You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Section 438) ishes a list of foreign individuals and entities determined to have violated, attempted to violate, conspired to violate, or caused a violation of U.S. sanctions on Syria or Iran pursuant to EO 13608. It also lists foreign persons who have facilitated deceptive transactions for or on behalf of persons subject to U.S. sanctions. Collectively, such individuals and companies are called 'Foreign Sanctions Evaders' or 'FSEs.' Transactions by U.S. persons or within the United States involving FSEs are prohibited. 4. The System for Award Management (SAM) Exclusions: The SAM contains the electronic roster of debarred companies excluded from federal procurement and nonprocurement programs throughout the U.S. Government (unless otherwise noted) and from receiving federal contracts or certain subcontracts and from certain types of federal financial and non-financial assistance and benefits. The SAM system combines data from the Central Contractor Registration, Federal Register, Online Representations and Certification Applications, and the Excluded Parties List System. It also reflects data from the Office of the Inspector General's exclusion list (GSA) (CFR Title 2, Part 180). 5. The List of Foreign Financial Institutions Subject to Correspondent Account PayableThrough Account Sanctions (the 'CAPTA List'): The CAPTA List replaced the list of Foreign Financial Institutions Subject to Part 561. It includes the names of foreign financial institutions subject to sanctions, certain prohibitions, or strict conditions before a U.S. company may do business with them. 6. The Persons Identified as Blocked: Pursuant to 31 CFR 560 and 31 CFR 560.304, property and persons included on this list must be blocked if they are in or come within the possession or control of a U.S. person. 7. The BIS Unverified List: Parties listed on the Unverified List (UVL) are ineligible to receive items subject to the Export Administration Regulations (EAR) by means of a license exception. 8.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Study of Federal Agency Needs for Information Technology Security say about NIST and Non-NIST Participants? According to A Study of Federal Agency Needs for Information Technology Security, NIST and Non-NIST Participants: | Ms. Judy Bloom, U.S. Department of Justice | |-------------------------------------------------------------------------------------| | Mr. Ed Borodkin, National Computer Security Center | | Mr. Richard W. Carr, National Aeronautics Space Administration | | Ms. Dorothea de Zafra, Department of Health & Human Services, Public Health Service | | Mr. Donald Franklin, Department of Veterans Affairs | | Mr. Bill Garvin, Social Security Administration | | Mr. Dennis Gilbert, NIST/CSL | | Ms. Irene Gilbert Perry, NIST/CSL | | Mr. John Haines, Department of the Interior | | Mr. John Ippolito, Comsis | | Ms. Rhonda Joseph, Department of Transportation | | Mr. William G. Logan, Department of Health and Human Services | | Mr. Vic Maconochy, National Computer Security Educators | | Mr. Nick Pantiuk, Grumman Data Systems | | Ms. Sadie Pitcher, Department of Commerce | | Mr. Dennis Steinauer, NIST/CSL |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of Federal Agency Needs for Information Technology Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology provide? (Section 9) | Purpose and Scope ........................................................................................ | 1 | | | 1.2 | Changes from Previous Versions.................................................................... | 1 | | | 1.3 | Publication Structure.......................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Study of OSI Key Management provide? (Section 87) .l macro is defined in the Directory Authentication Framework [ISO 9594-8]. As already mentioned the parameters associated with an algorithm can be referenced using the ASN.l ANY DEFINED BY construct. The following ASN.l definitions appear in a protocol that has to be algorithm independent: ``` Algorithmidentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL} ``` The protocol entity chooses the algorithm by giving the ASN.l variable algorithm the Object Identifier value of tiie selected algorithm. The field parameters contains the parameters associated with the selected algorithm. The ASN.l data type Algorithmidentifier is defined in [ISO 9594-8]. The following gives an illustration of what kind of data that is sent when the ASN.l data type Algorithmidenttiier appears in an application layer protocol identifying DES used in cbc mode: Figure 5.10.1:2 Data sent when DES is used in cbc mode <!-- image --> By separating from the protocol the parameters relevant for a certain algorithm, nothing algorithm specific needs to be defined in the protocol. This gives a security domain the possibility to choose the algorithms it finds appropriate to use. It also gives the security domain the possibility to use a publicly available key management protocol in combination with its own secret cryptographic algorithms. Another advantage is that the user of the protocol is given the possibility to choose another algorithm when the one being used is broken. As already mentioned, the algorithm specific parameters are defined in a security register. Another way to achieve algorithm independence is by using the concept of document types. In order to understand how document types can be used, parts of the FTAM standard [ISO 8571-2] [ISO 8571-4] are studied.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: A Study of OSI Key Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about Interview? According to Assessing Security Requirements for Controlled Unclassified Information, Interview: [SELECT FROM: personnel with responsibilities for defining least privileges; personnel with information security responsibilities; system administrators]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain USE OF AUTOMATION IN THE EXECUTION OF THE RMF according to NIST NIST_SP_800-37r2_Risk_Management_Framework According to NIST_SP_800-37r2_Risk_Management_Framework, USE OF AUTOMATION IN THE EXECUTION OF THE RMF: Organizations should maximize the use of automation , wherever possible, to increase the speed, effectiveness, and efficiency of executing the steps in the Risk Management Framework (RMF). Automation is particularly useful in the assessment and continuous monitoring of controls, the preparation of authorization packages for timely decision-making, and the implementation of ongoing authorization approaches-together facilitating a real-time or near real-time risk-based decision-making process for senior leaders. Organizations have significant flexibility in deciding when, where, and how to use automation or automated support tools for their security and privacy programs. In some situations, automated assessments and monitoring of controls may not be possible or feasible. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, rmf, fips. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DR-1 in Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events? (Part 40) Control DR-1: e information for the resolution of this vulnerability. ## 5.3.5.3 Other Considerations This use case highlights the need for a response-oriented build to collaborate with an identify-oriented build. Identification and resolution of vulnerabilities in custom code are sometimes feasible only through gathering information after the vulnerability has been exploited. This build provides the mechanisms to gather such information, but it is ultimately up to the security team to resolve the vulnerability and learn from the attack. ## 5.3.6 File Modification via Malicious Insider ## 5.3.6.1 Scenario The following scenario was simulated to test the architecture's defense against malicious file and backup modification. A malicious insider is assumed to have stolen administrator-level credentials through non-technical means. The insider, using these credentials, uses remote Windows PowerShell sessions to uniformly modify employee stock information to their benefit across several machines. This attack will also target the enterprise ʼ s backup system to modify all records of the previous stock information. It is expected that the aspects of the build described above will mitigate the ability of the user to target and modify enterprise data and backups. The method of securing administrator credentials will be considered out of scope for this solution. ## 5.3.6.2 Resolution The build has several layers of defense against this use case. The integrity monitoring capability detects changes to files and backups caused by a malicious insider. When forwarded to the logging and reporting capabilities, the build can report on these changes. Irregularities or differences from the normal backup schedule are important indicators of a compromise. When the security team is alerted to a malicious insider, they can use the mitigation and containment capability to disable the insider's access.