You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security of SQL-Based Implementations of Product Data Exchange Using STEP say about 4.2 Mandatory Access Control Policy for Confidentiality? According to Security of SQL-Based Implementations of Product Data Exchange Using STEP, 4.2 Mandatory Access Control Policy for Confidentiality: The majority of mandatory access control (MAC) models specify a security policy for the enforcement of a level and category-based mandatory security policy. In such a policy, each object has two security attributes: a security level (such as SECRET or SENSITIVE) and an optional set of categories. Categories specify 'need-to-know' areas, with the level specifying minimum clearance requirements. These security attributes are often called the label. The primary concerns in such a policy are enforcing access rights and maintaining appropriate labels as new objects are created. The policy is often described as 'read down, write up'. A user may read an object with a lower level; an object will be written with the highest level of any objects involved. For example, a user with SECRET clearance can read SENSITIVE objects. If that user uses a SECRET object and a SENSITIVE object as input, the output of the process will be labeled as SECRET. SQL can be used when a MAC policy is required, but not every SQL processor is suited to the task. SQL has no built in feature for handling labels, however nothing in the standard prevents an implementation from using and main- ^SQL does not require audit trail generation. This must be added as a value-added enhancement to the SQL processor. taining this information. First, an appropriate MAC implementation of SQL for the target OS is required. If the target OS is a MAC system, the Trusted Computing Base (TCB) subset architecture and Trusted Subject architecture can be used. If the target OS is not a MAC system, the integrity lock architecture is requiredfi. Add-on tools for detection and elimination of inference and aggregation are required. Authentication and auditing requirements are identical to those for role-based systems.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Security of SQL-Based Implementations of Product Data Exchange Using STEP.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Considerations for Voice Over IP Systems provide? (Section 47) e supported scenarios for this profile are endpoint to gatekeeper, gatekeeper to gatekeeper, and endpoint to endpoint. For the profile the gatekeeper-routed signaling (hop-by-hop security) is favored. Using it for the direct call model is generally possible but limited due to the fact that a shared secret has to be established between the parties that want to communicate before the actual communication takes place. This might be possible in smaller environments but may lead to a huge administrative effort in larger environments. This profile supports secure fast connect and H.245 tunneling, and may be combined with the Voice Encryption Option described in section 4.2.1.3. Note: that this profile is easy to implement but it is not really scalable for 'global' IP telephony due to the restricted key management.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE) say about Appendix I Example Security Control Map? (Part 17) According to Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE), Appendix I Example Security Control Map: | PR.DS-2-Data in transit is protected | System and Communications Protection SC-8, SC-11, SC-12 | A.8.2.3 Handling of Assets A.13.1.1 Network Controls A.13.2.1 Information Transfer Policies and Procedures A.13.2.3 Electronic Messaging A.14.1.2 Securing Application Services on Public Networks A.14.1.3 Protecting Application Services Transactions | CSC 13 Data Protection CSC 14 Controlled Access Based on the Need to Know | OV-SPP-002 Cyber Policy and Strategy Planner OV-MGT-002 Communications Security (COMSEC) Manager OV-LGA-002 Privacy Officer/Privacy Compliance Manager OM-NET-001 Network Operations Specialist | | Specific product used | How the component functions in the build | Applicable Cybersecurity Framework Version 1.1 Subcategories | Applicable NIST SP 800-53 Revision 4 Controls | ISO/IEC 27001:2013 | CIS 6 | NIST SP 800-181 NICE Framework Work Roles | |-------------------------|--------------------------------------------|----------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | PR.PT-4- Communications and control networks are protected | Access Control AC- 4, AC-17, AC-18 Contingency Planning CP-8 System and Communications Protection SC-7, SC-19, SC-20, SC- 21, SC-22, SC-23, SC-24, SC-25, SC- 29, SC-32, SC-36, SC-37, SC-38, SC- 39, SC-40, SC-41, SC-43 | A.13.1.1 Network Controls A.13.2.1 Information Transfer Policies and Procedures A.14.1.3 Protecting Application Services Transactions | CSC 8 Malware Defenses CSC 12 Boundary Defense CSC 15 Wireless Access Control | PR-INF-001 Cyber Defense

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Appendix B-Frequently Asked Questions (FAQ) according to NIST Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) According to Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), Appendix B-Frequently Asked Questions (FAQ): Privacy and security leadership and staff, as well as others, may have questions about identifying, handling, and protecting the confidentiality of personally identifiable information (PII). This appendix contains frequently asked questions (FAQ) related to PII. Organizations are encouraged to customize this FAQ and make it available to their user community.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NICE Framework Competency Areas_ Preparing a Job-Ready Cybersecurity Workforce provide? (Section 11) appreciates and acknowledges the contributions of those who established previous editions of cybersecurity workforce frameworks as described at the history page of the NICE Framework Resource Center. NICE released the Workforce Framework for Cybersecurity (NICE Framework) , NIST Special Publication 800-181, Revision 1, in November 2020 [1]. The revised NICE Framework established a set of building blocks-Task, Knowledge, and Skill statements-that describe cybersecurity work and what someone must know or be able to do to complete that work. It also identifies common ways these building blocks can be applied, most notably through Work Roles and, new in the NICE Framework revision 1, Competency Areas. 1 NICE Framework Competency Areas group together related Task, Knowledge, and Skill (TKS) statements to form a higher-level description of capabilities typically needed in a particular cybersecurity domain. By clearly defining what a person needs to know and do to perform well in a defined area of cybersecurity work, Competency Areas provide a means to communicate the needs of employers, the capabilities of learners (which, for the purposes of the NICE Framework includes students, job seekers, and employees), and the value of education, training, and certifications. Learners: Individuals who perform cybersecurity work, including students, job seekers, and employees. Competency Areas are defined via an employer-driven approach that enables education and training providers to be responsive to employer or sector needs by creating experiences that help learners develop and demonstrate relevant and needed capabilities. They correlate with performance on the job and can be improved through education, training (including on-the-job and apprenticeships), or other learning experiences.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: NICE Framework Competency Areas_ Preparing a Job-Ready Cybersecurity Workforce.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments say about Appendix A Security Configuration Settings? (Part 51) According to Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments, Appendix A Security Configuration Settings: | | CCE- 8450 3-2 | NIST800 53-VI- NET- CFG- 00253 | Built-in | NSX | From the vSphere Web Client, go to Administration >> Single Sign-On >> Policies >> Password Policy . | Universal Distrib- uted Logical Router Password (Depend- ent on Customer Configurations) | | CCE ID | Configur ation(s) | Built-In/ Enhanced | Prod- uct | Audit Procedure | Recommended Parameter Value | |---------------|--------------------------------|----------------------|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | CCE- 8450 4-0 | NIST800 53-VI- NET- CFG- 00281 | Built-in | NSX | Log on to NSX Manager Virtual Appliance, then go to Backup &Restore . If 'Audit Logs' or 'System Events' are excluded (by default they are NOT excluded), this is a finding. | Audit Logs and Sys- tem Events are not excluded | | CCE- 8450 5-7 | NIST800 53-VI- NET- CFG- 00282 | Built-in | NSX | Log on to NSX Manager Virtual Appliance, then go to Manage Appliance Settings and look under General Network Settings . If IPv6 is configured, this is a finding.

