You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DS-2 in Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? (Part 64) Control DS-2: rt, or protocol (TCP or UDP) that is not explicitly permitted Procedure 1. As stipulated in the preconditions, just before this test, test IoT-1-v4 (or IoT-1-v6) must have been run successfully. 2. Local-network (ingress): Initiate communications to the IoT device from anyhost-from for specific permitted service, and verify that this traffic is received at the IoT device. 3. Local-network (egress): Initiate communications from the IoT de- vice to anyhost-from for specific permitted service, and verify that this traffic is received at the MUD PEP, but it is not forwarded by the MUD PEP, nor is it received at anyhost-from. 4. Local-network, controller, my-controller, manufacturer class (egress): Initiate communications from the IoT device to anyhost-to for specific permitted service, and verify that this traffic is received at anyhost-to. 5. Local-network, controller, my-controller, manufacturer class (in- gress): Initiate communications to the IoT device from anyhost-to for specific permitted service, and verify that this traffic is received NIST SP 1800-15D: Securing Small-Business and Home Internet of Things Devices 157 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 Test Case Field Description at the MUD PEP, but it is not forwarded by the MUD PEP, nor is it received at the IoT device. 6. No associated class (egress): Initiate communications from the IoT device to unnamed-host (where unnamed-host is a host that is not from the same manufacturer as the IoT device in question and whose MUD URL is not explicitly mentioned in the MUD file as be- ing permitted), and verify that this traffic is received at the MUD PEP, but it is not forwarded by the MUD PEP, nor is it received at unnamed-host. 7.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.2 Extensible Configuration Checklist Description Format (XCCDF) according to NIST The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2 According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2, 3.2 Extensible Configuration Checklist Description Format (XCCDF): This section lists requirements and recommendations for using the Extensible Configuration Checklist Description Format (XCCDF) to express an XCCDF benchmark or tailoring component of an SCAP source data stream (see Table 12). They are organized by the following categories: general , <xccdf:Benchmark> , <xccdf:Profile> , <xccdf:Rule> , <xccdf:Value> , and <xccdf:Group>.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Guidelines for Smart Grid Cybersecurity? (Part 520) Control SI-11: 1 - R T A s m e t s y s d n a i n o i t a c n u m m o c y c a g e L : 1 1 - R T A l s o c o t o r p e g r a l r o f t n e m e g a n a m y e K : 3 1 - R T A i s e c v e d f o s r e b m u n i s e c v e d r o f i s t n a r t s n o c t n e m e g a n a m e t a d p u d n a h c t a P : 4 1 - R T A d e t s u r t n u , e r u c e s n I : 2 1 - R T A s n o i t a c o l , y t i l i b a i r a v , y t i l i i b

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Authentication Methods : according to NIST Blockchain Networks_ Token Design and Management Overview According to Blockchain Networks_ Token Design and Management Overview, Authentication Methods :: Stateful tokens allow lightweight blockchain-based authentication methods to be built. The blockchain is essential but thinly used since only reading access is required for status verification. Blockchain-based data stores for status querying can have multiple architectures (see Section 4.4 in [18]). They can be built as smart contract registries that are user-controlled, issuer- or consortium-controlled, or ownerless. These differ from nonfungible token factory contracts in that token ownership is not meant to be reassigned. Alternatively, blockchain-based data stores can be built on UTXO-based blockchains. Finally, the querying logic may involve additional components, such as status update batching protocols 2 or cryptographic accumulators. 3 The verifiable credential standard [19] published by the World Wide Web Consortium (W3C) specifies data field formats that provide the location and querying logic of data stores for stateful token status. Additionally, blockchain-based identifier systems can make it easier to resolve and authenticate the digital signatures of cryptographically signed content. In particular, they can be used to identify the owners and issuers of stateful tokens (and any other entities whose public key is present in the token). These systems may follow the decentralized identifier (DID) standard [20] (see Section 5.1.3.2). Their data stores can have blockchain-based architectures similar to the ones discussed above (further examined in [18]), which may be complemented by additional smart contracts for public credentials registries, such as those introduced in the draft ERC-780 [21] proposal.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is PCTS according to Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI? PCTS: 151-1 Version: 1.1 -07/01/91