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings provide? (Section 384) for a formula f is a triple ( C ; t; ‰ ) where C is a set of certifi cates, t , 0 is a time instance and ‰ is an evaluation. We give the semantics of a formula f over an interpretation ( C ; t; ‰ ) . For any certifi cate C let C:val be the validity time interval of C . For a given set C of certifi cates and time t , let C t = f C 2 Cj t 2 C:val g : C t denotes the set of certs valid at time t and P C t ( Q; ¡ ; -; v ) denotes the PDS constructed from the set of certs C t as described in previous section. We defi ne the satisfi ability relation j = between an interpretation and a FTPL formula as follows: ( C ; t; ‰ ) j = authoriz e ( i; j; d; e ) if the PDS constructed from set of certifi cates C t , P C t can go from confi guration h ‰ ( i ) ; / i to the confi guration h ‰ ( j ) ; / i , with authorization variable v ¶ e , at the end of the computation, when d = 1 i.e. h ‰ ( i ) ; / i ) / h ‰ ( j ) ; / i . If d = 0 the PDS P C t can reach either the above confi guration or the confi guration h ‰ ( j ) ; ¥ i . Note that if the key ‰ ( i ) directly/indirectly issues term ‰ ( j ) with greater delegation and authorization rights than specifi ed by d and e respectively, the authorize predicate still holds true. ( C ; t; ‰ ) j = resolve ( p; q ) if the PDS P C t can go from confi guration corresponding the name p , to the confi guration corresponding the term ‰ ( q ) . <!-- formula-not-decoded --> <!-- formula-not-decoded --> X f is true at an instance of time t iff f is true in the next instance of time t +1 . ( C ;t; ‰ ) j = f U [ t 1 ;t 2 ] g iff 9 t 0 2 [ t + t 1 ; t + t 2 ] such that ( C ;t 0 ; ‰ ) j = g and 8 t 00 : t · t 00 < t 0 ( C ;t 00 ; ‰ ) j = f . f U [ t 1 ;t 2 ] g is true at time t , iff formula f is true from time t to t 0 , where at t 0 , g will be true and t 0 ¡ t should be within bounds of [ t 1 ; t 2 ] .

Explanation: NIST publication on credential and access management. Topics: authorization, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Accuracy, Integrity, and Security in Computerized Vote-Tallying say about 2 . 7 California Attorney General's Report? (Part 3) According to Accuracy, Integrity, and Security in Computerized Vote-Tallying, 2 . 7 California Attorney General's Report: counties with 'sloppy procedures' have failed to test computer equipment as required by the state, according to Robert Naegele, a technical consultant to the state and the Federal Election Commission. Each county must run ' logic and accuracy tests ' of its system before and after the vote count." [13]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Accuracy, Integrity, and Security in Computerized Vote-Tallying.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines for Securing Radio Frequency Identification (RFID) Systems? (Part 114) Control ES-1: unexpected or unintended signal and field cancellation, interference, summation, or resonance. This makes it difficult to accurately predict specific localized field levels from radiated power alone. Some factors that may warrant additional examination of electromagnetic radiation hazards include: - GLYPH<c=31,font=/MCAMJE+Webdings> The use of RFID equipment that has not been certified by the FCC or that has been modified to operate outside of FCC mandated limits 36 (both of which are illegal in the US but may be legal in other countries), and - GLYPH<c=31,font=/MCAMJE+Webdings> Operating RFID equipment in environments in which signal reflections and other electromagnetic effects can focus radiation in unintended ways. 37 ## 4.4.2 Computer Network Attacks RFID technology represents a new attack vector on an enterprise network. Once RFID systems are implemented, a possibility exists that attackers could reach non-RFID and enterprise subsystem computers through a reader, although no such attack is known to have successfully occurred to date. If the system involves wireless handheld readers, then the wireless link between the reader and the networked middleware servers is another point of entry. Once RFID servers are compromised, they can be used to launch attacks on other networked systems. Attack possibilities include the introduction of malware (e.g., a worm or virus) or the exploits of a single adversary compromising one computer at a time. Once additional systems are compromised, all types of adverse consequences to the IT infrastructure are possible, including loss of confidentiality, integrity, and availability. While the risk of network compromise through an RFID interface is considered low, it is possible, especially as the number of RFID reader, middleware, and enterprise applications increases.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, attack vector, malware. Contains technical security guidance that could inform defensive posture. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SA-12 in NIST_SP_800-53r5_Security_Privacy_Controls? Control SA-12: SUPPLY CHAIN PROTECTION [Withdrawn: Incorporated into SR Family.] Control Enhancements: (1) SUPPLY CHAIN PROTECTION | ACQUISITION STRATEGIES / TOOLS / METHODS [Withdrawn: Moved to SR-5.] (2) SUPPLY CHAIN PROTECTION | SUPPLIER REVIEWS [Withdrawn: Moved to SR-6.] (3) SUPPLY CHAIN PROTECTION | TRUSTED SHIPPING AND WAREHOUSING [Withdrawn: Incorporated into SR-3.] (4) SUPPLY CHAIN PROTECTION | DIVERSITY OF SUPPLIERS [Withdrawn: Moved to SR-3(1).] (5) SUPPLY CHAIN PROTECTION | LIMITATION OF HARM [Withdrawn: Moved to SR-3(2).] (6) SUPPLY CHAIN PROTECTION | MINIMIZING PROCUREMENT TIME [Withdrawn: Incorporated into SR-5(1).] (7) SUPPLY CHAIN PROTECTION | ASSESSMENTS PRIOR TO SELECTION / ACCEPTANCE / UPDATE [Withdrawn: Moved to SR-5(2).] (8) SUPPLY CHAIN PROTECTION | USE OF ALL-SOURCE INTELLIGENCE [Withdrawn: Incorporated into RA-3(2).] (9) SUPPLY CHAIN PROTECTION | OPERATIONS SECURITY [Withdrawn: Moved to SR-7.] (10) SUPPLY CHAIN PROTECTION | VALIDATE AS GENUINE AND NOT ALTERED [Withdrawn: Moved to SR-4(3).] (11) SUPPLY CHAIN PROTECTION | PENETRATION TESTING / ANALYSIS OF ELEMENTS, PROCESSES, AND ACTORS [Withdrawn: Moved to SR-6(1).] (12) SUPPLY CHAIN PROTECTION | INTER-ORGANIZATIONAL AGREEMENTS [Withdrawn: Moved to SR-8.] (13) SUPPLY CHAIN PROTECTION | CRITICAL INFORMATION SYSTEM COMPONENTS [Withdrawn: Incorporated into MA-6 and RA-9.] (14) SUPPLY CHAIN PROTECTION | IDENTITY AND TRACEABILITY [Withdrawn: Moved to SR-4(1) and SR-4(2).] (15) SUPPLY CHAIN PROTECTION | PROCESSES TO ADDRESS WEAKNESSES OR DEFICIENCIES [Withdrawn: Incorporated into SR-3.]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Conformance Test for FDDI Medium Access Control (MAC) say about 0) cn a CO D O ·H > 0) a u ·0 0) 3 C ·H 4J C o u? (Part 7) According to A Conformance Test for FDDI Medium Access Control (MAC), 0) cn a CO D O ·H > 0) a u ·0 0) 3 C ·H 4J C o u: Get this value from Tester The operative Target Token Rotation Time. Tester's Requested TTRT. lUT's Requested TTRT. Highest Bidding Value of Tester in Claim Token Process Lowest Bidding Value of Tester in Claim Token process FCS field for the frame transmitted. FCS field for the frame received.