Explanation: NIST publication on credential and access management. Topics: password policy, single sign-on. Contains security framework guidance for authentication systems. Source: Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about Confidentiality? According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Confidentiality: The confidentiality impact level is the effect of unauthorized disclosure of contingency planning information on the ability of responsible agencies to plan for, respond to, and mitigate damaging events. Unauthorized disclosure of contingency planning information may equip an adversary with the information necessary to attack a system so that recovery is impaired. Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of background information that supports development of Federal contingency plans can reveal sensitive vulnerabilities, capabilities, intelligence assessments, intelligence sources, or methods employed in anti-terrorism, law enforcement, or national security activities. Depending on the information in question, the confidentiality impact can be moderate , high , or involve national security information (outside the scope of this guideline). Also, some contingency plans are themselves national security information . However, the purpose of most contingency planning information is to protect against inadvertent or accidental damaging events rather than against malicious attacks. Even so, in the case of Federal government systems, the case of hostile attacks on systems must be considered. The consequences of unauthorized disclosure of extracts from contingency plans are likely to have negligible to limited adverse effects on agency operations. In such cases, the confidentiality impact would be, at most, low . Unauthorized disclosure of the entire plan to malicious entities may have serious effects. As a result, the consequence of loss of confidentiality of comprehensive contingency plans is likely to involve serious harm to government assets, personnel, or missions. In such cases, the confidentiality impact would be, at least, moderate . Recommended Confidentiality Impact Level : The provisional confidentiality impact level recommended for contingency planning information is moderate .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 187) policy that addresses— i. The objectives, roles, and responsibilities for the physical and environmental security program as it relates to protecting the organization’s personnel and assets; and ii. The scope of the physical and environmental security program as it applies to all of the organizational staff, contractors, and third parties; and b. Procedures to address the implementation of the physical and environmental security policy and associated physical and environmental protection requirements; 2. Management commitment ensures compliance with the organization’s security policy and other regulatory requirements; and 161 3. The organization ensures that the physical and environmental security policy and procedures comply with applicable federal, state, local, tribal, and territorial laws and regulations. Supplemental Guidance The organization may include the physical and environmental security policy as part of the general security policy for the organization. Requirement Enhancements None. Additional Considerations None. Impact Level Allocation Low: SG.PE-1 Moderate: SG.PE-1 High: SG.PE-1 SG.PE-2 Physical Access Authorizations Category: Common Governance, Risk, and Compliance (GRC) Requirements Requirement 1. The organization develops and maintains lists of personnel with authorized access to facilities containing smart grid information systems and issues appropriate authorization credentials (e.g., badges, identification cards); and 2. Designated officials within the organization review and approve access lists on an organization-defined frequency, removing from the access lists personnel no longer requiring access. Supplemental Guidance None. Requirement Enhancements None. Additional Considerations A1. A2. A3.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2014 Annual Report say about FEDERAL INFORMATION PROCESSING STANDARDS (FIPS) NO FINAL APPROVED FIPS RELEASED DURING FY 2014.? (Part 4) According to Computer Security Division 2014 Annual Report, FEDERAL INFORMATION PROCESSING STANDARDS (FIPS) NO FINAL APPROVED FIPS RELEASED DURING FY 2014.: for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations | | March 2014 | Attribute Based Access Control (ABAC) Definition and Considerations | | February 2014 | Framework for Improving Critical Infrastructure Cybersecurity | | January 2014 | A Profile of the Key Management Framework for the Federal Government | | December 2013 | The National Vulnerability Database (NVD): Overview | | November 2013 | ITL Releases Preliminary Cybersecurity Framework | | October 2013 | ITL Updates Federal Information Processing Standard (FIPS) for Personal Identity Verification (PIV) of Federal Employees and Contractors | ABSTRACTS OF NIST TECHNICAL SERIES PUBLICATIONS RE- L E A S E D I N F Y 2 0 1

Explanation: NIST publication on credential and access management. Topics: access control, key management. Contains security framework guidance for authentication systems. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN) say about 4.5.2. Recover: Improvements Category? (Part 2) According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN), 4.5.2. Recover: Improvements Category: threats, improve technology, and address changes to the organization, the operating environment, and deficiencies encountered during plan implementation, execution, and testing. | NIST SP 800-53 Rev. 5 CP-2, CP-10, IR-4, IR-8 NIST SP 800 612 3.4 | | RC.IM-2: Recovery strategies are updated. | Evaluate the incident's characteristics and impact to determine if the recovery strategy was sufficient or appropriate (i.e., proportional to the impact) and revise the recovery strategy and corresponding plan accordingly. HSNs share lessons learned and after-action reports among partner organizations in a format and level of detail agreed upon in advance. Consider participation and sharing of lessons learned in forums such as Space ISAC. | NIST SP 800-53 Rev. 5 IR-3, IR-4, IR-8 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Application Container Security Guide say about C O M P U T E R S E C U R I T Y? According to Application Container Security Guide, C O M P U T E R S E C U R I T Y: この文書は以下の団体によって翻訳監修されています <!-- image --> 本文書は、原典に沿ってできるだけ忠実に翻訳するよう努めていますが、完全性、 正確性を保証するものではありません。 翻訳監修主体は、本文書に記載されている情報より生じる損失または損害に対し て、いかなる人物あるいは団体についても責任を負うものではありません。 <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Application Container Security Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SR-12 in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 90) Control SR-12: n an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. vulnerability analysis See vulnerability assessment. vulnerability assessment [CNSSI 4009] Systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation. T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I APPENDIX A PAGE 423 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in Derived PIV Application and Data Model Test Guidelines? (Part 245) Control HA-256: ct along with the status word '90 00'. 3. From Step 4, the extended key usage extension asserts the id- PIV-content-signing OID, indicating that the certificate is authorized to sign PIV data objects. | ## 9.3.4.7 Authority Information Access Extension | Test Assertion | TA-09.03.04.07 | |----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Purpose | Verifies the authority information access extension in the Derived PIV Credential Issuer's (content signing) certificate is populated appropriately and contains the id-ad-caIssuers (1.3.6.1.5.5.7.48.2) accessMethod, which points to the location where the certificates issued to the issuer of this certificate can be found. | | DTR(s) | • DTR-07.03.04.08 | | Issuer Documentation | None. | | Precondition(s) | • A token with the Derived PIV Application is inserted into an appropriate token reader. • Suitable drivers have been loaded between the test system and an instance of the reader. • A Security Object is present within the Derived PIV Application.