You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1.1 Purpose and Scope according to NIST Guide to Malware Incident Prevention and Handling for Desktops and Laptops According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops, 1.1 Purpose and Scope: This publication is intended to help a wide variety of organizations understand the threats posed by malware and mitigate the risks associated with malware incidents. In addition to providing background information on the major categories of malware, it provides practical, real-world guidance on preventing malware incidents and responding to malware incidents in an effective, efficient manner. The information presented in this publication is intended to be used as data points entered into a much larger risk management process. See the latest version of NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems for information on the basics of risk management. 1 This publication is based on the assumption that the organization already has a general incident response program and capability in place. See the latest version of NIST SP 800-61, Computer Security Incident Handling Guide for more information on general incident response. 2 NIST SP 800-61 serves as the foundation for this publication.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, incident response. Contains technical security guidance that could inform defensive posture. Source: Guide to Malware Incident Prevention and Handling for Desktops and Laptops.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security in ISDN provide? (Section 87) pecial, secure ISDN networks, with secure switches, and secure trunks between switches, may be practical for special applications, but would not be practical in the context of the public ISDN network. However, the encryption need not stop at tlie netwoiic switch. TE-to-TE encryption, as illustrated in figure 23 is transparent to the network, and could be used between any two suitably equipped terminals, provided a 64 kbps unrestricted digital channel is available between them. A companion packet application protocol, possibly using the D channel during call set-up, is necessary for key management and authentication, to initialize the secure link. Symmetry would indicate that if there might be an ISPIB protocol, atop the B channel, then there might also be a similar ISPID protocol. Such a protocol does not appear to be practical, however, because it would confound the contention mechanism used to share the D channel on a passive bus. If complete B channel traffic flow confidentiality is required, this can be provided by the combination of the ISP2D and the ISPIB protocols. Finally, ISPO encryption at the bottom of the Physical layer is also possible, as illustrated in figure 24. In this case both B channels, the D channels and the associated framing, balance and control bits would all be encrypted in one 192 kbps stream. Encryption at this layer could not be end-to-end since the encrypted signal could not cross the NTl. In effect, the cryptographic device would be inserted in the NTl device and in front of the line card (see figs. 19 and 20) in the local office switch. This would have the advantage of denying an intruder between the NTl and the switch any traffic fiow information. It would be practical on a limited scale and would completely protect a user's confidentiality where it is most vulnerable, on his line between his premises and the telephone local office.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Security in ISDN.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Considerations for Voice Over IP Systems provide? (Section 16) their information, system operations, and continuity of essential operations when deploying VOIP systems. An especially challenging security environment is created when new technologies are deployed. Risks often are not fully understood, administrators are not yet experienced with the new technology, and security controls and policies must be updated. Therefore, agencies should carefully consider such issues as their level of knowledge and training in the technology, the maturity and quality of their security practices, controls, policies, and architectures, and their understanding of the associated security risks. These issues should be considered for all systems but are especially important with VOIP deployment for essential operations, such as systems designated "high" under FIPS 199, Standards for Security Categorization of Federal Information and Information Systems [2]. VOIP can provide more flexible service at lower cost, but there are significant tradeoffs that must be considered. VOIP systems can be expected to be more \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ vulnerable than conventional telephone systems, in part because they are tied in to the data network, resulting in additional security weaknesses and avenues of attack (see Appendix A for more detailed discussion of vulnerabilities of VOIP and their relation to data network vulnerabilities). Confidentiality and privacy may be at greater risk in VOIP systems unless strong controls are implemented and maintained. An additional concern is the relative instability of VOIP technology compared with established telephony systems. Today, VOIP systems are still maturing and dominant standards have not emerged. This instability is compounded by VOIP's reliance on packet networks as a transport medium. The public switched telephone network is ultra-reliable.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 996) system developer; organizaonal personnel with boundary protecon responsibilies]. SC-07(22)-Test [SELECT FROM: Mechanisms supporng and/or implemenng separate network addresses/diﬀerent subnets]. SC-07(23) BOUNDARY PROTECTION | DISABLE SENDER FEEDBACK ON PROTOCOL VALIDATION FAILURE ASSESSMENT OBJECTIVE: Determine if: SC-07(23) feedback to senders is disabled on protocol format validaon failure. CHAPTER FOUR PAGE 541 Reference produced from open data hps://github.com/usnistgov/oscal-content T h i s p u b l i c a  o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h  p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P. 8 0 0 - 5 3 A r 5 NIST SP 800-53A, REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS SC-07(23) BOUNDARY PROTECTION | DISABLE SENDER FEEDBACK ON PROTOCOL VALIDATION FAILURE POTENTIAL ASSESSMENT METHODS AND OBJECTS: SC-07(23)-Examine [SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system hardware and soware; system architecture; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records]. SC-07(23)-Interview [SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer; organizaonal personnel with boundary protecon responsibilies]. SC-07(23)-Test [SELECT FROM: Mechanisms supporng and/or implemenng the disabling of feedback to senders on protocol format validaon failure].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Web Transactions_ TLS Server Certificate Management provide? (Section 356) the inventory system and act upon the status of any certificate (e.g., report a certificate that is expired, about to expire, or does not conform to policy, or it can replace an expired certificate). It can also send expiration reports and notifications to certificate owners and can support disaster recovery by quickly replacing a large number of certificates located throughout the network architecture. The certificate manager can be used in conjunction with the CAs to enroll and provision certificates (and keys), store attributes with those certificates, and discover the absence of an expected certificate from a machine where it should be installed. The certificate manager can revoke certificates and change the owner associated with that certificate. The certificate network scanning tool can discover certificates not being managed by the inventory. The certificate log server can record all certificate and private-key management operations, including certificate creation, installation, and revocation; key pair generation; certificate requests and request approvals; certificate and key copying; and certificate and key replacement. All components in this portion of the architecture-except for the certificate database-are configured to use the HSM, which can securely generate, store, manage, and process the private key corresponding to the TLS server's certificate. The HSM is capable of storing and protecting the symmetric keys that secure sensitive data in the certificate database, and can generate, store, manage, and process internal CAs' signing keys. Figure 1-2 depicts the physical architecture of the example implementation deployed in the NCCoE laboratory.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 988) curity responsibilies; organizaonal personnel with boundary protecon responsibilies; system users]. SC-07(12)-Test [SELECT FROM: Mechanisms implemenng host-based boundary protecon capabilies]. T h i s p u b l i c a  o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h  p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P. 8 0 0 - 5 3 A r 5 CHAPTER FOUR PAGE 536 Reference produced from open data hps://github.com/usnistgov/oscal-content NIST SP 800-53A, REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS SC-07(13) BOUNDARY PROTECTION | ISOLATION OF SECURITY TOOLS, MECHANISMS, AND SUPPORT COMPONENTS ASSESSMENT OBJECTIVE: Determine if: SC-07(13)_ODP informaon security tools, mechanisms, and support components to be isolated from other internal system components are deﬁned; SC-07(13) <SC-07(13)_ODP informaon security tools, mechanisms, and support components> are isolated from other internal system components by implemenng physically separate subnetworks with managed interfaces to other components of the system. POTENTIAL ASSESSMENT METHODS AND OBJECTS: SC-07(13)-Examine [SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system hardware and soware; system architecture; system conﬁguraon sengs and associated documentaon; list of security tools and support components to be isolated from other internal system components; system audit records; system security plan; other relevant documents or records]. SC-07(13)-Interview [SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with boundary protecon responsibilies]. SC-07(13)-Test [SELECT FROM: Mechanisms supporng and/or implemenng the isolaon of informaon security tools, mechanisms, and support components].


