You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Common Platform Enumeration_ Dictionary Specification Version 2.3 say about Appendix A-References? According to Common Platform Enumeration_ Dictionary Specification Version 2.3, Appendix A-References: The following documents are indispensable references for understanding the application of this specification.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Platform Enumeration_ Dictionary Specification Version 2.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessment of Access Control Systems say about Extensible Access Control Markup Language (XACML)? According to Assessment of Access Control Systems, Extensible Access Control Markup Language (XACML): A general purpose language for specifying access control policies.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessment of Access Control Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control II-4 in 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report)? (Part 92) Control II-4: ant modifications to existing applications. Management officials who are the primary users of applications should evaluate the sensitivity of new or existing applications being substantially modified. Fcr those applications considered sensitive, the management control process shall, at a minimum, include security specifications and design reviews and systems tests - (a) Security Specifications . Agencies shall define and approve security requirements and specifications prior to acquiring or starting formal development of the applications. The results of risk analyses performed at the information technology installation where the applications will be. processed should be taken into account when defining and approving security specifications for the applications. Othtr vulnerabilities of the appl 1 ca 1 1 ons , such as in telecommunications links, shall als: be considered in defining security requirements. The views and recommendations of the information technology user organization, the information technology installation, and the individual responsible for security at the installation shall be considered prior to the approval of security specifications for the appl i cations (b) Design Reviews and System Tests . Agencies shall conduct and approve design reviews and system tests, prior to placing the application into operation, to assure the propose: design meets the approved security specifications. The objective of the system tests should be to verify that required administrative, technical, and physical safeguards are operationally adequate. The results of the design reviews and system tests shall be fully documented and maintained in the official agency records. (c) Certl f 1 cat ion . Upon completion of the systeo tests, an agency official shall certify that the system meets all applicable Federal policies, regulations, and standards, and that the results of the tests demonstrate that the installed security safeguards are adequate for the application.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings say about Temporal Key Release Infrastructure 4? (Part 2) According to 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings, Temporal Key Release Infrastructure 4: cryptographic key pair for the issuing of TDCs, for safe private key storage, and for event log auditing. This entity is kept isolated, usually in a safe room, without data communication connections. In this way, the off-line TCA is not subjected to threats from public data communication channels. Data insertion and retrieval in the off-line TCA are carried out using removable media. The on-line TCA is responsible for the short-term cryptographic key pair generation, issuing of TDCs, and private key storage. The on-line TCA is also in charge of receiving the TDC requests and its policies and disclosing the private key at the time specified. The private keys that will be necessary in the long-term are sent to the off-line TCA. The on-line TCA can also receive private key publication delays or private key destruction requests. This entity must produce audit logs of its activities and publish them with the audit logs from the off-line TCA. The TSA issues time stamps that are attached to the electronic document and thus can prove its existence at a specific time [11, 19, 6]. The TSA, in this infrastructure, is in charge of producing time-related evidence for the electronic documents received or sent by the on-line and off-line TCA. The TSA clock is synchronized with trusted-time sources [16, 7]. The use of the TSA guarantees that the TCA clock will be synchronized and all the transactions carried out will be associated with the correct date and time, bringing trust to the temporal aspects of the process. As the on-line TCA is in charge of private key disclosure, its clock must be synchronized with a trusted time source. The off-line TCA does not require the same precision. The private keys are released in blocks by the off-line TCA to the on-line TCA. Each block has a group of private keys that must be dis- 2 LabSEC - Computer Security Lab (www.labsec.ufsc.br) closed in the next window of time to release private keys.

Explanation: NIST publication on credential and access management. Topics: pki, sso. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Web Transactions_ TLS Server Certificate Management provide? (Section 4) the following purposes: -  Recognize the harm that improper management of TLS server certificates can cause to business operations and provide guidance to mitigate risks related to TLS certificates. -  Ensure that the central certificate services team and the local application owners and system administrators understand the risks to the enterprise and are accountable for their roles in managing TLS server certificates. -  Establish an action plan to implement these recommendations and track progress. As the use of web transactions has grown, the number of TLS server certificates has increased to many thousands in some enterprises. Many of these enterprises struggle to effectively manage their certificates and, as a result, face significant risks to their core operations, including: -  application outages caused by expired TLS server certificates -  hidden intrusion, exfiltration, disclosure of sensitive data, or other attacks resulting from encrypted threats or server impersonation -  application outages or attacks resulting from delayed replacement of large numbers of certificates and private keys in response to either certificate authority compromise or discovery of vulnerabilities in cryptographic algorithms or libraries Challenges to TLS server certificate management include the broad distribution of certificates across enterprises, the complexity of certificate management processes, and the multiple roles involved in certificate management and issuance. TLS server certificates are typically issued by a central certificate services team, but the certificates are often installed and managed by the groups (lines of business) and local system administrators responsible for individual web servers, application servers, network devices, and other network components for which certificates are used. Some of these managers and administrators lack awareness of the risks and best practices associated with certificate management.