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EN-1 in Guidelines for the Creation of Interoperable Software Identification (SWID) Tags? (Part 3) Control EN-1: two ways. First, the schema specifies UTF-8 as the allowed character encoding scheme for SWID tag files. Second, the schema allows the optional @xml:lang attribute to be included on all tag elements. By taking advantage of these features, a Japanese software provider could issue a SWID tag like this: ``` <SoftwareIdentity xmlns="http://standards.iso.org/iso/19770/-2/2015/schema.xsd" xml:lang="ja-jp" name=" コンピュータ管理システム 2015" tagId="jp.largecomputerco. タグ番号 1" version="1.0"> ``` ``` <Entity name=" 大型コンピュータ会社 " regid="largecomputerco.jp" role="tagCreator softwareCreator"/> … </SoftwareIdentity> ``` According to W3C documentation, language tags 'are used to indicate the language of text or other items in HTML and XML documents' [W3C-langtags]. By supplying the language tag ' ja-jp ' as the value of the <SoftwareIdentity> @xml:lang attribute, the tag creator signals to tag consumers that various language-dependent attributes, such as the <SoftwareIdentity> @name attribute, are provided in Japanese. Additionally, the SWID schema is designed so that any value of @xml:lang specified on any tag element is inherited by all of that element's child elements, unless explicitly overridden. As a result, the value specified for the <SoftwareIdentity> @xml:lang attribute will, in effect, establish the preferred language that is used for all language-dependent attributes within the tag. Knowing the preferred language of SWID tag attribute values can be very useful to tag consumers, and can relieve them of the need to attempt to perform language auto-detection. The following guideline requires that tag creators always specify the preferred language of a tag: GEN-2. The <SoftwareIdentity> element MUST specify an @xml:lang attribute with a non-blank value to indicate the default human language used for expressing all language-dependent attribute values. Guideline GEN-2 is directed towards both authoritative and non-authoritative tag creators.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Creation of Interoperable Software Identification (SWID) Tags.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings say about 2005 PKI R&D Workshop Multiple Paths to Trust? (Part 3) According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, 2005 PKI R&D Workshop Multiple Paths to Trust: and Implementation of LDAP Component Matching for Flexible and PKI | Design and Implementation of LDAP Component Matching for Flexible and PKI | 41 | | Secure Certificate Access in Sang Seok Lim | IBM Watson Research Center | | | PKI without Revocation Checking * Karl Scheibelhofer | Institute for Applied Information Processing and Communications, Graz | 52 | | Delegation Issuing Service for X.509 | | 66 | | David Chadwick | University of Kent, England | | * Paper was accepted, but was not presented at during the Workshop.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1.2 Purpose and Scope according to NIST Guidelines on Firewalls and Firewall Policy According to Guidelines on Firewalls and Firewall Policy, 1.2 Purpose and Scope: This document seeks to assist organizations in understanding the capabilities of firewall technologies and firewall policies. It provides practical guidance on developing firewall policies and selecting, configuring, testing, deploying, and managing firewalls.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Firewalls and Firewall Policy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Threshold Schemes for Cryptographic Primitives_ Challenges and Opportunities in Standardization and Validation of Threshold Cryptography provide? (Section 97) '85, pages 291-304. ACM, 1985. DOI:10.1145/22145.22178. - [GMW87] O. Goldreich, S. Micali, and A. Wigderson. How to Play ANY Mental Game or A Completeness Theorem for Protocols with Honest Majority . In Proc. 19th Annual ACM Symposium on Theory of Computing, STOC '87, pages 218-229. ACM, 1987. DOI:10.1145/28395.28420. - [GRJK00] R. Gennaro, T. Rabin, S. Jarecki, and H. Krawczyk. Robust and Efficient Sharing of RSA Functions . Journal of Cryptology, 13(2):273-300, Mar 2000. DOI:10.1007/s001459910011. - [Gro16] C. T. Group. NIST Cryptographic Standards and Guidelines Development Process . NISTIR 7977, March 2016. DOI:10.6028/NIST.IR.7977. - [Gue09] S. Gueron. Intel's New AES Instructions for Enhanced Performance and Security . In O. Dunkelman (ed.), Fast Software Encryption, 16th International Workshop, FSE 2009, vol. 5665 of LNCS, pages 51-66. Springer, 2009. DOI:10.1007/978-3-642-03317-9\_4. - [HJKY95] A. Herzberg, S. Jarecki, H. Krawczyk, and M. Yung. Proactive Secret Sharing Or: How to Cope With Perpetual Leakage . In D. Coppersmith (ed.), Advances in Cryptology - CRYPT0' 95, pages 339-352. Springer Berlin Heidelberg, 1995. DOI:10.1007/3-540-44750-4\_27. - [HM00] M. Hirt and U. Maurer. Player Simulation and General Adversary Structures in Perfect Multiparty Computation . Journal of Cryptology, 13(1):31-60, Jan 2000. DOI:10.1007/s001459910003. - [HSH + 09] J. A. Halderman, S. D. Schoen, N. Heninger, W. Clarkson, W. Paul, J. A. Calandrino, A. J. Feldman, J. Appelbaum, and E. W. Felten. Lest We Remember: Cold-boot Attacks on Encryption Keys . Commun. ACM, 52(5):91-98, May 2009. DOI:10.1145/1506409.1506429. - [IN83] K. Itakura and K. Nakamura. A public-key cryptosystem suitable for digital multisignatures . In NEC J. Res. Dev. 71, pages 1-8, Oct. 1983. - [Int18] Intel Corporation. Software Guard Extention (SGX) . https: //software.intel.com/en-us/sgx, 2018. - [ISN89] M. Ito, A. Saito, and T. Nishizeki. Secret sharing scheme realizing general access structure .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Threshold Schemes for Cryptographic Primitives_ Challenges and Opportunities in Standardization and Validation of Threshold Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does An Algorithm for Generating Very Large Covering Arrays provide? (Section 4) ut line i and resume scanning with line i +1. This procedure can normally reduce 10,000 to 100,000 tests to a several hundred, with the final reduced tests containing less than 1% 'don't care' values. Discussion: This procedure works because with many variables, each test case contains thousands of k -way combinations of variables. Another way of viewing the covering procedure is to think of each of the C =    x v      k n k combinations that must be covered as a separate bin. If we throw C marbles into random bins, most bins will have at least one marble. Another set of C marbles covers more bins, and so on repeated d times, until nearly all contain one or more marbles. For example, with C =20, d =8, all C combinations are covered with 99.5% probability The number of combinations produced by the algorithm is d x C , and each random combination is assigned to one of the C bins, with the total number of randomly generated combinations proportional to C ln C . With suitable values of d , at least one combination is assigned to each bin with a very high probability. The efficiency of this approach is increased by minimizing the number of duplicate combinations in each new test in step 3 Implementation notes: The algorithm can be distributed across any number of machines, but requires a common 'checkbox' to record the combinations covered. For a large number of variables, a very large amount of disk storage would be required for the blackboard, roughly <!-- image --> 8     k bytes. For 6-way combinations of 50 variables with 6 values each, this is approximately 9 gigabytes; large but fairly easy to implement on a cluster system. With lower interaction levels or fewer values per variable, a desktop PC is adequate for 100 variables or more. Alternatively, a disk based version of the program can be used, although this increases run time from a few minutes to hours. Calculation of d in step 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: An Algorithm for Generating Very Large Covering Arrays.