You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 198) sions is required are deﬁned; AC-12(01) a logout capability is provided for user-iniated communicaons sessions whenever authencaon is used to gain access to <AC-12(01)_ODP informaon resources>. POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-12(01)-Examine [SELECT FROM: Access control policy; procedures addressing session terminaon; user logout messages; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records]. AC-12(01)-Interview [SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers]. AC-12(01)-Test [SELECT FROM: System session terminaon mechanisms; logout capabilies for user-iniated communicaons sessions]. AC-12(02) SESSION TERMINATION | TERMINATION MESSAGE ASSESSMENT OBJECTIVE: Determine if: AC-12(02) an explicit logout message is displayed to users indicang the terminaon of authencated communicaon sessions. POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-12(02)-Examine [SELECT FROM: Access control policy; procedures addressing session terminaon; user logout messages; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records]. CHAPTER FOUR PAGE 89 Reference produced from open data hps://github.com/usnistgov/oscal-content T h i s p u b l i c a  o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h  p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P. 8 0 0 - 5 3 A r 5 NIST SP 800-53A, REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS AC-12(02) SESSION TERMINATION | TERMINATION MESSAGE AC-12(02)-Interview [SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 8.1.5.3 Generation and Distribution of Other Keying Material according to NIST Recommendation for Key Management_ Part 1 – General According to Recommendation for Key Management_ Part 1 – General, 8.1.5.3 Generation and Distribution of Other Keying Material: Keys are often generated in conjunction with or are used with other keying material. This other keying material shall be protected in accordance with Section 6.2. Table 6 specifies the type(s) of protection required for keying material other than keys.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Sub-step 1.3 Review Security Assessment Plan Documentation: according to NIST Automation Support for Security Control Assessments_ Software Vulnerability Management According to Automation Support for Security Control Assessments_ Software Vulnerability Management, Sub-step 1.3 Review Security Assessment Plan Documentation:: - Review the defect checks documented in Section 3.2 to get an initial sense of the proposed items to be tested. - Review the security assessment plan narratives in Section 3.2 to understand how the defect checks apply to the controls that support vulnerability management.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Vulnerability Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Control according to Security and Privacy Controls for Information Systems and Organizations? Control: Notify the user, upon successful logon to the system, of the date and time of the last

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.2 The S-boxes according to NIST Validating the Correctness of Hardware Implementations of the NBS Data Encryption Standard According to Validating the Correctness of Hardware Implementations of the NBS Data Encryption Standard, 2.2 The S-boxes: The non-linear substitution tables, or S-boxes, constitute the most important part of the algorithm. The purpose of the S-boxes is to ensure that the algorithm is not linear, and hence too weak to stand up under cryptanaly tic attack [1,2]. Each of the eight S-boxes, such as is shown in figure 2, contains 64 entries, organized as a 4x16 matrix. Each entry is a four bit binary number, represented as 0-15 in figure 2, so the output of the parallel connection of eight S-boxes is 32 bits. A particular entry in a single S-box is selected by six bits, two of which select a row and four select a column. The entry in the corresponding row and column is the output for that input. Each row in each S-box is a permutation of the numbers 0-15, so no entry is repeated in any one row. There is no obvious small set of inputs that could be used to verify the S-boxes, so an extensive series of Monte-Carlo experiments was performed to discover a relatively small set of inputs that would exercise every S-box entry at least once. Nearly 200 separate trials were made, and among these were several test sets of 19 inputs which exercised every S-box entry. One of these sets is used as the DES test set for the S-boxes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validating the Correctness of Hardware Implementations of the NBS Data Encryption Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for Securing Radio Frequency Identification (RFID) Systems say about 8.1.2 Phase 2: Acquisition/Development? (Part 2) According to Guidelines for Securing Radio Frequency Identification (RFID) Systems, 8.1.2 Phase 2: Acquisition/Development: mation, the design team determined that the passive RFID system would operate in the high frequency range (13.56 MHz), and the semiactive RFID system would operate at microwave frequencies (2.45 GHz). While the risk of eavesdropping from locations outside the facility was considered to be very low, the design team still thought it would be of value to mitigate the risk to the greatest extent feasible. Therefore, they ensured that design drawings placed readers away from windows and exterior walls. Preferred locations were over doorways in rooms and on ceiling mounts in hallways. The devices would be prohibited in the radiology unit, but would be placed at entries to the unit. Previously installed shielding in the walls would prevent emissions from impacting the operation of the imaging equipment inside the unit. The design team determined that stationary readers would be connected to the RFID middleware infrastructure using Ethernet, which is also used to network the desktop computers and servers in the building. To accomplish this, the plan called for the installation of additional network cabling and drops, and use of the existing Ethernet switches, which had considerable excess capacity. Having the RFID systems, desktops, and servers all cabled into the same switches created a risk that the RFID system could be used as a platform to launch an attack on the rest of the network. To mitigate this risk, the design called for a dedicated VLAN to host the RFID-related network hosts. Traffic could only pass from the RFID VLAN to other network segments if it traversed the network firewall required by policy in the initiation phase. Once the architecture was completed, the CIO assigned two members of the design team to the job of procuring the system with her review and approval. They paid particular attention to the products' audit and management capabilities. Four vendors provided demonstrations of their products and submitted bids.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does PIV Data Model Test Guidelines say about July 2006 July 2006? According to PIV Data Model Test Guidelines, July 2006 July 2006: <!-- image --> U.S. Department of Commerce U.S. Department of Commerce Carlos M. Gutierrez, Secretary U.S. Department of Commerce U.S. Department of Commerce Carlos M. Gutierrez, Secretary National Institute of Standards and Technology . National Institute of Standards and Technology William A. Jeffrey, Director National Institute of Standards and Technology . National Institute of Standards and Technology William A. Jeffrey, Director