Explanation: NIST publication on credential and access management. Topics: access control, token. Contains security framework guidance for authentication systems. Source: A Conformance Test for FDDI Medium Access Control (MAC).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services provide? (Section 133) | Verify that operational PNT data performance baselines and expected data flows for relevant external PNT information systems, the organization's PNT system, and applications dependent on PNT data are captured, developed, and maintained to detect events. When practical, comply with standards-based solutions for data formatting, message formatting, and message transmission to facilitate interoperability and integration. | DHS CISA 1.d GPS ICD-870 3.1 IEEE 1588 Annex J IETF CMP IMO 1575 D, D.1, D.2 NIST SP 800-53 Rev.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 617) principle of accountability and traceability states that it is possible to trace security-relevant actions (i.e., subject-object interactions) to the entity on whose behalf the action is being taken. The principle of accountability and traceability requires a trustworthy infrastructure that can record details about actions that affect system security (e.g., an audit subsystem). To record the details about actions, the system is able to uniquely identify the entity on whose behalf the action is being carried out and also record the relevant sequence of actions that are carried out. The accountability policy also requires that audit trail itself be protected from unauthorized access and modification. The principle of least privilege assists in tracing the actions to particular entities, as it increases the granularity of accountability. Associating specific actions with system entities, and ultimately with users, and making the audit trail secure against unauthorized access and modifications provide non-repudiation because once an action is recorded, it is not possible to change the audit trail. Another important function that accountability and traceability serves is in the routine and forensic analysis of events associated with the violation of security policy. Analysis of audit logs may provide additional information that may be helpful in determining the path or component that allowed the violation of the security policy and the actions of individuals associated with the violation of the security policy. Related Controls: AC-6, AU-2, AU-3, AU-6, AU-9, AU-10, AU-12, IA-2, IR-4. (23) SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE DEFAULTS Implement the security design principle of secure defaults in [Assignment: organization- defined systems or system components].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.3.3 Identity Management and Access Control (PR.AC) according to NIST Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector According to Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector, 5.3.3 Identity Management and Access Control (PR.AC): To implement identity management and access control, the project team focused on PR.AC-1, PR.AC-4, and PR.AC-7 Subcategories. PR.AC-1 specifies, '[i]dentities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes.' PR.AC-4 specifies, '[a]ccess permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.' PR-AC7 specifies, '[u]sers, devices, and other assets are authenticated commensurate with the risk of the transaction.'

Explanation: NIST publication on credential and access management. Topics: access control, authorization, identity management. Contains security framework guidance for authentication systems. Source: Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Standard Security Label for GOSIP_ an Invitational Workshop say about B. The TMDF "labeling" solution? (Part 2) According to Standard Security Label for GOSIP_ an Invitational Workshop, B. The TMDF "labeling" solution: SCPs within the Domains are of no concern of the TMDF. Each SCP will have its own security policy and these SCP security policies (e.g., MAC policies) may require the traditional sensitivity labels. | | Table I: Types of Security Labels | Table I: Types of Security Labels | |-----------------------|-------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Major Class of Labels | Sub-Labels | Function | | Sensitivity | | Used by the BLFSP Reference Monitor to determine if a subject should have access to an object. | | | hierarchical | Indicate "classification level", e.g. Top Secret. Secret, or Confidential. These labels correspond to the security risk of having the information compromised. | | | non-hierarchical | Indicate "compartments". Compartments are subgroups of a classification level (e.g. artillery, armor, infantry or Army, Navy and Air Force). These labels do NOT exist independently of the classification level. | | Separation | | Used by the TMDF reference monitor to determine if a Domain has possession of a resource. |

Explanation: NIST publication discussing classified information handling. References: secret, top secret. Contains guidance on protecting sensitive government information. Source: Standard Security Label for GOSIP_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition say about 4.1.4 Distinguishing Attacks and Differential Properties? (Part 2) According to Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition, 4.1.4 Distinguishing Attacks and Differential Properties: wing that these components do not behave in an ideal way, and thus potentially undermining these proofs. Table 6 shows the bestknown distinguishing attacks and differential-property analyses. Table 6. Best Known Distinguishing Attacks and Differential Properties for the Finalists and SHA-2 | Algorithm | Target | Rounds | Fraction of Target Analyzed | CF Call | Reference | |------------------------|----------|----------|-------------------------------|-----------|-------------| | Block Cipher | 7/14 | 50% | 2 232 | [43] | BLAKE-256 | | Grøstl-256 Permutation | 9/10 | 90% | 2 368 | | [44] | | Compression Function | 42/42 | 100% | 2 304 | [39] | JH | | Permutation | 24/24 | 100% | 2 1579 | [45] | Keccak | | Permutation | 14/24 | 58% | 2 255.77 | [46] | | | Compression Function | 37/72 | 52% | 2 511.2 | [47] | Skein | | Compression Function | 36/72 | 50% | 2 454 | [48] | | | SHA-2 Hash Function | 46/64 | 72% | 2 46 | | [49] | Note that for BLAKE, Grøstl, and SHA-2, which have both 256- and 512-bit functions, this table applies only to the 256-bit functions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about Confidentiality? According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Confidentiality: The confidentiality impact level associated with the executive information type is associated with executive functions. The effects of loss of confidentiality of policies and guidance during the formative stage can result in attempts by affected entities and other interested parties to influence and/or impede the policy and guidance development process. Premature public release of formative policies and guidance before internal coordination and review can result in unnecessary damage to public confidence in the executive office. These consequences may occur when the release includes unedited internal commentary and discussion. Recommended Confidentiality Impact Level : The provisional confidentiality impact level recommended for executive functions information is low .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PM-5 in Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? (Part 16) Control PM-5: Yikes! router also provides MUD support for MUD-capable IoT devices that emit MUD URLs via DHCP. Future work may be done to support MUD-capable devices that emit MUD URLs via X.509 or LLDP. The Yikes! router receives the MUD URL emitted by the device, retrieves the MUD file associated with that URL, and configures traffic filters (firewall rules) on the router to enforce the communication limitations specified in the MUD file for each device. The Yikes! router requires access to the internet to support secure API access to the Yikes! cloud service. Last, the Yikes! router also provides integrated support for threat signaling by incorporating GCA Quad9 threat agent (see Section 7.2.13) and GCA Quad9 MUD manager (see Section 7.2.14) capabilities. Both the Quad9 threat agent and the Quad9 MUD manager are components of the open-source software Q9Thrt. See Section 7.3.1.3 for a description of Build 2’s threat-signaling architecture and more information on Q9Thrt. 7.2.7 Certificates DigiCert provisioned a Premium Certificate for signing the MUD files. The Premium Certificate supports the key extensions required to sign and CMS structures as required in the MUD specification. Further information about DigiCert’s CertCentral web-based platform, which allows provisioning and managing publicly trusted X.509 certificates, is in Section 6.2.8. 