You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EP-67 in Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)? (Part 295) Control EP-67: ITU International Telecommunication Union ITU-T International Telecommunication Union - Telecommunication JTC Joint Technical Committee LAN Local Area Network LDAP Lightweight Directory Access Protocol LES Lean Execution System LoRa Alliance Long Range Alliance LTE Long Term Evolution M2M Machine to Machine MAC Message Authentication Code MES Manufacturing Execution System MLE Mesh Link Establishment MQTT Message Queuing Telemetry Transport NATO North Atlantic Treaty Organization NERC North American Electric Reliability Corporation NHTSA National Highway Traffic Safety Administration NOAA National Oceanic and Atmospheric Administration NS/EP National Security and Emergency Preparedness NSC's Cyber IPC National Security Council's Cyber Interagency Policy Committee NSTAC President's National Security Telecommunications Advisory Committee OASIS Organization for the Advancement of Structured Information Standards OCF Open Connectivity Foundation OFB Output Feedback Block OMA Open Mobile Alliance OMG Object Management Group OpenFog RA OpenFog Reference Architecture OSDP Open Supervised Device Protocol OTA Open Travel Alliance O-TTPS Open Trusted Technology Provider Standard PCI Payment Card Industry PHR Personal Health Records PID Proportional Integral Derivative PII Personally Identifiable Information PKCS Public-Key Cryptography Standards PKI Public Key Infrastructure PLC Programmable Logic Controllers PSS Probabilistic Signature Scheme PTK Pairwise Transient Key QMS Quality Management Systems RA Reference Architecture RADIUS Remote Authentication Dial-In User Service RFC Request for

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways provide? (Section 70) software and critical software platforms. | Objective 5 : Strengthen the understanding and performance of humans' actions that foster the security of critical software and critical software platforms. | Objective 5 : Strengthen the understanding and performance of humans' actions that foster the security of critical software and critical software platforms. | | SM 5.1: Train all users of critical software, based on their roles and responsibilities, on how to securely use the software and the critical software platforms. | PR.AT-1 | AT-2, AT-3 | | Security Measure (SM) | Cybersecurity Framework Subcategories | SP 800-53 Rev. 5 Controls | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------|-----------------------------| | SM 5.2: Train all administrators of critical software and critical software platforms, based on their roles and responsibilities, on how to securely administer the software and/or platforms. | PR.AT-2 | AT-3, CP-3 | | SM 5.3: Conduct frequent awareness activities to reinforce the training for all users and administrators of critical software and platforms, and to measure the training's effectiveness for continuous improvement purposes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture provide? (Section 4) s own unique security requirements, follow different security guidance, and require tailored security solutions. Their complexity and uniqueness impede the sharing of security solutions and knowledge. This NIST Special Publication aims to standardize and facilitate the information and knowledge-sharing of HPC security using an HPC system reference architecture and key components as the basis of an HPC system lexicon. This publication also analyzes HPC threats, considers current HPC security postures and challenges, and makes best-practice recommendations. high-performance computing; HPC reference architecture; HPC security; HPC security posture; HPC threat analysis; security guidance. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does BIOS Protection Guidelines for Servers provide? (Section 36) . - 3-C.i If verification fails, then the system shall initiate a recovery procedure. - 3-C.ii Automatic recovery mechanisms which initiate recovery to a protected, authentic BIOS should be supported. - 3-D Each RTU shall be protected from modifications outside the authenticated update mechanisms. - 3-D.i Protection mechanisms that ensure the integrity of the RTU shall be engaged prior to execution of code outside of the RTU. - 3-D.ii RTU integrity protections shall be enforced by hardware mechanisms that are disengaged only by an authorized mechanism, for example system reset. - 4-A The design of the system and accompanying system components and firmware shall ensure that there are no mechanisms to install and execute unauthenticated BIOS code, except through physical intervention and the secure local update mechanism. - 4-B The authenticated BIOS update mechanism shall be the exclusive mechanism for modifying the RTU absent physical intervention through the secure local update mechanism. - 4-C The design of the system and accompanying system components and firmware shall ensure that there are no mechanisms that allow the host processor or any other system component to bypass the authenticated update mechanism for updating the RTU, except for the secure local update mechanism. - 4-D While a system component may have read access to system flash memory, it shall not be able to directly modify the RTU unless that component serves as an RTU itself. - 5-A Service Processors employed as a Root of Trust to protect BIOS, shall meet the following requirements: - 5-A.i Updates to the SP code, cryptographic keys, and static data stored on the SP flash memory shall be by way of an authenticating update mechanism. - 5-A.ii The SP environment shall be controlled such that only authenticated code can be executed on the SP. - 5-A.iii Authorization should be required for user interaction with the SP.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: BIOS Protection Guidelines for Servers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Fingerprint Identification and Mobile Handheld Devices_ An Overview and Implementation say about Reports on Computer Systems Technology? According to Fingerprint Identification and Mobile Handheld Devices_ An Overview and Implementation, Reports on Computer Systems Technology: The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Interagency Report discusses ITL's research, guidance, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations. Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. National Institute of Standards and Technology Interagency Report 18 pages (2006)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Fingerprint Identification and Mobile Handheld Devices_ An Overview and Implementation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Foundations of a Security Policy for Use of the National Research and Educational Network say about 2.2.2 Supercomputing Initiative? According to Foundations of a Security Policy for Use of the National Research and Educational Network, 2.2.2 Supercomputing Initiative: With funding from Congress, the National Science Foundation established in 1984 a program intended to improve the availability and use of high performance computing to the science research communities. In 1985-86, NSF selected five sites as National Supercomputing Centers with computing facilities remotely accessible by other researchers through a backbone NSFNET. The selected centers were: San Diego Super Computer Center - located by the University of California at San Diego and operated by General Atomics; National Center for Supercomputing Applications operated by the University of Illinois; Cornell Theory Center - located at Cornell University; Pittsburgh Supercomputing Center - operated jointly by the University of Pittsburgh, Carnegie Mellon University and Westinghouse Electric Corporation; and John von Neumann Supercomputer Center -located in Princeton, New Jersey. Promoted as providing backbone connectivity to supercomputer centers, the network traffic of NSFNET was soon dominated by use of general services such as electronic mail, remote login, and file transfer. With the creation of the Federally funded NSFNET in 1985, ARPANET was eventually phased out and replaced by a new Defense Research Internet (DRI) for unclassified military information that would make use of NSFNET. ARPANET and MILNET became the main constituents of a TCP/IP internet DDN (Defense Data Network) - a subset of the Internet operated by the Department of Defense. Other networks in DDN include DISNET (Defense Integrated Secure Network), SCINET (Sensitive Compartmented Information Network) and WINCS (WWMCCS Intercomputer Command and Control System) of the World Wide Military Command and Control System [QUAR90].