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 1 – General say about 8.1.5.1.1 Distribution of Public Keys? According to Recommendation for Key Management_ Part 1 – General, 8.1.5.1.1 Distribution of Public Keys: Static public keys are relatively long-lived and are typically used for several executions of an algorithm. Ephemeral public keys are short-lived. The distribution of the static or ephemeral public key should provide assurance to the receiver of the public key that the true owner of the key is known (i.e., the claimed owner is the actual owner); this requirement may be disregarded if anonymity is acceptable. However, the strength of the overall architecture and trust in the validity of the protected data depends, in large part, on assurance of the public-key owner's identity. In addition, the distribution of the public key shall provide assurance to the receiver that: 1. The purpose/usage of the key is known (e.g., for RSA digital signatures or elliptic-curve key agreement); 2. Any parameters associated with the public key are known (e.g., domain parameters); 3. The public key is valid (e.g., the public key satisfies the required arithmetical properties); and 4. The owner actually possesses the corresponding private key.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to SSL VPNs say about 3.2 SSL VPN Functions? (Part 3) According to Guide to SSL VPNs, 3.2 SSL VPN Functions: turn requires administrative access to the local system. The client is typically an active content agent, so the system must have the ability to load the agent and the necessary privileges to run it. This can cause challenges on public systems, where users might not have those privileges, and on managed systems where security policy prevents such applets and controls. A more limited form of network extension is sometimes called port forwarding . The three core functions allow SSL VPNs to provide secure remote access to a variety of applications. SSL VPN products vary in quality and effectiveness by the way they implement these three core functions. For example, SSL VPN products may offer support for different protocols via proxy and application translation; others might offer more or less control of the level of network access for network extensions. When evaluating SSL VPN products, it is important to have identified the remote access needs and applications served.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to SSL VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Key Notarization System for Computer Networks provide? (Section 6) D) | 20 | | 10. | DIGITAL SIGNATURES | DIGITAL SIGNATURES | 20 | | | 10.1 | RATIONALE | 20 | | :' . | 10.2 | EXAMPLE | 21 | | | 10.3 | THE AUTHENTICATION VALUE AS A SIGNATURE | 22 | | | 10.4 | NONPUBLIC KEY VERSUS PUBLIC KEY SIGNATURES | 23 | | 11. | ILLUSTRATIVE EXAMPLE | ILLUSTRATIVE EXAMPLE | 23 | | | 11.1 | INITIALIZATION | 23 | | | 11.2 | THE TRANSMITTER | 24 | | | 11.3 | THE RECEIVER | 24 | | i | 11.4 | KEY SUPERSESSION | 25 | | 12. | SUMMARY | SUMMARY | 25 | | APPENDIX | APPENDIX | APPENDIX | 26 | A Key Notarization System For Computer A cryptographic, Key Notarization System is proposed for computer networks to protect personal (nonshared) files, to communicate securely both on and off-line with local and remote users, to protect against key substitution, to authenticate system users, to authenticate data, and to provide a digital signature capability using a nonpublic key encryption algorithm. The system is implemented by the addition of key notarization facilities which give users the capability of exercising a set of commands for key management as well as for data encryption functions. Key notarization facilities perform notarization which, upon encryption, seals a key or password with the identities of the transmitter and Intended receiver.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: A Key Notarization System for Computer Networks.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Applications Using Approved Hash Algorithms provide? (Section 15) ithm that computes aMAC from a message and a key. | | Message digest | The result of applying a hash function to a message. Also known as a 'hash value' or 'hash output'. | |---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Preimage | A message X that produces a given message digest when it is processed by a hash function. | | Preimage resistance | An expected property of a hash function such that, given a randomly chosen message digest, message_digest , it is computationally infeasible to find a preimage of the message_digest , See 'Preimage'. | | Random bit | A bit for which an attacker has exactly a 50% probability of success of guessing the value of the bit as either a zero or one. It is also called an unbiased bit. | | Random bit generator | A device or algorithm that can produce a sequence of bits that appear to be both statistically independent and unbiased. | | Randomized hashing | A process by which the input to a hash function is randomized before being processed by the hash function. | | Random number | A value in a set of numbers that has an equal probability of being selected from the total population of possibilities and, in that sense, is unpredictable. A random number is an instance of an unbiased random variable, that is, the output produced by a uniformly distributed random process.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Applications Using Approved Hash Algorithms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 301) , National Institute of Standards and Technology, Gaithersburg, Maryland, August 2012, 78 pp. http://csrc.nist.gov/publications/drafts/800-90/draft-sp800-90b.pdf [accessed 8/11/2014]. E. Barker and J. Kelsey, Recommendation for Random Bit Generator (RBG) Constructions, DRAFT NIST SP 800-90C, National Institute of Standards and Technology, Gaithersburg, Maryland, August 2012, 50 pp. http://csrc.nist.gov/publications/drafts/800-90/draft-sp800-90c.pdf [accessed 8/11/2014]. 248 15. E. Barker, Recommendation for Digital Signature Timeliness, NIST SP 800-102, National Institute of Standards and Technology, Gaithersburg, Maryland, Septebmer 2009, 30 pp. http://csrc.nist.gov/publications/nistpubs/800-102/sp800-102.pdf [accessed 8/11/2014]. 16. E. Barker and A. Roginsky, Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths, NIST SP 800-131A, National Institute of Standards and Technology, Gaithersburg, Maryland, January 2011, 27 pp. http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf [accessed 8/11/2014]. 17. American National Standard Institute (ANSI), Protocol Specification for Interfacing to Data Communication Networks, ANSI C12.22-2008, National Electrical Manufacturers Association (NEMA), Rosslyn, Virginia, 2008. 18. S. Santesson, M. Myers, R. Ankney, A. Malpani, S. Galperin, and C. Adams, X.509 Internet Public Key Infrastructure Online Certificate Status Protocol – OCSP, IETF Network Working Group RFC 6960, June 2013. http://www.ietf.org/rfc/rfc6960.txt [accessed 8/11/2014]. 19. B. Aboba, L. Blunk, J. Vollbrecht, J. Carlson, and H. Levkowetz, Extensible Authentication Protocol (EAP), Internet Engineering Task Force (IETF) Network Working Group Request for Comments (RFC) 3748, June 2004. http://www.ietf.org/rfc/rfc3748.txt [accessed 8/11/2014]. 20. B. Aboba, D. Simon, and P. Eronen, Extensible Authentication Protocol (EAP) Key Management Framework, IETF Network Working Group RFC 5247, August 2008.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain System Requirements according to NIST Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector According to Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector, System Requirements: -  CPUs: 12 -  Memory: - 5 GB RAM -  Storage: 500 GB (thin provision) -  Operating System: CentOS 7 -  Network Adapter 1: VLAN 1901 -  Network Adapter 2: SPAN\_PACS

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Contingency Planning Guide for Federal Information Systems say about Control Enhancements:? According to Contingency Planning Guide for Federal Information Systems, Control Enhancements:: - (1) The organization identifies an alternate processing site that is separated from the primary processing site so as not to be susceptible to the same hazards. Enhancement Supplemental Guidance : Hazards that might affect the information system are typically defined in the risk assessment. - (2) The organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions. - (3) The organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with the organization's availability requirements. - (4) The organization fully configures the alternate processing site so that it is ready to be used as the operational site supporting essential missions and business functions. - (5) The organization ensures that the alternate processing site provides information security measures equivalent to that of the primary site. | LOW Not Selected | MOD CP-7 (1) (2) (3) (5) | HIGH CP-7 (1) (2) (3) (4) (5) | |--------------------|----------------------------|---------------------------------|

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Contingency Planning Guide for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Identity and Access Management for Electric Utilities? (Part 1) Control AC-1: Identities and credentials are managed for authorized devices and users Application Company Product Version Use CA Identity Management Platform Identity Manager R12.0 SP14 Build 9140 Implements workflows for creating digital identities and authorizing them access to physical and logical resources, including authoritative source NIST SP 1800-2B: Identity and Access Management for Electric Utilities 15 T h i s p u b l i c a t i o T n h i i s s p a u v b a i . l i i l c a a b t l i e o n f r e i s e a o v f a c i l h a a b r l e g e f r f e r o e m o f : c h h t t a p r : g / e / d f r o o m o r : g h / t 1 t 0 p . : 6 / / 0 d 2 o 8 i / . N o r I g S / T 1 . S 0 P . 6 1 0 8 2 0 8 0 / - N 2 I . S T . S P 1 8 0 0 - 2 . . . Security Characteristics Example Capability CSF Subcategory Application Company Product Version Use Provision, modify or revoke access throughout all federated entities Mechanisms for centrally managed provisioning of access RSA 6.9.74968 Identity Management and Governance (IMG) Governance Lifecycle Virtual Directory Adaptive Directory 7.1.5 R29692 Credential Management GlobalSign Enterprise PKI N/A Implements workflows for creating digital identities and authorizing them access to physical and logical resources Authoritative source for digital identities and authorized access to resources Provides North American Energy Standards Board (NAESB)- compliant X.509 certificates to OT personnel NIST SP 1800-2B: Identity and Access Management for Electric Utilities 16 T h i s p u b l i c a t i o T n h i i s s p a u v b a i . l i i l c a a b t l i e o n f r e i s e a o v f a c i l h a a b r l e g e f r f e r o e m o f : c h h t t a p r : g / e / d f r o o m o r : g h / t 1 t 0 p . : 6 / / 0 d 2 o 8 i / . N o r I g S / T 1 . S 0 P . 6 1 0 8 2 0 8 0 / - N 2 I . S T . S P 1 8 0 0 - 2 . . .