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 10.3 Audit and Accountability (AU) according to NIST An Introduction to Information Security According to An Introduction to Information Security, 10.3 Audit and Accountability (AU): An audit is an independent review and examination of records and activities to assess the adequacy of system controls and ensure compliance with established policies and operational procedures. An audit trail is a record of individuals who have accessed a system as well as what operations the user has performed during a given period. Audit trails maintain a record of system activity both by system and application processes and by user activity of systems and applications. In conjunction with appropriate tools and procedures, audit trails can assist in detecting security violations, performance issues, and flaws in applications. Audit trails may be used as a support for regular system operations, a kind of insurance policy, or both. As insurance, audit trails are maintained but not used unless needed (e.g., after a system outage). As a support for operations, audit trails are used to help system administrators ensure that the system or resources have not been harmed by hackers, insiders, or technical problems. Examples of audit and accountability controls include: audit events, time stamps, nonrepudiation, protection of audit information, audit record retention, and session audit. Organizations: (i) create, protect, and retain system audit records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate system activity; and (ii) ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: An Introduction to Information Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RC-16 in Effective Use of Computing Technology in Vote-Tallying? (Part 22) Control RC-16: a handcarried permanent magnet if it is located no closer than about 76 millimetres (about 3 inches) to any point at which such a magnet could be placed. NBS has issued a report on this subject. ## 4. Design Specifications for Summarizers An important aspect of ballot and vote summarizers is that they are altered to specialize them for each election. Specifications should include the methods that are used to document these changes so that the documentation can become part of the election records. Audit trails are needed in these devices, just as they are in computer programs meant for stored-program computers. If summarizers are precinct-located, the capabil ity- to provide partial summations of district-wide totals following the addition of each precinct is not a pertinent requirement. Nevertheless, the other capabilities listed under VI. C. 4 Inclusion of Audit Trails are still pertinent. However, the provisions for some of these capabilities, for example for undervote storage and the computation of undervotes for offices in which more than one vote is allowed, would probably need to be implemented in hardware in these devices. The extra cost of this implementation must be weighed against the need for complete confidence in the results. ## F. Acceptance Testing of Vote-Tallying Equipment The concept of acceptance testing implies that there exists a group of identical devices, and some subset of these are to undergo a specific test determining whether design specifications are met. If those undergoing the test pass, then it is assumed that the remainder, designed identically will also pass the same test and be allowed to be used. If the number of devices is small, say ten or less, then perhaps each one may be required to undergo specific acceptance tests against design specifications. If the number of identical devices is larger, then a small number may be required to undergo extensive tests and the remainder limited to tests on the most fundamental parameters.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Effective Use of Computing Technology in Vote-Tallying.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings provide? (Section 315) PKI may both potentially impact the performance of this security scheme; however, evaluating how these effects may scale to large networks is di GLYPH<14> cult to do analytically or empirically. In this paper, we use the tools of simulation to evaluate the impact that signatures, verification, and certificate handling have on convergence time, message size, and storage, for the principal approaches to securing BGP. By distributing and maintaining routing information, the Border Gateway Protocol (BGP) [32, 39] plays a central role in making the Internet work. However, BGP relies on hearsay information. BGP speakers trust the messages they receive and they completely trust other BGP speakers to follow the protocol specification reliably. Consequently, BGP-and the Internet it routes-is vulnerable to many potential attacks by malicious players [26]. To mitigate these risks, many researchers have proposed security mechanisms to authenticate the routing information transferred between BGP speakers [1, 8, 13, 17, 35, 40, 41]. S-BGP is the dominant scheme here. Because of the need to authenticate information passed among parties spanning a large set of domains, these se- GLYPH<3> contact author, zhaom@cs.dartmouth.edu (and BGP convergence) but this comes at a price, memory and message size. This Paper Section 2 reviews BGP and S-BGP. Section 3 reviews some alternate encoding and cryptographic approaches. Section 4 presents our evaluation methodology. Section 5 presents our experiments and results for path authentication. Section 6 presents our experiments and results for origin authentication. Section 7 reviews related work, and Section 8 concludes with some thoughts for future research. The Border Gateway Protocol (BGP) [32, 39] is the routing protocol for maintaining connectivity between autonomous systems (ASes) in the Internet. Each AS is assigned a unique integer as its identifier, known as its AS number .

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography provide? (Section 180) t: The derived keying material or an error indicator. Note: Key confirmation can be incorporated into this scheme. See Section 6.2.1.5 for details. dhHybridOneFlow is summarized in Table 15. Table 15: dhHybridOneFlow key-agreement scheme summary | | Party U | Party V | |---------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|-------------------------------| | ( p, q, g {, SEED, counter }) | ( p, q, g {, SEED, counter }) | Domain parameters | | Static private key x U Static public key y U | Static private key x V Static public key y V | Static data | | Ephemeral private key r U Ephemeral public key t U | N/A | Ephemeral data | | 1. Compute Z s by calling FFC DH using x U and y V 2. Compute Z e by calling FFC DH using r U and y V 3. Compute Z = Z e || Z s | 1. Compute Z s by calling FFC DH using x V and y U 2. Compute Z e by calling FFC DH using x V and t U 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Smart Card Technology_ New Methods for Computer Access Control say about 2.0 SMART CARD INTEGRATED CIRCUIT TECHNOLOGIES? According to Smart Card Technology_ New Methods for Computer Access Control, 2.0 SMART CARD INTEGRATED CIRCUIT TECHNOLOGIES: The smart card's ability to perform the computations and other functions needed in security applications depends on the development of the smart card microcomputer, which, in turn, is inherently tied to the progress of integrated circuit technologies. This chapter discusses some of the concepts and considerations involved in the production of integrated circuits.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Smart Card Technology_ New Methods for Computer Access Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Biometric Match-on-Card Feasibility Report say about 3.1 Test Fixture? (Part 1) According to Secure Biometric Match-on-Card Feasibility Report, 3.1 Test Fixture: 3.1 Test Fixture The test fixture uses the Win32 Smart Card Application Programming Interface (API) library to communicate with DUTs and smart card readers. The library was used to acquire the following time measurements: + Average 2 time to establish a secure session + Average time to transmit the encrypted biometric data to the DUT and receive a match result + Average total time to perform a complete biometric match-on-card transaction To perform time measurements, the test fixture sends Application Protocol Data Units (APDU) to a DUT using the SCardTransmit command. The time it takes to execute a SCardTransmit command, which is obtained by computing the time difference before and after a call to SCardTransmit, is then recorded to an output file. For APDUs that require multiple calls to SCardTransmit (e.g., GET RESPONSE), the total elapsed time is determined by adding the time to execute each SCardTransmit operation. An example message sequence between a DUT and the test fixture is as follows: 1. The test fixture selects the SBMOC application on the card. 2. The test fixture performs Get Data to read the PKI certificate from the DUT and validates the certificate. 3. The test fixture requests a challenge from the DUT. The DUT responds with a challenge. 4. The text fixture and DUT generate encryption and Message Authentication Code (MAC) session keys, and finish establishing a secure session. 