Explanation: NIST publication discussing classified information handling. References: classified, compartmented. Contains guidance on protecting sensitive government information. Source: Foundations of a Security Policy for Use of the National Research and Educational Network.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS) provide? (Section 164) s them from directly performing those actions (i.e., through untrusted system utility software.) This is a version of the "who watches the watcher" problem and is discussed in more detail below. - P8. The responsibility for creating, installing, running, and acting on the results of IVP (consistency checking) software cannot be assigned to the system itself in any general way - it must be done by management. The system can, however, ensure that results that purport to come from an IVP (such as a reconciliation of accounts) cannot be generated by masquerading software if each IVP (or collections of them) , and only an IVP, is installed (by procedures like P5 and P6) as a trusted subject whose a-max label is something like "account reconciliation." Following, very briefly, is an analysis of how each of the 9 requirements of the Clark & Wilson model is met by the above configuration rules or by the inherent properties of a Bl or higher class trusted system. - P8 CI: IVP Certification C2 : TP Certification - P6 El: TP to CDI enforcement - P2 , P4 , P6, and TCSEC security (integrity) policy enforcement - E2: User to TP enforcement - PI, P4 , P6, and TCSEC security (integrity) policy enforcement C3 : Separation of duties - primarily P4 and PI - E3: User identity authentication identification - TCSEC and authentication - P6 - C4; Audit trail and TCSEC audit requirements (for security actions) C5: Valid data P6 - P5, - E4 : Can't change own authorization or affect own transaction - P4 , P7 , and TCSEC security (integrity) policy - enforcement One topic that was somewhat glossed over above is that of what kind of controls should be exercised over those who are entrusted with authority to change the system itself, including authorization information such as the integrity categories given to users or trusted subjects. The following rules, all derived from the separation of duties principle, seem to make sense: - Rl.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control UI-64 in Guidelines for the Secure Deployment of IPv6? (Part 93) Control UI-64: ter Solicitation (RS) . When an interface becomes enabled, hosts may send RSs that request routers to generate RAs immediately rather than at their next scheduled time. -  Router Advertisement (RA) . Routers advertise their presence together with various link and Internet parameters either periodically or in response to a RS message. RAs contain prefixes used for on-link determination and address configuration, a suggested hop limit value, the Maximum Transmission Unit (MTU) for the link, etc. -  Neighbor Solicitation (NS) . Nodes send NSs to determine the link-layer address of a neighbor or to verify that a neighbor is still reachable via a cached link-layer address. NSs are also used for Duplicate Address Detection (DAD). -  Neighbor Advertisement (NA) . A response to a NS message. A node may also send unsolicited NAs to announce a link-layer address change. -  Redirect Message . Used by routers to inform hosts of a better first hop for a destination. A common use of the NS and NA messages is to resolve IP addresses by discovering the MAC (Media Access Control) addresses of nodes on the same link. A sender must discover the recipient's MAC address to send a data packet. Figure 3-11 illustrates this example of the ND process. Figure 3-11. Example of Neighbor Discovery <!-- image --> For NS, the sending node (Host A) knows the unicast address of the destination node (Host B) is local because of the network prefix. Knowing this, it uses a link-local solicited-node multicast address to send its NS message.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does An Analysis of Computer Security Safeguards for Detecting and Preventing Intentional Computer Misuse provide? (Section 34) | | H | | CD | CO | | | | | | woo: | | CO QCcn4-)CQPj4-lCOt-( | | | | | | | | Vj | | | OXJ 03.-iV43a33 | | | | | | | | | | | c^ | | | | | | | | | | | | | | | | ^ | | | | | | | | | in | | | M-l •r4 TJ J-l 4J CO .-I CJ Cfl 44 M-l 0) CO -H 3 o CU -H x: di g O Q H O S Q O H Q •H a!

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: An Analysis of Computer Security Safeguards for Detecting and Preventing Intentional Computer Misuse.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived PIV Application and Data Model Test Guidelines provide? (Section 151) eter command data field) or '63 CX' (verification failed, with X indicating the number of further allowed retries (verify the error code supplied matches what is described in vendor documentation). 4. From Step 4, the command returns status word '6A 80' (incorrect parameter in command data field) or '63 CX' (verification failed, | 13 It may be necessary to perform a successful VERIFY command while performing the test scenario in order to keep the Derived PIV Application Password's retry counter from dropping to 0. | | with X indicating the number of further allowed retries) (verify the error code supplied matches what is described in vendor documentation). 5. From Step 5, the command returns status word '6A 80' (incorrect parameter in command data field) or '63 CX' (verification failed, with X indicating the number of further allowed retries) (verify the error code supplied matches what is described in vendor documentation).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cryptographic Key Management Workshop Summary -- June 8-9, 2009 say about Matt Fanto, Aegis? According to Cryptographic Key Management Workshop Summary -- June 8-9, 2009, Matt Fanto, Aegis: - The focus of the talk was on KM in the auto industry. Cryptography is being, or will be, used in all aspects of the automotive business, including within the car itself. They are concerned with (1) a single point of failure, where systems are without support for redundancy, so that KM systems or backups are at the risk of a BIG loss (catastrophic); (2) immediate needs versus costs, and a more flexible credentialing system - many manufacturers are locked into the current system with no way to change -Electronic Key Management (EKM) is needed that can leverage existing policies and authentication methods to lower cost and give faster deployment; and (3) an offline availability of keys.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Cryptographic Key Management Workshop Summary -- June 8-9, 2009.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information say about B.1. Establishing Federation Trust? (Part 2) According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information, B.1. Establishing Federation Trust: nd behaves in a reliable, trustworthy way. This type of trust may be formalized in contracts or trust frameworks. Public keys for SAML IdPs and RPs are typically communicated using X.509 certificates. However, in most cases it is not necessary to establish or use a trusted certificate authority to issue certificates for SAML signatures or encryption. When certificates are used to assert the identity of a website or an email address, accepting only certificates from trusted certificate authorities is critical. When establishing a SAML integration, however, trust is explicitly established in a specific signing or encryption key; it is not inherited from a trusted authority. Message switches today do not commonly support SAML for user authentication. Switch vendors may take different approaches to SAML implementation. A SAML assertion could be used to authenticate a user and initiate a session for a defined period during which the user could submit multiple queries. Other designs are possible; for example, the switch might not maintain session state and instead might require a SAML assertion to be sent along with each individual query. The approach may be dependent on the specific vendor technology and implementation. The rest of this appendix covers the following topics: - Challenges in using federation technologies for message switch use cases (Appendix B.2) - Meeting FAL requirements in complex federation scenarios (Appendix B.3) - Options for federated architecture configurations (Appendix B.4) - VPN integration (Appendix B.5)