Explanation: NIST publication on credential and access management. Topics: identity management, credential management, pki. Contains security framework guidance for authentication systems. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Glossary of Computer Security Terminology provide? (Section 73) --------------------------------------------------------------------------------| | cross-talk | 1) An unwanted transfer of energy from one communications channel to another channel. (FIPS PUB 39; AR 380-380) | | crypto | A marking or designator identifying all COMSEC keying material used to protect or authenticate telecommunications carrying classified national security information and sensitive, but unclassified government or government-derived information, the loss of which could adversely affect the national security interest. (NTISSI 4002; NACSI8104) | | crypto-aIgorith m | A well-defined procedure or sequence of rules or steps used to produce a key stream or cipher text from plain text and vice versa.

Explanation: NIST publication discussing classified information handling. References: classified, national security. Contains guidance on protecting sensitive government information. Source: Glossary of Computer Security Terminology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5 General Findings according to NIST Implementing a Zero Trust Architecture_ High-Level Document According to Implementing a Zero Trust Architecture_ High-Level Document, 5 General Findings: When deploying ZTA, the following capabilities are considered to be fundamental to determining whether a request to access a resource should be granted and, once granted, whether the access session should be permitted to persist: -  Authentication and periodic reauthentication of the requesting user's identity -  Authentication and periodic reauthentication of the requesting endpoint -  Authentication and periodic reauthentication of the endpoint that is hosting the resource being accessed -  Each authentication and reauthentication includes authorization and reauthorization In addition, the following capabilities are also considered highly desirable: -  Verification and periodic reverification of the requesting endpoint's health -  Verification and periodic reverification of the health of the endpoint that is hosting the resource being accessed

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Implementing a Zero Trust Architecture_ High-Level Document.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Electronic Health Records on Mobile Devices say about puppet will install here? (Part 59) According to Securing Electronic Health Records on Mobile Devices, puppet will install here: d steps and corresponding screenshots. First install IIS and then install the .NET Framework. Table 11-2 summarizes the required IIS components and .NET Framework features followed by the screenshots. Table 11-2 IIS Components and .NET Features Required Option Common HTTP Features Health and Diagnostics Application Development Security Value IIS Default Document Directory Browsing HTTP Errors Static Content HTTP Logging .NET Extensibility 4.5 ASP .NET 4.5 ISAPI Extensions ISAPI Filters Request Filtering NIST SP 1800-1C: Securing Electronic Health Records on Mobile Devices 66 Required Option Management Tools .NET Framework 4.5 Features WCF Services Value IIS Management Console .NET Framework .NET Framework 4.5 ASP.NET 4.5 HTTP Activation TCP Port Sharing Figure 11-1 Web Server (IIS) Components Selection Screenshot T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 1 . . NIST SP 1800-1C: Securing Electronic Health Records on Mobile Devices 67 Figure 11-2 .NET Framework 4.5 Features Selection T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 1 . . Microsoft Office 2013 Filter Pack Download it from Microsoft website (http://www.microsoft.com/en-us/download/ details.aspx?id=40229) and install it. Java Runtime Environment (JRE) 8 Download and install JRE 8. Refer to 64-142952.html for details. All pre-installation software must be installed and configured before installing RSA Archer. 11.1.3 Installation 1. Create folders C:\ArcherFiles\Indexes and C:\ArcherFiles\Logging (will be used later). 2. Obtain/Download the installer package from RSA; extract the installation package. 3. Run installer. a.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TE-1 in Mobile Device Security_ Bring Your Own Device (BYOD)? (Part 204) Control TE-1: | User Authentication Configuration ............................................................................ | 39 | | | 2.4.7 | VPN Configuration ...................................................................................................... | 43 | | | 2.4.8 | Enable Automatic Application and Threat Updates................................................... | 53 | | 2.5 | Kryptowire...................................................................................................................55 | Kryptowire...................................................................................................................55 | | | | 2.5.1 | Kryptowire and MaaS360 Integration ........................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain The Security Problem according to NIST Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992 According to Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992, The Security Problem: - Many diverse CIS assets - Many diverse security products and systems - No overall security architecture

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Conformance Test for FDDI Medium Access Control (MAC) say about FDDI MAC Conformance Test C Language Test Generated by the TTCN Translator? (Part 24) According to A Conformance Test for FDDI Medium Access Control (MAC), FDDI MAC Conformance Test C Language Test Generated by the TTCN Translator: _lastlevel) { _level +-1; D; lUT receives its own while (TRUE) ( ``` ``` /* line 1119 "FDDI.MP" --[2]? TIMEOUT */ /* Tester holds Token and sends Idle symbols until TVX expires. */ if (Timeout ("TVX. ") ) { _level +-1; return (FALSE) } /* line 1121 "FDDI.MP" [2] IDLE */ pIDLE -IDLE__I(); Send_PDU_IDLE (pIDLE) ; _level +-1; while (TRUE) { /* line 1124 "FDDI.I^" [3] */ if ((a 0)) { _level +' 1; /* line 1126 "FDDI.MP" [4]? GOTO */ goto D; } /* line 1128 "FDDI.MP" [3] */ Start_timer ("TRT.TRTclaim", (long) T_Max 1000); _level += 1; _timername ·= "TRT."; while (TRUE) { /* line 1130 "FDDI.MP" [4]? CLAIM */ /* IDT issues Claim frame. */ pCLAIM = CLAIM_R1 () ; _buffer *= Receive_PDU (_timername) ; if (Is_PDU_CLAIM(pCLAIM, _buffer) ) { _level +·= 1; while (TRUE) { /* line 1135 "FDDI.MP" [5]? TIMEOUT */ /* * Tester holds lUT's Claim frame to cause that the Claim frame * fails. */ if (Timeout ("TRT. ") ) { _level +' 1; while (TRUE) { /* line 1137 "FDDI.MP" --[6] */ Start_timer ("TRT.TRTbeacon", (long) T_Max 1000) _level +* 1; _timemame -"TRT."; while (TRUE) { /* line 1139 "FDDI.MP" --[7]? BEACON */ /* lUT issues Beacon frame. */ pBEACON -BEAC0N_R1(); _buffer -Receive_PDD (_timername) if ( I s_PDD_BEACON (pBEACON, _buffer) ) { _level +» 1; while (TRUE) { /* line 1143 "FDDI.MP" [8]! BEACON */ /* Tester repeats lUT's Beacon frame. */ pBEACON -BEAC0N_T1(); Send_PDU_BEACON (pBEACON) Start_timer ("TRT.TRTclaim", (long) T_Max 1000); _level +-1; _timername ' "TRT."; while (TRUE) { /* line 1147 "FDDI.MP" --[9]? CLAIM */ /* * After IDT receives its own Beacon frame, it * issues Claim frame. */ pCLAIM -CLAIM_R1 () ; _buffer -Receiv€_PDU (__timemame) ; if (I s_PDD_CLAIM (pCLAIM, _buffer) ) { _level +-1; ``` ``` while (TRUE) ( /* line 1151 "FDDI.MP' --[10] I CLAIM */ /* Tester repeats lUT's Beacon frame. */ pCLAIM -CLAIM_T1 () ; Send_PDU_CLAIM (pCLAIM) Start_timer ("TRT. ", (long) TTRT 1000); _level +' 1; _timemame -"TRT."; while (TRUE) { /* line 1155 "FDDI.MP" [11]?

Explanation: NIST publication on credential and access management. Topics: access control, token. Contains security framework guidance for authentication systems. Source: A Conformance Test for FDDI Medium Access Control (MAC).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DS-2 in Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? (Part 6) Control DS-2: ions=re- submit( 120) NIST SP 1800-15D: Securing Small-Business and Home Internet of Things Devices 265 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 Test Case Field Description table=100 priority=810 n_packets=0 ip in_port="wlp2s0.2486" dl_src=00:c0:ca:97:d1:1f nw_dst=10.135.1.1 actions=resubmit( 120) table=100 priority=810 n_packets=0 ip in_port="wlp2s0.2486" dl_src=00:c0:ca:97:d1:1f nw_dst=104.237.132.42 actions=resubmit( 120) table=100 priority=810 n_packets=0 ip in_port="wlp2s0.2486" dl_src=00:c0:ca:97:d1:1f nw_dst=198.71.233.87 actions=resubmit( 120) table=100 priority=805 n_packets=103 in_port="wlp2s0.2486" dl_src=00:c0:ca:97:d1:1f actions=out- put:diagout1 table=100 priority=800 n_packets=0 in_port="wlp2s0.2486" dl_src=00:c0:ca:97:d1:1f actions=re- submit( 110) table=100 priority=460 n_packets=0 in_port=wlp2s0 dl_type=0x888e actions=resubmit( 120) table=100 priority=0 n_packets=0 actions=output:di- agout1 [Omitted for length] Micronets Gateway and Micronets Manager logs verifying onboarding: DPP Onboarding Initiated: • Micronets Gateway: “DPPHandler.onboard_device: Issuing DPP onboarding commands for device” 2020-06-16 14:03:32,897 micronets-gw-service: INFO DPPHandler.onboard_device: Issuing DPP onboarding commands for device '463165abc19725aefffc39def13ce09b17167fba' in mi- cronet 'generic... 2020-06-16 14:03:32,898 micronets-gw-service: INFO DPPHandler.send_dpp_onboard_event: sending: 2020-06-16 14:03:32,899 micronets-gw-service: INFO { "DPPOnboardingStartedEvent": { "deviceId": "463165abc19725aefffc39def13ce09b17167fba", "macAddress": "00:C0:CA:97:D1:1F", "micronetId": "Generic", NIST SP 1800-15D: Securing Small-Business and Home Internet of Things Devices 266 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does An Analysis of Computer Security Safeguards for Detecting and Preventing Intentional Computer Misuse say about U.S. DEPARTMENT OF COMMERCE? According to An Analysis of Computer Security Safeguards for Detecting and Preventing Intentional Computer Misuse, U.S. DEPARTMENT OF COMMERCE: National Bureau of Standards Washington, D.C. 20234 OFFICIAL BUSINESS Penalty for Private Use, $300 POSTAGE AND FEES PAID U.S. DEPARTMENT OF COMMERCE COM-215 <!-- image --> SPECIAL FOURTH-CLASS RATE BOOK

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: An Analysis of Computer Security Safeguards for Detecting and Preventing Intentional Computer Misuse.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Hewlett-Packard ScanJet Plus UP and IIC according to NIST Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST According to Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST, Hewlett-Packard ScanJet Plus UP and IIC: - I. The Hewlett-Packard ScanJet Plus IIP and EC are graphics and text scanners. The IIP model is a gray scale scanner, and the IIC model is a color scanner. The output resolution of both models is 400 dots per inch. 2. The scanners are useful for scanning and inserting graphics, text and handwritten equations into the ERN. 3. These scanners operate with PCs running Microsoft Windows. 4. The HP model costs $1,700 and the IIC model costs $2,700.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Fiscal Year 2024 Cybersecurity and Privacy Annual Report say about CRYPTOGRAPHY? According to Fiscal Year 2024 Cybersecurity and Privacy Annual Report, CRYPTOGRAPHY: Cryptography is foundational to our security and data protection needs. The standards, guidelines, recommendations, and tools provided by NIST's Cryptography priority area enable the trustworthy assurance of integrity and confidentiality in all types of information and technology - now and in the future.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Fiscal Year 2024 Cybersecurity and Privacy Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Requirements and Conformance Test Assertions for ANSI_NIST-ITL 1-2011 Record Type 18 - DNA Record provide? (Section 99) | | B* | | | Req. # - ID | Ref. in Base Std. | Requirement Summary | L e v e l t a t u s | S | Assertion ID | Test Assertion Test Note | Imp.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Requirements and Conformance Test Assertions for ANSI_NIST-ITL 1-2011 Record Type 18 - DNA Record.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach say about 4.5.2 Overview of the System Design Phase? (Part 4) According to Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach, 4.5.2 Overview of the System Design Phase: nal Control Related Specifications (FIPS PUBS 73 & 102) -The purpose is to set forth security and internal control specifications to meet the functional security and internal control requirements. This document may be included as an appendix to System/Subsystem, Program and Data Base Specifications document. 3. Validation, Verification, and Testing Plan and Specifications (FIPS PUB 101) -The purpose of the VV&T Plan is to plan for the evaluation of quality and correctness of the software, including requirements and design documentation. The W&T Plan also contains plans for the testing of software, including detailed program specifications, descriptions, internal contols and security specifications, and procedures for all tests, as well as test data reduction and evaluation criteria. The three updated documents are: 1. Audit Plan 2. Project Plan 3. System Decision Paper