5. The text fixture encrypts biometric data using session key and sends it to the DUT for verification. The DUT responds with the signed match / no-match result. After running the test fixture, a Comma-Separated Values (CSV) output file is created that contains the measured times for the DUT used in the test. Table 1 lists the data recorded in the output file. A sample test fixture output appears in Appendix C. Table 1.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Secure Biometric Match-on-Card Feasibility Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to General Server Security provide? (Section 63) ver software. The new user and new group should be independent from all other users and groups and unique. This is a prerequisite for implementing the access controls described in the following steps. During initialization, the server may have to run with root (Unix) or administrator/system (Windows) privileges; ensure that the server is configured to reduce its privileges to those of the server user after performing its initialization functions. In addition, use the server OS to limit which files can be accessed by the service processes. These processes should have read-only access to those files necessary to perform the service and should have no access to other files, such as server log files. Use server host OS access controls to enforce the following: 28 - GLYPH<c=31,font=/MIJOHI+Webdings> Service processes are configured to run as a user with a strictly limited set of privileges (i.e., not running as root, administrator, or equivalent). - GLYPH<c=31,font=/MIJOHI+Webdings> Service processes can only write to server content files and directories if necessary. - GLYPH<c=31,font=/MIJOHI+Webdings> Temporary files created by the server software are restricted to a specified and appropriately protected subdirectory (if possible). Access to these temporary files is limited to the server processes that created the files (if possible). It may also be necessary to ensure that the server software cannot save (or, in some cases, read) files outside the specified file structure dedicated to server content. This may be a configuration choice in the server software, or it may be a choice in how the server process is controlled by the OS. Ensure that such directories and files (outside the specified directory tree) cannot be accessed both directly and through the server software. To mitigate the effects of certain types of DoS attacks, configure the server to limit the amount of OS resources it can consume.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to General Server Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Storage Encryption Technologies for End User Devices? (Part 37) Control ES-1: e and the user has been authenticated to the storage encryption solution, malware could access decrypted files and transfer copies of them to external hosts or extract sensitive information from them. Other examples are an attacker disabling or reconfiguring storage encryption, malware installing a keylogger that captures passwords used for storage encryption authentication, or malware acquiring a copy of a storage encryption key from the device's memory (for software-based storage encryption solutions). Organizations should also be aware that they should not rely on storage encryption technologies to protect data without regularly maintaining the encryption solution. For example, if an attacker acquires a lost, stolen, or retired device protected by storage encryption technology, and a vulnerability in the storage encryption technology is discovered in the future, the attacker may be able to exploit it to access the protected data. ## 3.3 Comparison of Storage Encryption Technologies Table 3-1 lists several characteristics of storage encryption technologies as a means for comparing the types of technologies described in this publication. 26 When multiple encryption methods are used simultaneously, the cryptographic keys used by the encryption methods are usually different. Table 3-1.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, malware. Contains technical security guidance that could inform defensive posture. Source: Guide to Storage Encryption Technologies for End User Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identity and Access Management for Electric Utilities say about Java Application? (Part 18) According to Identity and Access Management for Electric Utilities, Java Application: LOCK_USER1 ocksetAccessMode],[IPLocksetCredentialFormat],[IPLocks etAccessAlways],[RawPrimaryCredential],[LargeEncodedCa rdID],[EmbossedNumber]) VALUES (NEWID(),$UserText1,$CardNumber,$FacilityCode,$PIN,'0' ,'0','0','1',NULL,NULL,'0','0',NULL,NULL,SYSDATETIME() ,'alertent',SYSDATETIME(),'alertent','0','0',NULL,'0', '255',NULL,NULL,'Active',NULL,NULL,NULL,NULL,NULL,NULL ,'') END END; update [dbo].[Cardholders] set CardholderStatus='0' where CardholderID=$CardholderID update [dbo].[Cardholders] set CardholderStatus='1' where CardholderID=$CardholderID select CardholderID from [dbo].[Cardholders] where CardholderID =$CardholderID INSERT INTO [dbo].[CardholderAccessLevels] ( [CardholderAccessLevelID], [AccessLevelID],[LastModified],[ActivateDate],[Deactiv ateDate]) VALUES ( NEWID(), $CardholderID,(select AccessLevelID from [dbo].[AccessLevels] where AccessLevelName=$ROLE_NAME),GetUTCDate(), NULL, NULL) [CardholderID], delete from [dbo].[CardholderAccessLevels] where CardholderID=$CardholderID and AccessLevelID=(select AccessLevelID from [dbo].[AccessLevels] where AccessLevelName=$ROLE_NAME) select CardholderID from [dbo].[Cardholders] where UserText1=$UserText1 BEGIN IF $CardNumber is null BEGIN update [dbo].[Cardholders] set CardholderStatus='1' where UserText1=$UserText1 END ELSE BEGIN INSERT INTO [AIUniversal].[dbo].[Cards] ([CardID],[CardholderID],[CardNumber],[FacilityCode],[ PINNumber],[PINExempt],[APBExempt],[UseExtendedAccessT imes],[CardStatus],[ActiveDate],[ExpireDate],[UserLeve l],[UseCustomReporting],[EventInfo],[Notes],[LastModif ied],[LastModifiedByUser],[DateCreated],[CreatedByUser ],[IssueLevel],[DeactivateExempt],[VacationDate],[Vaca tionDuration],[UseCount],[TempDeactivateStart],[TempDe activateEnd],[Classification],[IPLocksetUserType],[IPL ocksetAccessMode],[IPLocksetCredentialFormat],[IPLocks etAccessAlways],[RawPrimaryCredential],[LargeEncodedCa rdID],[EmbossedNumber]) VALUES (NEWID(),(select CardholderID from [dbo].[Cardholders] where UserText1=$UserText1),$CardNumber,$FacilityCode,$PIN,' 0','0','0','1',NULL,NULL,'0','0',NULL,NULL,SYSDATETIME (),'alertent',SYSDATETIME(),'alertent','0','0',NULL,'0 ','255',NULL,NULL,'Active',NULL,NULL,NULL,NULL,NULL,NU LL,'') END END; update [AIUniversal].[dbo].[Cards] set CardStatus='0',Classification='InActive' where [CardNumber]=$CardNumber NIST SP 1800-2C: Identity and Access Management for Electric Utilities 169 f.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Enhanced Security Requirements for Controlled Unclassified Information say about 3.10 PHYSICAL PROTECTION? According to Assessing Enhanced Security Requirements for Controlled Unclassified Information, 3.10 PHYSICAL PROTECTION: There are no enhanced security requirements for physical protection.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Glossary of Computer Security Terminology say about 2) See BELL-LAPADULA MODEL and SECURITY POLICY MODEL.? (Part 2) According to Glossary of Computer Security Terminology, 2) See BELL-LAPADULA MODEL and SECURITY POLICY MODEL.: nergy Act, as amended, and safeguarded as national security information subject to the restrictions of transmission to other countries and regional defense organizations that apply to Restricted Data. (DOE 5635.1 A) | | formulary | A technique for permitting the decision to grant or deny access to be determined dynamically at access time, rather than at the time of creation of the access list. (FIPS PUB 39) | | for official use only (FOLIO) data | Unclassified official information of a sensitive proprietary, or personal nature which must be protected against unauthorized public release as defined In AFR 12-30. (AFR 205-16; AR 380-380) | | front-end security filter | A process that Is invoked to process data according to a specified security policy prior to releasing the data outside the processing environment or upon receiving data from an external source. (DOD 5200.28-STD) | | functional testing | The portion of security testing in which the advertised features of a system are tested for correct operation.