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, certificate authority. Contains security framework guidance for authentication systems. Source: Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Intrusion Detection and Prevention Systems (IDPS) say about 9.4.2.1 Daily Use? (Part 1) According to Guide to Intrusion Detection and Prevention Systems (IDPS), 9.4.2.1 Daily Use: 9.4.2.1 Daily Use Organizations should consider how the IDPS solution needs to be used on a daily basis for monitoring security events, performing analysis of events of interest, and generating reports. Because these three activities are often intertwined, it is often easiest to assess them together.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Segmentation in a Small Manufacturing Environment provide? (Section 40) esign, which involves the following tasks: - Write policies for the company and for each security zone, including identifying users and permissions required. - Write detailed procedures where needed. Include steps for executing each policy. - Add technical security controls to the network and devices. - o Determine and implement appropriate settings on devices in the environment. - o Select and purchase security solutions as needed to meet security goals. - o Configure security solutions and products. Security segmentation is an approach to mitigate cyber vulnerabilities for small manufacturing environments through use of security zones. Implementing security controls and improving the cybersecurity posture are part of a journey not a one-time task. Each step on that journey makes a facility more secure and less vulnerable to a cyber attack. To facilitate the difficult task of implementing security controls, a limited initial set of security controls are presented as an example to begin the cyber risk mitigation journey. Additional cybersecurity practices can be selected from NISTIR 8183 Rev. 1 [3] as needed by the business. The security architecture design activities presented in this paper are foundational and will prepare the organization for additional security strategies like Zero Trust. - [1] Jeff Winter, What Is Industry 4.0?, https://blog.isa.org/what-is-industry-40 - [2] National Institute of Standards and Technology (2018) Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 6. https://doi.org/10.6028/NIST.CSWP.6 - [3] Stouffer KA, Zimmerman T, Tang C, Pease M, Lubell J, Cichonski J, McCarthy J (2020) Cybersecurity Framework Version 1.1 Manufacturing Profile. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Internal Report (IR) 8183 Rev.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Security Segmentation in a Small Manufacturing Environment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Domain Name System (DNS) Deployment Guide provide? (Section 166) between 1 - 15 octets would be acceptable for the majority of cases. Note that for zones that are dynamically resigned as needed may not be able to change the salt for NSEC3 RR's as an atomic process. In these cases, the salt rollover procedure is similar to the key algorithm rollover procedure in that the NSEC3 RR chain with the new salt is generated first (ending with the NSEC3PARAM RR) before removing the old (outgoing) NSEC3 chain. The iterations value depends on factors that are largely beyond the control of DNS administrators. The iterations value is included to increase the amount of work an attacker must complete when conducting a brute force attack offline against a known hashed name from the zone. The goal is to set this value so the amount of work is equal to the time needed to conduct a brute force attack against the server itself (including network lag, etc.). So choosing a value for the iterations requires a good estimate of the computational power available to an attacker and the time required to perform a brute force dictionary attack against an online DNS server. However, setting the value too high would result more work being done by the server and valid clients that may result in slow response time for end users and may be a possible Denial of Service (DoS) vector for servers and clients. The iterations value should be reviewed annually and changed if conditions warrant. Since the average DNS query response time is in the range of 25 to 200 ms, the iterations value should be chose to reflect the number of hash calculations the average processor could do in that time period. However, in practice the value should be lower to account for client processing power and to speed response for valid clients. Basic empirical work has shown that the ideal iteration value when using SHA-1 should be between 1 and 500, with values 1-200 recommended for average zones.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Domain Name System (DNS) Deployment Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Computer Security Log Management? (Part 106) Control ES-1: ould provide a stronger assurance of a successful attack than either log source would alone, and it would also likely contain more data on the attack than either individual source would have recorded. Another example of using correlation as a factor for prioritization is using information on known vulnerabilities in the 59 As described in Section 3.1, filtering does not alter the content of the original logs-it simply restricts which log entries are used for analysis. The filtered entries in the original log data might be needed for any number of reasons, including providing context for other entries and identifying long-term security problems through trend analysis. organization's installed operating systems and applications to assign a higher priority to log entries that are related to these vulnerabilities. ## 5.2.3 Comparing System-Level and Infrastructure-Level Analysis Analysis is typically very similar for system-level and infrastructure administrators. The main difference is that for infrastructure administrators, log analysis is often a primary responsibility, whereas for systemlevel administrators it is often a secondary responsibility, particularly if the infrastructure administrators are reviewing the most important log entries from systems. In such an arrangement, infrastructure administrators typically perform log analysis on an ongoing basis each day, and system-level administrators perform periodic reviews (e.g., daily, weekly) commensurate with the criticality of each system and its information. Also, infrastructure administrators might have access to more sophisticated tools than system-level administrators do because it is cost-prohibitive to have them available for all systems.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Computer Security Log Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector? (Part 88) Control AM-1: | |-------------------------------------------------------------------------------------------------------------------------------| ## 6.1.7 Test Case: PACS-6 | Parent Requirement | (CR-3) Enterprise Domain and Identity Management-Access Control (CR-6) Data Security | |--------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Testable Requirement | (CR-3.b) User Authentication, (CR-3.c) Device and System Authentication, (CR-6.a) In-Transit Encryption | | Description | Show how to securely review archived medical images.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Proceedings of the Cybersecurity for Direct Digital Manufacturing (DDM) Symposium say about Conclusion? According to Proceedings of the Cybersecurity for Direct Digital Manufacturing (DDM) Symposium, Conclusion: High-end AM printers are expensive, highly calibrated machines, increasingly complex, and generally not 'plug-and-play' systems. With respect to the system discussed in this presentation, there has been a great deal of ongoing support from the OEM in order to optimize printer operational performance. This type of support requires remote connectivity to the system. When the manufacturer is a foreign entity, this situation compounds security challenges and complicates protocols due to the need to comply with International Traffic in Arms (ITAR) regulations that may prohibit collaborations. At a minimum, many security assessment protocols and mitigation procedures implemented typically for enterprise business systems should be applied or adapted for implementation and operation of DDM systems.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Proceedings of the Cybersecurity for Direct Digital Manufacturing (DDM) Symposium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management provide? (Section 253) Y The organization establishes and retains unique identification of [Assignment: organization-defined supply chain elements, processes, and actors] for the system, system component, or system service. | | SA-12-z-15-z | SA-12 (15) | (15) SUPPLY CHAIN PROTECTION | PROCESSES TO ADDRESS WEAKNESSES OR DEFICIENCIES The organization establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements. | | SA-18 | SA-18 | SA-18 TAMPER RESISTANCE AND DETECTION Control: The organization implements a tamper protection program for the system, system component, or system service. | | SA-18-z-01-z | SA-18 (1) | (1) TAMPER RESISTANCE AND DETECTION | MULTIPLE PHASES OF SDLC The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including design, development, integration, operations, and maintenance. | | SA-18-z-02-z | SA-18 (2) | (2) TAMPER RESISTANCE AND DETECTION | INSPECTION OF SYSTEMS, COMPONENTS, OR DEVICES The organization inspects [Assignment: organization-defined systems, system components, or devices] [Selection (one or more): at random; at [Assignment: organization-defined frequency], upon [Assignment: organization-defined indications of need for inspection]] to detect tampering. | | SA-19-a | SA-19 | SA-19 COMPONENT AUTHENTICITY Control: The organization: a.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain https://doi.org/10.6028/NIST.SP.800-88r1 according to NIST Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide, https://doi.org/10.6028/NIST.SP.800-88r1 - [SP\_800-171] Ross RS, Pillitteri VY, Dempsey KL, Riddle M, Guissanie G (2020) Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-171, Rev. 2, Includes updates as of January 28, 2021. https://doi.org/10.6028/NIST.SP.800-171r2