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Auditing for Controls and Security_ A System Development Life Cycle Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.4 Portal Use Case according to NIST 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings According to 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings, 4.4 Portal Use Case: The other use case mentioned in the previous section involves the client using a web browser to access a web server, which in turn accesses Grid services on behalf of the client. This use case is becoming more common as a means to allow for easy access to Grid services with a minimal footprint installation on the client system. The primary observation in this case is that the portal effectively functions as a ÒchasmÓ that must be bridged. Either X.509 or Shibboleth/SAML can be used to authenticate to the portal, but neither has a delegation method that allows for the delegation of authority from the user of a web browser to a portal (see, however, recent work of Cantor [4]). This is the socalled n -tier problem ( n > 2), an active research area. We note that MyProxy has been used traditionally in the Grid community to enable a portal to use a clientÕs username and password to obtain X.509 credentials for the client. Recent work [23] has also shown that this can be extended to web single signon using PubCookie [33]. We believe this approach can be adapted to allow Shibboleth-issued SAML authentication assertions to be used to obtain X.509 credentials from MyProxy 4 . 4 The newly formed ÒShibGridÓ projects, ShibGrid and SHEBANGS, sponsored by the UK Joint Information Systems Committee has similar goals As in the previous section, these X.509 credentials would have the principal name, taken from the NameIdentifier element in the SAML assertion, embedded in them. This would allow the Grid service to query the SAML Attribute Authority in an identical manner as described previously.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does An Introduction to Privacy Engineering and Risk Management in Federal Systems provide? (Section 45) o be assessed and the relationships among those factors. 65 In information security, the risk factors include the threats to the system and the vulnerabilities that can be exploited by those threats. 66 However, the terms 'threat' and 'vulnerability' fail to capture the essence of many privacy problems for individuals. Returning to the example of the smart meters, the smart meters are the part of the system collecting the information and thereby creating the problems for individuals (e.g., loss of trust; chilling effect on ordinary behavior). An information security risk model would be unlikely to perceive this behavior of the smart meter as a 'threat' since the activity is an authorized part of the functioning of the system itself. While it is not inconceivable to expand a threat-based model to apply to the purposeful processing of PII, overloading this term runs the risk of causing more confusion and miscommunication than clarity, and ultimately creating more difficulties in determining meaningful privacy risk assessments and appropriate mitigations. Consequently, agencies need terminology more suited to the nature of privacy in systems to be able to identify privacy risk as distinct from information security risk. As described in section 2.2, the potential circumstance or event of concern is a problem that individuals experience as a byproduct of authorized processing of PII. Therefore, rather than adding more concepts to the term 'threat,' a more information-rich factor for a privacy risk model is to identify the operation that a system is performing on PII, that could cause an adverse effect or a problem for individuals-in short, a problematic data action . Problematic data action means a data action that causes an adverse effect, or problem, for individuals. In the information security risk model the primary risk factors are expressed as the likelihood that a vulnerability will be exploited by a threat and the impact of such occurrence.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: An Introduction to Privacy Engineering and Risk Management in Federal Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TG-005 in Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS)? (Part 44) Control TG-005: an IVP, when executed by an auditor, has, in some way, more "value" since it could be argued that a greater degree of Division of Duties was observed during that execution. E2 Users authorized to TP. Gomments As mentioned above the Paper makes reference to "Users". The Group felt that this word should be replaced, in many cases with Job Function, the concept being that individual users should only acquire access to GDIs, through approved TPs, by virtue of their Job Functions. The Job Functions, as mentioned above, are specified in Job Descriptions and the "map" of the Division of Duties is shown in the Organization Ghart for that organization. The Division of Duties over the whole process by which TPs are set up and users acquire access to them is obviously critical to the stature of the Integrity Trusted Gomputer Base (ITGB) The Group also felt that there should be a series of IVPs to periodically check the integrity of these definitions of access to TPs and GDIs. E3 Users must be authenticated. Gomments The Group felt that this is a function which must be performed by the Trusted Gomputer Base (TGB) . The user must be authenticated before any opportunity is provided to invoke a TP. The Group felt that the remaining rules which are listed below should be deleted for the reasons given. El GDIs changed only by authorized TPs. Comments This rule is subsumed by E2 , and this was generally agreed by all Groups during the general discussion. E4 Authorization Lists changed only by Security Officer. Comments This was regarded as only a particular implementation example of Rule E2 . It was seen as being an advantage to have a similar procedure as for normal TPs, since the Authorization Lists would have to be changed by a TP. C3 Suitable separation of duties. Comments This is another implementation example of Rule E2 Issues Questions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.1.4 Technology Transfer according to NIST Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls, 4.1.4 Technology Transfer: As discussed above in 3.3 and 3.4, the knowledge of what it takes to truly improve the security of a system is not widespread. Current research efforts, notably the KVM/370 (Kernel ized VM/370) [6], KSOS (Kernel ized Secure Operating System) [21], UCLA Secure Unix [24], and PSOS (Provably Secure Operating System) [15] projects --as well as the MULTICS GUARDIAN effort [22] --have developed some experience in using the kinds of software tools and management approaches that seem necessary. To aid the transfer of this technology, a report should be written that carefully documents the experiences of each of these efforts. The report should cover what the goals of each project were (or are), what kinds of tools were used, the experience --especially learning curve in using them, the costs involved, and the results. Costs should include both the expense df the effort and the effect on the product --performance and compatibility. The point here is not so much the detailed technology involved --as that has to be covered by other means but a feel for "what it really takes to make a system secure."

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IP-002 in Guidelines for Smart Grid Cybersecurity? (Part 219) Control IP-002: idge. For large inter-domain systems, a federated approach is the most reasonable solution for large inter- domain systems. In general, any two domains should be allowed to cross-sign as they see fit. However, the activity of cross-signing with many other domains can result in significant overhead. Utility companies may wish to form regional consortiums that would provide bridging services for its member utility companies to help alleviate this concern. Small utilities could outsource their PKI. This is not necessarily the same as going to a public PKI provider, such as a large CA organization, and getting an “Internet model” certificate. With the Internet model, a certificate mainly proves that the organization is the rightful owner of the domain name listed in the certificate. For smart grid, this is probably not sufficient. Certificates should be used to prove ownership, as well as being used for authorization credentials. Smart grid certificates could be issued under smart grid–sanctioned policies and could carry authorization credentials. 222 IEEE 802.16 (WiMAX) PKI certificates, by comparison, do not prove ownership; they can only be used to prove that the entity with the corresponding private key is the entity listed in the certificate. An AAA server must then be queried to obtain the authorization credential of the device. 4.1.2.4.4 Need for a Model Policy A CP is a document that describes the policies under which a particular certificate was issued. A typical CP document contains a rich set of requirements for all PKI participants, including those that are ascribed to the RP. A CP document also contains legal statements, such as liability limits that the PKI is willing to accept. RFC 3647 provides an outline and description for a template CP document. Most PKIs follow this template. A certificate reflects the CP that it was issued under by including a CP Extension.

Explanation: NIST publication on credential and access management. Topics: authorization, pki. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain UNIX according to NIST Computer Security Training & Awareness Course Compendium According to Computer Security Training & Awareness Course Compendium, UNIX: COURSE TITLE: Audit and Security of Unix-Based Operating Systems COURSE LENGTH: 3 DAYS