Explanation: NIST publication discussing classified information handling. References: classified, for official use only, national security. Contains guidance on protecting sensitive government information. Source: Glossary of Computer Security Terminology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2007 Annual Report say about Overview? (Part 2) According to Computer Security Division 2007 Annual Report, Overview: each programs. Activities in this area have historically involved, and continue to involve, large amounts of collaboration and the facilitation of relationships with other entities. Federal agencies that have collaborated recently with these activities are the Department of State, the Department of Commerce, the Department of Defense, the General Services Administration, the National Aeronautics and Space Administration, the National Security Agency, the Department of Energy, the U.S. Office of Management and Budget, the Social Security Administration, the United States Postal Service, the Department of Veterans Affairs, the Federal Aviation Administration, and NIST's National Voluntary Laboratory Accreditation Program. The list of industry entities that have worked with us in this area is long and includes the American National Standards Institute (ANSI), Oracle, Cisco Systems, Lucent Technologies, Microsoft Corporation, International Business Machines (IBM), VISA, MasterCard, Computer Associates, RSA Security, Research in Motion, Sun Microsystems, Network Associates, Entrust, and Fortress Technologies. The Division also has collaborated at the global level with Canada, the United Kingdom, France, Germany, India, Japan, and Korea in this area.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2007 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain approved according to NIST Recommendation for Key Derivation Using Pseudorandom Functions According to Recommendation for Key Derivation Using Pseudorandom Functions, approved: An algorithm or technique for a specific cryptographic use that is specified in a FIPS or NIST Recommendation, adopted in a FIPS or NIST Recommendation, or specified in a list of NIST-approved security functions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key Derivation Using Pseudorandom Functions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Section 61) entation; list of devices requiring unique identification and authentication; device connection reports; system audit records; list of privileged system accounts; other relevant documents or records]. Interview : [ SELECT FROM: Organizational personnel responsible for system operations; organizational personnel responsible for account management; organizational personnel responsible for device identification and authentication; organizational personnel responsible for information security; system/network administrators; system developers]. Test : [ SELECT FROM: Cryptographically-based bidirectional authentication mechanisms; mechanisms supporting and/or implementing network connection policy; mechanisms supporting and/or implementing replay-resistant authentication mechanisms; mechanisms supporting and/or | | 3.5.2e | ENHANCED SECURITY REQUIREMENT Employ automated mechanisms for the generation, protection, rotation, and management of passwords for systems and system components that do not support multifactor authentication or complex account management. | ENHANCED SECURITY REQUIREMENT Employ automated mechanisms for the generation, protection, rotation, and management of passwords for systems and system components that do not support multifactor authentication or complex account management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IR-7658 in Guide to SIMfill Use and Development? (Part 17) Control IR-7658: of records in a linear fixed file, test data may sometimes exceed those limits. To accommodate such situations, data written to a shorter field is truncated and excess records are dropped. SIMfill logs such events as a warning message for the user. The implications of the procedure used by SIMfill are important to understand when using or modifying the baseline test data provided, or creating new test data. The process allows the freedom to experiment with simple test data cases, involving only a single EF, while not affecting other EFs on a (U)SIM. However, any EF intended to be empty (i.e., erased and not populated with any test data) must be specified explicitly in the data file as a null entry. Otherwise, the content remains unchanged. Similarly, one must be aware of the field length and record number limits of (U)SIMs being populated when constructing test data. If not careful, important parts of a test case could be truncated or dropped. ## 4. Data and Schema Definitions The choice of XML as a representation for the data used by SIMfill has several advantages. XML is a well-known and well-defined standard, similar to the Hypertext Markup Language (HTML). Most users are likely to be familiar with it or with HTML, which lessens the learning curve. XML scheme definitions can also be specified for a document to exert control over its contents. Schema-sensitive XML editors are widely available, and many of them are free. With such an editor, it is fairly easy to modify existing or create new reference test data conforming to the schema definition. Changes to the XML schema definitions provided in the SIMfill distribution normally are not needed unless an error is discovered or the capabilities of SIMfill are modified to accommodate additional EFs or other types of identity modules. Nevertheless, some basic understanding is helpful, particularly if using an XML editor to modify or create test data.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to SIMfill Use and Development.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TG-005 in Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS)? (Part 161) Control TG-005: s the integrity category [t] Similarly, any GDI has greater integrity than any UDI: however, no GDI or TP has a combined access class that is comparable to any UDI when both components are considered. What has been described so far is a system in which the individual objects of interest (GDIs and TPs) are in isolated domains, but are "tagged" with access classes that encode their attributes relative to the Clark/Wilson rules. In particular, the integrity component of the access class of a TP serves as the "relation" required by Rule El. ## Non-Discretionary Policy The non-discretionary component of the policy implicit in the Glark/Wilson requirements can be found by examining the semantics of the classes assigned to the various data objects in the context of the basic non-discretionary and program integrity rul6s. The properties listed below are global, persistent, and unconditionally maintained by the underlying security kernel, provided the security officer and certifying officials are diligent in assigning clearances and assigning labels to certified transactions correctly. An individual GDI has the "general" GDI integrity and disclosure category, an individual GDI category, and an individual GDI disclosure category. It, therefore, can be manipulated using only programs that have been certified to correctly manipulate that specific GDI, by personnel authorized to both read and write GDIs in general and this GDI in particular. An individual TP has the "general" TP and GDI integrity and disclosure categories, the integrity category of each GDI it has been certified to manipulate correctly, and an individual TP disclosure category. It, therefore, (as an executable object) can be used to manipulate any of the GDIs it has been certified for, and none of the others (it does not carry their integrity category, so program integrity will prevent it from being executed.) It may be created, modified, or deleted only by someone cleared "[t]" (i.e., a certifier).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Reference control parameter P1 according to NIST Government Smart Card Interoperability Specification, Version 2.1 According to Government Smart Card Interoperability Specification, Version 2.1, Reference control parameter P1: The reference control parameter P1 shall be used to indicate the type of requested properties information. The following P1 values are possible: 0x00: Get a GSC-IS v2.0 compatible properties response message. If this response cannot be supported by the smart card then an error (0x6A86) shall be returned. 0x01: Get all the properties. 0x02: Get the properties of the tags provided in list of tags in the command data field.