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Small Business Information Security_ The Fundamentals provide? (Section 40) owing your policies. Train employees on the following: - What they are allowed to use business computers and mobile devices for, such as if they are allowed to use them to check their personal email. - How they are expected to treat customer or business information, for example whether or not they can take that information home with them. - What to do in case of an emergency or security incident (see Section 3.4). - Basic practices as contained in Section 4 of this document. You may be able to obtain training from various organizations, such as your local Small Business Development Center (SBDC), SCORE Chapter, community college, technical college, or commercial training vendors. In addition, the Small Business Administration (SBA) and Federal Trade Commission (FTC) produce videos and topic-specific tips and information which can be used for training [SBA LC] [FTC]. Continually reinforce the training in everyday conversations or meetings. Monthly or quarterly training, meetings, or newsletters on a specific subject can help reinforce the importance of security and develop a culture of security in your employees and in your business. The activities under the Detect Function enable timely discovery of information security or cybersecurity events. Malware (short for Malicious Software or Malicious Code) is computer code written to steal or harm 10 . It includes viruses, spyware, and ransomware. Sometimes malware only uses up computing resources (e.g. memory), but other times it can record your actions or send your personal and sensitive information to cyber criminals. Install, use, and regularly update anti-virus and anti-spyware software on every device used in your business (including computers, smart phones, and tablets). It may be useful to set the anti-virus and anti-spyware software to automatically check for updates at least daily (or in 'real-time', if available), and then set it to run a complete scan soon afterwards.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Small Business Information Security_ The Fundamentals.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Security and Privacy Controls for Information Systems and Organizations? Discussion: Trusted sources include software and data from write-once, read-only media or