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Federal and Commercial Information Security Needs provide? (Section 51) portion of the evaluation themselves, the vast majority wanted an independent third party evaluation. A federal government-operated or commercial government-accredited process was the most desirable. Many factors contributed to each organization's attitude toward certification, including sensitivity of the applications, corporate culture, time and cost considerations, mission criticality, past experience with vendors, and availability of assessment sources. The vast majority of the organizations interviewed felt that administering computer security, particularly access control, was burdensome in a heterogeneous, distributed environment. Given their other responsibilities, this function took more time and effort than they felt was appropriate. Interviewees wanted computer security-related products that would easily implement organization security policy and manage security functions. These functions included centralized network security administration and single logon for network data and services. Organizations felt that improved security administrator interfaces were essential to balance the increasing need for protection and limitations on the staff resources devoted to it. Most organizations felt that vendors should provide a strong password management capability at the operating system level and it should be tailorable to specific environmental needs. Along with that, most felt NIST should continue to promote research on improving the integrity of the identification and authentication process. Technologies such as smart cards, signature verification, and voice authentication have a potential place in an overall approach to security. However, for most organizations, only a low-cost solution would be practical due to a large number of users. For EDI to be a practical alternative to the exchange of paper, organizations want specific assurances that EDI messages are authentic and properly authorized.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Assessing Federal and Commercial Information Security Needs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to Domain Name System-Based Electronic Mail Security? https: //www.cvedetails.com/vulnerability-list/vendor\_id-73/product\_id-1950/version\_id-8545/MacromediaFlash-Player-6.0.29.0.html.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio say about Plan and Execute Risk Response Strategies? (Part 1) According to Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio, Plan and Execute Risk Response Strategies: Plan and Execute Risk Response Strategies The fifth step of the risk management life cycle is to determine the appropriate response to each risk. The goal of effective risk management, including ICT risks, is to identify ways to keep risk aligned with the risk appetite or tolerance in as cost-effective a way as possible. In this stage, the practitioner will determine whether the exposure associated with each risk in the register is within acceptable levels based on the potential consequences. If not, that practitioner can identify and select cost-effective risk response options to achieve ICT objectives. Planning and executing risk responses are iterative activities and should be based on the risk strategy guidance described in Sec. 3.1.3. As the risk oversight authorities monitor the success of those responses, they will provide operational leaders with financial and mission guidance to inform future risk management activities. In some cases, risk evaluation may lead to a decision to undertake further analysis to confirm estimates or more closely monitor results (as described in Sec. 5.1.2). Note that risk responses themselves may introduce new risks. For example, adding multi-factor authentication to a business system to reduce an access control risk may introduce a new risk of decreased productivity when users have difficulty authenticating. While there is some variance among the terms used by risk management frameworks, there are four types of actions available (as described in Table 5 ) for responding to negative ICT risks: accept, transfer, mitigate, and avoid . Table 5.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, multi-factor. Contains security framework guidance for authentication systems. Source: Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.2.7 Modems and Terminal Servers according to NIST SRI International_ Improving the Security of Your UNIX System According to SRI International_ Improving the Security of Your UNIX System, 2.2.7 Modems and Terminal Servers: Modems and terminal servers (terminal switches. Annex boxes, etc.) present still another potential security problem. The main problem with these devices is one of configuration - misconfigured hardware can allow security breaches. Explaining how to configure every brand of modem and terminal server would require volumes. However, the following items should be checked for on any modems or terminal servers installed at your site: 1. If a user dialed up to a modem hangs up the phone, the system shouir' him out. If it doesn't, check the hardware connections and the kernel configurauon of the serial ports. 2. If a user logs off, the system should force the modem to hang up. Again, check the hardware connections if this doesn't work. 3. If the connection from a terminal server to the system is broken, the system should log the user off. * Oo Sun systems, /infers/ is stored in lusrletclin.fingerd. On most other systems, it is called !etc!fingerd. 4. - If the terminal server is connected to modems, and the user hangs up, the terminal server should inform the system that the user has hung up. Most modem and terminal server manuals cover in detail how to properly connect these devices to your system. In particular you should pay close attention to the 'Carrier Detect,' 'Clear to Send,' and 'Request to Send' connections.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: SRI International_ Improving the Security of Your UNIX System.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 28) Control HA-1: g able to use a finer grained distributed trust model, and of being able to use multiple origin site authorities (and private keys) to issue and sign the authentication and attribute assertions. In many origin sites a single back end LDAP server is the sole authoritative source for both authentication and attribute information. Typically Shibboleth sites implement stage one by issuing a Bind operation on their LDAP server, using the username and password provided by the user to the web login prompt. If the Bind succeeds, the user has been successfully authenticated against the password stored in the LDAP server. Stage two is implemented ## 4th Annual PKI R&D Workshop -- Proceedings by searching the LDAP server for the attributes stored in the user's entry, and filtering these against the Shibboleth origin's attribute release policy before returning them to the Shibboleth target site as signed SAML attribute assertions. One can see that in such an implementation, and as a consequence of the Shibboleth trust model, the Shibboleth target site has no choice but to make access control decisions based on these attributes, without knowing who actually issued them to the user, whether they are still valid or not, or whether they are even the correct attributes for the particular user, since the user's name is not provided to the target site for privacy reasons. The Shibboleth origin doesn't trust anyone to see the attributes except the trusted targets, but even they are not allowed to see the binding between the attributes and the owner's identity. (The two reasons given for this in the Shibboleth documentation are user privacy and legal requirements for universities to protect a student's privacy). The target site thus has no option but to indirectly trust the contents of the origin site's LDAP server or other attribute repository, since it trusts the origin site directly.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain SOFTWARE OOVKKKD according to NIST Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems According to Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems, SOFTWARE OOVKKKD: List each critical software (operating system and applications). What supports: | ID | Name | Version | Vendor | Language | |------|--------|-----------|----------|-------------| | | | | | Responsible |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domestic Disaster Recovery Plan for PCs, OIS, and Small VS systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Bluetooth Security provide? (Section 34) until after authentication, encryption, and authorization have been performed. Once a device has been authenticated, service-level authorization is not typically performed by a Security Mode 3 device. However, NIST recommends that servicelevel authorization should be performed to prevent 'authentication abuse'-that is, an authenticated remote device using a Bluetooth service without the local device owner's knowledge. All 2.0 and earlier devices can support Security Mode 3, but 2.1 and later devices can only support it for backward compatibility purposes. Similar to Security Mode 2, Security Mode 4 (introduced in Bluetooth 2.1 + EDR) is a service-levelenforced security mode in which security procedures are initiated after physical and logical link setup. Security Mode 4 uses Secure Simple Pairing (SSP), in which ECDH key agreement is utilized for link key generation (see Section 3.1.1). Until Bluetooth 4.0, the P-192 Elliptic Curve was used for the link key generation, and the device authentication and encryption algorithms were identical to the algorithms in Bluetooth 2.0 + EDR and earlier versions. Bluetooth 4.1 introduced the Secure Connections feature, which allowed the use of the P-256 Elliptic Curve for link key generation. In Bluetooth 4.1 the device authentication algorithm was upgraded to the FIPS-approved Hash Message Authentication Code Secure Hash Algorithm 256-bit (HMAC-SHA-256). The encryption algorithm was upgraded to the FIPS-approved AES-Counter with CBC-MAC (AES-CCM), which also provides message integrity. Security requirements for services protected by Security Mode 4 must be classified as one of the following: - Level 4: Authenticated link key using Secure Connections required - Level 3: Authenticated link key required - Level 2: Unauthenticated link key required - Level 1: No security required - Level 0: No security required.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Guide to Bluetooth Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.2 HyTrust DataControl Setup according to NIST Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments According to Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments, 4.2 HyTrust DataControl Setup: Follow the directions on these pages: 1. Creating a Cloud VM Set 2. Installing [the Policy Agent] Interactively on Windows 3. Registering the Policy Agent Using the HyTrust Policy Agent GUI 4. Encrypting a Disk Using the webGUI

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Supporting Roles according to NIST_SP_800-37r2_Risk_Management_Framework? Supporting Roles: Senior Accountable Official for Risk Management or Risk Executive (Function); Authorizing Official or Authorizing Official Designated Representative; Information Owner or Steward; System Security Officer; System Privacy Officer.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Section 404) ? | | Manufacturer | | How does the manufacturer assess, prioritize, and remediate reported product or service vulnerabilities? | | Manufacturer | | How does the manufacturer ensure that product or service vulnerabilities are remediated in a timely period to reduce the window of opportunity for attackers? | | Manufacturer | | Does the manufacturer maintain and manage a Product Security Incident Reporting and Response program (PSRT)? | | Manufacturer | | What is the manufacturer's process for ensuring that customers and external entities (such as government agencies) are notified of an incident when their product or service is impacted? | | Manufacturer | Define threat analysis as well as the criteria that will be utilized to assess the threat of the product, service, or supplier. Include a rubric with categorical definitions to encourage the transparency of assessment results. The C-SCRA threat analysis evaluates and characterizes the level of threat to the integrity, trustworthiness, and authenticity of the product, service, or supplier as described below. This analysis is based on a threat actor's capability and intent to compromise or exploit the product, service, or supplier being introduced into the supply chain. Following completion of the analysis, one of the following threat levels is assigned: - Critical: Information indicates that an adversarial or non-adversarial threat is imminent (e.g., an adversary is actively engaged in subversion, exploitation, or sabotage of the product, service, or supplier).

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, threat actor, adversary. Contains technical security guidance that could inform defensive posture. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-1 in Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers? (Part 46) Control CM-1: ltiple fields that collectively identify the goal of the test, the specifics required to implement the test, and how to assess the results of the test. Table 7-1 describes each field in the test case. Table 7-1 Test Case Fields | Test Case Field | Description | |--------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Parent Requirement | Identifies the top-level requirement, or the series of top-level requirements, leading to the testable requirement. | | Testable Requirement | Guides the definition of the remainder of the test case fields. Specifies the capability to be evaluated. | | Description | Describes the objective of the test case. | | Associated Test Cases | In some instances, a test case may be based on the outcome of (an)other test case(s). For example, analysis-based test cases produce a result that is verifiable through various means (e.g., log entries, reports, alerts). | | Associated Cybersecurity Framework Subcategories | Lists the Cybersecurity Framework Subcategories addressed by the test case. | | Preconditions | The starting state of the test case. Preconditions indicate various starting state items, such as a specific capability configuration required or specific protocol and content. | | Procedure | The step-by-step actions required to implement the test case.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide for Security-Focused Configuration Management of Information Systems provide? (Section 62) isabling or uninstalling unused/unnecessary operating system (OS) functionality, protocols, ports, and services, and limiting the software that can be installed and the functionality of that software. Implementing secure configurations is part of the Identifying and Implementing Configurations phase of SecCM and supports the implementation of NIST [SP 800-53] controls CM-6 Configuration Settings and CM-7 Least Functionality. A baseline configuration is a set of specifications for a system, or Configuration Item (CI) within a system, that has been formally reviewed and agreed on at a given point in time, and which can be changed only through change control procedures. The baseline configuration is used as a basis for future builds, releases, and/or changes. The baseline configuration of a system may evolve over time depending on the stage of the system development life cycle (SDLC). Early in the SDLC when a system is being initiated and acquired, the baseline may be a set of functional requirements. As the system is developed and implemented, the baseline may expand to include additional configuration items such as the technical design, the software load, the architecture, and configurations of the system and its individual components. A baseline configuration may also represent different information computing environments such as development, test, and production. When a new baseline configuration is established, the implication is that all of the changes from the last baseline have been approved. Older versions of approved baseline configurations are maintained and made available for review or rollback as needed. Developing and documenting the baseline configuration for a system is part of the Identifying and Implementing Configurations phase of SecCM and supports the implementation of NIST [SP 800-53] control CM-2 Baseline Configuration.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Conformance Test for FDDI Medium Access Control (MAC) say about Continued from previous page.? (Part 1) According to A Conformance Test for FDDI Medium Access Control (MAC), Continued from previous page.: Continued from previous page. | Behaviour Description | Label | Constraint Reference | V | Comments | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|----------------------------|-----------------------|---------------------------------------------------------------------------------------------------------------------| | # ? CLAIM START TRT # # # ! TOKEN # # # # # # ? TOKEN # 70THERWISE ?

Explanation: NIST publication on credential and access management. Topics: access control, token. Contains security framework guidance for authentication systems. Source: A Conformance Test for FDDI Medium Access Control (MAC).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways? (Part 61) Control AM-1: | Refs. | |--------|---------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------| | SM 2.4 | Does the system use or contain an option to enable the use of NIST- certified cryptographic standards for protecting data in transit? | Data in transit is encrypted using TLS version 1.2. | | | SM 2.5 | Does the system support performing regular backups and restorations? | Daily backups and snapshots of the production environment are taken and stored via Amazon's S3 service within multiple zones and U.S. regions. Regular integrity checks occur through restorations occurring multiple times annually. These restores populate new production instances which are then verified and monitored. | | | SM 3.1 | Does the product list all software dependencies and currently installed applications/services? | The Lookout MES Console provides a full application inventory list of all devices within the customer's user fleet. | | | SM 3.2 | Does the platform allow for the deployment of patches and OS updates? | Patches to the Lookout MES Console are controlled and maintained by Lookout backoffice support. | | | SM 4.1 | Does the security tool support logging and sending that data to rsyslog or a SIEM?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Trust Considerations for Digital Twin Technology provide? (Section 18) tion is the process of digital twin definition authoring and encoding. While it may be possible to author definitions using a text editor, this practice could become supplanted by more advanced tools. This is similar to how not many people hand-code HTML or XML anymore [7]. Moreover, the complexity of digital twin definitions could entirely preclude the ability to craft definitions by hand. Many industries use sophisticated software applications to create digital artifacts that represent what they plan to build. Some of these software applications support the 'export' of their artifacts in standard file formats and encodings, such as the 3D PDF standard [8]. However, the majority of these applications use their own proprietary file formats and encodings to define, capture, and persist the models, drawings, and various artifacts that they create. Like existing commercial applications, any future digital twin standard should include a language for describing and defining a digital twin, including formal grammar , syntax , and semantics . It would have to be comprehensive enough to support the definition of artifacts to represent any arbitrary real-world entity that a digital twin can represent [5]. Most likely, a standard would accommodate the creation of static and dynamic 2D, 3D, VR, and AR models for visual presentation to human users. It may also accommodate the creation, manipulation, and persistence of presentation forms that are intended for machine rather than human consumption. Digital twin definitions will likely be available from libraries to enable reuse by software applications. Software can execute a digital twin definition to create a specific instantiation linked to a real-world object. Software can both read and modify digital twin definitions and their instantiations, which would allow for modeling, simulation, monitoring, and other applications.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Trust Considerations for Digital Twin Technology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.1.10.1 Local Domain A uthority ID Check according to NIST Secure Data Network Systems (SDNS) Access Control Documents According to Secure Data Network Systems (SDNS) Access Control Documents, 4.1.10.1 Local Domain A uthority ID Check: Inputs: Local Primary Certificate LDA ID Remote Primary Certificate LDA ID Outputs: Common LDA = Pass/Fail Functionality: The function of the LDA ID Check is to determine if the LDA identified in both the Local and Remote Primary Certificate is the same. The Local Domain Authority Identifier field within the Primary Certificate will contain the ID of the LDA associated with that Primary Certificate (assuming there is an LDA associated with this certificate, otherwise the field will be null). If either the LDA ID found in both Primary Certificates is null or the LDA ID in both Primary Certificates is found to be different, then an AV is not used for this association, LDA Check = Fail, and the Additional Access Control Information function is called to perform its processing. If the LDA ID is found to be the same in both Primary Certificates, then LDA Check Pass, and the AV' Implemented Check function is called to perform its processing.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Secure Data Network Systems (SDNS) Access Control Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Introduction to Cybersecurity for Commercial Satellite Operations provide? (Section 5) | Executive Summary................................................................................................................. 1 | |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------| | Purpose and Scope.................................................................................................... | Report Structure ......................................................................................................... 2 | Purpose and Scope.................................................................................................... | | | Conceptual High-Level Architecture of Satellite Operations ........................................ | Space Architecture Segments ....................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Introduction to Cybersecurity for Commercial Satellite Operations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Weaknesses: according to NIST Guidelines for Securing Radio Frequency Identification (RFID) Systems According to Guidelines for Securing Radio Frequency Identification (RFID) Systems, Weaknesses:: - GLYPH<c=31,font=/MCAMJE+Webdings> Adversaries can often obtain valuable information from the identifier alone. For example, knowledge of the EPC manager ID and object class bits in certain EPC formats may reveal the make and model of a tagged object concealed in a container. An adversary might target containers based on the perceived worth of their contents. - GLYPH<c=31,font=/MCAMJE+Webdings> Placing data in the enterprise subsystem makes the availability of that data contingent on the availability of the network. Retrieving data over a network also introduces a small delay, which could be unacceptable for some applications. Section 3.3.3 discusses why organizations might choose to store data on tags even after taking into consideration the risks of doing so.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain C O M P U T E R S E C U R I T Y according to NIST Directions in Security Metrics Research According to Directions in Security Metrics Research, C O M P U T E R S E C U R I T Y: Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 April 2009 <!-- image --> U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Deputy Director

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Directions in Security Metrics Research.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control II-4 in Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out? (Part 46) Control II-4: prove the plan or return it for revision. Task 2 will not begin before plan approval. ## Task 2 - Perform Data Collection The Contractor shall perform data collection according to the SCAR Work plan. This data will include at a minimum for the <Appiication Name>: - o OMB Bulletin 90-08 Computer Security and Privacy Plan; - o assignments of responsibility; - o security specifications; - o design reviews and test results; - o audits results and certification and accreditation statements; and - o contingency plans. ## Task 3 - Prepare SCAR Report The Contractor shall analyze the information collected during Task 2 and prepare a SCAR report. The SCAR report shall contain the following: - o an executive summary of not more than two pages; - o a discussion of the objectives and authority for the review; - o a description of the appiication and its criticality and sensitivity status at the time the review was conducted; - o the identified strengths and weaknesses in the application's security/internal control procedures (automated and manual); - o the recommendations for improvements (if any), rated as to their potential effect on the security environment (low, moderate, high) and an implementation priority proposal; and - o a draft certification statement which includes the Contractor's recommendation whether the application should be certified acceptable, not acceptable, or acceptable with qualification. If the Contractor makes a recommendation of certification with qualification, the draft certification statement shall also include those recommendations that must be implemented to obtain an unqualified acceptable certification. The Contractor shali deliver the SCAR Report to the COTR. ## DELIVERABLES (NOTE; See Appendix G for a sample text on SOIA/ deliverables.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.2.10 De-Identification according to NIST Security Architecture Design Process for Health Information Exchanges (HIEs) According to Security Architecture Design Process for Health Information Exchanges (HIEs), 6.2.10 De-Identification: Definition: To ensure that individuals' records have all data elements removed before the data is shared for statistical, research, public health, or other reasons that do not benefit the data subject directly, and for which no authorization has been provided, such that there is no reasonable basis to believe that the information can be used to identify an individual. De-identification can be accomplished by removing the data permanently (anonymization); permanently replacing each data element removed with a placeholder, sometimes called a 'token' (pseudonymization); or replacing each datum with a unique token and maintaining a record (usually through a third party) such that it is possible to re-identify the individual through appropriate channels, such as having a third party contact the individual's care provider (reversible pseudonymization, or reidentification). Illustration: Researcher at Hospital wants to study the records of all patients with a particular form of cancer within a certain age range. The Researcher contacts their organization's research review board to confirm that the protocol will be conducted ethically and within all state, federal, and local laws and guidelines. The Researcher then contacts all providers in the HIE and asks them to help populate a database of de-identified information. Providers contact all patients fitting the profile and secure their consent. Each provider then uses the De-Identification enabling service to remove all potentially identifying information from each consenting patient's record, and then sends the record to Researcher. Thereafter, no further patient consent will be required to further share or disclose the de-identified data. Because ages are a relevant research parameter, birth years are retained in each record, although exact birth dates are removed. 11

Explanation: NIST publication on credential and access management. Topics: authorization, token. Contains security framework guidance for authentication systems. Source: Security Architecture Design Process for Health Information Exchanges (HIEs).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Web Transactions_ TLS Server Certificate Management say about 4.3.1.1 Venafi Trust Protection Platform? (Part 3) According to Securing Web Transactions_ TLS Server Certificate Management, 4.3.1.1 Venafi Trust Protection Platform: -  agent-based automated certificate life-cycle management -  standard protocol support, including simple certificate enrollment protocol (SCEP) and ACME -  DevOps framework integration -  cloud platform integration, including Amazon Web Services and Azure -  Representational state transfer (REST)-based application programming interfaces (APIs) -  dual-control enforcement through workflow gates that can be applied at specific steps in the certificate life cycle, and can be assigned to groups and individuals with sufficient knowledge of application context to review and approve certificate requests -  integration with HSMs for private-key security -  integration with identity systems (e.g., Microsoft Active Directory, Lightweight Directory Access Protocol [LDAP] directories) -  central logging of all certificate management operations -  configurable event-based alerts, including delivery via simple mail transfer protocol, syslog, security incident and event management systems, ticketing systems, file, or database -  certificate revocation list (CRL) expiration monitoring to prevent outages caused by expired CRLs -  trust anchor management (e.g., root certificates) on TLS clients that act as relying parties for TLS server certificates -  load balanced architecture to support scalability, fault tolerance, and geographic distribution to support enterprise certificate operations -  Common Criteria certified

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Automation Support for Security Control Assessments_ Software Asset Management provide? (Section 161) --------------------------------------------------------| | CM-7(b){1} | SWAM- F01 | Unauthorized software executes | the execution of unauthorized software. | | CM-7(b){1} | SWAM- F03 | Unauthorized software directory/folder location | the execution of software not loaded from an approved directory/folder location. | Control: The organization: - a. Develops and documents an inventory of information system components that: 1. Accurately reflects the current information system; 2. Includes all components within the authorization boundary of the information system; 3. Is at the level of granularity deemed necessary for tracking and reporting; and 4. Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]. | Determination Statement ID | Determination Statement Text | |------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | CM-8(a){1} | Determine if the organization: develops and documents an inventory of system components {for software} that: (1) accurately reflects the current system; and (2) includes all components within the authorization boundary of the system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Situational Awareness for Electric Utilities say about 4.2.2 Example Solution Data Aggregation and Analysis Lab Build? (Part 2) According to Situational Awareness for Electric Utilities, 4.2.2 Example Solution Data Aggregation and Analysis Lab Build: in enterprise. The sensor (O10) sends data files to the server (E8) for analysis. When the server detects a change to the assets on the ICS network in operations, it sends an event to ArcSight (E12). The PACS in the example solution is implemented by RS2 AccessIT! (E7). Door open/close events from the RS2 door controller (O4) in operations are sent to AccessIT! (E7) and stored in an internal database. An ArcSight database connector is used to extract these events and send them to ArcSight (E12). The enterprise historian is provided by the OSIsoft PI Historian (E4). ICS data from the operations Pi Historian (O8) is replicated to the enterprise PI Historian (E4). This data is used by the ICS behavioral monitoring component in the example solution, implemented by ICS2 OnGuard (E5), to detect unusual ICS behavior. OnGuard (E5) reports this unusual behavior to ArcSight (E12). The enterprise log collector/aggregator component in the example solution is provided by TDi Technologies ConsoleWorks (E6). This instance of ConsoleWorks (E6) receives files from the operations instance (O9). The files contain integrity-sealed syslog records. The enterprise instance of ConsoleWorks (E6) verifies the integrity seal on the records and sends the syslog records to ArcSight (E12). Siemens RUGGEDCOM CROSSBOW (E9), which implements part of the remote management connection described in Section 5.3, sends log information about remote management actions to ArcSight (E12). The analysis workflow engine, analysis tools, and visualization tools in the example solution are implemented by RSA SecOps (E13). This product extracts event data from ArcSight (E12) and performs analyses to identify potential cyber incidents.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Situational Awareness for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain : rsassaPss according to NIST NIST Test Personal Identity Verification (PIV) Cards Version 2 According to NIST Test Personal Identity Verification (PIV) Cards Version 2, : rsassaPss: Signature Algorithm Hash Algorithm: sha256 Mask Algorithm: mgf1 with sha256 Salt Length: 0x20 Trailer Field: 0xBC (default) Issuer : CN=Test RSA 3072-bit CA for Test PIV Cards v2, ou=Test CA, o=Test Certificates 2020, c=US Validity : Not Before: Aug 5 08:30:00 2019 GMT, Not After: Dec 31 08:30:00 2040 GMT Subject : CN=Tëst Cardholder Jr. (affiliate), ou=Test Agency, ou=Test Department, o=U.S. Government, c=US

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST provide? (Section 75) but its capabilities have not been fully tested as of the moment. 3. Excalibur operates on UNIX platforms as well as PCs running Microsoft Windows. 4. The approximate cost of the system is $35,000. 1. InfoSelect is a personal information manager (PIM) which allows users to organize their personal information such as phone numbers, client lists, plans and projects, etc. It is not a generalized DBMS but rather a program that uses stacks and windows - like pieces of paper on a desk. It offers a number of predefined forms so that users do not have to create fields and enter information in a particular way. 2. InfoSelect has already been used by some NIST scientists to organize their information, which could be extended for ERN use. It is claimed to be very easy to use. The drawbacks are that it is strictly a personal information management tool and not designed to support sharable databases. 3. InfoSelect operates on PCs and compatible computers running Microsoft Windows. 4. The approximate cost is $150. 1. Lotus Notes is a cross between database software and network application packages for workgroup communications. Lotus Notes provides an easy user interface to allow users to create data definitions with many point and click options. The system has a simple macro language which allows users to define views so that selective queries may be displayed with a customized reporting style. All Windows applications can be "cut and pasted" into Notes, including data in the form of pictures, graphs, and bitmap images (In the future voice and video will be included.). Lotus Notes also incorporates public-key signature verification features. 2. Notes can be used to organize public ERN files and report and display different views of lab notebook contents for retrieval, browsing or reading. The key feature is that multiple clients may access a central server computer in order to manipulate multiple databases.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain IT Asset Inventory according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case, IT Asset Inventory: | Description | Quantity | |-----------------------------|------------| | SuperMicro Servers | 6 | | Allen Bradley 5700 Switches | 2 | | Allen Bradley 8300 Router | 1 | | HP Tower Workstation | 1 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Section 97) d in Appendix D. - When an approved elliptic-curve group is used, and the corresponding ECC domain parameters are ( q, FR, a, b { , SEED } , G, n, h ), the private keys are in the interval [1, n - 1]. The owner of a static or ephemeral key-establishment key pair shall obtain an initial assurance that the private key is an integer in the correct interval by using one of the following methods: - a. For both a static and ephemeral key pair: The owner generates the key pair as specified in Section 5.6.1, or - b. For a static key pair (only): After receiving a static key pair from a trusted third party (trusted by the owner), the owner performs a separate check to determine that the private key is in the correct interval. (While an entity can accept ownership of a static key pair that was generated by a TTP, an ephemeral key pair shall only be generated by its owner.) To renew this assurance for a static key pair (if desired), the owner shall perform a separate check to determine that the private key is in the correct interval as determined by the domain parameters. Prior to a key-establishment transaction, the owner of a key pair shall obtain an initial assurance that the public key has the expected representation for a non-identity element of the correct cryptographic subgroup, as determined by the domain parameters, using one of the following methods: - a. For either a static key pair or an ephemeral key pair: The owner generates the key pair as specified in Section 5.6.1 and performs a full public-key validation or an equivalent procedure as part of its generation process (see Section 5.6.2.3.1 for FFC, and Section 5.6.2.3.3 for ECC); or - b.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD) provide? (Section 210) tocol: It sends a configuration request to the Micronets Gateway, receives a configuration response from the Micronets Gateway, and responds by sending a configuration result to the Micronets Gateway. As noted earlier, configuration may happen on a frequency different from the one used for authentication. This completes the onboarding process. As a result of the configuration message it received, the device has learned the SSID and the unique credential that it needs to connect to the home/small-business network. In addition, the Micronets Gateway has been provided with both the micronet to which the device will be assigned upon connection to the network and ACLs that express the device’s communications profile, as specified in its MUD file. NIST SP 1800-15B: Securing Small-Business and Home Internet of Things Devices 142 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15  With onboarding complete, the device initiates a standard Wi-Fi handshake and presents its newly provisioned credentials to connect to the network. It will be assigned its provisioned IP address, it will be located in a micronet that had been specified by the user of the Micronets mobile application at onboarding time, and it will be able to send and receive messages in accordance with both its micronet and the rules specified in its MUD file (i.e., it will not be permitted to communicate with any local devices that are in a different micronet unless such communication is explicitly permitted by its MUD file). 8.3.3.2 Onboarding Non-MUD-Capable Devices Figure 8-5 depicts the message flows involved in the process of onboarding devices that are Wi-Fi Easy Connect-capable but not MUD-capable in Build 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Privacy control according to An Introduction to Privacy Engineering and Risk Management in Federal Systems? Privacy control: The administrative, technical, and physical safeguards employed within an agency to ensure compliance with applicable privacy requirements and manage privacy risks. 83

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: An Introduction to Privacy Engineering and Risk Management in Federal Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Examine according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Examine: [SELECT FROM: security policies and procedures associated with the protection of CUI; audit findings; system security plan; other relevant documents or records]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Web Transactions_ TLS Server Certificate Management say about Recommended Responsibilities :? According to Securing Web Transactions_ TLS Server Certificate Management, Recommended Responsibilities :: -  Certificate Services team: provide automated certificate and key management services that remove the need for administrators to manually access private keys, alleviating the need to replace certificates and private keys when a system administrator is reassigned or terminated -  Certificate owners: ensure manually managed certificates and private keys are replaced when a system administrator with access is reassigned or terminated


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations say about 03.14.01 Flaw Remediation? According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, 03.14.01 Flaw Remediation: - a. Identify, report, and correct system flaws. - b. Install security-relevant software and firmware updates within [ Assignment: organization-defined time period ] of the release of the updates.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Framework for Designing Cryptographic Key Management Systems provide? (Section 46) | 11.1.3 Functional and Security Testing................................................................... | | 11.1.4 Penetration Testing....................................................................................... | 87 87 | 11.1.4 Penetration Testing....................................................................................... | | 11.2 Periodic Security Review ................................................................................... Assessment....................................................................... | 87 | 11.2 Periodic Security Review ................................................................................... Assessment....................................................................... | | 11.3 Incremental Security | 11.3 Incremental Security | 11.3 Incremental Security | | 11.4 Security Maintenance ......................................................................................... | 88 | 11.4 Security Maintenance ......................................................................................... | | 12.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: A Framework for Designing Cryptographic Key Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Framework Manufacturing Profile provide? (Section 42) rs, actuators, robots, machine firmware, network switches, routers, power supplies, and other networked components or System component inventory is reviewed and updated as defined by the organization. deemed necessary for effective accountability of manufacturing system components for example, hardware inventory specifications, component owners, networked or devices, machine names and network addresses. Inventory specifications include, | 62443-2-1:2009 4.2.3.4 62443-3-3:2013 SR 7.8 CM-8 | | | Asset Management | ID.AM-1 | Document Manufacturing tools, devices. Information includes, components for example, manufacturer, device type, model, serial number, and physical location. | 62443-2-1:2009 4.2.3.4 62443-3-3:2013 SR 7.8 CM-8 | | | Asset Management | ID.AM-1 | Moderate | 62443-2-1:2009 4.2.3.4 62443-3-3:2013 SR 7.8 CM-8 | | | Asset Management | ID.AM-1 | Identify individuals who are both responsible and accountable for administering manufacturing system components.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IP-002 in Guidelines for Smart Grid Cybersecurity? (Part 135) Control IP-002: ments; 146 3. The organization ensures that the incident response security policy and procedures comply with applicable federal, state, local, tribal, and territorial laws and regulations; and 4. The organization identifies potential interruptions and classifies them as to “cause,” “effects,” and “likelihood.” Supplemental Guidance The incident response policy can be included as part of the general information security policy for the organization. Incident response procedures can be developed for the security program in general, and for a particular smart grid information system, when required. The various types of incidents that may result from system intrusion need to be identified and classified as to their effects and likelihood so that a proper response can be formulated for each potential incident. The organization determines the impact to each smart grid system and the consequences associated with loss of one or more of the smart grid information systems. Requirement Enhancements None. Additional Considerations None. Impact Level Allocation Low: SG.IR-1 Moderate: SG.IR-1 High: SG.IR-1 SG.IR-2 Incident Response Roles and Responsibilities Category: Common Governance, Risk, and Compliance (GRC) Requirements Requirement 1. The organization’s smart grid information system security plan defines the specific roles and responsibilities in relation to various types of incidents; and 2. The plan identifies responsible personnel to lead the response effort if an incident occurs. Response teams need to be formed, including smart grid information system and other process owners, to reestablish operations. Supplemental Guidance The organization’s smart grid information system security plan defines the roles and responsibilities of the various employees, contractors, and third parties in the event of an incident. The response teams have a major role in the interruption identification and planning process. Requirement Enhancements None.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to 2016 NIST_ITL Cybersecurity Program Annual Report? http: / /csrc.nist.gov/publications/nistbul/itlbul2016\_02.pdf

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Accuracy, Integrity, and Security in Computerized Vote-Tallying provide? (Section 51) by providing technical assistance to advance new uses of computer technology. In 1987, additional responsibilities were assigned to ICST due to the passage of the Computer Security Act (P.L. 100-235). In accordance with this act, ICST will develop standards and guidelines on computer security to protect the U.S. Government's sensitive but unclassified information. This report concerns measures to assure the presence of accuracy, integrity, and security in computerized vote-tallying. Accuracy is the essential requirement of a computerized vote-tallying system, but its achievement may not be possible without the implementation of integrity and security. Even if accuracy is attained, confidence in the results may not be assured unless the other two factors can be shown to be present. Thus, for votetallying systems, these factors are not mutually exclusive parameters that can be separately considered. Definitions, for the purpose of this report, are as follows: accuracy: conformity of the output data of a vote-tallying system with logically correct and acceptably precise treatment of all input data provided to the system; integrity : the state of a vote-tallying system in which it will correctly perform the functions specified for it, and only those functions security : the achievement of a desired control of access to votetallying facilities, areas, equipment, supplies, documents, media, files, and data. The origins of the current project go back to 1974. In February of that year, ICST was asked by the General Accounting Office (GAO) to "conduct a systems analysis and evaluation of the role of automatic digital processing equipment in the vote-tallying process." The year-long project, undertaken also by the author of this latest report, was completed in 1975.

Explanation: NIST publication discussing classified information handling. References: classified, sensitive but unclassified. Contains guidance on protecting sensitive government information. Source: Accuracy, Integrity, and Security in Computerized Vote-Tallying.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Common Platform Enumeration_ Naming Specification Version 2.3 say about Appendix A-References? According to Common Platform Enumeration_ Naming Specification Version 2.3, Appendix A-References: The following documents are indispensable references for understanding the application of this specification.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Platform Enumeration_ Naming Specification Version 2.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived Personal Identity Verification (PIV) Credentials provide? (Section 67) es an authentica- tion certificate, which is an X.509 public key certificate that has been issued in accordance with the re- quirements of NIST SP 800-157 and the X.509 Certificate Policy for the U.S. Federal PKI Common Pol- icy Framework [25] | PR.AC-1 | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Component | Product | Version | Function | Cybersecurity Framework Subcategories | |------------------------------------------|------------------------------------|------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------| | PKI Certificate Authority | Verizon Shared Service Pro- vider | Not appli- cable | Entity that issues an authentica- tion certificate, which is an X.509 public key certificate that has been issued in accordance with the re- quirements of NIST SP 800-157 and the X.509 Certificate Policy for the U.S.

Explanation: NIST publication on credential and access management. Topics: pki, certificate authority. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-128 in Recommendation for Random Bit Generator (RBG) Constructions? (Part 102) Control ES-128: ce The source of an ideal random sequence of bits. Each bit of an ideal random sequence is unpredictable and unbiased with a value that is independent of the values of the other bits in the sequence. Prior to an observation of the sequence, the value of each bit is equally likely to be 0 or 1, and the probability that a particular bit will have a particular value is unaffected by knowledge of the values of any or all the other bits. An ideal random sequence of n bits contains n bits of entropy. ## independent entropy sources Two entropy sources are independent if knowledge of the output of one entropy source provides no information about the output of the other entropy source. ## initial randomness source The randomness source for the root RBGC construction in a DRBG tree of RBGC constructions. ## instantiate The process of initializing a DRBG with sufficient randomness to generate pseudorandom bits at the desired security strength. ## internal state (of a DRBG) The collection of all secret and non-secret information about an RBG or entropy source that is stored in memory at a given point in time. ## known answer test A test that uses a fixed input/output pair to detect whether a deterministic component was implemented correctly or continues to operate correctly. ## legacy implementation (of DRBGs) DRBG implementations that may not conform to the current SP 800-90A version but do conform to a previous version of SP 800-90A. ## min-entropy A lower bound on the entropy of a random variable. The precise formulation for min-entropy is ( -log2 max pi ) for a discrete distribution having probabilities p 1 , ..., pk . Min-entropy is often used as a measure of the unpredictability of a random variable. ## must Used to indicate a requirement that may not be testable by a CAVP/CMVP testing lab. Note: Must may be coupled with not to become must not . ## noise source A source of unpredictable data that outputs raw discrete digital values.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Bit Generator (RBG) Constructions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Securing Public Web Servers say about 3.1 Installation and Deployment Planning? (Part 4) According to Guidelines on Securing Public Web Servers, 3.1 Installation and Deployment Planning: organization's reputation that could occur if the servers' integrity is compromised. In such cases, it is critical that the Web servers are located in areas that provide secure physical environments. When planning the location of a Web server, the following issues should be considered: - GLYPH<c=31,font=/IEIOAF+Webdings> Are the appropriate physical security protection mechanisms in place? Examples include- -  Locks -  Card reader access -  Security guards -  Physical IDSs (e.g., motion sensors, cameras). - GLYPH<c=31,font=/IEIOAF+Webdings> Are there appropriate environmental controls so that the necessary humidity and temperature are maintained? - GLYPH<c=31,font=/IEIOAF+Webdings> Is there a backup power source? For how long will it provide power? - GLYPH<c=31,font=/IEIOAF+Webdings> If high availability is required, are there redundant Internet connections from at least two different Internet service providers (ISP)? - GLYPH<c=31,font=/IEIOAF+Webdings> If the location is subject to known natural disasters, is it hardened against those disasters and/or is there a contingency site outside the potential disaster area?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Securing Public Web Servers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on PDA Forensics say about 4.2 Evidential Principles? (Part 3) According to Guidelines on PDA Forensics, 4.2 Evidential Principles: is the expert's qualifications and stature in the scientific community? Does the technique rely upon the special skills and equipment of one expert, or can it be replicated by other experts elsewhere? -  Clarity - Can the technique and its results be explained with sufficient clarity and simplicity so that the court and the jury can understand its plain meaning? This criterion is assumed to be incorporated in Daubert implicitly. In general, even outside of law enforcement investigations, evidence should be collected in a manner that makes it likely the evidence could be admissible in court. It may not be obvious when an investigation is initiated, for example, when a computer security incident is first detected, that a court action will ensue. Important evidence might be overlooked, improperly handled, or accidentally destroyed before the seriousness of the incident is realized.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on PDA Forensics.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Secure Web Services provide? (Section 68) formation, and documents by which an entity's identity is verified, identity documents and credentials are issued to the entity, and entity identities are authenticated at point of entry into the SOA. In the SOA, an entity's identity forms the basis for both authorization and trust. An Identity Management System (IDMS), such as that pictured in Figure 3-1, is responsible for verifying the identities of entities, registering them, and issuing them digital identifiers. In accordance with Homeland Security Presidential Directive (HSPD) 12, Subject: Policy for a Common Identification Standard for Federal Employees and Contractors 27 , NIST Federal Information Processing Standard (FIPS) 201-1, Personal Identity Verification of Federal Employees and Contractors 28 , describes a number of requirements that must be satisfied before a human entity may be registered in a Federal IDMS, including a National Agency Check and Inquiries (NACI) background check. Non-government organizations may have different rules for registration. For example, users who wish to gain access to many e-commerce sites often need to provide only a valid email address and a credit card number. 27 HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors , is available at 28 FIPS 201-1, Personal Identity Verification of Federal Employees and Contractors , is available at http://csrc.nist.gov/publications/fips/. Figure 3-1. Identity Management Overview <!-- image --> Once an entity has been issued a digital identifier, that identifier can be used within that organization to associate other information with the entity, such as role and authorization attributes. The identifier may also become part of the digital credential that authorizes the entity to access different resources in the SOA. Once registered, an entity must provide a portion of its credentials sufficient to authenticate that entity's identity.

Explanation: NIST publication on credential and access management. Topics: authorization, identity management, sso. Contains security framework guidance for authentication systems. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Guidelines for Storage Infrastructure provide? (Section 90) ct violations to the pattern, which sends notifications, should also be implemented. AC-SS-R31 Users that do need to authenticate should be disabled (e.g., Anonymous, null, guest, or 'public access'). An exception may be provided to allow organization-critical functions such as network discovery, but in such cases these class of users should be mapped to the 'nobody' user group and not to "ID 0". AC-SS-R32 - Regular audits of all the security settings mentioned above for storage data of all types (e.g., Files, Objects) should be performed to ensure that there are no drifts. Audit results should be documented. AC-SS-R33 - Scan files containing sensitive information with anti-malware tools on-access: Every time a file with sensitive information is accessed, it should first be scanned with organization approved anti-malware tools to ensure that it has not been compromised. AC-SS-R34 - Granular permission assignment: For file and object sharing systems (e.g., NFS, CIFS, cloud object stores), permissions should be granted at a finer level of granularity rather than a coarser one (e.g., file or object over folder, and label over share or bucket). AC-SS-R35 - Secure NFS by restricting root access: This includes the use of the 'nosuid' option, and avoidance of use of 'no\_root\_squash' to prevent programs from being executed as a root user on the client, and modification of shared files by remote root users. In general, NFS clients should not be allowed to run 'suid' and 'sgid' programs on exported file systems. AC-SS-R36: In NFS, for files that are to be used in the 'read only' mode, the mount configuration for corresponding NFS shares should always have the 'noexec' option. AC-SS-R37 Export of administrative file systems should not be allowed: This includes the '/' filesystems and restricted OS or storage array system folders.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Guidelines for Storage Infrastructure.