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Technology Assessment_ Methods for Measuring the Level of Computer Security say about CONTENTS? (Part 9) According to Technology Assessment_ Methods for Measuring the Level of Computer Security, CONTENTS: 5-31 | | CHAPTER | 6 | SECURITY POLICY IMPACT | | | 6.1 | SENSITIVITY DISTINCTIONS 6-1 | | | 6.2 | ACCEPTANCE CRITERIA 6-4 | | | 6.2.1 | Definition Of Acceptance Criteria 6-5 | | | 6.2.2 | Security Requirement Classes For Evaluation | | | 6.2.3 | Types Of Acceptance Criteria 6-13 6-20 | | | 6.2.4 | Conclusions | | CHAPTER | 7 | DOCUMENT OVERVIEW | | | 7.1 | INTRODUCTION 7-1 ENVIRONMENTS | | | 7.2 7.3 | V-2 CONTROLS V-2 | | | 7.3.1 | Control Groupings Or Structures 7-2 | | | 7.3.2 | Exposure Groupings Or Structures 7-3 | | | 7.4 | EVALUATION METHODOLOGIES/APPROACHES 7-3 | | 7.5 | SUMMARY OF THE STATE-OF-THE-ART 7-6 | |-------|-----------------------------------------| | 7.5.1 | Similarities And Differences 7-8 | | 7.5.2 | Approaches For Structuring Analysis 7-9 | | 7.5.3 | General Evaluation Issues 7-9 | | 7.5.4 | Conclusions 7-10 | | 7.6 | SECURITY POLICY IMPACT 7-10 | | 7.6.1 | Sensitivity Distinctions 7-10 | | 7.6.2 | Acceptance Criteria 7-11 | | 7.6.3 | Conclusions 7-11 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technology Assessment_ Methods for Measuring the Level of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is COURSE TITLE according to Computer Security Training & Awareness Course Compendium? COURSE TITLE: Hands-On-Lans: Auditing Novell Networks Workshop COURSE LENGTH:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Integrating Forensic Techniques into Incident Response provide? (Section 140) 6>s hard drive instead of the expected action, rebooting the system. An analyst who uses the keyboard of a computer of interest could enter keystrokes that cause unexpected actions to be performed. The best way to avoid key remapping problems is by collecting data from the computer without using its keyboard. For example, the analyst could attach a forensic workstation to a computer of interest using a crossover network cable and run scripts from the forensic workstation. Various tools and techniques can be used to support the examination process. Many of the tools and techniques discussed in Section 4.3 for examining collected data files can also be used with collected OS data. In addition, as described in Section 7, security applications, such as file integrity checkers and host IDSs, can be very helpful in identifying malicious activity against OSs. For instance, file integrity checkers can be used to compute the message digests of OS files and compare them against databases of known message digests to determine whether any files have been compromised. If intrusion detection software is installed on the computer, it might contain logs that indicate the actions performed against the OS. Another issue that analysts face is the examination of swap files and RAM dumps, which are large binary data files containing unstructured data. Hex editors can be used to open these files and examine their contents; however, on large files, manually trying to locate intelligible data using a hex editor can be a time-consuming process. Filtering tools automate the process of examining swap and RAM dump files by identifying text patterns and numerical values that might represent phone numbers, names of people, email addresses, Web addresses, and other types of critical information. Analysts often want to gather additional information about a particular program running on a system, such as the processGLYPH<146>s purpose and manufacturer.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: intrusion detection, incident response. Contains technical security guidance that could inform defensive posture. Source: Guide to Integrating Forensic Techniques into Incident Response.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Random Bit Generator (RBG) Constructions provide? (Section 89) ding output for use by a consuming application). 5. If a reseed capability is implemented, the DRBG shall be reseeded using any healthy validated entropy source(s) used for instantiation. 6. The DRBG shall be reseeded before generating output if the DRBG has produced 2 17 or more bits of output since instantiation or the last reseeding process. 7. When instantiating and reseeding CTR\_DRBG without a derivation function, keylen + output\_len bits with full entropy (where keylen is the length of the key to be used by the cryptographic primitive and output\_len is the length of its output block) or as otherwise specified in [SP\_800-90A] shall be obtained either directly from the entropy sources or 27 See Sec. 2.8.2 and 3.1 for discussions of the Get\_entropy\_bitstring function. ``` , call is replaced by: Get_conditioned_input ``` . via an external vetted conditioning function that provides full-entropy output (see Sec. 3.2.2.2). 8. For CTR\_DRBG with a derivation function, Hash\_DRBG , or HMAC\_DRBG , a bitstring with at least 3 s /2 bits of entropy shall be obtained from the entropy sources to instantiate the DRBG at a security strength of s bits. When reseeding is performed, a bitstring with at least s bits of entropy shall be obtained from the entropy source(s). The entropy may be obtained directly from the entropy source(s) or via an external vetted conditioning function (see Sec. 3.2.2). 9. The entropy source(s) used for the instantiation and reseeding of the DRBG within an RBG2(P) construction shall include one or more validated physical entropy sources; the inclusion of one or more validated non-physical entropy sources is optional. A bitstring that contains entropy shall be assembled and the entropy in that bitstring determined as specified in Method 1 of Sec. 2.3 (i.e., only the entropy provided by validated physical entropy sources shall be counted toward fulfilling the amount of entropy in an entropy request). 10.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Bit Generator (RBG) Constructions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices say about Implementation Tip? (Part 1) According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, Implementation Tip: Implementation Tip Most government information systems access, process, and/or disseminate more than one class of information. Security objectives and impacts associated with all of the types of information and processes served by the information system need to be considered in determining the system's information security requirements. Each information type may include one or more elements. For example, benefits management information includes employee identification information, benefit plan information for insurance and other products, cost information, claims and reimbursement policy information, claims procedures, etc. In some cases, different impact levels are appropriate for different information elements. For example, elements of program monitoring information relating to remediation of information security vulnerabilities may have a different impact level than elements of program monitoring information relating to an office furniture upgrade. Each agency that processes an information type may process a distinct combination of elements. The authority and responsibilities assigned to each agency that processes an information type can affect the actual impact level associated with the information within the context of that agency's operations. In Table C-2, the existence of exceptions to provisional impact assignments are identified by displaying impact assignments in a gray font [ gray font ] and are described as applicable by security objective in the information type descriptions to follow. The specific descriptions are provided under the sub-heading 'Special Factors Affecting [Security Objective] Impact Determination.' Appendices C.2 and C.3 identify information elements and contexts that may result in variances from the basic impact level assignment. For example, some systems process information the compromise of which affect national security, critical infrastructures, or key national assets.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Conformance Test for FDDI Medium Access Control (MAC) say about Continued from previous page.? (Part 17) According to A Conformance Test for FDDI Medium Access Control (MAC), Continued from previous page.: | | Test Case Dynamic Behaviour | Test Case Dynamic Behaviour | Test Case Dynamic Behaviour | Test Case Dynamic Behaviour | Test Case Dynamic Behaviour | |----------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| | Reference : FDDI/MAC/BASIC/FrameRepeat Identifier; FrameRepeat Purpose; Test MAC Frame Repeating Defaults Reference; | Reference : FDDI/MAC/BASIC/FrameRepeat Identifier; FrameRepeat Purpose; Test MAC Frame Repeating Defaults Reference; | Reference : FDDI/MAC/BASIC/FrameRepeat Identifier; FrameRepeat Purpose; Test MAC Frame Repeating Defaults Reference; | Reference : FDDI/MAC/BASIC/FrameRepeat Identifier; FrameRepeat Purpose; Test MAC Frame Repeating Defaults Reference; | Reference : FDDI/MAC/BASIC/FrameRepeat Identifier; FrameRepeat Purpose; Test MAC Frame Repeating Defaults Reference; | | Behaviour Description | Label | Constraint Reference | V | Comments | | FrameRepeat +FDDI/INITCONNECT # # !DATA # # # * ?DATA # # # # 70THERWISE ?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Conformance Test for FDDI Medium Access Control (MAC).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cell Phone Forensic Tools_ an Overview and Analysis provide? (Section 197) reported above. (Above) The following scenarios were conducted on an unlocked Nokia 6610i GSM phone, using an ATETSI interface (i.e., AT-ETSI phone protocol plug-in, ETSI-AT phone data conversion). Connectivity and Retrieval: The password-protected device contents were successfully acquired with or without the SIM present without providing authentication. Basic subscriber and service provider information was found and reported (i.e., IMEI, ICCID). Memory size is not reported. (Meet) PIM Applications: Active phonebook entries were found and reported. No other PIM data was found. (Below) Dialed/Received Phone Calls: All dialed/received phone calls were found and reported. Deleted phone calls were not found. (Below) SMS/MMS Messaging: All active incoming and outgoing SMS messages were found and reported. Active MMS and deleted SMS/MMS messages were not found. (Below) Internet Messaging: N.A. - The Nokia 6610i does not support email. (NA) Web Applications: Visited URLs, search queries performed, textual Web content or graphical images of visited sites were not found. (Miss) Text File Formats: Data content associated with text files (i.e., . txt , . doc , . pdf ) was not found. (Miss) Graphics Files Format: Graphic files (e.g., . bmp , . jpg , . gif , . png , . tif ) were not found. (Miss) Compressed File Archive Formats: Compressed data file (i.e., . zip , . rar , . exe , . tgz ) content was not found. (Miss) Misnamed Files: Misnamed files (e.g., . txt file renamed with a . dll extension) were not found. (Miss) Peripheral Memory Cards: N.A. - The Nokia 6610i does not allow for removable media. (NA) Acquisition Consistency: N.A. - The MD5/SHA1 hashing algorithms are used to determine whether a case file has been damaged, not to verify that the acquired data has not been altered after acquisition. (NA) Cleared Devices: N.A. - A Hard Reset function is not provided by the phone.