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Information Security Handbook_ A Guide for Managers? (Part 222) Control PD-12: onse capability involves the participation of many people within the organization. Making the right planning and implementation decisions is key to establishing a successful incident response program. One of the first planning tasks should be to develop an organization-specific definition of the term 'incident' so that the scope of the term is clear. Additional tasks that should be performed during the preparation phase include the following: - Create an Incident Response Policy. The policy should define what events are considered incidents, establish the organizational structure for incident response, define roles and responsibilities, and list the organization's incident reporting requirements. - Develop Incident Response and Reporting Procedures. Based on the incident response policy, standard operating procedures (SOPs) are a delineation of the specific technical processes, techniques, checklists, and forms used by the incident response team. SOPs should be comprehensive and detailed to ensure that the organization's priorities are properly reflected in response operations. In addition, following standardized response procedures is also an effective way to minimize errors, particularly those that might be caused by incident handling pace and stress. Prior to implementation, the organization should test incident response SOPs in order to validate their accuracy and usefulness. Once validated, the SOPs must be widely disseminated throughout the organization. Incidents can occur in countless and unpredictable ways; therefore, it is impractical to develop comprehensive procedures with step-by-step instructions for handling every incident. The best that the organization can do is prepare to handle any type of incident, and more specifically, to handle common types of incidents. - Establish Guidelines for Communicating with External Parties.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols say about 5.3.2 Security Services? (Part 2) According to Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols, 5.3.2 Security Services: ce Address within the protected header.The peer SP3 is authenticated by pairwise keying. The source end system is authenticated to be a member of the set of addresses served by the peer SP3 entity. 8. SP3 supplies in the Indication a representation (Security Labeljndicated) of a security label which has been carried with integrity. 9. SP3 supports access control. The key service external to SP3 may choose, for access control reasons, not to make a key available for communication between two SP3 entities. This decision by the key service implies an access control service at the upper interface of SP3, since SP3 will not allow communication if an appropriate key is not present. In addition, if a security label is provided for the data, then SP3 will make an access control check against this label on both transmit and receive.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is CHIEF INFORMATION SECURITY OFFICER according to Minimum Security Requirements for Federal Information and Information Systems? CHIEF INFORMATION SECURITY OFFICER: See Senior Agency Information Security Officer.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Minimum Security Requirements for Federal Information and Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in Recommendation for Stateful Hash-Based Signature Schemes? (Part 28) Control HA-256: | 32 | 25 | ## 4.4 LMS with SHAKE256/192 When generating LMS or HSS key pairs using SHAKE256/192, the LMS and LM-OTS parameter sets shall be selected from the following two tables. Table 7: LM-OTS parameter sets for SHAKE256/192 | LM-OTS Parameter Sets | Numeric Identifier | n | w | p | |-------------------------|----------------------|-----|-----|-----| | LMOTS_SHAKE_N24_W1 | TBD | 24 | 1 | 200 | | LMOTS_SHAKE_N24_W2 | TBD | 24 | 2 | 101 | | LMOTS_SHAKE_N24_W4 | TBD | 24 | 4 | 51 | | LMOTS_SHAKE_N24_W8 | TBD | 24 | 8 | 26 | Table 8: LMS parameter sets for SHAKE256/192 | LMS Parameter Sets | Numeric Identifier | m | h | |----------------------|----------------------|-----|-----| | LMS_ SHAKE_M24_H5 | TBD | 24 | 5 | | LMS_ SHAKE_M24_H10 | TBD | 24 | 10 | | LMS_ SHAKE_M24_H15 | TBD | 24 | 15 | | LMS_ SHAKE_M24_H20 | TBD | 24 | 20 | | LMS_ SHAKE_M24_H25 | TBD | 24 | 25 | ## 5 eXtended Merkle Signature Scheme (XMSS) Parameter Sets The XMSS and XMSS MT algorithms are described in RFC 8391 [1]. This Special Publication approves the use of XMSS and XMSS MT with four different hash functions: SHA-256, SHA256/192, SHAKE256/256, and SHAKE256/192 (see Section 2.3). 5 The parameter sets that use SHA-256 are defined in RFC 8391 [1]. The parameter sets that use SHA-256/192, SHAKE256/256, and SHAKE256/192 are defined below. The WOTS + parameters that correspond to the use of each of these hash functions are specified in the following table.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Stateful Hash-Based Signature Schemes.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3 provide? (Section 154) es intended to handle sensitive data, in four increasing levels of stringency. The levels are intended to cater to the degree of data sensitivity required by the applications utilizing a given module. The security levels presented in FIPS 140-2 are as follows: Security Level 1 is the lowest level which 'allows the software and firmware components of a cryptographic module to be executed on a general-purpose computing system using an unevaluated operating system. Such implementations may be appropriate for some low-level security applications when other controls, such as physical security, network security, and administrative procedures are limited or nonexistent [155].' (p.1) 'Security Level 2 enhances the physical security mechanisms of a Security Level 1 cryptographic module by adding the requirement for tamper-evidence, which includes the use of tamper-evident coatings or seals or for pick-resistant locks on removable covers or doors of the module. Tamper-evident coatings or seals are placed on a cryptographic module so that the coating or seal must be broken to attain physical access to the plaintext cryptographic keys and critical security parameters (CSPs) within the module. Tamper-evident seals or pick-resistant locks are placed on covers or doors to protect against unauthorized physical access. Security Level 2 requires, at a minimum, role-based authentication in which a cryptographic module authenticates the authorization of an operator to assume a specific role and perform a corresponding set of services [155].' (p. 2) Security Level 3: 'In addition to the tamper-evident physical security mechanisms required at Security Level 2, Security Level 3 attempts to prevent the intruder from gaining access to CSPs [critical security parameters] held within the cryptographic module.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain REFERENCES according to NIST Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, REFERENCES: Source Control: SC-15 Supporting Publications: None

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Computer Security Division 2007 Annual Report? (Part 32) Control HA-1: e that includes interagency and interdepartmental participation from NIST, the National Security Agency (NSA), the Defense Information Systems Agency (DISA), and the Department of Defense (DoD). This program focuses on a standard, automated approach for the implementation of information system security controls, which includes the following objectives: - Develop requirements for automated sharing of information security data; - Customize and manage configuration baselines for various IT products; - Assess information systems and report compliance status; - Use standard metrics to weight and aggregate potential vulnerability impact; and - Remediate identified vulnerabilities. Recognizing that NIST has the responsibility to produce security configuration guidance for the U.S. Government, and that NSA and DISA provide the same service to DoD, ISAP consolidates data sources from these agencies and provides the data in a standardized XML format. Commercial-off-theshelf (COTS) and government-off-the-shelf (GOTS) software products and initiatives utilize this security-related data for the purposes of automating the identification and remediation of vulnerabilities, measuring potential impact, and conducting compliance reporting in the various computing infrastructures. The freely available information contained in ISAP files includes, but is not limited to: - Checking for vulnerabilities (security-related software flaws and misconfigurations) on an information technology asset; - Mapping to higher-level policies, such as FISMA via NIST SP 800-53, DoD 8500 Information Assurance (IA) controls, etc.; and - Providing a standard impact metric for vulnerabilities and a capability to aggregate impact scores to the agency reporting level.

Explanation: NIST publication discussing classified information handling. References: national security, defense information. Contains guidance on protecting sensitive government information. Source: Computer Security Division 2007 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Product Supplier according to Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI? Product Supplier: Digital Equipment Corporation


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 22) Control HA-1: enhanced distributed trust model and authorisation decision making capability that can be implemented by using X.509 attribute certificates and a Privilege Management Infrastructure such as PERMIS. Several different combinatorial approaches can be taken, depending upon the trust models adopted by the Shibboleth target and origin sites, and each of these are described. The paper also discusses whether user privacy, which is strongly protected by Shibboleth, is bound to be weakened by the use of X.509 attribute certificates rather than simple attributes, and concludes that this does not have to be the case. ## 1. Introduction Shibboleth [1] is a distributed web resource access control system that allows federations to co-operate together to share web based resources. It has done this by defining a protocol for carrying authentication information and user attributes from a home site to a resource site. The resource site can then use the attributes to make access control decisions about the user. The Shibboleth project is run by the Internet2 consortium in the USA, and universities throughout the USA and Europe (at least) are now starting to build experimental services based upon it. At the heart of Shibboleth is a trust model that allows the members of a federation to cooperate together. This trust model, whilst functional, is somewhat limited. Basically each Shibboleth target resource site trusts each Shibboleth origin (home) site in the federation, so that whatever assertions authentication or authorisation -are digitally signed by the origin site, they will be believed and trusted by the target site. There is little scope for differentiation between authentication authorities and attribute authorities, or for allowing more sophisticated distribution of trust, such as static or dynamic delegation of authority.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile say about 7. Manufacturing Profile Subcategory Guidance? (Part 5) According to Cybersecurity Framework Manufacturing Profile, 7. Manufacturing Profile Subcategory Guidance: | | IDENTIFY | (ID.AM) | | High Employ automated mechanisms where safe and feasible to detect the presence of unauthorized software within the system. | CM-8 (2)(3) | | Function | Category | Subcategory | Manufacturing Profile | Reference | |------------|--------------------------|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------| | IDENTIFY | Asset Management (ID.AM) | ID.AM-3 | Low Document all connections within the manufacturing system, and between the manufacturing system and other systems. All connections are documented, authorized, and reviewed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 574) fe cycle, organizations may be able to modify the system design to reduce the critical nature of these components and functions, such as by adding redundancy or alternate paths into the system design. Criticality analysis can also influence the protection measures required by development contractors. In addition to criticality analysis for systems, system components, and system services, criticality analysis of information is an important consideration. Such analysis is conducted as part of security categorization in RA-2. Related Controls: CP-2, PL-2, PL-8, PL-11, PM-1, PM-11, RA-2, SA-8, SA-15, SA-20, SR-5. Control Enhancements: None. References: [IR 8179]. RA-10 THREAT HUNTING Control: CHAPTER THREE PAGE 247 NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ a. Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existing controls; and b. Employ the threat hunting capability [Assignment: organization-defined frequency]. Discussion: Threat hunting is an active means of cyber defense in contrast to traditional protection measures, such as firewalls, intrusion detection and prevention systems, quarantining malicious code in sandboxes, and Security Information and Event Management technologies and systems. Cyber threat hunting involves proactively searching organizational systems, networks, and infrastructure for advanced threats. The objective is to track and disrupt cyber adversaries as early as possible in the attack sequence and to measurably improve the speed and accuracy of organizational responses.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to General Server Security? (Part 59) Control ES-1: lnerabilities and related patches available that should be installed or configured as part of the setup process. Only after these preliminary steps are accomplished should the installation be started. Note that this section discusses only generic installation and configuration procedures; specific directions for particular servers are available from server manufacturers and from security checklist repositories. 24 A partially configured and/or patched server should not be exposed to external networks (e.g., the Internet) or external users. In addition, internal network access should be as limited as possible until all software is installed, patched, and configured securely. Insecure servers can be compromised in a matter of minutes after being placed on the Internet. While it is ideal to fully harden the platform before placing it on the network, it is not always feasible. For example, some application development tool combinations cannot be installed, configured, and tested on top of a pre-hardened OS and Web server configuration. In such situations, stepwise or incremental hardening is a viable option to consider, with full validation of complete hardening occurring at production deployment. ## 5.1 Securely Installing the Server Software In many respects, the secure installation and configuration of the server software mirrors the OS process discussed in Section 4. The overarching principle, as before, is to install only the services required for the server and to eliminate any known vulnerabilities through patches or upgrades. Any unnecessary applications, services, or scripts that are installed should be removed immediately once the installation process is complete. During the installation of the server software, the following steps should be performed: - GLYPH<c=31,font=/MIJOHI+Webdings> Install the server software either on a dedicated host or on a dedicated guest OS if virtualization is being employed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to General Server Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Key Rollover according to Secure Domain Name System (DNS) Deployment Guide? Key Rollover: The process of generating and using a new key (symmetric or asymmetric key pair) to replace one already in use. Rollover is done because a key has been compromised or is vulnerable to compromise as a result of use and age.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Domain Name System (DNS) Deployment Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways? (Part 10) Control AM-1: implement access control across heterogeneous networks to unpatched assets. It continuously monitors all connected devices and automates response when noncompliance or unpatched assets are detected. ## 4.1.4 IBM IBM MaaS360 with Watson is a unified endpoint management (UEM) solution that transforms how organizations support users, apps, content, and data across every type of mobile device: laptops, smartphones, tablets, and IoT. IBM MaaS360 was built almost twenty years ago as a cloud-based Software-as-a-Service (SaaS) platform that integrates with preferred security and productivity tools, allowing modern business leaders to derive immediate value. IBM MaaS360 is the only UEM platform that leverages the power of the Watson Artificial Intelligence engine to deliver contextually relevant security insights for administrators, while ensuring continuous monitoring of the riskiest end users. IBM Code Risk Analyzer was developed in conjunction with IBM Research projects and customer feedback. It enables developers to quickly assess and remediate security and legal risks that they are potentially introducing into their source code, and it provides feedback directly in Git artifacts (for example, pull/merge requests) as part of continuous delivery in a DevOps pipeline. IBM Code Risk Analyzer is provided as a set of Tekton tasks, which can be easily incorporated into delivery pipelines. ## 4.1.5 Lookout Lookout is an integrated endpoint-to-cloud security solution provider with mobile endpoint protection offerings. Lookout's Mobile Endpoint Security (MES) solution provides cloud-centric behavior-based detection capabilities; it performs behavioral analysis based on telemetry data from nearly 200 million devices and over 120 million apps. This analysis enables Lookout to deliver efficient protection with a lightweight app on the device that optimizes processor speed and battery life.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2017 NIST_ITL Cybersecurity Program Annual Report say about CONTACT:? According to 2017 NIST_ITL Cybersecurity Program Annual Report, CONTACT:: Dr. Apostol Vassilev (301) 975-3221 apostol.vassilev@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-140 in Computer Security Division 2003 Annual Report? (Part 15) Control PS-140: artment of Treasury, agencies participating in the Federal PKI Steering Committee and Bridge CA Project, the Federal Deposit Insurance Corporation (FDIC), and the National Security Agency (NSA). Projects in this area have worked with the American National Standards Institute's (ANSI's) X9 Committee that develops standards for the financial industry, as well as with the Internet Engineering Task Force's (IETF's) PKIX Working Group. Industry collaborators in this area have included RSA Security Entrust Technologies, IBM, Mastercard, Visa, Verizon, VeriSign, Microsoft, and others. ## ACCOMPLISHMENTS ## CRYPTOGRAPHIC STANDARDS TOOLKIT T he aim of the Cryptographic Standards Toolkit (CToolkit) project is to enable U.S. governmental agencies, and others, to select cryptographic security components and functionality for protecting their data, communications, and operations. The Toolkit helps to ensure that there is worldwide government and industry use of strong cryptography, and that secure interoperability is achieved through standard algorithms. The Toolkit also makes guidance and education available in the use of cryptography. The Toolkit currently includes a wide variety of cryptographic algorithms and techniques for encryption, authentication, non-repudiation, key establishment, and random number generation. The Toolkit is a collection of standards and guidance, and does not include any actual software implementations of the algorithms. Many of the projects discussed in this area of work are combined to form the CToolkit. The past year has seen a great deal of work go into the CToolkit. A draft version of the NIST Special Publications 800-56 Recommendation on Key Establishment Schemes and 800-57 Recommendation on Key Management were issued for public review in January 2003.

Explanation: NIST publication on credential and access management. Topics: authentication, pki, key management. Contains security framework guidance for authentication systems. Source: Computer Security Division 2003 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Interview according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Interview: [SELECT FROM: personnel with assessment and auditing responsibilities; system administrators; personnel with security responsibilities]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Electronic Mail Security say about 4.6 General Information System Security Principles? (Part 2) According to Guidelines on Electronic Mail Security, 4.6 General Information System Security Principles: e security administrator. - GLYPH<c=31,font=/HABHKN+Webdings> Least Privilege -This principle dictates that each task, process, or user is granted the minimum rights required to perform its job. By applying this principle consistently, should a task, process, or user be compromised, the scope of damage is constrained to the limited resources available to the compromised entity. - GLYPH<c=31,font=/HABHKN+Webdings> Psychological Acceptability -Users should understand the necessity of security. This can be provided through training and education. In addition, the security mechanisms in place should present users with sensible options that give them the usability they require on a daily basis. If users find the security mechanisms too cumbersome, they may devise ways to work around or compromise them. The objective is not to weaken security so it is understandable and acceptable, but to train, educate, and design security mechanisms and policies that are usable and effective. - GLYPH<c=31,font=/HABHKN+Webdings> Least Common Mechanism -When providing a feature to the system, it is best to have a process or service gain some function without granting the same function to other parts of the system. The ability for the mail server process to access a backend database, for instance, should not also enable other applications on the system to access the backend database. - GLYPH<c=31,font=/HABHKN+Webdings> Defense in Depth -Organizations should understand that a single security mechanism would generally prove insufficient. Security mechanisms (defenses) need to be layered so that compromise of a single security mechanism is insufficient to compromise a host or network. There is no 'silver bullet' for information system security. - GLYPH<c=31,font=/HABHKN+Webdings> Work Factor -Organizations should understand what it would take to break the system or network's security features.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Note according to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case? Note: The software is tied to a Windows user account. Any changes made by a user would not be visible to a different user logging in to the same system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DS-3 in Cryptographic Key Management Workshop Summary -- June 8-9, 2009? (Part 71) Control DS-3: , and use (recall that the electronic distribution of wrapped keys led to an improvement over manually distributed keys, and public key-based key distribution led to an improvement over key wrapping). - A holistic approach to enterprise key management is needed, where a complete standard set of key management capabilities would be widely available for information protection. - Customers want to defer to authorities to tell them what key management system is good, better, and best. There is a need for a public-private partnership that allows the new CKM technologies to incubate and be evaluated, so that consumers will accept the solutions when they become available. The RSA algorithm had to be vetted for some time before it became accepted. - We must have a uniform solution to a uniform family of problems. We need a glossary of security to minimize undefined buzzwords that are used to sell commercial products. A well-understood standard lexicon is needed in security. ## 3.13 New Technologies New CKM technologies are needed to keep up with the increased demand for security, due to significant increases in computer capability, applications, and usage. New or greatly improved technologies are needed in: quantum cryptographic algorithms/computing, cloud computing, identity-based cryptography, security improvements, speed improvements, usability improvements, and cost reductions. The following are highlights of presentations from the workshop that are related to new technologies. - In computer technology, we keep moving faster and faster. We have seen an improvement of price-performance in computer technology by a factor of nearly one million in the past 30 years. - Cloud computing will provide convenient, remote, on-demand utilization (e.g., rental) of computing power and applications that the user cannot afford to maintain locally, but may need from time to time.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cryptographic Key Management Workshop Summary -- June 8-9, 2009.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i say about 10.4 IEEE 802.11 RSN Operation? (Part 1) According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i, 10.4 IEEE 802.11 RSN Operation: 10.4 IEEE 802.11 RSN Operation IEEE 802.11 RSN operation is based on a frame exchange protocol used to transfer frames between WLAN components-STAs, APs, and ASs. The protocol uses three types of IEEE 802.11 frames, as follows: - GLYPH<c=31,font=/HACNND+Webdings> Data frames , which encapsulate upper layer protocol packets, including user data (e.g., e-mail, Web pages). - GLYPH<c=31,font=/HACNND+Webdings> Management frames , which include the management of association and deassociation activities, authentication, probes, and beacons. - GLYPH<c=31,font=/HACNND+Webdings> Control frames , which are used for requesting and controlling access to the wireless media, such as sending an acknowledgement after receiving a data frame. By grouping the frame exchanges within the frame exchange protocol by function, IEEE 802.11 RSN operation may be thought of as occurring in five distinct phases: - GLYPH<c=31,font=/HACNND+Webdings> RSN Operation Phase 1: Discovery. The STA identifies an AP for a WLAN with which it wishes to communicate. The STA locates an AP either by receiving one of the AP's periodic transmissions of Beacon frames, or by sending a Probe Request to solicit a Probe Response from an AP. After the STA has identified an AP, the STA and the AP exchange frames to negotiate various parameters for their communications. By the end of the phase, the STA and AP have agreed on an authentication method. - GLYPH<c=31,font=/HACNND+Webdings> RSN Operation Phase 2: Authentication. During this phase, the STA and AS prove their identities to each other. The authentication frames pass through the AP, which also blocks nonauthentication traffic from the STA using IEEE 802.1X port-based access control. The actual authentication mechanism is implemented by the STA and AS using EAP.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-128 in A Framework for Designing Cryptographic Key Management Systems? (Part 39) Control ES-128: ate Applications for the Key: This element specifies applications for which the key may be used. Examples include Kerberos, Signed E-Mail, Trusted Time Stamp, Code Signing, File Encryption, and IPSEC. - n) Key Security Policy Identifier: This element identifies the security policy applicable to the key or key type. A Key Security Policy is a set of security controls that are used to protect the key or key type during the lifecycle of the key from generation to destruction (see Section 6.7 and [RFC 3647]). A Key Security Policy is typically represented by an object identifier registered by the CKMS organization. The Key Security Policy for individual keys or key types is part of, and should be consistent with, the CKMS Security Policy. 5 Key type also implies key usage, since usage is one of the two factors that define key type. Thus, the key usage implied by the key type should be consistent with the application of the key. SP 800-130 August 2013 - o) Key Access Control List (ACL) 6 : An access control list identifies the entities that can access and/or use the keys as constrained by the key and metadata management functions (see Section 6.7). This Framework does not specify the access control list structure. The following are examples of such structures: a Microsoft Windows file/folder access control list consisting of zero or more access control entries, a Sun File System access control list, and while not a list, the Unix protection bits. In cases where interoperability is desired, the following items may require standardization: the syntax and semantics of the separators among access control entries, the ordering of entity and 'access modes' within an access control entry, the entity identifier, and the designation of bits for different 'access modes'.

Explanation: NIST publication on credential and access management. Topics: access control, key management. Contains security framework guidance for authentication systems. Source: A Framework for Designing Cryptographic Key Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 8.2.2.4 BER-TLV for the Derived PIV Data Objects according to NIST Derived PIV Application and Data Model Test Guidelines According to Derived PIV Application and Data Model Test Guidelines, 8.2.2.4 BER-TLV for the Derived PIV Data Objects: | Test Assertion | TA-08.02.02.04 | |----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Purpose | Confirms the BER-TLV tags for the data objects implemented within the Derived PIV Application. | | DTR(s) | • DTR-06.02.02.10 | | Vendor Documentation | The vendor to provide in its documentation the list of all the data objects implemented in the Derived PIV Application with the BER-TLV tags associated with each of them. |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Attribute Based Access Control (ABAC) Definition and Considerations say about 3.2.2.7 A Shared Repository for Subject Attributes? According to Guide to Attribute Based Access Control (ABAC) Definition and Considerations, 3.2.2.7 A Shared Repository for Subject Attributes: Direct use of shared repositories for subject attributes should be considered where there is sufficient network connectivity to take advantage of economies of scale, increased quality control, and standard interfaces. Another advantage of using shared attribute repositories is that they provide a single access point for data from multiple sources. Building and managing a connection to a single access point may be less complex than managing multiple connections. In some cases, limited connectivity, insufficient bandwidth, or intermittent connections may prevent authorization service providers from being able to use shared repositories reliably. It may be necessary to maintain local copies of data that cannot be continuously in sync with a shared attribute repository, and thus not have access to current data.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Guide to Attribute Based Access Control (ABAC) Definition and Considerations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation provide? (Section 86) -|---------------------------------------------------|----------|------------| | Data Element (TLV) | Tag | Type | Max. Bytes | | Certificate | 0x70 | Variable | 1856 27 | | CertInfo | 0x71 | Fixed | 1 | | MSCUID (Optional) | 0x72 | Variable | 38 | | Error Detection Code | 0xFE | LRC | 0 | Table 31. Retired X.509 Certificate for Key Management 11 | Retired X.509 Certificate for Key Management 11 | Retired X.509 Certificate for Key Management 11 | 0x100B | 0x100B | |---------------------------------------------------|---------------------------------------------------|----------|------------| | Data Element (TLV) | Tag | Type | Max. Bytes | | Certificate | 0x70 | Variable | 1856 27 | | CertInfo | 0x71 | Fixed | 1 | | MSCUID (Optional) | 0x72 | Variable | 38 | | Error Detection Code | 0xFE | LRC | 0 | Table 32.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 1 – General say about B.3.10 Static Key-Agreement Key Pairs? According to Recommendation for Key Management_ Part 1 – General, B.3.10 Static Key-Agreement Key Pairs: Static key-agreement key pairs are used to establish shared secrets between entities (see SP 80056A and SP 800-56B), sometimes in conjunction with ephemeral key pairs (see SP 800-56A). Each entity uses its private key-agreement key(s), the other entity's public key-agreement key(s), and possibly its own public key-agreement key(s) to determine the shared secret. The shared secret is subsequently used to derive shared keying material. Note that in some key-agreement schemes, one or more of the entities may not use a static key-agreement pair (see SP 800-56A and SP 80056B).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report of the Workshop on Software Measures and Metrics to Reduce Security Vulnerabilities (SwMM-RSV) say about William R. Nichols, Software Engineering Institute? (Part 1) According to Report of the Workshop on Software Measures and Metrics to Reduce Security Vulnerabilities (SwMM-RSV), William R. Nichols, Software Engineering Institute: William R. Nichols, Software Engineering Institute A recent update to a major mobile OS included security patches to address violations of least privilege, buffer overflows and multiple cases of memory corruption, all of which were common security problems as long ago as the 1990s. It's striking that after all these years, common implementation defects remain a major source of software security vulnerabilities, including such well known examples as OpenSSL Heartbleed and Apple 'goto fail.' Research literature shows that software defect rates contribute to these vulnerabilities, providing evidence that 1% to 3% of all released defects in the Windows and Linux operating systems were potentially exploitable. Based on this, we at the SEI believed that 1) quality attributes such as security are undermined by defects, 2) defective software cannot be secure, and 3) we can estimate the number of vulnerabilities if we know the overall defect level. To test this, we examined a small number of industry software products that have very low levels of defects. In these products, we found proportionally lower levels of vulnerabilities or safety critical issues. What the products had in common was a robust measurement framework supporting early and effective defect removal; this framework allowed the system developers to manage the quality processes during implementation. We therefore concluded that improving the quality in implementation is something that can be and is being done right now to reduce security vulnerabilities. While the current quality improvements are a step in the right direction, they're only one part of making secure software. The software development lifecycle can incorporate many tools that can statically analyze source code, statically and dynamically analyze executables, examine for code coverage, scan web services, implement numerous testing techniques, and so forth.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Workshop on Software Measures and Metrics to Reduce Security Vulnerabilities (SwMM-RSV).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Interview according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Interview: [SELECT FROM: personnel with account management responsibilities; system administrators; personnel with information security responsibilities; system developers]


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Bluetooth Security provide? (Section 71) itiator to B, encryption setup will begin after that initial authentication. If the encryption setup being successful is good enough to satisfy B, then B may never bother to attempt to authenticate A. | 1.0 1.1 1.2 2.0 2.1 3.0 | Bluetooth offers several benefits and advantages, but the benefits are not provided without risk. Bluetooth and associated devices are susceptible to general wireless networking threats, such as denial of service attacks, eavesdropping, MITM attacks, message modification, and resource misappropriation, 31 and are also threatened by more specific Bluetooth related attacks, such as the following: - Bluesnarfing. Bluesnarfing 32 enables attackers to gain access to a Bluetooth-enabled device by exploiting a firmware flaw in older (circa 2003) devices. This attack forces a connection to a Bluetooth device, allowing access to data stored on the device including the device's international mobile equipment identity (IMEI). The IMEI is a unique identifier for each device that an attacker could potentially use to route all incoming calls from the user's device to the attacker's device. 31 Additional information on general wireless security threats is available in Section 3 of NIST SP 800-48 Revision 1, Guide to Securing Legacy IEEE 802.11 Wireless Networks (https://doi.org/10.6028/NIST.SP.800-48r1). 32 - Bluejacking. Bluejacking is an attack conducted on Bluetooth-enabled mobile devices, such as cell phones. An attacker initiates bluejacking by sending unsolicited messages to the user of a Bluetooth-enabled device. The actual messages do not cause harm to the user's device, but they may entice the user to respond in some fashion or add the new contact to the device's address book. This message-sending attack resembles spam and phishing attacks conducted against email users. Bluejacking can cause harm when a user initiates a response to a bluejacking message sent with a harmful intent.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Guide to Bluetooth Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Access Control for SAR Systems provide? (Section 40) EP is the system entity that performs access control by making decision requests and enforcing authorization decisions by the PDP. The PEP receives access requests from an Access Requester . An Access Requester may be any entity that requires access to a resource including a machine process requiring access to a file or a user requiring access to a database record. The Policy Information Point (PIP) provides the interface to access subject, resource and other attributes. A more detailed description of the XACML data-flow model is found in [OASIS-a]. Figure 3. XACML Data-Flow Model [OASIS-a]. <!-- image --> The PET system embodies a simplification of the XACML data-flow model architecture. For instance, PET combines the functionality of the PEP and Context Handler into a single PEP entity. In addition, certain components of the XACML data-flow model are omitted including the PAP (since the implemented PDP provides direct access to the system's policies) and obligation services. The simplified PET architecture is shown in Figure 4. The operation of the PET begins with a user authentication process. During the user authentication process, a user submits a login ID and password to the PEP via the PET (login) web interface. After receiving a user ID and password, the PEP attempts to authenticate the user by matching the received user ID and password against entries in the Subject (User) database. If a match exists, the PEP will (1) authorize the user for access to the PET system, (2) create a new user session, and (3) return the main PET page. If a match does not exist, however, the PEP returns an error to the user. The PET user authentication process is shown in Figure 5. Figure 4. PET architecture. <!-- image --> Figure 5. PET user authentication. <!-- image --> After being authorized by the PEP, the user may then query the system for SAR records.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Access Control for SAR Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Password-Based Key Derivation_ Part 1_ Storage Applications say about Recommendation for Password-Based Key Derivation Part 1: Storage Applications? According to Recommendation for Password-Based Key Derivation_ Part 1_ Storage Applications, Recommendation for Password-Based Key Derivation Part 1: Storage Applications: Meltem Sönmez Turan, Elaine Barker, William Burr, and Lily Chen Computer Security Division Information Technology Laboratory

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Password-Based Key Derivation_ Part 1_ Storage Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 11.1.2.2 Verify id-fpki -com mon-authentication OID according to NIST PIV Data Model Test Guidelines According to PIV Data Model Test Guidelines, 11.1.2.2 Verify id-fpki -com mon-authentication OID: 11.1.2.2 Verify id-fpki -com mon-authentication OID | Purpose | Confirms that the PIV Authentication certificate asserts the id-fpki- common-authentication OID. | |--------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Reference(s) | 1. AS07.01.06 | | Precondition | 1. A valid PIV card is inserted into the contact reader. 2. A valid PC/SC connection exists between the test application and the contact reader. 3. The test application is currently connected to the card application sible through card handle. nt which is acces 4. A PIV authentication key and corresponding certificate are prese on the PIV card. | | Test Steps | 1. Set cardHandle := <<valid card handle>> <PIV Authentication Certificate d values from the certificate 2. Set OID := < (2.16.840.1.101.3.7.2.1.1)>> 3. Call pivGetData w/ • (IN) cardHandle • (IN) OID • (OUT) data 4. Extract certificatePolicies->policyIdentifier extension fiel | | Expected Result(s) | A policyIdentifier field in the certificatePolicies extension asserts id- fpki-common-authentication. |

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PE-6 in Identity and Access Management for Electric Utilities? (Part 68) Control PE-6: ide. Firewall Configurations 3.2 The firewalls were deployed to minimize the allowed traffic among the silo networks, as well as to minimize the traffic received from the DMZ and the public internet. The goal was to limit the cross- network traffic/connections to only those required to support the use case. The following firewall configurations include the rules that were implemented in each of the firewalls for the build implementation (Table 3-1 through Table 3-5). These configurations are provided to enable the reader to reproduce the traffic filtering/blocking that was achieved in the build implementation.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Guidelines for Storage Infrastructure say about Table of Contents? (Part 17) According to Security Guidelines for Storage Infrastructure, Table of Contents: | Authentication Recommendations...................................................... 34 | |---------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------| | | 4.3.2 Password Recommendations............................................................. | 34 | | | 4.3.3 Account Management Recommendations.......................................... | 35 | | | 4.3.4 Privilege and Session Management | Recommendations .................... 36 | | | 4.3.5 SAN-Specific Recommendations | .......................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Guidelines for Storage Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control OC-01 in Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile? (Part 69) Control OC-01: t Task Force Transformation Initiative (2012) Guide for Conducting Risk Assessments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-30r1. | | [SP800-37r2] | Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-37r2. | [SP800-61r2] Cichonski PR, Millar T, Grance T, Scarfone KA (2012) Computer Security Incident Handling Guide. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-61r2. https://doi.org/10.6028/NIST.SP.800-61r2 [SP800-84] Grance T, Nolan T, Burke K, Dudley R, White G, Good T (2006) Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-84. [SP800-92r1] Scarfone K, Souppaya M (2023) Cybersecurity Log Management Planning Guide. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-92r1 ipd. https://doi.org/10.6028/NIST.SP.800-92r1.ipd [SP800-150] Johnson CS, Waltermire DA, Badger ML, Skorupka C, Snyder J (2016) Guide to Cyber Threat Information Sharing.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, csf, risk management framework. General security reference material without sensitive content. Source: Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AN-2013 in Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet? (Part 17) Control AN-2013: | Notation | | Integer Set | Set of all Integers (positive and negative integral values, including zero) represented as a Set-Int. | Integers | | Numeric Leading Zero | The string value is a Regular Expression in the form: Str(^(\+|-){0,1}0([0-9]+|[0-9]+\.[0-9]+)$) The expression represents any numeric value (with or without a + or - sign) that has a leading zero followed by one or more numeric digits (which optionally may be followed by a decimal point and one or more numeric digits after the decimal). | LeadingZer oNum | | Time Index | The string value is a Regular Expression in the form: Str(^([0,1][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9].[0-9]{3}$) The expression represents time in the form hh:mm:ss.nnn, where hh is the two- digit hour,mm is the two-digit minute, ss is the two-digit seconds, and nnn is the three-digit milliseconds. (See section 7.7.2.5 of the standard). | ValidTimeI dx | | Date Range Estimate | The string expression is a Regular Expression in the form: ^((Y[0-9]{1,2}){0,1}(M[0-9]{1,2}){0,1}(D[0-9]{1,2}){0,1})$ The expression represents the amount of time used as an offset (plus or minus), in the form Y yy M mm D dd . Any of Y yy, M mm, or D dd may be omitted. Bold letters are constants; yy is the 2-digit year offset, mmis the 2-digit month offset, and dd is the 2-digit day offset. The bold letters are constants. | DateRange Estimate | | Date Time Range Estimate | The string expression is a Regular Expression in the form: ^((Y[0-9]{1,2}){0,1}(M[0-9]{1,2}){0,1}(D[0-9]{1,2}){0,1}(h[0-9]{1,2}){0,1}(m[0- 9]{1,2}){0,1})$ The expression represents the amount of time used as an offset (plus or minus), in the form Y yy M mm D dd h hh m mm. Any of Y yy, M mm, D dd, h hh, or m mmmay be omitted. The bold letters are constants.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.8 Deactivation according to NIST Contingency Planning Guide for Federal Information Systems According to Contingency Planning Guide for Federal Information Systems, 5.8 Deactivation: Once all activities have been completed and documentation has been updated, the {system owner} will formally deactivate the ISCP recovery and reconstitution effort. Notification of this declaration will be provided to all business and technical POCs.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Contingency Planning Guide for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Storage Encryption Technologies for End User Devices provide? (Section 1) <!-- image --> Karen Scarfone Murugiah Souppaya Matt Sexton NIST Special Publication 800-111 Guide to Storage Encryption Technologies for End User Devices Recommendations of the National Institute of Standards and Technology Karen Scarfone Murugiah Souppaya Matt Sexton Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 November 2007 <!-- image --> U.S. Department of Commerce Carlos M. Gutierrez, Secretary National Institute of Standards and Technology James M. Turner, Acting Director The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-111 Natl. Inst. Stand. Technol. Spec. Publ. 800-111, 40 pages (Nov. 2007) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.

Explanation: NIST publication discussing classified information handling. References: classified, secret. Contains guidance on protecting sensitive government information. Source: Guide to Storage Encryption Technologies for End User Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Technical Guide to Information Security Testing and Assessment say about 4.4.3 Wireless Device Location Tracking? According to Technical Guide to Information Security Testing and Assessment, 4.4.3 Wireless Device Location Tracking: Security personnel who operate the wireless scanning tool should attempt to locate suspicious devices. RF signals propagate in a manner relative to the environment, which makes it important for the operator to understand how wireless technology supports this process. Mapping capabilities are useful here, but the main factors needed to support this capability are a knowledgeable operator and an appropriate wireless antenna. If rogue devices are discovered and physically located during the wireless scan, security personnel should ensure that specific policies and processes are followed on how the rogue device is handled-such as shutting it down, reconfiguring it to comply with the organization's policies, or removing the device completely. If the device is to be removed, security personnel should evaluate the activity of the rogue device before it is confiscated. This can be done through monitoring transmissions and attempting to access the device. If discovered wireless devices cannot be located during the scan, security personnel should attempt to use a WIDPS to support the location of discovered devices. This requires the WIDPS to locate a specific MAC address that was discovered during the scan. Properly deployed WIDPSs should have the ability to assist security personnel in locating these devices, and usually involves the use of multiple WIDPS sensors to increase location identification granularity. Because the WIDPS will only be able to locate a device within several feet, a wireless scanning tool may still be needed to pinpoint the location of the device.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technical Guide to Information Security Testing and Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Secure Deployment of IPv6 provide? (Section 294) systems to secure IPv4 tunnel endpoints from IPv4-based attacks. They should also check the consistency of the IPv4 and IPv6 addresses used in tunneled traffic and apply ingress and egress filtering. Finally, they should only accept DSTM traffic on their internal interfaces to avoid being used as an open relay. Perhaps the most serious resource exhaustion DOS attack is against the supply of IPv4 addresses. Authenticating the client-server protocol allows such attacks to be tracked down easily. For several years, dual stack hosts and routers have been promoted as the most practical transition plan. However, this approach faces a new problem today. Dual stack means having IPv4 and IPv6 addresses, but the world is running out of IPv4 addresses. It is expected that IPv4 will be needed to support IPv4only devices in the home and IPv4-only content on the Internet long past the exhaustion of the pool of globally routable IPv4 addresses. The emphasis in this transition strategy is on helping service providers plan for a situation in which not enough globally-routable IPv4 addresses are available for the WAN-facing (Wide Area Network) side of customers' NAT boxes. Several proposals have been made to deploy native IPv6 along with some method of sharing globally reachable IPv4 addresses among broadband customers needing both IPv4 and IPv6 access. All of these involve some kind of centralized network address translation (NAT), which is frequently called -carriergrade NAT.‖ In this context, -carrier grade‖ essentially means centralized, and it may also imply high capacity, shared, or multiplexed. At least four choices for how a customer's site achieves IPv4 connectivity with a carrier-grade NAT 57 have been described. One, called -IPv4->IPv4->IPv4,‖ provides the customer with a non-routable (typically network 10.0.0.0/8) IPv4 address between the customer's gateway and the carrier-grade NAT.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Reference according to Advanced Metering Infrastructure Smart Meter Upgradeability Test Framework? Reference: NEMA SG-AMI 1-2009, Section 4.3

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Advanced Metering Infrastructure Smart Meter Upgradeability Test Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability say about 1. Introduction? (Part 1) According to Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability, 1. Introduction: 1. Introduction This work provides a novel security metric to determine the likelihood that a vulnerability has been observed to be exploited. Only a small fraction of the tens of thousands of software and hardware vulnerabilities that are published every year will be exploited. Predicting which ones is important for the efficiency and cost effectiveness of enterprise vulnerability remediation efforts. One study shows that only 5 % of vulnerabilities have been observed to be exploited in the wild [2], while the monthly vulnerability remediation rate for companies is 16 % [3]. The remediation rate is so low because it is expensive for companies to address vulnerabilities. Security patches must be tested with enterprise software to ensure continuity of operations; some vulnerabilities require non-patch remediations that require human deployment. This situation would not be a problem if the 16 % were to cover the 5 %, but metrology is lacking to accurately make that calculation. Thus, predicting which vulnerabilities will be exploited is critically important for the efficiency and cost-effectiveness of enterprise vulnerability remediation efforts. One effort that has made great progress towards this goal is the Exploit Prediction Scoring System (EPSS). EPSS provides probabilities that a vulnerability will be observed to be exploited in the wild within the next 30 days [4]. However, its probabilities are known to be inaccurate for vulnerabilities that have been previously observed to be exploited; this is stated in the EPSS documentation itself [1]. Fortunately, the probabilities are not randomly inaccurate; they underestimate the true probability. Another area that is foundational for vulnerability remediation prioritization are Known Exploited Vulnerability (KEV) lists. KEV lists are enumerations of vulnerabilities that have definitively been exploited in the past (e.g., [5] and [6]).

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification say about 4.7 Secret Shared Betwen Physical Token and Cardholder? (Part 1) According to A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification, 4.7 Secret Shared Betwen Physical Token and Cardholder: 4.7 Secret Shared Betwen Physical Token and Cardholder The verification of the Person Identifier - Token Secret binding (established by Personal Authentication Certificate) and the verification of the Token Secret - Physical Token binding (established by the non-shared secret object, i.e., Private Cryptographic Key) involves mechanisms that does not require cardholder participation and hence authentication use cases that involve these mechanisms will be successful even in situations where the cardholder is an imposter (i.e., not the card owner/credential holder). Thus the presence of the Personal Authentication Certificate Object and the Physical Token-exclusive secret object (Sec. 4.6) are not sufficient for providing assurance against a stolen card. To provide this assurance, an object that is of the nature of a shared secret and that establishes the binding between the physical token and the cardholder must be created in the smart identity token. Verification of this binding then provides the assurance that the cardholder is indeed the legitimate owner of the token/credentials. Fortunately, the smart card technology provides the capability to define a 'PIN' object whose verification can be made as an access control condition for reading certain "sensitive objects" or for performing certain 'sensitive operation.' Using this feature, the identity verification application on the card can be configured to have the 'PIN Verification' as an access control condition for the 'private key operation' (i.e., digitally signing a random challenge sent by the authentication system using a private cryptographic key), which is one of integral operations of the protocol for testing the presence of a private cryptographic key on the card. Making the card recipient choose a PIN value at the time of issuance in the presence of the card issuer thus completes the process of establishing the Physical Token - Cardholder binding .

Explanation: NIST publication on credential and access management. Topics: access control, authentication, token. Contains security framework guidance for authentication systems. Source: A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.2 Usability Research Methodology according to NIST Usability and Security Considerations for Public Safety Mobile Authentication According to Usability and Security Considerations for Public Safety Mobile Authentication, 2.2 Usability Research Methodology: In order to achieve the objectives of UCD, usability research methods must be applied. There are a variety of qualitative and quantitative research methods, each appropriate at different phases of the product development lifecycle. Qualitative research methods include such techniques as contextual inquiry, user needs analysis, user profiling, behavioral observation, task analysis, workflow analysis, interviews, focus groups, and participatory design. Formal usability testing and laboratory experiments are examples of quantitative research methods that often use statistical analyses. Some methods, such as questionnaires and user modeling, can be both qualitative and quantitative. It is common to begin with qualitative research to understand users' characteristics, needs, tasks, and environments. Qualitative research focuses on the rich and detailed information provided by smaller numbers of users [4] rather than the statistical analyses from larger numbers of users in quantitative research. An in-depth qualitative approach is especially crucial for domains with specialized personnel, such as public safety, given their challenging operating environments and interactions with specialized tools, technologies, and equipment. Given the exploratory nature of this effort to investigate the impacts of public safety mobile authentication, we chose to use a qualitative approach. Three NIST researchers met with six public safety subject matter experts (SMEs) in the areas of Fire, EMS, and Law Enforcement and gathered background information focused on public safety field operations. The individual semi-structured collegial discussions allowed for flexibility and the ability to follow SMEs' leads during the discussions.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Usability and Security Considerations for Public Safety Mobile Authentication.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Accuracy, Integrity, and Security in Computerized Vote-Tallying provide? (Section 228) lertsen (from Illinois Issues, November, 1985, pp. 1215) . - [67] Oklahoma County Purchasing Department, Report of Engineering Examination and Election Use of the DIMS Precinct Work Station PWS 1000 . December 10, 1984 (photocopy) - [68] Oklahoma State Election Board, Rules and Regulations, Section 21-8, "After The Polls Close." - [69] The Sunday Oklahoman . "Security of Elections Described," by Kay Morgan Atkins, January 25, 1987, p. 3 -A. - [70] Board of County Commissioners, Oklahoma County, Memorandum to Commissioner Shirley Darrell-Daniels, "Evaluation of Voting Devices," by Kimberly Statum, February 27, 1987. - [71] The Sunday Oklahoman . "Uncertain Vote Count Puzzling to Analysts," by Kay Morgan Atkins, January 25, 1987, p. 1-A. - [72] In the Circuit Court of the Fifteenth Judicial Circuit of Florida, In and For Palm Beach County, Civil Division, Case No. 84-7180 CA(L)H, Complaint , filed Nov. 29, 1984. - [73] Palm Beach Post . "Re-Count Lawsuit Dismissed," March 2, 1985. - [74] In the Circuit Court of the Fifteenth Judicial Circuit of Florida, In and For Palm Beach County, Civil Action Case No. 84-7180 CA(L)H, Amended Complaint , filed Apr. 4, 1985, item 6 (i) , p. 2 . - [75] op. cit... Defendant Walker's First Requests for Admission To Plaintiff , filed Jan. 22, 1985. - [76] op. cit.. Amended Complaint , filed Apr. 4, 1985, item 6(p) , p. 3. - [77] op. cit. , Amended Motion to Dismiss of Rebecca E. Walker , filed Jan. 16, 1985. - [78] op. cit.. Order, by Circuit Court Judge Richard I. Wennet, Sept. 10, 1985. - [79] Salt Lake Tribune . "County Election Computer Fails To Deliver Vote Total on Time," by Dave Jonsson, November 6, 1980, p. B-1. - [80] Election Administration Reports , vol. 16, no. 15, July 21, 1986, "Audit of Recount Detects Error, Restores Stark County, Ohio Commissioner Victor," pp. 2-4. - [81] National Bureau of Standards, Federal Information Processing Standard 31.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Accuracy, Integrity, and Security in Computerized Vote-Tallying.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cloud Computing Synopsis and Recommendations say about 8.5.1 Risk of Unintended Data Disclosure? According to Cloud Computing Synopsis and Recommendations, 8.5.1 Risk of Unintended Data Disclosure: Unclassified government systems are often operated in a manner where a single system is used to process PII, FOUO, or proprietary information, as well as to process non-sensitive, public information. In a typical scenario, a user will store sensitive and nonsensitive information in separate directories on a system or in separate mail messages on an email server. By doing so, sensitive information is expected to be carefully managed to avoid unintended distribution. If a consumer wishes to use cloud computing for non-sensitive computing, while retaining the security advantages of on premises resources for sensitive computing, care must be taken to store sensitive data in encrypted form only.

Explanation: NIST publication discussing classified information handling. References: classified, fouo. Contains guidance on protecting sensitive government information. Source: Cloud Computing Synopsis and Recommendations.