7.2.8 IoT Devices This section describes the IoT devices used in the laboratory implementation. There are two distinct categories of devices: devices that can emit a MUD URL in compliance with the MUD specification, i.e., MUD-capable IoT devices; and devices that are not capable of emitting a MUD URL in compliance with the MUD specification, i.e., non-MUD-capable IoT devices. 7.2.8.1 MUD-Capable IoT Devices The project used several MUD-capable IoT devices: BeagleBone Black (devkit), NXP i.MX 8M (devkit), Raspberry Pi (devkit), and Samsung ARTIK 520 (devkit).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet say about AN-2013 Annex G: Mapping to the NIEM IEPD? (Part 2) According to Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet, AN-2013 Annex G: Mapping to the NIEM IEPD: | N o t e s | Imp. Required | Imp. Support | Supporte d Range | Test Result | E n c . | |---------------------------------------------------|----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------|----------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------| | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | | TX.1 - Tran saction: Required Record Types | 5.1, 5.3.1, Annex G | There may be multiple records in a transaction of each record type other than Type-1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is DEBUG according to Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? DEBUG: :GENERAL::/etc/osmud/create_ip_fw_rule.sh -s lan -d


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identity and Access Management for Electric Utilities say about Enable enrollment? (Part 69) According to Identity and Access Management for Electric Utilities, Enable enrollment: t not have the “access this computer from the network” user right on domain controllers. – Fail  Allow log on locally • Unauthorized accounts must not have the “allow log on locally” user right. – (CCE-25228-8) – Fail  Back up files and directories • Unauthorized accounts must not have the “back up files and directories” user right. – (CCE-25380-7) – Fail  Bypass traverse checking • Unauthorized accounts must not have the “bypass traverse checking” user right. – (CCE-25271-8) – Fail  Change the system time • Unauthorized accounts must not have the “change the system time” user right. – (CCE-24185-1) – Fail T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . .  Change the time zone • Unauthorized accounts must not have the “change the time zone” user right. – (CCE-24632-2) – Fail  Force shutdown from a remote system NIST SP 1800-2C: Identity and Access Management for Electric Utilities 345 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . • Unauthorized accounts must not have the “force shutdown from a remote system” user right. – (CCE-24734-6) – Fail  Increase a process working set • Unauthorized accounts must not have the “increase a process working set” user right. – (CCE-24162-0) – Fail  Load and unload device drivers • Unauthorized accounts must not have the “load and unload device drivers” user right. – (CCE-24779-1) – Fail  Log on as a batch job • Unauthorized accounts must not have the “log on as a batch job” user right. – (CCE-23386-6) – Fail  Restore files and directories • Unauthorized accounts must not have the “restore files and directories” user right.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-4009 in NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3? (Part 21) Control SI-4009: The group exchanges information within and between systems to include security domains.' | | Term | Sources | Security and Privacy Fabric | Comments | |--------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Community risk for privacy | | Add - privacy fabric | 'Probability that a particular vulnerability will be exploited within an interacting population and adversely impact some members of that population.' | | Compartmentalization (see DHHS meaning) | | | 'A nonhierarchical grouping of sensitive information used to control access to data more finely than with hierarchical security classification alone.' | | Compromise - As applied to privacy | | Especially re- identification | 'Disclosure of information to unauthorized persons, or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred.' | | Compromising Emanations (for privacy data) | | | 'Unintentional signals that, if intercepted and analyzed, would disclose the information transmitted, received, handled, or otherwise processed by information systems equipment.' | | CND | | Different for privacy fabric?

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-3(4) in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 8) Control AC-3(4): CCESS CONTROL Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined attributes to assume access permissions]. Discussion: Attribute-based access control is an access control policy that restricts system access to authorized users based on specified organizational attributes (e.g., job function, identity), action attributes (e.g., read, write, delete), environmental attributes (e.g., time of day, location), and resource attributes (e.g., classification of a document). Organizations can create rules based on attributes and the authorizations (i.e., privileges) to perform needed operations on the systems associated with organization-defined attributes and rules. When users are assigned to attributes defined in attribute-based access control policies or rules, they can be provisioned to a system with the appropriate privileges or dynamically granted access to a protected resource. Attribute-based access control can be implemented as either a mandatory or discretionary form of access control. When implemented with mandatory access controls, the requirements in AC-3(3) define the scope of the subjects and objects covered by the policy. Related Controls: None. (14) ACCESS ENFORCEMENT | INDIVIDUAL ACCESS CHAPTER THREE PAGE 27 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV.

Explanation: NIST publication on credential and access management. Topics: access control, authorization, sso. Contains security framework guidance for authentication systems. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TE-1 in Mobile Device Security_ Bring Your Own Device (BYOD)? (Part 27) Control TE-1: ites - phishing protection risky URLs - application forensics - application binaries (Android only) - application inventory (Android only) zIPS also collects some information that cannot be disabled. These items include: - device root/jailbreak status - USB debug mode status (Android only) - developer mode status (Android only) - 3 rd party app store presence (Android only) - mobile OS-specific vulnerability status (e.g., Stagefright) - device encryption status (Android only) - device protection status - screen lock status zIPS must collect certain data items to properly communicate with the zConsole. These items include: - user credentials (email address, Zimperium-specific password) - mobile network operator - mobile network country code - device operating system - device push token - hash of local z9 database - time and name of threat detection when a threat occurs ## 4.7.3 Application Vetting: Kryptowire Kryptowire collects certain pieces of device information through the MaaS360 REST API for analytics and application association purposes. The data collected includes: - MDM device ID - MDM device name - MDM username - last MDM sync date - MDM enrollment data - enterprise and non-app store installed applications ## 4.7.4 VPN: Palo Alto Networks The Palo Alto Networks VPN uses information about the device as it establishes VPN connections.

Explanation: NIST publication on credential and access management. Topics: token, sso. Contains security framework guidance for authentication systems. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 134) m accounts (or roles) with access to [Assignment: organization- defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions. Discussion: Requiring the use of non-privileged accounts when accessing nonsecurity functions limits exposure when operating from within privileged accounts or roles. The inclusion of roles addresses situations where organizations implement access control policies, such as role-based access control, and where a change of role provides the same degree of assurance in the change of access authorizations for the user and the processes acting on behalf of the user as would be provided by a change between a privileged and non- privileged account. Related Controls: AC-17, AC-18, AC-19, PL-4. (3) LEAST PRIVILEGE | NETWORK ACCESS TO PRIVILEGED COMMANDS Authorize network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and document the rationale for such access in the security plan for the system. Discussion: Network access is any access across a network connection in lieu of local access (i.e., user being physically present at the device). Related Controls: AC-17, AC-18, AC-19. (4) LEAST PRIVILEGE | SEPARATE PROCESSING DOMAINS Provide separate processing domains to enable finer-grained allocation of user privileges. Discussion: Providing separate processing domains for finer-grained allocation of user privileges includes using virtualization techniques to permit additional user privileges within a virtual machine while restricting privileges to other virtual machines or to the underlying physical machine, implementing separate physical domains, and employing hardware or software domain separation mechanisms. Related Controls: AC-4, SC-2, SC-3, SC-30, SC-32, SC-39.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to Computer Security Division 2006 Annual Report? http: //csrc.nist.gov/fissea/ Contacts: Mr. Mark Wilson (301) 975-3870 mark.wilson@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2006 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about Determine if:? According to Assessing Security Requirements for Controlled Unclassified Information, Determine if:: A.03.06.02.ODP[01]: the time period to report suspected incidents to the organizational incident response capability is defined . A.03.06.02.ODP[02]: authorities to whom incident information is to be reported are defined . A.03.06.02.a[01]: A.03.06.02.a[02]: system security incidents are tracked. system security incidents are documented. A.03.06.02.b: suspected incidents are reported to the organizational incident response capability within <A.03.06.02.ODP[01]: time period> . A.03.06.02.c: incident information is reported to <A.03.06.02.ODP[02]: authorities> . A.03.06.02.d: an incident response support resource that offers advice and assistance to system users on handling and reporting incidents is provided.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Security Considerations for Voice Over IP Systems? (Part 9) Control HA-1: ress resolution). The user initially reports their location to a registrar, which may be integrated into a proxy or redirect server. This information is in turn stored in the external location server. Messages from endpoints must be routed through either a proxy or redirect server. The proxy server intercepts messages from endpoints or other services, inspects their 'To:' field, contacts the location server to resolve the username into an address and forwards the message along to the appropriate end point or another server. Redirect servers perform the same resolution functionality, but the onus is placed on the end points to perform the actual transmission. That is, Redirect servers obtain the actual address of the destination from the location server and return this information to the original sender, which then must send its message directly to this resolved address (similar to H.323 direct routed calls with gatekeeper). The SIP protocol itself is modeled on the three-way handshake method implemented in TCP (see Figure 6). We will consider the setup here when a proxy server is used to mediate between endpoints. The process is similar with a redirect server, but with the extra step of returning the resolved address to the source endpoint. During the setup process, communication details are negotiated \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ between the endpoints using Session Description Protocol (SDP), which contains fields for the codec used, caller's name, etc. If Bob wishes to place a call to Alice he sends an INVITE request to the proxy server containing SDP info for the session, which is then forwarded to Alice's client by Bob's proxy, possibly via her proxy server. Eventually, assuming Alice wants to talk to Bob, she will send an 'OK' message back containing her call preferences in SDP format. Then Bob will respond with an 'ACK'.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Domain Name System-Based Electronic Mail Security say about 3.2.1 Outlook? According to Domain Name System-Based Electronic Mail Security, 3.2.1 Outlook: To use digital signatures and encryption, both the sender and recipient must have a mail application that supports the S/MIME standard. Outlook supports the S/MIME standard. Instructions for user-driven cryptographic functions vary from version to version and platform to platform. Accessing digital signature on an Outlook Help page usually provides the necessary operator instructions. The example instructions provided here are for Outlook 2016 for Windows 10 and Outlook for Mac 2011.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Attribute Considerations for Access Control Systems provide? (Section 25) e role Job Lead wants to access information in organization B , except organization B uses the term Task Lead to denote the equivalent role. Table 1 shows an example of a subject's attributes. Table 1: Subject attribute example | Subject attribute Name | Attribute Value | Policy Applied a | |--------------------------|-----------------------------------------------------|-----------------------------------------| | Company ID | ID numbers (e.g., Organization A) | Subject and Administrator object access | | Division | Division name (e.g., Software Development Division) | Subject and Administrator object access | | Group | Group name (e.g., Testing group) | Subject and Administrator object access | | Name | Person's name (e.g., Joe Smith) | Subject and Administrator object access | | Authorization | Authorization level (e.g., 1) | Administrator object access | | Role | Role ID (e.g., Job Lead, (or Task lead)) | Administrator object access | | Training ID | Training label (e.g., Minimum Requirement) | Administrator object access | a Policy Applied column lists the type of policy rules which require this attribute for the evaluations of access permission if multiple policies are applied to the access control system. As subject attributes may be provisioned by different authorities (e.g., human resources , security , organization leadership , etc.), methods for obtaining authoritative data must be regulated.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Attribute Considerations for Access Control Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Blockchain Networks_ Token Design and Management Overview provide? (Section 18) tion Submission................................................................................ | Transaction Submission................................................................................ | 29 | | | 4.2.1 | Meta Transactions..............................................................................29 | | | | 4.2.2 | Smart Contract-Based Access Control...............................................30 | | | | 4.2.3 | Blockchain Node Permissioning .........................................................30 | | | 4.3 | Transaction Viewability .................................................................................

Explanation: NIST publication on credential and access management. Topics: access control, token. Contains security framework guidance for authentication systems. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-02(04) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control SI-02(04): automated patch management tools are employed to facilitate ﬂaw remediaon to <SI-02(04)_ODP components>. POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography? (Part 11) Control HA-3: nding authority shall verify the owner's intent to associate a specific identifier chosen for the owner and the public key; the means for accomplishing this is beyond the scope of this Recommendation. The binding authority shall also obtain assurance of the validity of the domain parameters associated with the owner's key pair, the arithmetic validity of the owner's static public key, and the owner's possession of the static private key corresponding to that static public key (see Section 5.5.2, Section 5.6.2.2.1 [method 1], and Section 5.6.2.2.3, respectively.) As an alternative to reliance upon a binding authority, trusted associations between identifiers and static public keys may be established by the direct exchange of this information between entities using a mutually trusted method (e.g., a trusted courier or a face-to-face exchange). In this case, each entity receiving an identifier and the associated static public key shall be responsible for obtaining the same assurances that would have been obtained on their behalf by a binding authority (see the previous paragraph). Entities shall also be responsible for maintaining (by cryptographic or other means) the trusted associations between any identifiers and static public keys received through such exchanges. If an entity engaged in a key-establishment transaction owns a static key pair that is employed during the transaction, then the identifier used to label that party shall be one that has a trusted association with the static public key of that key pair. If an entity engaged in a keyestablishment transaction contributes only an ephemeral public key during the transaction, but an identifier is still desired/required for that party, then a non-null identifier shall be selected/assigned in accordance with the requirements of the protocol relying upon the transaction.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about Availability? According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Availability: The availability impact level is based on the specific mission and the data supporting that mission, not on the time required to re-establish access to social services information. The effects of disruption of access to most social services information or information systems would have, at most, a limited adverse effect on agency operations, agency assets, or individuals. Recommended Availability Impact Level: The provisional availability impact level recommended for social services information is low .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Criticality Analysis Process Model_ Prioritizing Systems and Components say about Process A - Criticality Analysis Procedure Definition? (Part 1) According to Criticality Analysis Process Model_ Prioritizing Systems and Components, Process A - Criticality Analysis Procedure Definition: Process A - Criticality Analysis Procedure Definition The Project Manager reviews the organization's strategic plan, risk management plan, and other documentation and determines that the organization does not have any formal criticality analysis procedures. The Project Manager does not have the authority nor the time and ability to perform a criticality analysis of the entire organization, which would be ideal. However, it is early enough in the ERP project that an analysis can be written into the project plan prior to and concordant with system procurement and implementation. A.1 The Project Manager delegates to an employee with business analysis training, the process of integrating criticality analysis activities into the project plan. The Business Analyst 9 uses the Criticality Analysis Process Model in this publication to determine appropriate tasks, roles, and responsibilities based on Processes B, C, D, and E of the Model. The Project Manager and Business Analyst coordinate with a legal representative to identify laws, regulations, and organizational policies which may impact the project; they discuss with the rest of the project team how the criticality analysis may align with or impact their normal activities and discuss ways to address any concerns they have. The Business Analyst works with the project team to compare the guidance in the Related Processes Outside of Criticality Analysis in each Process and Sub-process description 9 In the context of this document, any role mentioned, such as 'Business Analyst,' is not a specific title but a role of a person engaged in the program. with the organization's existing processes to ensure that security engineering and risk management processes are appropriately integrated and planned for.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Criticality Analysis Process Model_ Prioritizing Systems and Components.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Domain according to Foundations of a Security Policy for Use of the National Research and Educational Network? Domain: A logical structure, group or sphere of influence over which control is exercised.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Foundations of a Security Policy for Use of the National Research and Educational Network.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 7. Characterization and Analysis of Measurement Data according to NIST Manufacturing Profile Implementation Methodology for a Robotic Workcell According to Manufacturing Profile Implementation Methodology for a Robotic Workcell, 7. Characterization and Analysis of Measurement Data: After each tool has been installed or a configuration measurement is performed, the data from the experiment is analyzed to determine if the manufacturing process performance was negatively impacted. This analysis is performed with an approach called exploratory data analysis (EDA), and is described in great detail in the NIST Engineering Statistics Handbook [12]. This analysis process requires the workcell to be characterized for proper comparative analysis to be performed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Manufacturing Profile Implementation Methodology for a Robotic Workcell.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Information Security Handbook_ A Guide for Managers say about 4.5 Managing Change? According to Information Security Handbook_ A Guide for Managers, 4.5 Managing Change: It is necessary to ensure that the program, as structured, continues to evolve as new technology and associated security issues emerge. Training needs will shift as new skills and capabilities become necessary to respond to new architectural and technology changes. A change in the organizational mission and/or objectives can also influence ideas on how best to design training solutions and content. Emerging issues, such as homeland defense, will also impact the nature and extent of security awareness and training activities necessary to keep users informed and/or trained about the latest threats, vulnerabilities, and countermeasures. New laws and court decisions may also impact agency policy that, in turn, may affect the development and/or implementation of awareness and training material. Finally, as security policies evolve, awareness and training material should reflect these changes.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for Access Control System Evaluation Metrics say about 4.2.10 Adaptable to the implementation and evolution of AC policies? (Part 5) According to Guidelines for Access Control System Evaluation Metrics, 4.2.10 Adaptable to the implementation and evolution of AC policies: ed flexible if the security policy can interpose atomically on any operation performed by the system, allowing the operation to proceed, denying the operation, or even injecting operations of its own. In such a system, the access request decision of the security policy relies on the knowledge of the entire current system state, which includes the history of the system. Because it is possible to interpose on all access requests, it is possible to modify the existing security policy and to revoke any previously granted access. The suggested approach for the needed flexibility is to identify the system state that is potentially security relevant and to control operations that affect or are affected by that state. The degree of flexibility in such a system will depend upon the completeness of both the set of controlled operations and the current system state that is available to the security policy, as well as the granularity of the controlled operations. | | | Is the AC system capable of dynamically interposing AC rules based on the system states?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Access Control System Evaluation Metrics.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Analyzing Collusion Threats in the Semiconductor Supply Chain provide? (Section 16) ductor life cycle, and the motivation for the attacks. Other motivations can be analyzed through this methodology as well. The methodology provides a relative risk-based score to help plan mitigation. In the future, NIST plans to extend this work to analyze the supply chain threats related to 3D heterogeneous integration and integrate different hardware vulnerabilities into the framework, which will help the stakeholders to improve their threat mitigation techniques and implement more secure and robust designs. Addressing these hardware and supply chain security issues is essential to safeguard national interests and promote economic stability. - [1] DARPA (2020) DARPA Selects Teams to Increase Security of Semiconductor Supply Chain. Available at - [2] DARPA (2021) Expanding Domestic Manufacturing of Secure, Custom Chips for Defense Needs. Available at https://www.darpa.mil/news-events/2021-03-18 - [3] NSWC Crane Corporate Communications (2019) NSWC Crane leverages OTA to ensure that the U.S. Government has access to secure state-of-the-art design, assembly, packaging and test for state-of-the-art microelectronics. Available at - [4] Institute for Systems Research (2020) AFRL-Northrop Grumman: Locked Electronics for Assured Design (LEAD): Delay Locking ASIC IP Blocks to Protect Functionality. Available at https://isr.umd.edu/research-funding/afrl-northrop-grumman-locked-electronicsassured-design-lead-delay-locking-asic-ip - [5] Wolfe F (2020) Aether Spy Next-Generation Multi-Function Radar to Advance, Northrop Grumman Says. Defense Daily . Available at - [6] CISA (2020) Defining Insider Threats.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Analyzing Collusion Threats in the Semiconductor Supply Chain.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.3.6.3 Other Considerations according to NIST Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events According to Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events, 5.3.6.3 Other Considerations: A significant trade-off between memory and frequency of backups occurs when implementing a secure storage solution for backups. As WORM space may be limited by the number of disks purchased or by a cloud service's limitations, it is important for organizations to consider the cost of storing all backups in secure storage, especially for organizations that frequently take backups to reduce the loss of data.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Section 4) on provides enhanced security requirements to help protect CUI associated with critical programs or high value assets in nonfederal systems and organizations from the advanced persistent threat (APT). The SP 800-172 enhanced security requirements are designed to protect confidentiality, integrity and availability of information. <!-- image --> NIST SP 800-172A, Assessing Enhanced Security Requirements for Controlled Unclassified Information provides assessment procedures and a methodology to conduct assessments of the enhanced security requirements in SP 800-172. Knowing what requirements to implement is important, but it is also important to understand how to evaluate the organization's implementation. Both publications work handin-hand for full implementation. ht ps:/ csrc.nist.gov/projects/protecting-control ed-unclas <!-- image --> ified-information Protecting information from unauthorized modification [SP 800-171] Security Requirement: Security outcomes levied on a nonfederal organization to ensure adequate measures are taken to protect the confidentiality of CUI being processed, stored, or transmitted. <!-- image --> <!-- image --> Important Note: The security requirements in NIST SP 800-171 are only applicable to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components. Protecting information from unauthorized access and disclosure Preventing disruption in how information is accessed <!-- image --> 2 SP 800-171 does not explicitly cover integrity and availability so it is not a comprehensive security program. SP 800-171 security requirements are organized into 17 families, as illustrated in the table below. Each family is further broke n down into requirements related to the family's general security topic (see the example at the bottom of the page).

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Confidentiality according to NIST Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Confidentiality: The confidentiality impact level is the effect of unauthorized disclosure of water resource management information on the ability of responsible agencies to promote the effective use and management of the nation's water resources. The consequences of unauthorized disclosure of most water resource management information would have, at most, a limited adverse effect on agency operations, agency assets, or individuals. Special Factors Affecting Confidentiality Impact Determination : There may be some cases for which moderate confidentiality impact is associated with unauthorized disclosure of business/industry development. For example, unauthorized disclosure of details of current agency water resource management activities and plans may focus opposition and/or give an unfair advantage to competing interests. Consistent premature disclosure of agency plans may cause significant degradation in mission capability. Recommended Confidentiality Impact Level : The provisional confidentiality impact level recommended for water resource management information is low .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain NIST CYBERSECURITY PRACTICE GUIDES according to NIST Securing Property Management Systems According to Securing Property Management Systems, NIST CYBERSECURITY PRACTICE GUIDES: NIST Cybersecurity Practice Guides (Special Publication 1800 series) target specific cybersecurity challenges in the public and private sectors. They are practical, user-friendly guides that facilitate the adoption of standards-based approaches to cybersecurity. They show members of the information security community how to implement example solutions that help them align with relevant standards and best practices, and provide users with the materials lists, configuration files, and other information they need to implement a similar approach. The documents in this series describe example implementations of cybersecurity practices that businesses and other organizations may voluntarily adopt. These documents do not describe regulations or mandatory practices, nor do they carry statutory authority.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Property Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance say about Incident Management? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance, Incident Management: Incident management tools enable a manufacturer to document, track, and coordinate the mitigation of an adverse event in manufacturing system devices or networks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Device Security_ Cloud and Hybrid Builds provide? (Section 23) ich the user and device are authorized Privacy issues can be complex and difficult to implement, particularly since these issues often span a broad range of topics, from law and policy to technology. Although privacy protections are listed within our desired capabilities, these goals are out of scope for this publication and will be addressed in subsequent efforts. In the meantime, organizations may want to follow a more comprehensive privacy engineering effort to satisfy these goals, such as National Institute of Standards and Technology Internal Report 8062, An Introduction to Privacy Engineering and Risk Management in Federal Systems [8]. Finally, the breadth of technologies in this building block was intentionally limited to organizations that have entered into a National Cybersecurity Excellence Partnership (NCEP) with the NCCoE, meaning that only NCEP partners of the NCCoE were allowed to participate in the build phase of this project. We anticipate significantly expanding on the technologies used within the next phase of this MDS project by leveraging Cooperative Research and Development Agreements (CRADAs) with other interested collabor ators. Organizations wishing to participate in future efforts should visit the NCCoE's website for more information about participating. The following assumptions exist for this project: - Both the cloud and hybrid builds are highly dependent on Microsoft's cloud platform, including Microsoft Office 365 and Microsoft Intune.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Cloud and Hybrid Builds.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Key Management Documents say about 9.2. end-sys-addr? According to Secure Data Network Systems (SDNS) Key Management Documents, 9.2. end-sys-addr: This parameter must be included on the request primitive and is passed on the indication primitive. It contains the address of the end system which has no SDNS component and which uses this SDNS component as a gateway.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Subject Key Identifier : according to NIST NIST Test Personal Identity Verification (PIV) Cards Version 2 According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Subject Key Identifier :: B2:BE:E0:D2:D4:99:E4:2E:BC:FC:EF:05:D9:A2:8A:41:8B:4E:10:8B

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance) provide? (Section 79) ference data (PIN) in the command data field of the command does not satisfy the criteria in Section 2.4.3 of Part 2 of SP 800-73-4, then the PIV Card Application shall return the status word '6A 80'. If the reset retry counter authentication data (PUK) in the command data field of the command does not match reference data associated with the PUK and the new reference data (PIN) in the command data field of the command does not satisfy the criteria in Section 2.4.3 of Part 2 of SP 800-73-4, then the PIV Card Application shall return either status word '6A 80' or '63 CX'. If the PIV Card Application returns status word '6A 80', then the retry counter associated with the PIN shall not be reset, the security status of the PIN's key reference shall remain unchanged, and the PUK's retry counter shall remain unchanged. VE05.33.01: The vendor shall state in its documentation that the card supports the assertion made in AS05.33. TE05.33.01: The tester shall review and validate that the vendor's documentation includes the information required in VE05.33.01 and the tester shall also validate that card inplements the RESET RETRY COUNTER card command in a manner consistent with AS05.33 by ensuring the following conditions: - (a) If the new reference data (PIN) in the command data field of the command satisfies the criteria in Section 2.4.3 of Part 2 of SP 800-73-4, but the reset retry counter authentication data (PUK) in the command data field of the command does not match reference data associated with the PUK, then the PIV Card Application returns the status word '63 CX'. - (b) If the reset retry counter authentication data (PUK) in the command data field of the command matches reference data associated with the PUK, but the new reference data (PIN) in the command data field of the command does not satisfy the criteria in Section 2.4.3 of Part 2 of SP 800-73-4, then the PIV Card Application returns the status word '6A 80'.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Government Smart Card Interoperability Specification, Version 2.1? (Part 60) Control HA-1: required to access a value in the container. The required list of authenticators is returned by gscBsiGcGetContainerProperties( ). The calling application is responsible for constructing this object. The BSIAuthenticator class is defined as follows: ``` public class gov.gsc.classes.BSIAuthenticator { //FIELDS: protected int accessMethodType; ``` ``` protected int keyIDOrReference; protected byte[] authValue; //CONSTRUCTORS: public BSIAuthenticator() { accessMethodType = 0; keyIDOrReference = 0; authValue = ''; } public BSIAuthenticator( int int byte[] { accessMethodType = amType; keyIDOrReference = keyIDOrRef; authValue = authVal; } amType, keyIDOrRef, authVal ) //ACCESSORS: public int getAccessMethodType() { return accessMethodType; } public void setAccessMethodType(int type) { accessMethodType = type; } public int getKeyIDOrReference() { return keyIDOrReference; } public void setKeyIDOrReferece(int keyIDOrRef) { keyIDOrReference = keyIDOrRef; } public byte[] getAuthValue() { return authValue; } public void setAuthValue(byte[] auth) { authValue = auth; } } ``` ## The fields of the BSIAuthenticator class are: accessMethodType: Access Method Type (see Table 3-1 in Section 3.1). keyIDOrReference: Key identifier or reference of the authenticator. This is used to distinguish between multiple authenticators with the same Access Method Type. authValue: Authenticator, can be an external authentication cryptogram or PIN. If the authenticator value is NULL, then BSI is in charge of gathering authentication information and authenticating to the card. ## Return codes: BSI\_OK BSI\_BAD\_HANDLE BSI\_BAD\_AID BSI\_ACR\_NOT\_AVAILABLE BSI\_SC\_LOCKED BSI\_BAD\_AUTH BSI\_CARD\_REMOVED BSI\_PIN\_BLOCKED BSI\_TERMINAL\_AUTH BSI\_UNKNOWN\_ERROR ## F.2.2 gscBsiUtilConnect() Purpose: Establish a logical connection with the card inserted in a specified reader. BSI\_TIMEOUT\_ERROR will be returned if a connection cannot be established within a specified time.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Glossary of Computer Security Terminology provide? (Section 180) Printing Office. (NCSC-TG-004-88) | | primary distribution | The initial targeted distribution of or access to technical documents authorized by the controlling DOD office. (DODD 5230.24) | | principle of least privilege | The granting of the minimum access authorization necessary for the performance of required tasks. (FIPS PUB 39; AR 380-380) | | print suppression/ print suppress | To eliminate the printing of characters In order to preserve their secrecy; for example, the characters of a password as it is keyed at the input terminal. (FIPS PUB 39; AR 380-380) | | privacy | 1) The right of an Individual to self-determination as to the degree to which personal information will be shared among other individuals or organizations. This includes the right of individuals and organizations to control the collection, storage, and dissemination of personal or organizational Information. (AR 380-380) | - 2) a. The right of an individual to selfdetermination as to the degree to which the individual Is willing to share with others information about himself that may be compromised by unauthorized exchange of such information among other individuals or organizations. b. The right of individuals and organizations to control the collection, storage, and dissemination of their information or information about themselves.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Glossary of Computer Security Terminology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Considerations for Code Signing provide? (Section 7) tion software signing. Please note that these examples are for illustrative purposes; they neither reflect all instantiations of each use case nor are they comprehensive of all code signing use cases. Secure distribution of firmware is an example of a software supply chain where all aspects of the code signing activity-software development, authorization of the code to be signed, administration of the CSS, and development of the verifier-are typically under the control of a single organization. A typical work flow includes a team of developers who track contributions to the project in a version control system before the code is passed along to a build system. During development, the CSS might sign non-production versions with development or test keys. These signatures would be used in testing but would not be used for verifying code in fielded products. When the code is ready to be shipped, the developers submit it for signing. An authorized approver (or multiple approvers) examine the code per organization policy and submit the code, along with an approval. The CSS inspects the package (code, approvals, and metadata) to determine whether all requirements are met. The package is then signed with a production key. This key can be unique per project. All production keys are centrally held, likely in a hardware security module (HSM). Each corresponding public key is securely installed in the verifier component on the platform for which the firmware is intended. Device drivers are privileged processes that run close to a computer's system kernel, controlling and communicating with hardware components. A typical personal computer will have several hardware devices with associated drivers. While drivers are typically developed by the associated hardware vendor, all other aspects of the code signing activity are still typically controlled by a central authority.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Security Considerations for Code Signing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SR-1 in Attribute-based Access Control for Microservices-based Applications using a Service Mesh? (Part 11) Control SR-1: rd to revoke a user's access once a JWT is issued. Community standards, such as Internet Engineering Task Force (IETF) Request for Comments (RFC) for OAuth2 Introspection, can be used to address this. An example of an authorization policy that will enable the sidecar itself to make an access control decision based on claims in the JWT and enforce it, without calling on an external authorization system, is given below: apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: backend namespace: product spec: action: ALLOW rules: - from: - source: principals: ["cluster.local/ns/product/sa/frontend"] to: - operation: methods: ["GET"] paths: ["/info*"] - operation: methods: ["POST"] paths: ["/data"] when: - key: request.auth.claims[iss] values: ["accounts.google.com"] Figure 4.1 - An example Istio authorization policy This allows the front end to call specific methods on the backend only if the request has an EUC attached issued by 'accounts.google.com.' EUAZ-SR-3 : All application traffic should carry end user credentials, and there should be a policy in the mesh enforcing that credentials are present. This is recommended even if the application is enforcing authentication and authorization independently of the mesh because these organization-wide controls allow functionalities like audit to be built on top of the mesh at a lower cost to central teams responsible for compliance and controls. ## 4.5.3 Model-based Authorization Policies The service-level authorization policies and a use case of end-user authorization policies that uses JWT are natively implemented in the proxies. Since these cannot be used for resourcelevel authorization policies, support for model-based authorization policies is needed as well. As already alluded to in Section 4.5.2, this requires a call from the proxy to an external authorization server, which holds the model-based authorization engine to obtain an access decision.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Attribute-based Access Control for Microservices-based Applications using a Service Mesh.