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives say about 7.7 Ecosystem scale and interoperability? (Part 2) According to Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives, 7.7 Ecosystem scale and interoperability: ion of typically centrally administered cyber certifications, such as granting an Authority to Operate (govt) or the equivalent in commercial settings, and applicability to decentralized capabilities. - Overcoming cybersecurity practices which may result in siloing cyber knowledge in specific domains, e.g., industrial controls, space satellites. - Security and life cycle management concerns associated with dependence on open-source software [60]. Impact : The mechanics and patterns of linking traceability between blockchain solutions, for example to accommodate logistics, must ultimately stand up to the demands of multiple end operating environments and traceability ecosystems. The experience need not be the only teacher. Experiments, further proofs of concept, modeling and simulation could improve readiness and cyber resilience. By probing with adaptive models, we may anticipate constitution of transactions, in scope, identity solutions, content, vocabulary, synchronicity, and perhaps unforeseen characteristics when market forces and cyber adversaries are on the move.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Control according to Security and Privacy Controls for Information Systems and Organizations? Control: Employ a detonation chamber capability within [Assignment: organization-defined

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines on Electronic Mail Security provide? (Section 133) s (e.g., Windows, Linux, Unix). This arrangement introduces an added layer of complexity because that general-purpose operating system must also be secured in addition to the firewall software itself. Application layer firewalls are increasingly being deployed as appliance-based devices, which may use specialized operating systems. Routers and stateful inspection firewalls also typically run on specialized operating systems. To successfully protect a mail server using a firewall, ensure that the firewall is patched to the latest or most secure level (application and underlying operating system) and is both capable of and configured to support the following items: - GLYPH<c=31,font=/HABHKN+Webdings> Control all traffic between the Internet and the mail server - GLYPH<c=31,font=/HABHKN+Webdings> Block all inbound traffic to the mail server except that traffic which is required, such as TCP port 25 (SMTP).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Advanced Encryption Standard (AES) say about Table of Contents? (Part 5) According to Advanced Encryption Standard (AES), Table of Contents: Expansion of a 192-bit Key | . . . . . . . . . . . . . . . . . . | 30 | | A.3 | Expansion of a 256-bit Key | . . . . . . . . . . . . . . . . . . | 32 | | Appendix B -Cipher Example | Appendix B -Cipher Example | Appendix B -Cipher Example | 34 | | Appendix C -Example Vectors | Appendix C -Example Vectors | Appendix C -Example Vectors | 36 | | Appendix D -Change Log (Informative) | Appendix D -Change Log (Informative) | Appendix D -Change Log (Informative) | 37 |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Advanced Encryption Standard (AES).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DP-10 in Computer Security_ Selected Articles? (Part 38) Control DP-10: e computer security articles and a reading list of computer security publications. This information will benefit computer security managers as well as managers and users of information technology. 12. KEY WORDS (5 TO 12 ENTRIES; ALPHASETICAL ORDER; CAPITAUZE ONLY PROPER NAMES; AND SEPARATE KEY WORDS BY SEMICOLONS) encryption; internet; local area network; risk analysis; security; viruses 13. AVAILABILITY 14. NUMBER OF PRINTED PAGES UNUMITED FOR OFFICIAL DISTRIBUTION. DO NOT RELEASE TO NATIONAL TECHNICAL INFORMATION SERVICE (NTIS). 4 3 ORDER FROM SUPERINTENDENT OF DOCUMENTS, U.S. GOVERNMENT PRINTING OFFICE, WASHINGTON, DC 20402, 15. PRICE AO 3 1 A ORDER FROM NATIONAL TECHNICAL INFORMATION SERVICE (NTIS), SPRINGFIELD, VA 22161. .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security_ Selected Articles.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does User's Guide to Telework and Bring Your Own Device (BYOD) Security say about Authority? (Part 1) According to User's Guide to Telework and Bring Your Own Device (BYOD) Security, Authority: Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3541 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-114 Revision 1 Natl. Inst. Stand. Technol. Spec. Publ. 800-114rev1, 44 pages (July 2016) CODEN: NSPUE2 This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-114r1 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: User's Guide to Telework and Bring Your Own Device (BYOD) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Non-Fungible Token Security provide? (Section 21) point of a token's transaction history and determine its origin and where it has been. The ability to validate a token's history can help a user determine whether a token is fraudulent or legitimate. A blockchain could undergo an attack (e.g., 51 % attack [25]) that enables a malicious entity to change the blockchain history, but this is unlikely for established and widely used blockchains due to the significant resources dedicated to maintenance of those chains (e.g., either mining processing power or large staked holdings). A fundamental property of a blockchain is its ability to record data in a near-permanent manner based on its decentralized storage and cryptographic mechanisms. Other than the previously referenced 51% attack [25], there are some exceptions to a blockchain's permanence. One way to sidestep the property of permanence is to 'burn' the NFT. Transferring an NFT to an address that no one can access renders any further use of the NFT impossible. For example, sending any transaction to the Ethereum address '0x0000000000000000000000000000000000000000' will effectively destroy whatever is sent because there is no known private key that resolves to this address (and it is extremely unlikely for someone to find it) so no one can access the account. Other blockchains have specific addresses that the underlying blockchain code will prevent from sending transactions but can still receive transactions. These are hard coded burn addresses, so even if someone were to discover a private key that would resolve to that address, they could not claim any asset associated with it. There may be legitimate use cases for burning an NFT, such as to provide proof of burning to receive an upgraded NFT in a different smart contract or if the NFT is a consumable object in a blockchain-based video game (i.e., a unique item that provides some benefit for the player). Even though the NFT is burned, it still technically exists in the smart contract on the blockchain.

Explanation: NIST publication on credential and access management. Topics: token, sso. Contains security framework guidance for authentication systems. Source: Non-Fungible Token Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook provide? (Section 98) "Computer Security Training Guidelines,' dated July 1988. 7. Federal Information Processing Standards Publication (FIPS PUB) 73, "Guidelines for Security of Computer Applications,' dated June 1980. 8. FIPS PUB 39, "Glossary for Computer Systems Security,' dated February 1976. 9. DOD Trusted Computer System Evaluation Criteria, DOD 5200.28-STD, dated December 1985. 10. National Computer Security Center, NCSC-TG-004, Version 1, "Glossary of Computer Security Terms,' dated October 1988. - B. NASA MANAGEMENT INSTRUCTIONS AND HANDBOOKS 1. NMI 1152.19, "NASA Information Security Program Committee.' 2. NMI 1200.7, "NASA's Internal Control System.' 3. NMI 1371.3, "Coordination of Foreign Visitor Activity." 4. NMI 1610.3, "Personnel Security Program." 5. NHB 1610.6, "NASA Personnel Security Handbook." 6. NMI 1630.2, "Delegation of Authority to Certify for Access 5. to Restricted Data." 7. NHB 1640.4, "NASA Information Security Program." 8. NMI 1640.7, "Delegation of Authority to Make Determinations in Original Classification Matters." 9. NMI 1650.1, "Industrial Security Policies and Procedures." 10. NHB 2410.1, "Information Processing Resources Management." 11. NMI 2410.7, "Assuring the Security and Integrity of NASA 11. Automated Information Resources." 12. NMI 2520.1, "Communications System Management." 13. NMI 9810.1, "The NASA Investigations Program." - C. NASA HEADQUARTERS IRM OFFICE DOCUMENTS NASA Computer Security Awareness and Training (CSAT) Guide, dated April, 1990.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook.