation information type is as follows: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)}

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 444) organizations may choose to do so. There may be legal considerations when performing and retaining video surveillance, especially if such surveillance is in a public location. Related Controls: None. (4) MONITORING PHYSICAL ACCESS | MONITORING PHYSICAL ACCESS TO SYSTEMS Monitor physical access to the system in addition to the physical access monitoring of the facility at [Assignment: organization-defined physical spaces containing one or more components of the system]. Discussion: Monitoring physical access to systems provides additional monitoring for those areas within facilities where there is a concentration of system components, including server rooms, media storage areas, and communications centers. Physical access monitoring can be coordinated with intrusion detection systems and system monitoring capabilities to provide comprehensive and integrated threat coverage for the organization. Related Controls: None. References: None. PE-7 VISITOR CONTROL [Withdrawn: Incorporated into PE-2 and PE-3.] PE-8 VISITOR ACCESS RECORDS Control: a. Maintain visitor access records to the facility where the system resides for [Assignment: organization-defined time period]; b. Review visitor access records [Assignment: organization-defined frequency]; and c. Report anomalies in visitor access records to [Assignment: organization-defined personnel]. Discussion: Visitor access records include the names and organizations of individuals visiting, visitor signatures, forms of identification, dates of access, entry and departure times, purpose of visits, and the names and organizations of individuals visited. Access record reviews determine if access authorizations are current and are still required to support organizational mission and business functions. Access records are not required for publicly accessible areas. Related Controls: PE-2, PE-3, PE-6.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does U.S. Department of Energy Risk Assessment Methodology provide? (Section 114) V Risk management - V Contingency planning - V Security tests and evaluations - Certification - Accreditation - V Open door policy - Establishment of computer security organization - Designation of officials with specific duties and responsibilities - Recovery management - V - V V V - V - V - Security incidents - Facility and system access controls - System operation - Backup - Emergency response - Housekeeping COUNTERMEASURES GUIDANCE: ADMINISTRATIVE PROCEDURAL SECURITY AND SECURITY MANAGEMENT STEP 5 RESOURCE TABLE R5.1g V V V V V V V V V - V V V Uninterrupted power supply Surge protectors Power plant physical security Emergency lighting Grounding (equipment and floor mats) Power off control switch V V V V V V V V V V V V - V V - V V - Fire detectors Fire suppression system Portable fire extinguishers - Fire dampers in duct work - Fire rated walls and partitions - Noncombustible construction materials and furnishings - Smoke exhaust systems - Fire fighting teams V V V V V V V V Water drains Water sensors Humidity recording device and sensors Plastic sheeting for equipment - V V V V V V Good housekeeping Emergency evacuation

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: U.S. Department of Energy Risk Assessment Methodology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4 say about <score>? According to Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4, <score>: This element contains the weighted score for a Benchmark test, as a real number. Scoring models are defined in Section 3.3. This element may only appear as a child of a TestResult element. Content: string (non-negative number) Cardinality: 1-n Parent Elements: TestResult Attributes: system, maximum Child Elements: none The system attribute, a URI, identifies the scoring model (see the description of the model element on page 62 for a list of pre-defined models). If the system attribute does not appear, then the model used was the default model. The maximum attribute, a real number, gives the maximum possible value of the score for this Benchmark test. If the maximum attribute does not appear, then it is taken to have a value of 100.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3 provide? (Section 112) a way to create and manage infrastructure with reduced manual intervention, Open Control was used by GSA's lean startup-influenced digital services agency 18F to facilitate continuous authorization . Continuous authorization is seen as logically similar to agile's continuous deployment . The 18F team employs YAML to implement a schema which is publicly available on GitHub. Infrastructure management involves security and privacy considerations related to hardware operation and maintenance. Some topics related to infrastructure management are listed below. - Threat and vulnerability management - o DoS-resistant cryptographic protocols - Monitoring and alerting - o As noted in the NIST Critical Infrastructure Cybersecurity Framework, Big Data affords new opportunities for large-scale security intelligence, complex event fusion, analytics, and monitoring. - Mitigation - o Breach mitigation planning for Big Data may be qualitatively or quantitatively different. - Configuration Management - o Configuration management is one aspect of preserving system and data integrity. It can include the following: - o Patch management - o Upgrades - Logging - o Big Data must produce and manage more logs of greater diversity and velocity. For example, profiling and statistical sampling may be required on an ongoing basis. - Malware surveillance and remediation - o This is a well-understood domain, but Big Data can cross traditional system ownership boundaries. Review of NIST's 'Identify, Protect, Detect, Respond, and Recover' framework may uncover planning unique to Big Data. - Network boundary control - o Establishes a data-agnostic connection for a secure channel -  Shared services network architecture, such as those specified as 'secure channel use cases and requirements' in the ETSI TS 102 484 Smart Card specifications [100].

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware. Contains technical security guidance that could inform defensive posture. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Product Tested according to Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI? Product Tested: UNIX® System V/88 Release 4.0 Version: 3

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EC-62443 in 2017 NIST_ITL Cybersecurity Program Annual Report? (Part 20) Control EC-62443: occurred on June 19, 2017 at NIST. The FISSEA audience included managers responsible for information systems security awareness, training, certifications, workforce identification, compliance, etc. in federal agencies; contractors providing awareness and training support; and faculty members of accredited educational institutions who are involved in information security training and education. Clarence Williams, Peggy Himes, Gretchen Morris (DB Consulting Group/NASA), and other members of the FISSEA Working Group, were integral to the effort to support the conference. This year's theme was 'Securing the Future to Infinity and Beyond: Improving Cybersecurity through Awareness, Training, and Education'. Attendees gained new techniques for developing/conducting training, cost-effective practices, considerations for compliance, and free resources and contacts. Over 150 cybersecurity training professionals attended the one-day conference. NIST's ITL Director, Charles Romine, welcomed attendees to the event. FISSEA Lifetime Member, Louis Numkin, provided a historical timeline of FISSEA, recognizing 30 years of providing a platform for security specialists to collaborate, network, and learn. Presenters represented NIST, DHS, DoD, HHS, private industry, and academia. Attendees had an opportunity to share about their specific awareness and training programs throughout the conference. The FISSEA Educator of the Year Award was established to recognize and honor a contemporary who is making special efforts to create, build, manage, or inspire an information systems security awareness, training, or education program. Gretchen Morris, 2015 FISSEA Educator of the Year, presented the 2016 FISSEA Educator of the Year Award to Professor Sushil Jajodia of George Mason University. Mrs. Morris shared Mr.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does An Introduction to Information Security say about 3.6 Authorizing Official (AO)? According to An Introduction to Information Security, 3.6 Authorizing Official (AO): The Authorizing Official is a senior official or executive with the authority to formally assume responsibility for operating a system at an acceptable level of risk to organizational operations and assets, individuals, and other organizations. Responsibilities include, but are not limited to: - Approving security plans, memorandums of agreement or understanding, plans of action and milestones, as well as determining whether significant changes in the system or environments of operation require reauthorization; and - Ensuring that authorizing official designated representatives carry out all activities and functions associated with security authorization.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: An Introduction to Information Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2009 Annual Report say about Security for Grid and Pervasive Systems? (Part 2) According to Computer Security Division 2009 Annual Report, Security for Grid and Pervasive Systems: tacks, protocols, and application programming interfaces (APIs) for the pervasive systems' security functions that have either been embedded or recommended by commercial or standards organizations. In the future, we will focus on analyzing the capabilities and limitations of authorization management infrastructures that the selected grid or pervasive systems of previous research are capable of providing. We will also develop guide documentations or reference implementations using already-developed tools (such as Globus and Access Control languages) to demonstrate how to configure a grid or pervasive system to satisfy the security requirements. We expect that this project will: - Promote (or accelerate) the adoption of community computing that utilizes the power of shared resources and computing time of grid and pervasive infrastructure; - Provide prototype security standards for the authorization management of community computing environments; - Increase security and safety of static (connected) distributed systems by applying the trust domain concept of grid and pervasive computing; and - Assist system architects, security administrators, and security managers whose expertise is related to community computing in managing their systems, and to learn the limitations and practical approaches for their applications. Contact: Dr. Vincent Hu (301) 975-4975 vhu@nist.gov

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IR-6 in Guide to Operational Technology (OT) Security? Control IR-6: (3) INCIDENT REPORTING | SUPPLY CHAIN COORDINATION Select Select Select Select OT Discussion: The organization should report incidents on a timely basis. CISA collaborates with international and private-sector computer emergency response teams (CERTs) to share control systems-related security incidents and mitigation measures. Control Enhancement: (1) OT Discussion: The automated mechanisms used to support the incident reporting process are not necessarily part of or connected to the OT. Control Enhancement: (3) No OT Discussion for this control. 257 NIST SP 800-82r3 September 2023 Guide to Operational Technology (OT) Security

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 596) p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P. 8 0 0 - 5 3 A r 5 CHAPTER FOUR PAGE 320 Reference produced from open data hps://github.com/usnistgov/oscal-content NIST SP 800-53A, REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS MP-05 MEDIA TRANSPORT POTENTIAL ASSESSMENT METHODS AND OBJECTS: MP-05-Examine [SELECT FROM: System media protecon policy; procedures addressing media storage; physical and environmental protecon policy and procedures; access control policy and procedures; authorized personnel list; system media; designated controlled areas; system security plan; other relevant documents or records]. MP-05-Interview [SELECT FROM: Organizaonal personnel with system media protecon and storage responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators]. MP-05-Test [SELECT FROM: Organizaonal processes for storing informaon media; mechanisms supporng and/or implemenng media storage/media protecon]. MP-05(01) MEDIA TRANSPORT | PROTECTION OUTSIDE OF CONTROLLED AREAS [WITHDRAWN: Incorporated into MP-05.] MP-05(02) MEDIA TRANSPORT | DOCUMENTATION OF ACTIVITIES [WITHDRAWN: Incorporated into MP-05.] MP-05(03) MEDIA TRANSPORT | CUSTODIANS ASSESSMENT OBJECTIVE: Determine if: MP-05(03)[01] a custodian to transport system media outside of controlled areas is idenﬁed; MP-05(03)[02] the idenﬁed custodian is employed during the transport of system media outside of controlled areas. POTENTIAL ASSESSMENT METHODS AND OBJECTS: MP-05(03)-Examine [SELECT FROM: System media protecon policy; procedures addressing media transport; physical and environmental protecon policy and procedures; system media transport records; audit records; system security plan; other relevant documents or records].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Web Transactions_ TLS Server Certificate Management say about Technologies? (Part 6) According to Securing Web Transactions_ TLS Server Certificate Management, Technologies: --------------| | Load balancer | F5 Networks BIG-IP Local Traffic Manager | Acts as a TLS server and distributes re- ceived traffic across a number of other TLS servers. | PR.AC-7, PR.DS-2, PR.PT-5 | | DevOps framework | Kubernetes | Open-source container orchestration system for automating application de- ployment, scaling, and management. | PR.PT-5 | | Automated certificate management frameworks | Jetstack Cert- Manager Certbot | Jetstack Cert-Manager provides auto- mated certificate management for Ku- bernetes. Certbot is an automated client that en- rolls and deploys TLS certificates for web servers by using the ACME proto- col. | PR.AC-1, PR.AC-4 | | TLS servers | Apache Microsoft IIS NGINX | The following TLS server configurations were deployed with a TLS server certifi- cate managed as follows: Microsoft IIS: remote agentless certifi- cate management Microsoft IIS attached to the Thales TCT HSM: remote agentless certificate man- agement Apache: remote agentless certificate management Apache: certificate management via the ACME protocol and certbot client NGINX on Kubernetes: Cert-Manager plug-in for automated certificate man- agement of ingresses. | PR.AC-7, PR.DS-2, PR.PT-5 | | Application servers | Apache | These systems represented a second tier of internal application servers that were also deployed with TLS server cer- tificates. | PR.AC-7, PR.DS-2, PR.PT-5 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does An Introduction to Information Security say about 7.4 Interdependencies? According to An Introduction to Information Security, 7.4 Interdependencies: Assurance is an issue for every control and safeguard discussed in this publication. One important point to reemphasize here is that assurance is not only for technical controls, but for operational controls as well. Although this chapter focused on systems assurance, it is also important to have assurance that management controls are working properly. Are user IDs and access privileges kept up to date? Has the contingency plan been tested? Can the audit trail be tampered with? Is the security program effective? Are policies understood and followed? As noted in the introduction to this chapter, the need for assurance is more widespread than individuals often realize. Assurance is closely linked to planning for security in the system life cycle. Systems can be designed to facilitate various kinds of testing against specified security requirements. By planning for such testing early in the process, costs can be reduced. Some kinds of assurance cannot be obtained without proper planning.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: An Introduction to Information Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD) provide? (Section 793) Test Case Field Description 2020-06-11T19:45:43.985692867Z 2020-06-11 19:45:43,985 mi- cronets-mud-manager: INFO fromDeviceACL: [{'name': 'cl0- frdev', 'matches': {'ipv4': {'ietf-acldns:dst-dnsname': 'www.osmud.org', 'protocol': 6}, 'tcp': {'ietf-mud:direc- tion-initiated': 'from-device', 'destination-port': {'opera- tor': 'eq', 'port': 443}}}, 'actions': {'forwarding': 'ac- cept'}}, {'name': 'myctl0-frdev', 'matches': {'ietf- mud:mud': {'my-controller': [None]}}, 'actions': {'forward- ing': 'accept'}}] 2020-06-11T19:45:43.985885574Z 2020-06-11 19:45:43,985 mi- cronets-mud-manager: INFO Found ietf-mud:mud: {'my-control- ler': [None]} 2020-06-11T19:45:43.987174428Z 2020-06-11 19:45:43,987 mi- cronets-mud-manager: INFO acls: {'device': {'deviceId': '', 'macAddress': {'eui48': ''}, 'networkAddress': {'ipv4': '10.135.4.2'}, 'allowHosts': ['www.osmud.org', 'my-control- ler'], 'denyHosts': []}} 2020-06-11T19:45:43.989185189Z fromDeviceACL: dip: www.osmud.org 2020-06-11T19:45:43.989232148Z fromDeviceACL: dip: my-con- troller 2020-06-11T19:45:43.989236949Z [2020-06-11 19:45:43,988] 172.17.0.1:36620 POST /getFlowRules 1.0 200 296 5824 2020-06-11T19:45:43.990630231Z 2020-06-11 19:45:43,988 quart.serving: INFO 172.17.0.1:36620 POST /getFlowRules 1.0 200 296 5824 IoT device—second onboarding event: MUD manager—log file showing cached file in use: 2020-06-12T14:39:21.769511212Z 2020-06-12 14:39:21,768 mi- cronets-mud-manager: INFO getMudInfo called with: {'url': 'server2.micronets.net/micronets-mud/nist- model-fe_mycontroller.json'} 2020-06-12T14:39:21.770159883Z 2020-06-12 14:39:21,769 mi- cronets-mud-manager: INFO getMUDFile: url: server2.micronets.net/micronets-mud/nist-model-fe_mycontrol- ler.json 2020-06-12T14:39:21.770708123Z 2020-06-12 14:39:21,770 mi- cronets-mud-manager: INFO getMUDFile: mud filepath for server2.micronets.net/micronets-mud/nist- model-fe_mycontroller.json: /mud-cache-dir/nccoe-server2.mi- cronets.net_micronets-mud_nist-model-fe_mycontroller.json...

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TG-005 in Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS)? (Part 19) Control TG-005: place outside any feasible integrity perimeter. We also note that circularities are fatal to the inductive verification proposed by Clark and Wilson, in that they lead to indefinite recursive descent. ## 3.4.2 Challenge: A Rigorous Demonstration Our challenge in this regard is to demonstrate that the induction is indeed possible, by taking a representation of even a trivial system in an appropriate formal notation, performing the induction, and submitting the result to the social process. An inductive proof of the overall integrity of an applications subsystem which had been checked by the Boyer-Moore theorem prover would be a convincing demonstration. ## 4. Summary and Conclusion We end our report with a question, two admonitions, and a concluding observation. The question addresses the issue raised often in the plenary sessions, to wit, what the economic value of all this is, and forms a final challenge: If one has a mechanism which enforces the E-rules to some degree of assurance, and one has an applications subsystem whose elements all exhibit Clark and Wilson's properties to varying degrees of assurance, and this system is to protect assets of a known value, then how does one estimate the insurance premium to cover loss? The first admonition is to repeat the theme of the challenges that run through this report: work some examples. The history of computer science is replete with proposals for programming languages, system structuring techniques, notations, and assurance technologies which seemed plausible and even desirable when described at the level of detail used by Clark and Wilson, but which collapsed utterly under the stress of actual use. In particular, we admonish the various organizations which are considering the establishment of standards, criteria, and certification mechanisms not to do so until considerable experience has been gained in the implications of these rules.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).