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices provide? (Section 551) 31, 1974; amended by Public Law 94-183, Sec. 2(2), Dec. 31, 1975, 89 Stat. 1057; Debt Collection Act of 1982, Public Law 97-365, Sec. 2, Oct. 25, 1982, 96 Stat. 1749; Congressional Reports Elimination Act of 1982, Public Law 97-375, Title II, Sec. 201(a), (b), Dec. 21, 1982, 96 Stat. 1821; Public Law 97-452, Sec. 2(a)(1), Jan. 12, 1983, 96 Stat. 2478; Central Intelligence Agency Information Act, Public Law 98- 477, Sec. 2(c), Oct. 15, 1984, 98 Stat. 2211; National Archives and Records Administration Act of 1984, Public Law 98-497, Title I, Sec. 107(g), Oct. 19, 1984, 98 Stat. 2292; Computer Matching and Privacy Protection Act of 1988, Public Law 100-503, Sec. 2-6(a), 7, 8, Oct. 18, 1988, 102 Stat. 2507- 2514; Omnibus Budget Reconciliation Act of 1990, Public Law 101-508, Title VII, Sec. 7201(b)(1), Nov. 5, 1990, 104 Stat. 1388-334; Omnibus Budget Reconciliation Act of 1993, Public Law 103-66, Title XIII, Sec. 13581(c), Aug. 10, 1993, 107 Stat. 611; Personal Responsibility and Work Opportunity Recon-ciliation Act of 1996, Public Law 104-193, Title I, Sec. 110(w), Aug. 22, 1996, 110 Stat. 2175; Social Security- Medicare and Medicaid Coverage Data Bank Repeal, Public Law 104- 226, Sec. 1(b) (3), Oct. 2, 1996, 110 Stat. 3033; General Accounting Office Act of 1996, Public Law 104-316, Title I, Sec. 115(g)(2)(B), Oct. 19, 1996, 110 Stat. 3835; Taxpayer Re-lief Act of 1997, Public Law 105-34, Title X, Sec. 1026(b) (2), Aug. 5, 1997, 111 Stat. 925; Federal Reports Elimina- tion Act, Public Law 105-362, Title XIII, Sec. 1301(d), Nov. 10, 1998, 112 Stat. 3293; Tax Relief Extension Act of 1999, Public Law 106-170, Title IV, Sec. 402(a)(2), Dec. 17, 1999, 113 Stat.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation say about Appendix G References? (Part 2) According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, Appendix G References: lable: https://arstechnica.com/information-technology/2010/11/how-china- swallowed-15-of-net-traffic-for-18-minutes/. | | [NANOG69] | M. Adalier, K. Sriram, O. Borchert, K. Lee, and D. Montgomery, 'High Performance BGP Security: Algorithms and Architectures,' North American Network Operators Group (NANOG69) , February 2017. Available: | | [NIST BGP-SRx] | BGP Secure Routing Extension (BGP SRx) Prototype , National Institute of Standards and Technology, [website]. Available: secure-routing-extension-bgp-srx-prototype. | | [NIST SP 800-130] | E. Barker, M. Smid, D. Branstad, and S. Chokhani, A Framework for Designing Cryptographic Key Management Systems , NIST SP 800-130, National Institute of Standards and Technology, August 2013. Available: | | [NIST SP 800-152] | E. Barker, M. Smid, and D. Branstad, A Profile for U.S. Federal Cryptographic Key Management Systems, NIST SP 800-152, National Institute of Standards and Technology, October 2015. Available: | |-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [NIST SP 800-160] | Systems Security Engineering: An Integrated Approach to Building Trustworthy Resilient Systems , NIST SP 800-160 Second Public Draft, National Institute of Standards and Technology, November 2016. Available: https://doi.org/10.6028/NIST.SP.800-160 | | [NIST SP 800-30] | Guide for Conducting Risk Assessments , NIST SP 800-30 Revision 1, National Institute of Standards and Technology, September 2012.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 653) PROTECTION | IDENTITY AND TRACEABILITY [Withdrawn: Moved to SR-4(1) and SR-4(2).] (15) SUPPLY CHAIN PROTECTION | PROCESSES TO ADDRESS WEAKNESSES OR DEFICIENCIES [Withdrawn: Incorporated into SR-3.] SA-13 TRUSTWORTHINESS [Withdrawn: Incorporated into SA-8.] CHAPTER THREE PAGE 280 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974 provide? (Section 137) erefore, to take a doomsday approach and claim that security is impossible to attain is as short sighted as to ignore the very real problems of network vulnerability. Good security is possible, today. But there are some very important conditions, most of them uivolving human and sociological issues, not technical ones. The custodians of data banks and the owners of data, as well as users and subjects, should have a large voice in determining what safeguards are present. This session, and the previous one last November addressed the question of legislation. As a concerned professional and private citizen, I welcome legislation in this area. Dr. Willis Ware's report to the Secretary. Health, Education and W^elfare presented a reasoned exposition of legislative needs. Beyond this step, I believe there are two very important actions that need to be addressed by you, me and other concerned people on a national basis. If action is started now, we should go a long way toward insuring that systems are designed with security in mind and that they are capable of safeguardmg individual and corporate rights of confidentiality that are so urgently needed. Specifications for RFP's -To date, very few Requests for Proposal have included definitive requirements for security and integrity. Certainly, if we as users don't care about the subject, it becomes very difficult for the manufacturers to include it in the design of their systems. If we do care about the subject, it is about time we put our money where our mouth is. Therefore, in a spirit of User's Lib, I am presenting an outline of a model set of specifications for requesting secure computer services or systems: Management and Operating Guidelines -Every data processing/data communications environment is sufficiently different in scope, breath, purpose and size so as to make rigid rules of security very difficult to enforce. However, there are sufficient guidelines and practices that have stood the test of time.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Federal and Commercial Information Security Needs provide? (Section 32) wnership within their computer systems. In addition, the ability to list group membership before granting access privileges to that group was considered by some as a necessary part of this capability. The most common approach to implementing DAC is through access control lists (ACLs) . The TCSEC encouraged ACLs as appropriate for usercontrolled access rights. However, when centrally administered, ACLs can become clumsy and difficult to maintain. In centrally administrating DAC, the system administrator assumes responsibility for ownership of all resources, determining what resources and modes of access are needed for the performance of each user's function within the organization. For each new user or every change in responsibility, the central administrator establishes the appropriate access rights within the system. Additionally, when a person leaves the organization, the central administrator deletes the person from all ACLs within the system. Many of the organizations felt ACLs were difficult for the central control and management of access rights. Many organizations preferred a centrally administered, non-discretionary set of controls to meet their security policies and objectives. During the course of this study, organizational policies and objectives have included maintaining and enforcing the rules and ethics associated with a judge's chambers, and the laws and respect for privacy of diagnosing ailments, treating of disease, and administering of medicine within a VA hospital. To support such policies, a capability to centrally control and maintain access rights is needed. The security administrator is responsible for enforcing policy and represents the organization as the "owner" of system objects. Access control decisions were found to be based on the roles individual users take on as part of an organization. This includes the specification of duties, responsibilities, obligations, and qualifications.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Assessing Federal and Commercial Information Security Needs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Related Controls according to NIST_SP_800-53r5_Security_Privacy_Controls? Related Controls: AC-20, CA-5, CA-6, CA-7, PM-9, RA-5, RA-10, SA-11, SC-38, SI-3, SI-12, SR-2, SR-


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case say about Installation Instructions and Configurations? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case, Installation Instructions and Configurations: Details of the solution implemented: | Name | Version | Hardware Details | |--------------------|-----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Graylog Enterprise | 2.4.6 | Hyper-V Virtual Machine (Generation 1): • Processors: 2 virtual cores • Memory: 6 GB • Disk space: 400 GB Total (i) Root volume as allocated by the Virtual Appliance file provided by the vendor. (ii) 350+ GB Data volume for log storage • Network: 1 network adapter • OS: Ubuntu 14 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Recovering from Ransomware and Other Destructive Events say about Executive Summary? According to Data Integrity_ Recovering from Ransomware and Other Destructive Events, Executive Summary: -  Data integrity attacks have compromised corporate information including emails, employee records, financial records, and customer data. -  Destructive malware, ransomware, malicious insider activity, and even honest mistakes all set the stage for why organizations need to quickly recover from an event that alters or destroys data. Businesses must be confident that recovered data is accurate and safe. -  The National Cybersecurity Center of Excellence (NCCoE) at NIST built a laboratory environment to explore methods to effectively recover from a data corruption event in various Information Technology (IT) enterprise environments. NCCoE also explored auditing and reporting IT system use issues to support incident recovery and investigations. -  This NIST Cybersecurity Practice Guide demonstrates how organizations can develop and implement appropriate actions following a detected cybersecurity event. The solutions outlined in this guide encourage monitoring and detecting data corruption in commodity componentsas well as custom applications and data composed of open-source and commercially available components. -  Thorough quantitative and qualitative data collection is important to organizations of all types and sizes. It can impact all aspects of a business including decision making, transactions, research, performance, and profitability, to name a few.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations say about DISCUSSION? According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, DISCUSSION: Organizations test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, and simulations. Incident response testing can include a determination of the effects of incident response on organizational operations, organizational assets, and individuals. Qualitative and quantitative data can help determine the effectiveness of incident response processes.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Data Confidentiality_ Identifying and Protecting Assets Against Data Breaches provide? (Section 113) entify the products that will best integrate with your existing tools and IT system infrastructure. We hope that you will seek products that are congruent with applicable standards and best practices. Section 3.6 Technologies, lists the products that we used and maps them to the cybersecurity controls provided by this reference solution. A NIST Cybersecurity Practice Guide does not describe 'the' solution but a possible solution. Comments, suggestions, and success stories will improve subsequent versions of this guide. Please contribute your thoughts to ds-nccoe@nist.gov . The NCCoE built a hybrid virtual-physical laboratory environment to explore methods to effectively identify sensitive data and protect against a loss of data confidentiality in various Information Technology (IT) enterprise environments. This work also highlights standards and technologies that are useful for a variety of organizations defending against this threat. The servers in the virtual environment were built to the hardware specifications of their specific software components. The NCCoE worked with members of the Data Confidentiality Community of Interest to develop a diverse (but non-comprehensive) set of security scenarios against which to test the reference implementation. These are detailed in Volume B, Section 5.2. The following table presents typographic conventions used in this volume.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Confidentiality_ Identifying and Protecting Assets Against Data Breaches.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio provide? (Section 53) -level measures 9 have been standardized, like the estimated likelihood and impact of a particular vulnerability being exploited. However, for many aspects of ICT risk, there are no standard measures. Without consistent measures, there is little basis for analyzing risk or expressing risk in comparable ways across digital assets and the systems composed of those assets. 9 NIST typically uses the term 'measures' instead of 'metrics.' For more information on the distinction, see https://www.nist.gov/itl/ssd/software-quality-group/metrics-and-measures . Risk analysis for ICT tends to be inconsistent compared to many other forms of risk. Even where guidance is provided, such as in NIST publications, the resulting risk assessment reports from agencies differ significantly. Moreover, foundational inputs for likelihood and impact calculations generally lack a standardized methodology or are at the discretion of vendors who provide a scoring system. Decisions are often made based on an individual's instinct, experience, and knowledge of conventional wisdom and typical practices. In addition, there is usually little analysis performed after controls are deployed to determine whether risks have been reduced to a level deemed acceptable (i.e., within the established risk tolerance parameters). The management of ICT risk is conducted in different ways at various levels, including at the system, organization, and enterprise levels. A common practice is for individual system-level teams to be responsible for tracking relevant risks. While system reporting to the organizational level may occur, there is typically no mechanism in place to consolidate the risk data for systems to the organization level, much less to the enterprise level. When organization or enterprise managers receive system risk data, it is often a vague risk map or at such a volume as to be impractical.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Common Biometric Exchange Formats Framework (CBEFF) provide? (Section 20) ag-Length-Value An application that transforms a CBEFF Basic Data Structure from one Patron Format into another Patron Format. This can include processing of the content of the BDB, but need not. CBEFF defines rules for migrating the values in Standard Biometric Header fields. CBEFF provides the required information to uniquely identify the format and the originator of every biometric data substructure within a CBEFF-compliant structure. The combination of Format Owner, Format Type, Creator and the PID fields described in Clause 5.2.1 meets this objective. CBEFF provides the capability for CBEFF-compliant data structures to be either Basic or Nested. In order to achieve this, CBEFF describes a nested data structure that can be made as complex as the originator of the biometric data structure requires. An example of a nested structure is given in Clause 5.3 . A nested structure could represent biometric data from the same biometric type (e.g., two finger templates) or different biometric data types (e.g., a finger template and a face template) while each substructure would uniquely identify the Format Owner/Format Type, the Creator and PID of each specific biometric data structure. A standard biometric format that may be embedded in a CBEFF data structure is identified by the Format Owner. Upon request by this organization the CBEFF registration Authority, the International Biometric Industry Association (IBIA) in consultation with the CBEFF Technical Development Team, will assign a Format Owner value that will identify that biometric data format. IBIA provides these values to standards organizations free of charge. It is expected that the data conforming to the biometric data format specified in that standard will be used in the CBEFF Biometric Data Block (BDB). Non-standard (proprietary) formats also need a Format Owner to be used within a CBEFF structure.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Biometric Exchange Formats Framework (CBEFF).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Considerations for Identity Management in Public Safety Mobile Networks provide? (Section 106) o generate an authentication vector (AUTN). To compute an AUTN, the HSS/AuC needs to choose a random nonce (RAND), the secret key K , and a Sequence Number (SQN) as inputs to a cryptographic function. This function produces two cryptographic parameters used in the derivation of future cryptographic keys, alongside the expected result (XRES) and authentication token (AUTN). This authentication vector is passed back to the MME for storage. In addition, the MME provides the AUTN and RAND to the UE, which is then passed to the USIM application. The USIM sends AUTN, RAND, the secret key K , and its SQN through the same cryptographic function used by the HSS/AuC. The result is labeled as RES, which is sent back to the MME. If the XRES value is equal to the RES value, authentication is successful and the UE is granted access to the network. 15 Informally known as a 'SIM card.' 16 Temporary identifiers are useful to protect users from entities maliciously eavesdropping to traffic passing over the air interface. These temporary identifiers prevent eavesdroppers from learning the permanent identity (i.e., IMSI) associated with a cellular subscriber, preventing user's mobile device from being uniquely identified. Temporary identifiers do not defend against false basestation attacks. The following diagram provides shows the LTE AKA authentication process. <!-- image --> The authentication provided by LTE authenticates the UICC to the network. The capabilities of LTE do not support public safety's need for user authentication as neither the user nor the UE are authenticated. To support user authentication, additions to the LTE family of standards or a separate authentication framework built on top of LTE would be required. The following provides additional context around the identifiers provided by LTE and their applicability to public safety.

Explanation: NIST publication on credential and access management. Topics: authentication, identity management, token. Contains security framework guidance for authentication systems. Source: Considerations for Identity Management in Public Safety Mobile Networks.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.7 Chaining Blocks according to NIST Blockchain Technology Overview According to Blockchain Technology Overview, 3.7 Chaining Blocks: Blocks are chained together through each block containing the hash digest of the previous block's header, thus forming the blockchain . If a previously published block were changed, it would have a different hash. This in turn would cause all subsequent blocks to also have different hashes since they include the hash of the previous block. This makes it possible to easily detect and reject altered blocks. Figure 3 shows a generic chain of blocks. Figure 3: Generic Chain of Blocks <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain Technology Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Enhancement Supplemental Guidance according to Contingency Planning Guide for Federal Information Systems? Enhancement Supplemental Guidance: Examples of related plans include Business Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan, Crisis Communications Plan, Critical Infrastructure Plan, Cyber Incident Response Plan, and Occupant Emergency Plan.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Contingency Planning Guide for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is References according to Security and Privacy Controls for Information Systems and Organizations? References: [SP 800-160-1], [SP 800-160-2].


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management provide? (Section 104) Communications <!-- image --> Once these expectations have been defined and communicated, practitioners can use various methods to ensure that risk is managed to stay within the limits articulated. They do this by identifying potential risks (as described in Section 2.2), estimating the probability that an impactful event will occur, calculating the potential harm to the enterprise after such an event, and analyzing the actual risk exposure (the product of likelihood and impact). Industry practitioners have demonstrated that applying risk analysis techniques like those described in Section 2.3 can be helpful for identifying, responding to, and monitoring enterprise cybersecurity risk. While statistical analysis has been available for hundreds of years, many within the CSRM community have only recently recognized the value of applying a more quantitative approach to risk estimation. It seems likely that those in the CSRM domain will continue to develop and improve statistical methods to estimate risk and include guidance regarding the application of various statistical distribution models. Responses to previous requests for information have indicated that enterprise risk managers desire increased rigor in the manner in which risk identification, analysis, and reporting are performed. This publication is designed to provide guidance and to further conversations regarding ways to improve CSRM and the coordination of CSRM with ERM. Subsequent publications in this series will describe improvements to the manner in which risk scenarios are prioritized, treated, and reported. Through the NISTIR 8286 series publications, NIST will continue to collaborate with public- and private-sector communities to address methods for improving the integration and coordination of ERM and CSRM. - [1] Stine K, Quinn S, Witte G, Gardner RK (2020) Integrating Cybersecurity and Enterprise Risk Management (ERM).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Connectivity and Retrieval according to Cell Phone Forensic Tools_ an Overview and Analysis Update? Connectivity and Retrieval: The password-protected device contents were successfully acquired with or without the SIM present. Basic subscriber information (i.e. IMEI) was found and reported. Memory size is not reported. (Meet)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived Personal Identity Verification (PIV) Credentials provide? (Section 17) Datacard.........................................................................................................23 | Entrust Datacard.........................................................................................................23 | | 3.6.2 | Intel Authenticate.......................................................................................................24 | Intel Authenticate.......................................................................................................24 | | 3.6.3 | Intercede.....................................................................................................................24 | Intercede.....................................................................................................................24 | | 3.6.4 | MobileIron ..................................................................................................................25 | MobileIron ..................................................................................................................25 | | 3.6.5 | Verizon Shared Service Provider.................................................................................25 | Verizon Shared Service Provider.................................................................................25 | | 3.6.6 | Mobile Endpoints........................................................................................................26 | Mobile Endpoints........................................................................................................26 | | 3.6.7 | Technology Mapping...................................................................................................26 | Technology Mapping...................................................................................................26 | | 5.2.1 | Managed | Architecture Build Testing ..........................................................................35 | | | 5.2.1.1 | Initial Issuance ............................................................................................35 | | | 5.2.1.2 | Maintenance...............................................................................................42 | | | 5.2.1.3 | Termination ................................................................................................42 | | | 5.2.1.4 | Derived PIV Authentication Certificate Management................................43 | | 5.2.2 | Hybrid Architecture Build Testing...............................................................................44 | Hybrid Architecture Build Testing...............................................................................44 | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | | 5.2.2.1 | Initial Issuance ............................................................................................44 | |-------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | 5.2.2.2 | Maintenance............................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 769) services. Ultimately cybersecurity, as applied to the information exchange standards, should be described as profiles of technologies and procedures which can include both “power system” methods (e.g. redundant equipment, analysis of power system data, and validation of power system states) and information technology (IT) methods (e.g., encryption, role-based access control, and intrusion detection). There also can be a relationship between certain communication standards and correlated cybersecurity technologies. For instance, if Transmission Control Protocol (TCP)/Internet Protocol (IP) is being used at the transport layer and if authentication, data integrity, and/or confidentiality are important, then transport layer security (TLS) should be used. In the following discussions of information exchange standard being reviewed, these caveats should be taken into account. 9.3.2 Correlation of Cybersecurity Requirements with Physical Security Requirements Correlating cybersecurity requirements with specific physical security requirements is very complex since they generally address very different aspects of a system. Although both cyber and physical security requirements seek to prevent or deter deliberate or inadvertent adversaries from accessing a protected facility, resource, or information, physical security solutions and procedures are vastly different from cybersecurity solutions and procedures, and involve very different expertise. Each may be used to help protect the other, while compromises of one can definitely compromise the other. Physical and environmental security that encompasses protection of physical assets from damage is addressed by this document only at a high level. Therefore, assessments of standards that cover these non-cyber issues must necessarily also be at a general level.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SA-14 in Criticality Analysis Process Model_ Prioritizing Systems and Components? (Part 80) Control SA-14: | |---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Inputs | Listing of components and subcomponents matched to workflow paths from D.3; Function Diagram with Workflow Paths | | Outputs | Description of operating states to pass to D.5.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Criticality Analysis Process Model_ Prioritizing Systems and Components.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cell Phone Forensic Tools_ an Overview and Analysis say about Scenarios? (Part 7) According to Cell Phone Forensic Tools_ an Overview and Analysis, Scenarios: s of the device, find and display selected filenames and file contents. • Expect that text, images, and other information contained in the compressed archive formatted files can be found and reported. | | Scenario | Description | |-------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Misnamed Files | Determine whether the tool can recognize file types by header information instead of file extension, and find common text and graphics formatted files that have been misnamed with a misleading extension. • Load the device (via email and device synchronization protocols) with various types of common text (e.g., . txt ) and graphics files (e.g., . bmp , . jpg , . gif , and .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Validity according to NIST Test Personal Identity Verification (PIV) Cards Version 2? Validity: Not Before: Sep 25 23:18:12 2007 GMT, Not After: Sep 25 23:18:12 2010 GMT

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector say about 2.3.1.1 Create PKI Certificate for Hyland Acuo VNA? According to Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector, 2.3.1.1 Create PKI Certificate for Hyland Acuo VNA: 1. Use the DigiCert Certificate Utility for Windows to generate a certificate signing request (CSR) for Hyland Acuo VNA. Information needed for requesting the certificate for Hyland Acuo VAN is below: 2.  Common Name: Hyland-VNA.pacs.hclab 3.  Subject Alternative Name: Hyland-VNA.pacs.hclab 4.  Organization: NIST 5.  Department: NCCoE 6.  City: Rockville 7.  State: Maryland 8.  Country: USA 9.  Key Size: 2048 2. Submit the created CSR to DigiCert portal for certificate signing. 3. Download and save the signed certificate along with its root certificate authority (CA) certificate in the .pem file format. 4. Import the saved certificate to DigiCert Certificate Utility for Windows, then export the certificate with its private key in the .pfx format. 5. The certificate is ready for installation.

Explanation: NIST publication on credential and access management. Topics: pki, certificate authority. Contains security framework guidance for authentication systems. Source: Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms? https: //doi.org/10.6028/NIST.SP.800-38A

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Securing Web Transactions_ TLS Server Certificate Management? (Part 449) Control HA-1: TPP. 2. Certificate: These objects hold configuration data for certificates managed by Venafi TPP, including certificate authority (CA), key length, certificate owner, approver, and other information. A certificate object can have one or more applications objects-each indicating a location where the certificate is installed. 3. Device: These objects hold configuration information about the systems where certificates are deployed, including the network address and port, authentication credentials, and other information for the system. 4. Application: These objects hold information about the specific application (e.g., Apache, F5, Java, etc.) that uses a certificate on a device. Each device may have one or more applications that use certificates. The attributes and information stored in an application object depends on the type of application. For example, an F5 application object stores information such as the SSL profile, virtual server, and partition for the associated certificate on the F5 device. 5. Workflow: Workflow objects store the rules that are enforced for workflow gates within Venafi TPP. They include the stage of the certificate lifecycle where approval is needed, the required approvers, and even actions that may be automatically perform when the workflow gate is triggered. 6. CA Template: These objects store information about CAs from which Venafi TPP requests certificates and the specific certificate templates that the CAs will use. 7. Credential: These objects hold credential information that Venafi TPP uses to authenticate to other systems, including CAs, systems where certificates are managed via agentless management, etc. Passwords and private keys used in credentials are stored in encrypted form in the Venafi TPP database. ## C.2 Certificate Metadata in Venafi TPP Certificates are stored in Venafi TPP in binary form (i.e., the DER encoded version of the certificate).

Explanation: NIST publication on credential and access management. Topics: authentication, certificate authority, sso. Contains security framework guidance for authentication systems. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is The current official CCE list is available at http according to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2? The current official CCE list is available at http: //cce.mitre.org/lists/cce\_list.html and new CCEs can be requested from the CCE Content Team. Submitters should review the information provided at

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Domain Name System (DNS) Deployment Guide say about 9.8 Additional Protection Measures for DNS Query/Response? (Part 2) According to Secure Domain Name System (DNS) Deployment Guide, 9.8 Additional Protection Measures for DNS Query/Response: emented for protecting zone transfer and dynamic update transactions). Alternatively, the enterprise can provide this capability through other network security mechanisms, such as IP Security (IPsec). Guidance on how to set up IPsec protected connections between clients and a recursive caching server is beyond the scope of this document. Whatever mechanism is used for channel security of the last hop (resolving name server to stub resolver), this capability should be present in DNSSEC-aware nonvalidating stub resolvers as well, in addition to non-DNSSEC aware stub resolvers. A DNSSEC-aware nonvalidating stub resolver can leverage this trusted path to examine the setting of the AD bit in the message header of a response message it receives. These types of stub resolvers can then use this flag bit as a hint to find out whether the resolving name server was able to successfully validate the signatures for all of the data in the Answer and Authority sections of the response. In some situations, establishing a trusted path between stub resolvers and the resolving name servers that provide DNS service for them is not feasible. An example is where the resolving name server is not under the administrative domain of the enterprise but is run by an ISP. In this situation, the end-to-end protection for DNS query/response can be ensured only by having a DNSSEC-aware stub resolver or a stub resolver that can use message authentication (TSIG or SIG(0)) to communicate with a trusted caching server. A DNSSEC-aware stub resolver can indicate to the local resolving name server that it wants to perform its own signature validation by setting the checking disabled (CD) bit in its query messages. Or a stub resolver must be manually configured to use a specific resolving name server and use TSIG/SIG(0) to provide message authentication.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Domain Name System (DNS) Deployment Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-14 in Security and Privacy Controls for Information Systems and Organizations? Control CM-14: SIGNED COMPONENTS Control: Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization. Discussion: Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication. Related Controls: CM-7, SC-12, SC-13, SI-7. References: [IR 8062]. CHAPTER THREE PAGE 114 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ 3.6 CONTINGENCY PLANNING Quick link to Contingency Planning Summary Table

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.