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-12 in Engineering Trustworthy Secure Systems? (Part 48) Control AM-12: nd that new, unanticipated, and otherwise unforeseen adverse consequences will occur despite proactive planning and instituting of means and methods to control loss and the extent of its consequences. The reactive aspect promotes informed operational decision-making after the system is in use and a loss condition occurs, proactively providing an operations capability to address the loss condition and handle the loss. The reactive aspect complements the preemptive aspect by providing an informed basis and means for an external entity (e.g., a human operator or system) to act when failures occur. Essentially, the reactive aspect is a proactive engineering activity about providing a reactive capability. An effective design will optimize protection against loss to the extent practical while recognizing that losses will occur irrespective of the protections put in place. Optimization decisions across preemptive and reactive approaches must consider assets, stakeholders, concerns, and objectives. Achieving a proper mix requires establishing security objectives and conducting requirements elicitation and analysis to unambiguously ascertain the scope of security in terms of addressing failure and the associated consequences in its preemptive and reactive aspects. ## D.2. Design Considering Emergence A system is expected to deliver the required capabilities as authorized, as intended, and at the specified level of performance. It should not deliver unauthorized or unintended capabilities. One cause of unintended behaviors and outcomes lies with the concept of emergence . Emergence refers to the behaviors and outcomes that result from how individual system elements compose to form the system beyond the collection of behaviors and outcomes of the individual system elements. This composition is covered in the design principle of Structured Decomposition and Composition and illustrated in Figure 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Storage Encryption Technologies for End User Devices provide? (Section 62) e organization's facilities. Some storage encryption products allow the passwordbased authentication recovery mechanisms to be used and permit the user to temporarily use passwordbased authentication. However, because this is generally a reduction in the strength of authentication, many organizations do not permit its use. This means that a loss of authenticator could cause an extended loss of availability to the data, until the user can receive a new authenticator (e.g., smart card, cryptographic token) and an administrator can configure the device to use the new authenticator. Recovery mechanisms increase the availability of the storage encryption solution for individual users, but they can also increase the likelihood that an attacker can gain unauthorized access to encrypted storage by abusing the recovery mechanisms. Organizations should consider the tradeoff between availability and security when selecting and planning recovery mechanisms. Some storage encryption products also offer protection against authentication-guessing attempts. For example, if there are too many consecutive failed authentication attempts, some products can either lock the computer for a period of time or increase the delay between attempts. In particularly high-security situations, some products can be configured so that too many failed attempts causes the product to wipe all the protected data from the device. This approach strongly favors security over functionality. After the solution has been designed, the next step is to implement and test a prototype of the design. Ideally, implementation and testing should first be performed on lab or test devices. Only implementations in final testing should be conducted on production devices. Aspects of the solution to evaluate include the following: - GLYPH<c=31,font=/PKMAFP+Webdings> Protection. Each type of information that needs protection should be protected in accordance with the information gathered during the Identify Needs phase.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Guide to Storage Encryption Technologies for End User Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Enhancing Resilience of the Internet and Communications Ecosystem_ A NIST Workshop Proceedings provide? (Section 17) n bolting it on later, was a widely shared belief. Far too many products are shipped with known vulnerabilities; these products may be detected, attacked, and compromised within minutes of deployment. Secure update mechanisms are needed to address vulnerabilities discovered during the normal product lifetime. Clear and effective processes to address end-oflife issues are also needed, as vulnerabilities in obsolete products cannot be addressed, ensuring that adversaries have a reliable starting point when penetrating an enterprise or establishing a botnet. Participants noted a systemic education and awareness problem. Almost 6 % of the recommendations/comments during workshop breakout sessions focused on the importance of education and awareness. Many attendees cited transportation safety, where seatbelt usage and crash test ratings have led to better outcomes, as an education and awareness success story. Others cited the same sector as a cautionary tale, with long lead times before widespread acceptance of seat belts and other technological improvements. Energy Star was also the subject of repeated discussion, with simple metrics for consumers. An independent body to test and certify security-relevant features, and offer a more accessible rating scheme, was frequently cited as an important step towards consumer identification of products with strong security features. Perceived market incentives do not align with our security and resilience goals, according to many workshop participants. Product developers and vendors minimize cost and time to market, rather than build in security or offer efficient security updates. Much of the discussion focused on techniques to create market incentives, such as independent product certification, but some felt that more active government intervention (e.g., regulation) would eventually be needed to overcome market failures.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Enhancing Resilience of the Internet and Communications Ecosystem_ A NIST Workshop Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines on Firewalls and Firewall Policy provide? (Section 70) sed or personal firewalls built in to the hosts' operating systems? If so, how easily can these conflicts be resolved? The configuration phase involves all facets of configuring the firewall platform. This includes installing hardware and software, configuring policies, configuring logging and alerting, and integrating the firewall into the network architecture. Once the firewall has been chosen and acquired, the hardware, operating system, and underlying firewall software should be installed for a software-based firewall. Next, for both software-based and hardwarebased firewalls, patches and vendor updates should be installed on the system. During this stage, the firewall should also be hardened to decrease the risk of vulnerabilities and protect the system against unauthorized access. Any console software needed for remote access should also be installed at this time. During the installation and configuration, only the administrator doing that work should be able to manage the firewall. All other management services for the firewall, such as SNMP, should be disabled, and these services should be left disabled permanently unless needed. If the firewall supports having a separate administrator account for each person performing firewall administration duties, configure such accounts. Network firewalls should be placed in a room that meets the product's recommended environmental requirements for temperature, humidity, space, power, etc. This room should also be physically secured to prevent unauthorized personnel from accessing the firewall. Comparing the logs of multiple systems when analyzing problems is very important, so the internal clocks in each firewall should be consistent with those in all other systems used by the organization. The best way to do this is to have all systems synchronize with an authoritative time source. Once hardware and software has been installed and secured, administrators can create the firewall's policies.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Firewalls and Firewall Policy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings provide? (Section 22) the use of the following relationship types : - Supports : Concept A supports concept B when A can be applied alone or in combination with one or more other concepts to achieve B in whole or in part. - Is supported by : Concept A is supported by concept B when B can be applied alone or in combination with one or more other concepts to achieve A in whole or in part. - Identical: Concept A and concept B are identical. They use exactly the same wording. - Equivalent: Concept A and concept B are equivalent. They have the same meaning but different wording. - Contrary: Concept A and concept B each have one or more elements that contradict one or more elements of the other concept. The contradictions may be opposites but do not have to be. This is based on the contrary concept type in Section 6.5.4 of [ISO704]. - No relationship: Concept A and concept B are not related or are not sufficiently related to merit another supportive relationship type. The supports and is supported by relationships are more than simply cause and effect. They can also indicate whether or not the supporting concept is necessary for achieving the supported concept. One of the following relationship properties can optionally be assigned to each supports and is supported by relationship: - Example of: The supporting concept C is one way (an example) of achieving the supported concept D in whole or in part. However, the supported concept D could also be achieved without applying the supporting concept C. In other words, one can accomplish D without C. This is based on the generic relationship type in Section 5.5.4.2 of [ISO704]. - Integral to: The supporting concept C is integral to and a component of the supported concept. The supporting concept must be applied as part of achieving the supported concept. In other words, one cannot accomplish D without C. This is based on the partitive relationship type in Section 5.5.4.3 of [ISO704].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings say about 5.6 Implementation, Performance, Availability? (Part 1) According to 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings, 5.6 Implementation, Performance, Availability: 5.6 Implementation, Performance, Availability The technical realisation of a VA service is not a central topic of this paper. However, the following observations are made: - -A VA is an on-line trust service subject to severe requirements for availability and security. These requirements are enforced on the software and hardware used as well as on the operational environment of the service. 5 This is almost always the case for PKIs that require particular software to be installed. An agreement covers both purchase of software and acceptance as an authorised RP. - -A VA needs to handle the heterogeneity encountered in the PKI area, including support for various certificate profiles, cryptographic algorithms and protocols. - -For scaling, a VA must be replicated. Synchronisation between instances of the VA service and optimisation of collection of revocation information and auxiliary information must be in place. Outsourcing certificate processing to a VA may improve performance since an optimised and dedicated installation is used at the VA. The avoidance of certificate path discovery and validation procedures greatly improves speed in cases where this would normally be needed. However, the VA solution must scale, and performance is influenced by factors like the communication link between RP and VA. When RPs operating critical services rely on a VA, the VA's availability must be guaranteed. There are two main issues involved: - -Availability of the VA towards the RPs. This is similar to availability of other critical systems, and measures are reliable systems and communication links, redundancy, protection against DoS attacks and so on. - -Availability of updated status information from the CAs.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control WE-125 in Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities? (Part 48) Control WE-125: ble size (see line 1458 ). As the content of this array is read and copied to bp , so too is a huge amount of data from over its upper bound. The three-state BF chain so far (see the upper row in Fig. 17) shows that data can be read from over the bound of the array pointed by pl . However, it does not show why an exploit would reach sensi/t\_i.ligave informa/t\_i.ligaon, such as private keys or login creden/t\_i.ligaals. The vulnerability triggered by the missing size veri/uniFB01ca/t\_i.ligaon bug is only a part (although the main one) of the puzzle. ``` typedef struct ssl3_record_st { int type; /* type of record */ unsigned int length; /* How many bytes available */ unsigned int off; /* read/write offset into ' buf' */ unsigned char *data; /* pointer to the record data */ unsigned char *input; /* where the decode bytes are */ unsigned char *comp; /* only used with decompression - malloc()ed */ unsigned long epoch; /* epoch number, needed by DTLS1 */ unsigned char seq_num[8]; /* sequence number, needed by DTLS1 */ } SSL3_RECORD; 1448 dtls1_process_heartbeat(SSL *s) 1449 { 1450 unsigned char *p = &s->s3->rrec.data[0], *pl; 1451 unsigned short hbtype; 1452 unsigned int payload; 1453 unsigned int padding = 16; /* Use minimum padding */ 1454 1455 /* Read type and payload length first */ 1456 hbtype = *p++; 1457 n2s(p, payload); 1458 pl = p; ... 1465 if (hbtype == TLS1_HB_REQUEST) 1466 { 1467 unsigned char *buffer, *bp; ... 1470 /* Allocate memory for the response, size is 1 byte 1471 * message type, plus 2 bytes payload, plus 1472 * payload, plus padding 1473 */ 1474 buffer = OPENSSL_malloc(1 + 2 + payload + padding); 1475 bp = buffer; 1476 1477 /* Enter response type, length and copypayload */ 1478 *bp++ = TLS1_HB_RESPONSE; 1479 s2n(payload, bp); 1480 memcpy(bp, pl, payload); /* Naive implementation of memcpy() void *memcpy (void *dst, const void *src, size_t n) { size_t i; for (i=0; i<n; i++) *(char *) dst++ = *(char *) src++; return dst; } pl bp payload ``` Fig. 18.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Operational Technology (OT) Security provide? (Section 171) tes of that object and the requesting subject. For federal employees and contractors, Personal Identity Verification (PIV), used in accordance with FIPS 201, may be required to achieve access control. Organizations may also consider one or more of these techniques when determining how to support local access controls within their environments. Supplemental guidance for access controls can be found in the following documents: • NIST SP 800-63-3, Digital Identity Guidelines • NIST SP 800-73-4, Interfaces for Personal Identity Verification • NIST SP 800-76-2, Biometric Specifications for Personal Identity Verification • NIST SP 800-78-4, Cryptographic Algorithms and Key Sizes for Personal Identity Verification • NIST SP 800-96, PIV Card to Reader Interoperability Guidelines • NIST SP 800-97, Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i • NIST SP 800-162, Guide to Attribute Based Access Control (ABAC) Definition and Considerations OT-Specific Recommendations and Guidance Organizations should consider the following: • Some logical access controls, such as RBAC, support the principle of least privilege and the separation of duties by 98 NIST SP 800-82r3 September 2023 Guide to Operational Technology (OT) Security providing a uniform means to manage access to OT devices while reducing the cost of maintaining individual device access levels and minimizing errors. These logical access controls can also restrict OT user privileges to only those required to perform each person’s job (i.e., configuring each role based on the principle of least privilege). The level of access can take several forms, including viewing, using, and altering specific OT data or device functions. • Solutions that provide credential management, authentication, authorization, and system use monitoring technical capabilities.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways say about 1.6 Typographic Conventions? According to Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways, 1.6 Typographic Conventions: The following table presents typographic conventions used in this volume. | Typeface/Symbol | Meaning | Example | |-------------------|---------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------| | Italics | file names and path names; references to documents that are not hyperlinks; new terms; and placeholders | For language use and style guidance, see the NCCoE Style Guide . | | Bold | names of menus, options, command buttons, and fields | Choose File > Edit. | | Monospace | command-line input, onscreen computer output, sample code examples, and status codes | mkdir | | Monospace Bold | command-line user input contrasted with computer output | service sshd start | | blue text | link to other parts of the document, a web URL, or an email address | All publications from NIST's NCCoE are available at |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Electronic Mail Security say about 3.1 OpenPGP? (Part 4) According to Guidelines on Electronic Mail Security, 3.1 OpenPGP: encrypted HTTP session. Some gateways can also perform these functions for emails sent to lists of users. For example, a single user could send an encrypted and signed email to a mailing list address. The gateway would decrypt the email and re- 15 Sites include the Free Software Foundation (http://www.gnupg.org/), Hushmail (http://www.hushmail.com/), International PGP Site (http://www.pgpi.org/), OpenPGP Site (http://www.openpgp.org/), and PGP (commercial version) (). 16 For more information about the DSA and the associated Digital Signature Standard (DSS), see FIPS PUB 186-2, Digital Signature Standard (DSS), 17 FIPS PUB 140-2, Security Requirements for Cryptographic Modules ; FIPS PUB 180-2, Secure Hash Standard (SHS) , and FIPS PUB 186-2, Digital Signature Standard (DSS) are available at encrypt it for all the individual recipients of the mailing list. Each recipient can then decrypt the email and verify the original signature.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Use of ISO_IEC 24727 provide? (Section 18) ate a cardholder's PIN. Instead of creating a smart card specific command, the client-application invokes the ISO/IEC 24727-3 'DIDAuthenticate' service and passes the PIN number through the interface. The ISO/IEC 24727-3 implementation then packages the PIN number into a Generic Card Interface instruction and sends it to the ISO/IEC 24727-2 implementation. The Generic Card Interface instruction is packaged in accordance with the 'discovered' data objects on the card. In order to do the discovery, an ISO/IEC 24727-3 implementation needs to come to know which key reference to use within the card-application. This mapping from the named 'PIN number' to the key reference is discovered through a data structure called the registry. The registry is card-application specific and can be retrieved from an on-card storage location (from the card-application's Application Capability Description (ACD) when it is activated) or from an alternative off-card storage location. The registry contains data object information, access control requirements, key references, cryptographic algorithm references, and protocol references supported by the card-application. The registry also provides associations between the objects and key references. The SALII implementation receives a service action on its interface, and with the help of the registry, translates the service into a sequence of requests/commands for the Part 2 Generic Card Interface. This is illustrated in Figure 2. Figure 2 - Use of the Registry by ISO/IEC 24727-3 <!-- image --> ISO/IEC 24727-3 provides a set of normative authentication protocols. Currently, IDMS implementations use authentication protocols to meet their requirements but the protocols may differ from implementation to implementation. For example, two IDMS implementations might use an on-card biometric comparison authentication protocol.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Use of ISO_IEC 24727.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Block Cipher Modes of Operation_ Galois_Counter Mode (GCM) and GMAC say about Appendix B: Authentication Assurance? (Part 1) According to Recommendation for Block Cipher Modes of Operation_ Galois_Counter Mode (GCM) and GMAC, Appendix B: Authentication Assurance: Appendix B: Authentication Assurance The creation of an authentication tag by the authenticated encryption function provides the mechanism whereby assurance of the authenticity of the plaintext and AAD (and IV) can be obtained upon the execution of the authenticated decryption function. The nature of this assurance depends on the output of the authenticated decryption function: - If the output is the plaintext, then the design of the mode provides strong, but not absolute, assurance that the purported source of the data created the tag, i.e., that the plaintext and the AAD (and the IV and the tag) are authentic. Consequently, the mode also provides strong assurance that this information was not subsequently altered, either intentionally or unintentionally. - If the output is FAIL , then it is certain that at least one of the given inputs (i.e., the ciphertext, the AAD, the IV, or the tag) is not authentic. In the first case, the assurance is not absolute because forgeries are possible, in principle. In other words, an adversary, i.e., a party without access to the key or to the authenticated encryption function, may be able to produce the correct tag for some triple of ciphertext, AAD, and IV. As with any tag-based authentication mechanism, if the adversary chooses a t -bit tag at random, it is expected to be correct for given data with probability 1/2 t . With GCM, however, an adversary can choose tags that increase this probability, proportional to the total length of the ciphertext and AAD. Consequently, GCM is not well-suited for use with short tag lengths or very long messages. In particular, if n denotes the total number of blocks in the encoding (i.e., the input to the GHASH function in the definition of S in Secs.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Block Cipher Modes of Operation_ Galois_Counter Mode (GCM) and GMAC.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Securing Public Web Servers say about H? According to Guidelines on Securing Public Web Servers, H: Host-based intrusion detection and prevention software, 4-6 Hypertext Preprocessor (PHP), 6-14

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Securing Public Web Servers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Access Control Documents say about 4.3.3 PERFORMPAA? According to Secure Data Network Systems (SDNS) Access Control Documents, 4.3.3 PERFORMPAA: Inputs; Message Originator's Composite ID Information Message Recipient's Composite ID Information Outputs: PAA Result = Pass/Fail Enforcement Vector (EV) Error Condition Functionality; The purpose of the Perform PAA function is to compare both the message originator's and message recipient's Composite ID information to determine whether or not a commonly held set of security attributes exists on which an association can be based. In the PAA procedure, a UA is responsible for calling all the PAA functionality which the local configuration dictates. For a detailed description of PAA refer to section 4. 1 If PAA is successfully completed then PAA Result = Pass, and the EV is passed to the Perform PAE function so that it can perform its processing If the PAA is unsuccessful then PAA Result = Fail and an error condition is generated The error condition generated by a failed PAA would indicate that no allowable set of communications exists between the two peers, this is an access control decision. In the case of an outgoing multicast message, this error condition is only tied to the specific recipient for . whom the attempt to perform PAA is made. If PAA fails, control of the processing is returned to the MSP along with the appropriate error condition.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Secure Data Network Systems (SDNS) Access Control Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Wireless Infusion Pumps in Healthcare Delivery Organizations provide? (Section 392) s, J. Martin, Ed., J. Burbank, and W. Kasch, Network Time Protocol Version 4: Protocol and Algorithms Specification, Internet Engineering Task Force (IETF) Request for Comments (RFC) 5905, June 2010. https://www.ietf.org/rfc/rfc5905.txt [accessed 2/7/18]. [12] U.S. Department of Commerce. Announcing the Advanced Encryption Standard (AES), Federal Information Processing Standards (FIPS) Publication 197, November 2001. http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf [accessed 2/7/18]. [13] Cisco Wireless Controller Configuration Guide, Release 8.0, Cisco [Web site], guide/b_cg80.html [accessed 2/7/18]. [14] D. Simon, B. Aboba, and R. Hurst, The EAP-TLS Authentication Protocol, Internet Engineering Task Force (IETF) Network Working Group Request for Comments (RFC) 5216, March 2008. https://www.ietf.org/rfc/rfc5216.txt [accessed 2/7/18]. [15] C. Rigney, S. Willens, A. Rubens, and W. Simpson, Remote Authentication Dial In User Service (RADIUS), Internet Engineering Task Force (IETF) Network Working Group Request for Comments (RFC) 2865, June 2000. https://tools.ietf.org/html/rfc2865 [accessed 2/7/18]. [16] [17] S. Santesson, M. Myers, R. Ankney, A. Malpani, S. Galperin, and C. Adams, X.509 Internet Public Key Infrastructure Online Certificate Status Protocol – OCSP, Internet Engineering Task Force (IETF) Request for Comments (RFC) 6960, June 2013. https://tools.ietf.org/html/rfc6960 [accessed 2/7/18]. Symantec™ Data Center Security: Server, Monitoring Edition, and Server Advanced 6.7 MP1 Planning and Deployment Guide, Symantec [Web site], Center-Security:-Server-Advanced-6.7-or-6.7-MP1/?locale=EN_US [accessed 2/7/18]. NIST SP 1800-8C: Securing Wireless Infusion Pumps 257

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: Automated tools and mechanisms include host-based, network-based,

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Stateful Hash-Based Signature Schemes say about B.2? (Part 5) According to Recommendation for Stateful Hash-Based Signature Schemes, B.2: type) { case xmssmt-sha2_20/2_192: case xmssmt-sha2_40/2_192: case xmssmt-shake256_20/2_256: case xmssmt-shake256_40/2_256: case xmssmt-shake256_20/2_192: case xmssmt-shake256_40/2_192: xmss_reduced xmss_red_arr_d2[2]; case xmssmt-sha2_60/3_192: case xmssmt-shake256_60/3_256: case xmssmt-shake256_60/3_192: xmss_reduced xmss_red_arr_d3[3]; case xmssmt-sha2_20/4_192: case xmssmt-sha2_40/4_192: case xmssmt-shake256_20/4_256: case xmssmt-shake256_40/4_256: case xmssmt-shake256_20/4_192: case xmssmt-shake256_40/4_192: xmss_reduced xmss_red_arr_d4[4]; case xmssmt-sha2_60/6_192: case xmssmt-shake256_60/6_256: case xmssmt-shake256_60/6_192: xmss_reduced xmss_red_arr_d6[6]; case xmssmt-sha2_40/8_192: case xmssmt-shake256_40/8_256: case xmssmt-shake256_40/8_192: xmss_reduced xmss_red_arr_d8[8]; case xmssmt-sha2_60/12_192: case xmssmt-shake256_60/12_256: case xmssmt-shake256_60/12_192: ``` ``` xmss_reduced xmss_red_arr_d12[12]; }; /* Types for bitmask seed */ union seed switch (xmssmt_algorithm_type type) { case xmssmt-sha2_20/2_192: case xmssmt-sha2_20/4_192: case xmssmt-sha2_40/2_192: case xmssmt-sha2_40/4_192: case xmssmt-sha2_40/8_192: case xmssmt-sha2_60/3_192: case xmssmt-sha2_60/6_192: case xmssmt-sha2_60/12_192: case xmssmt-shake256_20/2_192: case xmssmt-shake256_20/4_192: case xmssmt-shake256_40/2_192: case xmssmt-shake256_40/4_192: case xmssmt-shake256_40/8_192: case xmssmt-shake256_60/3_192: case xmssmt-shake256_60/6_192: case xmssmt-shake256_60/12_192: bytestring24 seed_n24; case xmssmt-shake256_20/2_256: case xmssmt-shake256_20/4_256: case xmssmt-shake256_40/2_256: case xmssmt-shake256_40/4_256: case xmssmt-shake256_40/8_256: case xmssmt-shake256_60/3_256: case xmssmt-shake256_60/6_256: case xmssmt-shake256_60/12_256: bytestring32 seed_n32; }; /* Types for XMSS^MT root node */ union xmssmt_root switch (xmssmt_algorithm_type type) { case xmssmt-sha2_20/2_192: case xmssmt-sha2_20/4_192: case xmssmt-sha2_40/2_192: case xmssmt-sha2_40/4_192: case xmssmt-sha2_40/8_192: case xmssmt-sha2_60/3_192: case xmssmt-sha2_60/6_192: case xmssmt-sha2_60/12_192: ``` ``` case xmssmt-shake256_20/2_192: case xmssmt-shake256_20/4_192: case xmssmt-shake256_40/2_192: case xmssmt-shake256_40/4_192: case xmssmt-shake256_40/8_192: case xmssmt-shake256_60/3_192: case xmssmt-shake256_60/6_192: case xmssmt-shake256_60/12_192: bytestring24 root_n24; case xmssmt-shake256_20/2_256: case xmssmt-shake256_20/4_256: case xmssmt-shake256_40/2_256: case xmssmt-shake256_40/4_256: case xmssmt-shake256_40/8_256: case xmssmt-shake256_60/3_256: case xmssmt-shake256_60/6_256: case xmssmt-shake256_60/12_256: bytestring32 root_n32; }; ```

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Stateful Hash-Based Signature Schemes.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services provide? (Section 155) ce, such as PNT interference or corrections for leap seconds. There are four Subcategories within the Communications category that apply to the PNT Profile, as summarized in the table below. Table 19. Communications Subcategories Applicable to PNT | Respond Communications Subcategory | Applicability to PNT | References (PNT-Specific) | |-------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | CO-1: Personnel know their roles and order of operations when a response is needed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.