Explanation: NIST publication on credential and access management. Topics: certificate authority, sso. Contains security framework guidance for authentication systems. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2013 Annual Report say about Cryptography for Constrained Environments? (Part 1) According to Computer Security Division 2013 Annual Report, Cryptography for Constrained Environments: Cryptography for Constrained Environments Pervasive computing is an emerging technical area in which many highly constrained devices (e.g., limited resources, such as program space and RAM) are interconnected, typically communicating wirelessly with one another, and working in concert to accomplish some task. These systems apply to a wide variety of fields. Sample application areas include sensor networks, medical devices, distributed control systems, and the Smart Grid. Security can be very important in each of these areas. For example, an unauthorized party should not be able to take control of an insulin pump or the brakes on a car. There are also privacy concerns, particularly in the area of Health IT. Because the majority of the current cryptographic algorithms were designed for desktop/server environments, many of these algorithms cannot operate under these constraints, or if they can be made to operate in these constrained environments, their performance is typically not acceptable. A particular problem is the use of asymmetric (public key) algorithms. These algorithms tend to be much more computational and resourceintensive and are not easily accommodated in such constrained environments. As a result, CSD is currently focusing on studying the use of the NIST-approved symmetric-key algorithms in constrained environments. Symmetric-key algorithms can perform encryption for confidentiality, and can generate message authentication codes (MAC) for authenticity and integrity. NIST has implemented the Advanced Encryption Standard (AES) to provide both confidentiality and the AES-based message authentication code, CMAC mode, for authentication. Additionally, CTG has implemented the 256-bit version of the Secure Hash Algorithm (SHA-256) to provide a Hash-based Message Authentication Code (HMAC) for authentication.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2013 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2010 Annual Report? (Part 103) Control HA-3: l study of the requirements of a lab that can support a wide variety of virtualization and cloud computing experiments, such as those involving multiple clouds or clouds comprised of diverse software. This resulted in the procurement of needed hardware and software resources as well as the necessary networking sup port to allow the lab's unimpeded access to the Internet. In FY2011, CSD plans to deploy and test the hardware and software components of two primary setups to support a variety of virtu alization solutions including both commercial and open source software such as VMWare vSphere, Citrix XenServer, and Microsoft Hyper-V hypervisors. CSD also plans to leverage the test environ ment to support some of the SAJACC use cases by implementing a proof of concept for supporting the NIST SP 800-53 security con trol requirements for low and moderate impact baseline in a cloud computing service model such as infrastructure as a service refer ence implementation. Contact: Mr. David Ferraiolo (301) 975-3046 david.ferraiolo@nist.gov ## Access Control and Identity Management in Virtualized Systems The purpose of this project is to conduct research on how to in tegrate advanced access control mechanisms into virtualized sys tems. Access control has traditionally been integrated into either operating system mechanisms, network components (such as firewalls), or directly in applications. With a virtualized system, the option is available to add access control mechanisms into the hy pervisor layer that implements the virtual machine abstractions. Such access control implementations may leverage the isolation feature offered by virtualized systems. This research analyzes the requirements for adding access control at the different layers, and the impact on different access control components such as users, processes, policy enforcements points, policy decision points, and policy database coordinated.

Explanation: NIST publication on credential and access management. Topics: access control, identity management. Contains security framework guidance for authentication systems. Source: Computer Security Division 2010 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is False Positive according to Guide to Intrusion Detection and Prevention Systems (IDPS)? False Positive: An instance in which an intrusion detection and prevention technology incorrectly identifies benign activity as being malicious.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer provide? (Section 7) 171A. | | What products, vendors, or solutions are 'NIST SP 800 -171 compliant' or 'CMMC - certified'? | NIST does not identify or track implementation of or compliance with the security requirements. | | What is the relationship between NIST and CMMC? | The Cybersecurity Maturity Model Certification (CMMC) is a DOD program that references the security requirements in NIST SP 800-171 and SP 800-172. NIST is not involved in the design, development, or implementation of the CMMCmodel, accreditation body, or certification process. It is important to note that CMMCis currently based on SP 800-171, Revision 2. Contractors should check for specific requirements in their contracts to understand which version they are required to use. | <!-- image --> View more FAQs here. If you still have a question after reviewing all our FAQs , send your question to: sec-cert@nist.gov. ht ps:/ csrc.nist.gov/projects/protecting-control ed-unclas ified-information <!-- image --> <!-- image --> <!-- image --> SP 800-171 requirements are focused on protecting confidentiality and are based on a subset of controls found in SP 800-53, which is a catalog of security and privacy controls for systems and organizations. With that in mind, it is important to have a basic understanding of the SP 800-53 series. To assist, NIST has released three self-guided online introductory courses to provide a high-level overview of foundational security and privacy risk management concepts. The online introductory courses are between 45-60 minutes, are available at no cost, and registration is not required. Access the courses. - The National Archives and Records Administration (NARA) , per 32 CFR Part 2002 "Controlled Unclassified Information," determines what CUI is and lists CUI types at archives.gov/cui. - NIST is responsible for developing and publishing the security requirements for the protection of CUI.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information (CUI)_ NIST Special Publication 800-171, Revision 3. Small Business Primer.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PA-5060 in Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation? (Part 193) Control PA-5060: the routing table. 7. AS 65511 removes the ROA published in Step 1 from the RPKI. 8. Verify that the RUT now evaluates the route advertisement for 10.100.0.0/16 that originated from 65511 as invalid . | | Expected Results | Each of the expected results in Steps 4, 5, 6, and 8 above are verified. | Each of the expected results in Steps 4, 5, 6, and 8 above are verified. | Each of the expected results in Steps 4, 5, 6, and 8 above are verified. | | Actual Results | Test completed and functions as intended in Steps 4, 5, 6, and 8. | Test completed and functions as intended in Steps 4, 5, 6, and 8. | Test completed and functions as intended in Steps 4, 5, 6, and 8. | | Additional Comments (If Needed) | Changes in the validation state of selected routes are also observed via iBGP traffic. Step 6 is validated by monitoring the incoming traffic on its iBGP peer. | Changes in the validation state of selected routes are also observed via iBGP traffic. Step 6 is validated by monitoring the incoming traffic on its iBGP peer. | Changes in the validation state of selected routes are also observed via iBGP traffic. Step 6 is validated by monitoring the incoming traffic on its iBGP peer. | Test case SIDR-ROV-1.2.2 is identical to test case SIDR-ROV-1.2.1, except that IPv6 addresses are used instead of IPv4 addresses. ## E.3.1.3 Test Case: SIDR-ROV-1.3.1 and 1.3.2 | Test Objective | Test SIDR Requirement CR-1.3.1. Show that the ROV-capable router correctly evaluates received routes in the following situation: The advertised route is initially evaluated as valid . The single ROA that had made the route valid is removed from the RPKI. There is another ROA that covers the route, but its maximum prefix length is less than the prefix length of the route, so the route is re-evaluated as invalid .  | Test SIDR Requirement CR-1.3.1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.4.2.3 Query Handler according to NIST Access Control for SAR Systems According to Access Control for SAR Systems, 3.4.2.3 Query Handler: The primary function of the PEP is to restrict unauthorized access to SAR records. When the PEP receives a user query for SAR records, it creates a series of queries to the PDP to determine whether the user is authorized to access Full, Summary ISE, or Summary SLT SAR records. This involves having the PEP construct an XACML Request for each query that represents an ABAC policy comprising a set of subject attribute values, an action, and a set of resource attribute values. To acquire the attribute values needed for the XACML Request, the PEP queries the subject, environment and resource attribute databases. To achieve this, the PEP must consult the policies used by the PDP in order to acquire the proper attributes. Note that in this version of PET, the PEP is responsible for ensuring that attributes needed by the PDP to render a policy decision are supplied in an XACML Request rather than relying on the PDP to acquire these attributes itself. 4

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Access Control for SAR Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events provide? (Section 106) ngruent with applicable standards and best practices. Section 3.5 of Volume B, Technologies, lists the products we used and maps them to the cybersecurity controls provided by this reference solution. A NIST Cybersecurity Practice Guide does not describe 'the' solution, but a possible solution. This is a draft guide. We seek feedback on its contents and welcome your input. Comments, suggestions, and success stories will improve subsequent versions of this guide. Please contribute your thoughts to dsnccoe@nist.gov. The National Cybersecurity Center of Excellence (NCCoE) built a hybrid virtual-physical laboratory environment to explore methods to effectively identify assets and protect them against a data corruption event in various IT enterprise environments. The NCCoE also explored identifying vulnerabilities in advance of an incident. The servers in the virtual environment were built to the hardware specifications of their specific software components. The NCCoE worked with members of the Data Integrity Community of Interest to develop a diverse but noncomprehensive set of use case scenarios against which to test the reference implementation. These are detailed in Volume B, Section 5.2. For a detailed description of our architecture, see Volume B, Section 4. The following table presents typographic conventions used in this volume. | Typeface/Symbol | Meaning | Example | |-------------------|--------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------| | Italics | file names and pathnames; references to documents that are not hyperlinks; new terms; and placeholders | For language use and style guidance, see the NCCoE Style Guide.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Conformance Test for FDDI Medium Access Control (MAC) say about FDDI MAC Conformance Test TTCN Machine Processable Form? (Part 35) According to A Conformance Test for FDDI Medium Access Control (MAC), FDDI MAC Conformance Test TTCN Machine Processable Form: TA_Strip $CRef DATA_Strip_R3 $Comment PA, SD, FC, DA, SA, INFO, FCS, ED and FS returned {A=S, E=S, C=R) , $End_Behc $BehaviourLine $Line [5J7TOKEN $CRef T0KEN_R1 $Verdict P $Comment followed by Token. $End_BehaviourLine $BehaviourLine $Line [ 5] 7CTHERWISE $Verdict F $End_BehaviourLine $BehaviourLine $Line [5]7TIMEOUT TRT $Verdict F $End_BehaviourLine $BehaviourLine $Line [ 4 ] 70THERWISE $Verdict F $End_BehaviourLine $BehaviourLine $Line [4]7TIMEOUT TRT $Verdict F $End_BehaviourLine $End_BehaviourDescription $End_TestCase $Begin_TestCase $TestCaseRef FDDI /MAC/FED/DetectFCS ``` ``` $TestCaseId DetectFCS $TestPurpose Testing Frame Error Detection 10: Detecting FCS Errors $BehaviourDescription $TreeHeader DetectFCS $ BehaviourLine $Line [ 1] +FDDI/INITCONNECT $Cornment Intializing Connection $End_BehaviourLine $ BehaviourLine $Line [2] !DATA $CRef DATA_T11_0 $Comment Tester sends the frame (DA=IUT Address; FCS errors), $End_BehaviourLine $BehaviourLine $Line [3] ! TOKEN $CRef TOKEN_Tl $CoiTiment followed by Token. $End_BehaviourLine $BehaviourLine $Line [4]?DATA $CRef DATA_R11_0 $Comment lUT repeats Tester's frame (A=S , E=S , C=R) , $End__BehaviourLine $ BehaviourLine $Line [5]?TOKEN $CRef TOKEN_Rl $Comment Token returned. $End_BehaviourLine $BehaviourLine $Line [6]! DATA $CRef DATA_T11_1 $Comment Tester sends the frame (DAOIUT Address;. FCS error), $End_BehaviourLine $ BehaviourLine $Line [7] ! TOKEN $CRef T0KEN_T1 $Comment followed by Token. $End_BehaviourLine $BehaviourLine $Line [8]?DATA $CRef DATA_R11_1 $Comment lUT repeats Tester's f rame (A-R, E=S, C=R) $End_BehaviourLine $ BehaviourLine $Line [9]?TOKEN $CRef T0KEN_R1 $Verdict P $Coniment lUT returns Token.

Explanation: NIST publication on credential and access management. Topics: access control, token. Contains security framework guidance for authentication systems. Source: A Conformance Test for FDDI Medium Access Control (MAC).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Example according to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Example: The defender uses selectively planted false

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Telehealth Remote Patient Monitoring Ecosystem provide? (Section 68) §§ 164.310(d)(2)(i) 164.310(d)(2)(ii) | A.8.2.3 A.8.3.1 A.8.3.2 A.11.2.7 | | | Information Protection (PR.IP) | PR.IP-9: Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed | CP-1 CP-2 CP-7 CP-10 IR-1 IR-7 IR-8 IR-9 | | DTBK SGUD | 45 C.F.R. §§ 164.308(a)(6) 164.308(a)(6)(i) 164.308(a)(7) 164.310(a)(2)(i) 164.312(a)(2)(ii) | A.16.1.1 A.17.1.1 A.17.1.2 A.17.1.3 | | | Information Protection (PR.IP) | PR.IP-10: Response and recovery plans are tested | CP-4 IR-3 PM-14 | OM-NET- 001 | DTBK SGUD | 45 C.F.R. §§ 164.308(a)(7)(ii)(D) | A.17.1.3 | | | Information Protection (PR.IP) | PR.IP-12: A vulnerability management plan is developed and implemented | RA-1 RA-3 RA-5 SI-2 | OV-PMA- 001 | MLDP | 45 C.F.R.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, incident response. Contains technical security guidance that could inform defensive posture. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Glossary of Computer Security Terminology provide? (Section 18) IS and for the data and information contained in the AIS. It includes the totality of security safeguards needed to provide an acceptable level of protection for an AIS and for data handled by an AIS. (DODD 5200.28) | analysis | See COST-ANALYSIS, CRYPTOANALYSIS, and RISK ANALYSIS. | |-----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | annual loss expectancy (ALE) | The ALE of an ADP system or activity is the expected yearly dollar value loss from the harm to the system or activity by attacks against its assets.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Glossary of Computer Security Terminology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain FlowStream (from Consilium) according to NIST Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST According to Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST, FlowStream (from Consilium): 1. FlowStream was developed mainly for the pharmaceutical and related chemical industries, thus the compliance to regulations is much emphasized. FlowStream specifically addresses the needs of the chemical research and development facility. The researcher can define and document experiments and procedures, statistically compare results from different experiments, and automatically record notebook changes. FlowStream also maintains a detailed record of laboratory equipment, including its use and servicing history. A Document Vault permanently stores documents and provides a complete audit trail of their life cycle. 2. FlowStream appears to provide some of the basic requirements mentioned in Chapter 2 of this paper. It has not been tested as of the moment, but it might be helpful in the development of a prototype ERN system. One concern about using this product is that its format might be too industry-specific in the area of pharmaceutical, but this will have to be determined at a later time. 3. The Document Vault package is based on a client-server architecture, and requires either Microsoft Windows, XWindows, or a Macintosh platform, as well as network software and hardware. An SQL-compatible relational database could also be used. Tools from the Digital Equipment Corporation should allow the user to connect FlowStream to existing equipment, such as data acquisition devices and laboratory information systems. 4. To obtain all modules of FlowStream for twelve users, the estimated cost ranges between $175,000 and $200,000 (it is not clear if this figure includes the price of hardware).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? http: //www.ittc.ku.edu/resilinets/papers/Sterbenz-Hutchison-Cetinkaya-Jabbar-


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does ISCMA_ An Information Security Continuous Monitoring Program Assessment say about Table of Contents? (Part 13) According to ISCMA_ An Information Security Continuous Monitoring Program Assessment, Table of Contents: Inter-Level Consolidation (Alternate Judgments) .......................................................17 | Figure 7 - Inter-Level Consolidation (Alternate Judgments) .......................................................17 | | Figure 9 - ISCMA Report and Follow-on: Formulate Actions .......................................................18 | Figure 9 - ISCMA Report and Follow-on: Formulate Actions .......................................................18 | Figure 9 - ISCMA Report and Follow-on: Formulate Actions .......................................................18 | | Figure 10 - ISCMA Partially Automated Steps.............................................................................21 | Figure 10 - ISCMA Partially Automated Steps.............................................................................21 | Figure 10 - ISCMA Partially Automated Steps.............................................................................21 | | Figure 11 - Required References ................................................................................................22 | Figure 11 - Required References ................................................................................................22 | Figure 11 - Required References ................................................................................................22 | | Figure 12 - TitlePage Worksheet ................................................................................................22 | Figure 12 - TitlePage Worksheet ................................................................................................22 | Figure 12 - TitlePage Worksheet ................................................................................................22 | | Figure 13 - Assessment Worksheet (Recommended Judgments)...............................................23 | Figure 13 - Assessment Worksheet (Recommended Judgments)...............................................23 | Figure 13 - Assessment Worksheet (Recommended Judgments)...............................................23 | | 14 - Assessment Worksheet (Alternate Judgments)........................................................23 | 14 - Assessment Worksheet (Alternate Judgments)........................................................23 | 14 - Assessment Worksheet (Alternate Judgments)........................................................23 | | Figure Figure 15 - Specifying a Detailed Level 1 Assessment of the Full ISCM Program........................24 | Figure Figure 15 - Specifying a Detailed Level 1 Assessment of the Full ISCM Program........................24 | Figure Figure

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: ISCMA_ An Information Security Continuous Monitoring Program Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Technology Assessment_ Methods for Measuring the Level of Computer Security provide? (Section 135) in transactions effec- tively remaining unrecorded (e.g. when an outdated file is mistaken for a current one), or certain transactions may be recorded twice, or recorded incorrectly, or misclassified. Operator errors may be more frequent (because of inadequate monitoring by operating system) leading to undetected inaccuracies in processed data. oofioo oooofiooooo oo Library is not maintained to control files. Library exists but its operation is inadequate (which may result in authorized requests not being required for file issue, or not being based on the production schedule, or no log of file usage being maintained). Incorrect files may be processed inadvertently resulting in certain transactions effec- tively remaining unrecorded (e.g. when an outdated file is mistaken for a current one) Certain transactions may be recorded twice or recorded incorrectly or misclassified. Unauthorized access to files may lead to deliberate inaccuracies or fictitious trans- actions being inserted in processed data. ooooo ooooofififioo oo Poor programming controls permit logic errors to occur in programming. Undetected logic programming errors may cause inaccuracies in processed data. Control Deficiency Guide Excerpt LCICT5, p. 233 Reprinted with permission from Computer Audit Guidelines, 1975, published by the Canadian Institute of Chartered Accountants, Toronto, Canada. The Arthur Andersen & Co. approach to evaluation of internal accounting controls consists of four tasks: - 0 General risk analysis - 0 Transaction flow reviews - 0 Evaluation of internal control techniques - 0 Compliance testing In the risk analysis, financial planning and control are reviewed to document the processes and obtain an overview of the internal control environment. Most of the document consists of illustrative control objectives and "risk identifiers" which presumably assist in the risk analysis process. These will be briefly discussed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technology Assessment_ Methods for Measuring the Level of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2013 Annual Report say about Draft SP 800-101 Revision 1, Guidelines on Mobile Device Forensics? According to Computer Security Division 2013 Annual Report, Draft SP 800-101 Revision 1, Guidelines on Mobile Device Forensics: Mobile device forensics is the science of recovering digital evidence from a mobile device under forensically sound conditions using accepted methods. Mobile device forensics is an evolving specialty in the field of digital forensics. This guide attempts to bridge the gap by providing an in-depth look into mobile devices and explaining technologies involved and their relationship to forensic procedures. This document covers mobile devices with features beyond simple voice communication and text messaging capabilities. This guide also discusses procedures for the validation, preservation, acquisition, examination, analysis, and reporting of digital information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TE-1 in Mobile Device Security_ Bring Your Own Device (BYOD)? (Part 45) Control TE-1: 37] (adapted from Government Accountability Office Report 08-536). Predictability Enabling of reliable assumptions by individuals, owners, and operators about PII and its processing by a system [34]. Privacy Event The occurrence or potential occurrence of problematic data actions [2]. Problematic Data Action A data action that could cause an adverse effect for individuals [2]. Threat Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, or modification of information, and/or denial of service [8]. Vulnerability Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source [8]. ## Appendix C References - [1] National Institute of Standards and Technology (NIST). NIST Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1 (Cybersecurity Framework). Apr. 16, 2018. [Online]. Available: - [2] NIST. NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0 (Privacy Framework). Jan. 16, 2020. [Online]. Available: - [3] W. Newhouse et al., National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework, NIST Special Publication (SP) 800-181 rev. 1, NIST, Gaithersburg, Md., Nov. 2020. Available: - [4] NIST. Risk Management Framework (RMF) Overview. [Online]. Available: )-overview. - [5] NIST. Mobile Threat Catalogue. [Online]. Available: - [6] J.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identity and Access Management for Electric Utilities say about Java Application? (Part 40) According to Identity and Access Management for Electric Utilities, Java Application: t t p : / / d o i .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Bring Your Own Device (BYOD) say about Appendix D A Note Regarding Great Seneca Accounting? According to Mobile Device Security_ Bring Your Own Device (BYOD), Appendix D A Note Regarding Great Seneca Accounting: A description of a fictional organization, Great Seneca Accounting, was included in the National Institute of Standards and Technology (NIST) Special Publication (SP) 1800-22 Mobile Device Security: Bring Your Own Device (BYOD) Practice Guide. This fictional organization demonstrates how a small-to-medium sized, regional organization implemented the example solution in this practice guide to assess and protect their mobile-devicespecific security and privacy needs. It illustrates how organizations with office-based, remote-working, and travelling personnel can be supported in their use of personally owned devices that enable their employees to work while on the road, in the office, at customer locations, and at home. <!-- image --> <!-- image --> Figure D-1 Great Seneca Accounting's Work Environments <!-- image --> <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Section 144) e and inform intrusion detection and threat hunting. Determine if: | 3.14.6e_ODP[1] | External organizations from which to obtain threat indicator information and effective mitigations are defined. | |------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 3.14.6e[a] | Threat indicator information is identified. | | 3.14.6e[b] | Effective mitigations are identified. | | 3.14.6e[c] | Intrusion detection approaches are identified. | | 3.14.6e[d] | Threat hunting activities are identified. | | 3.14.6e[e] | Threat indicator information and effective mitigations obtained from <3.14.6e_ODP[1]: external organizations> are used to guide and inform intrusion detection and threat hunting. | Examine : [ SELECT FROM: System and information integrity policy; information security program plan; procedures addressing security alerts, advisories, and directives; threat awareness program documentation; procedures addressing system monitoring; procedures for the threat awareness program; risk assessment results relevant to threat awareness; records of security alerts and advisories; system design documentation; security plan; system monitoring tools and techniques documentation; system configuration settings and associated documentation; system monitoring logs or records; system audit records; documentation on the cross-organization information-sharing capability; other relevant documents or records].

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Secure Web Services? (Part 104) Control ES-1: element in an XML file to a request for entry through a physical door. When using XACML in a Web service or Web application, it is important to understand that the application itself must be the PEP. All requests for information from the client or requester service must be translated into an access request. In many implementations, XACML is used solely for authentication, in which case only the authentication request needs to be translated while all subsequent requests would be allowed. As mentioned earlier, the PEP needs to send XACML requests to the PDP. The PDP will take the XACML request and determine the appropriate XACML response to send to the PEP, which will then grant or deny the request. Because there is no mechanism for transmitting XACML over a network in the XACML specification, SAML is traditionally used to transmit requests, responses, and attributes over a network. SAML was designed for the secure exchange of authentication and authorization information, but not for performing the actual decisions. This makes it a perfect match for transmitting XACML information over a network. The PEP converts the XACML request into a SAML query and sends it to the PDP. The PDP converts the SAML query into an XACML request and processes the request against the XACML policy. The XACML response is converted into a SAML response and sent back to the PEP, which converts it back into an XACML response. SAML does not provide message confidentiality-only message integrity. If any of the data being transmitted is sensitive, it must be transmitted using SSL/TLS or WS-Security. If the SAML protocol is being used without SSL/TLS, all SAML messages must be signed appropriately. The XACML v2.0 specification only supports a configuration where the PDP and PEP are on the same system. There is no standard specified for transmitting XACML policies, requests, or responses over a network.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to Security and Privacy Controls for Information Systems and Organizations? https: //doi.org/10.6028/NIST.SP.800-34r1

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Prepared By according to Automated Information System Security Accreditation Guidelines? Prepared By: (Name and Title of AISSO) (Organization)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Automated Information System Security Accreditation Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2012 Annual Report say about Leveraging Access Control for Cloud Computing? (Part 2) According to Computer Security Division 2012 Annual Report, Leveraging Access Control for Cloud Computing: ualized environment providing cloud-like features. To appreciate the PM's advantages in computing, it is important to recognize the methoGLYPH(cmap:df00)s in which DSs are delivered today. Each DS runs in an Operating Environment (OE) and an OE can be of many types (e.g., operating systems, web services, miGLYPH(cmap:df00)GLYPH(cmap:df00)leware, and database and database applications), each implementing its own routines to enable the execution of DS-specific operations (e.g., reaGLYPH(cmap:df00), senGLYPH(cmap:df00), anGLYPH(cmap:df00) view) on their respective GLYPH(cmap:df00)ata types (e.g., files, messages, anGLYPH(cmap:df00) fielGLYPH(cmap:df00)s). This heterogeneity among OEs introduces a number of administrative and policy enforcement challenges and user inconveniences. Administrators must contend with a multituGLYPH(cmap:df00)e of security GLYPH(cmap:df00)omains when managing privileges, and ordinary users and administrators alike must authenticate to and establish sessions within GLYPH(cmap:df00)ifferent OEs in orGLYPH(cmap:df00)er to exercise legitimate DS capabilities. Even if properly coordinated across OEs, access control policies are not always globally enforced. An email application may, for example, GLYPH(cmap:df00)istribute files to users regarGLYPH(cmap:df00)less of an operating system's protection settings on those files. Also, while researchers, practitioners, and policy makers have specifieGLYPH(cmap:df00) a large variety of access control policies to aGLYPH(cmap:df00)GLYPH(cmap:df00)ress real-worlGLYPH(cmap:df00) security issues, only a relatively small subset of these policies can be enforced through off-the-shelf technology, and even a smaller subset can be enforced by any one OE.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines on Active Content and Mobile Code provide? (Section 55) r malicious code as an embedded file attachment [Fis01]. When the contaminated PDF file is opened for the demonstration, a game is launched that prompts the user to click on a moving image of a peach. The occurrence of that event, in turn, causes the execution of an embedded VBScript file, which attempts to mail out the PDF file to others using Microsoft Outlook. Note that even content readers are not completely immune from problems. From time-to-time, vulnerabilities have occurred in the implementation of Acrobat Reader that could be exploited with carefully constructed content. For example, Adobe released a patch to the Acrobat Reader 8 browser plug-in that eliminates a cross-site scripting vulnerability [Ado07a]. An attacker could exploit the vulnerability by appending Javascript to a PDF URL that would cause any version of the reader to execute arbitrary JavaScript code when the file was rendered. This example illustrates how even relatively benign content can affect document rendering software having implementation errors. PDF does incorporate two distinct security features that can be applied to any conforming document, individually or together. The document can be digitally sealed through a signed document digest, a biometric signature, or other means to certify its authenticity and protect against tampering. The document can also be encrypted so that only authorized users can view or operate on its contents. Java is a full-featured, object-oriented programming language compiled into platform-independent byte code executed by an interpreter called the Java Virtual Machine (JVM). The resulting byte code can be executed where compiled or transferred to another Java-enabled platform. The Java programming language and runtime environment [Gon98, Gos96] enforce security primarily through the Java security manager, which monitors running Java applications and verifies that they are following a specified policy.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Guidelines on Active Content and Mobile Code.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EQ-1 in Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines? (Part 22) Control EQ-1: The integrity of the code in the repository can be trusted such that it can be used for further updates. | | | 5.1.3 Integrity of Evidence Generation During Software Updates (To provide assurance to acquirers that the software they get is legitimate, steps are taken to protect the integrity of evidence generation tasks) | 1. The framework should provide protection against all known attacks on the tasks performed by the software update systems, such as metadata (hash) generation, the signing process, the management of signing keys, the integrity of the authority performing the signing, key validation, and signature verification. 2. The framework should provide a means to minimize the impact of key compromise by supporting roles with multiple keys and threshold or quorum trust (with the exception of minimally trusted roles designed to use a single key). The compromise of roles that use highly- vulnerable keys should have minimal impact. Therefore, online keys (i.e., keys used in an automated fashion) must not be used for any role that clients ultimately trust for files they may install [11]. When keys are online, exceptional care should be taken in caring for them, such as storing them in an HSM and only allowing their use if the artifacts being signed pass the policy defined in Sec. 5.1.1. 3. The framework must be flexible enough to meet the needs of a wide variety of software update systems. 4. The framework must be easy to integrate | Provide a Mechanism for Verifying Software Release Integrity (PS.2): Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance say about 8.1.1 DNS Data Authentication? (Part 1) According to Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance, 8.1.1 DNS Data Authentication: 8.1.1 DNS Data Authentication Cryptographically generated public key-based digital signatures provide authentication for DNS data. Commonly, there will be two or more digital signature public-key pairs (which make up the key set) used to implement DNSSEC in a zone. One key pair is used to sign the zone data (referred to as the Zone Signing Key or ZSK), and a separate key pair is used to sign the zone key set (known as the Key Signing Key or KSK). While some zones may only use one key pair for both ZSK and KSK, it is not recommended for federal agency zones. This KSK is also known as the Secure Entry Point (SEP) key for the zone - using it, a client can authenticate the ZSK (by validating the signature over the ZSK using the KSK public key), and then use the ZSK to authenticate the zone data. The KSK is also used to link the security chain 37 from the zone to its delegating parent. Since the KSK is used to link security from the zone (e.g. 'example.gov') to the delegating parent zone (e.g. '.gov') [RFC 4035], it is often longer lived, and used infrequently (used only to sign the zone key set). Multiple digital signature algorithms can be supported, so there may be multiple keys (one for each algorithm), as there is no algorithm negotiation in DNSSEC, and clients may only understand certain digital signature algorithms. There is one mandatory-to-implement algorithm as defined by the IETF, so there is at least one agreed-upon digital-signature algorithm that all servers and clients will understand. Currently, both RSA using SHA-1 and SHA-256 have been specified and can be used with DNSSEC zones. Most modern implementations either support both or will do so after an upgrade. Zones deploying DNSSEC for the first time can start with RSA using SHA-256. Zones that initially deployed with RSA using SHA-1 should migrate to RSA (2048-bit RSA key) using SHA-256: see [SP 800-131A] for information about guidelines for using RSA with different key sizes and hash algorithms.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TR-124 in Recommended Cybersecurity Requirements for Consumer-Grade Router Products? (Part 7) Control TR-124: than as normative text. - Multiple signatures for software update packages when possible. At a minimum, all software update packages should be signed by the source of the update (e.g., manufacturer). When applicable (e.g., when routers are leased from internet service providers (ISPs) other entities, such as the owning ISP, may also cryptographically sign updates, adding another layer of security. Routers would only apply a software update if the cryptographic signatures from both the manufacturer and ISP are verified. Cosigning by the ISP also gives the ISP a mechanism to manage the acceptance of software updates. - Robust security for protecting logs of captured cybersecurity state information. Cybersecurity State Awareness, documented in Appendix A, is essential for detecting compromised routers. Because logs can be a valuable tool for security researchers and others performing forensic analysis of cybersecurity incidents, this data needs to be stored securely. Protections that can enhance router log security include encrypting and password protecting logs to ensure that access is limited to authorized personnel only, use of non-volatile memory storage for logs, off-device storage for logged data, and restricting log deletion. Several of these examples highlight ways consumer-grade router products can use multiple techniques to deliver cybersecurity capabilities. Manufacturers should consider these and other techniques to continually improve router cybersecurity as risks shift and new mitigations become available. ## 3. Conclusion This consumer-grade router profile can help manufacturers determine appropriate cybersecurity to incorporate as they develop their products. These recommendations draw from current effective practices and promote the adoption of accepted and vetted cybersecurity features for router products.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommended Cybersecurity Requirements for Consumer-Grade Router Products.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Framework for Emergency Response Officials (ERO)_ Authentication and Authorization Infrastructure say about 3. Leveraging Standards and Emerging Specifications? (Part 2) According to Framework for Emergency Response Officials (ERO)_ Authentication and Authorization Infrastructure, 3. Leveraging Standards and Emerging Specifications: an identity proofing process before being issued their credentials. This has resulted in the following developments and emerging specifications which will have an impact on the ERO-AA infrastructure. - Personal Identity Verification for Non-Federal Issuers (PIV-NFI) & Revised X.509 Certificate Policy for the Federal Bridge Certification Authority (FBCA) : With the increasing use of PIV tokens, there is a great deal of interest from parties external to the government and who want to do business with the federal government to issue identity cards that are technically operable with federal government PIV systems and are issued in a manner that allows federal relying parties to trust the cards. To facilitate this, a set of minimum requirements for non-federally issued identity cards have been provided in the PIV-NFI document that has been issued by the federal CIO council. The associated trust requirements for these identity cards are specified in the FBCA profile document. - Federal Identity, Credentialing and Access Management (FICAM) - Open ID and Identity Metasystem Interoperability (IMI) Profiles: In order to facilitate exchange of business transactions between federal government agencies and its business partners and constituents, the FICAM subcommittee (that has been established by the Federal CIO council) has already developed profiles for industry developed federation protocols as a means of adopting them for meeting the requirements for various levels of authentication for doing business with the federal government.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, token. Contains security framework guidance for authentication systems. Source: Framework for Emergency Response Officials (ERO)_ Authentication and Authorization Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Threat Analysis on UOCAVA Voting Systems say about Information Types:? According to A Threat Analysis on UOCAVA Voting Systems, Information Types:: Voter name, residency information, mailing address Voter authenticator (e.g. signature, PIN) Voter identifiers (e.g. social security, driver's license and/or passport numbers)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Threat Analysis on UOCAVA Voting Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Situational Awareness for Electric Utilities provide? (Section 253) ing to connect, or of identified host attempting to connect to unidentified host - Use OT network Zones (as defined in SA-1 content). - Use filter for OT network Zones (as defined in SA-1 content). - Filter for events from OT network Zone to/from a different Zone - Filters for authorization, authentication failures - Filter for authorization, authentication failures, or outbound events - Data Monitor and Dashboard to display results of the above Examine the behavior of systems, and configure the SIEM to alert on behavior that is outside the normal baseline. Alerts can be created emanating from OT, IT, and PACS. This test case seeks alerting based on behavioral anomalies rather than recognition of IP addresses, and guards against anomalous or malicious inputs. Anomalous behavior falling outside defined baseline Alert sent to SIEM on any event falling outside of what is considered normal activity based on historical data - Use OT network Zones. - Use Filter for OT network Zones. - Filter for ICS2 OnGuard events or events with a Category of Traffic Anomaly (e.g., as defined in Dragos Security CyberLens ArcSight FlexConnector/Categorizer files). - Data Monitor and Dashboard to display results of the above An alert will be created to notify the SIEM of unauthorized (inadvertent or malicious) uploading of an ICS network device configuration. The detection method will be primarily based on inherent device capability (i.e., log files). Configuration change on Tofino FW, Cisco 2950 Alert will be created to notify SIEM that this has occurred.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Situational Awareness for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Technical Guide to Information Security Testing and Assessment say about 5. Target Vulnerability Validation Techniques? According to Technical Guide to Information Security Testing and Assessment, 5. Target Vulnerability Validation Techniques: This section addresses target vulnerability validation techniques, which use information produced from target identification and analysis to further explore the existence of potential vulnerabilities. The objective is to prove that a vulnerability exists, and to demonstrate the security exposures that occur when it is exploited. Target vulnerability validation involves the greatest amount of risk in assessments, since these techniques have more potential to impact the target system or network than other techniques. Target vulnerability validation techniques for application security testing are briefly discussed in Appendix C.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Technical Guide to Information Security Testing and Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Power Loss according to Cell Phone Forensic Tools_ an Overview and Analysis? Power Loss: The Kyocera 7135 was repopulated with the above scenarios, then completely drained of all battery power and reacquired. No data was found. (Meet)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Subject Public Key Info according to NIST Test Personal Identity Verification (PIV) Cards Version 2? Subject Public Key Info: rsaEncryption, 2048-bit modulus, e=65537

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Threat Analysis on UOCAVA Voting Systems say about 4 Description of Transmissions Options? According to A Threat Analysis on UOCAVA Voting Systems, 4 Description of Transmissions Options: The purpose of this report is to identify options for distributing election materials to UOCAVA voters. This section will identify several different transmission options and provide brief descriptions for how these technologies and methods could be used to support overseas voting. The descriptions presented in Sections 4.2, 4.3, and 4.4 are merely examples of typical methods for employing the transmission options. This paper will outline threats to the types of systems described in this section, but other types of systems are possible.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Version 1.1 Manufacturing Profile say about 6.3 Risk Management? According to Cybersecurity Framework Version 1.1 Manufacturing Profile, 6.3 Risk Management: The Profile relies on the manufacturer's risk management processes to inform and prioritize decisions regarding cybersecurity. It supports recurring risk assessments and validation of business drivers to help manufacturers select target states for cybersecurity activities that reflect desired outcomes. To manage cybersecurity risks, a clear understanding of the business drivers and security considerations specific to the Manufacturing system and its environment is required. Each organization's risk is unique, along with its use of ICS and IT, thus the implementation of the profile will vary. The Manufacturing Profile is meant to enhance but not replace current cybersecurity standards and industry guidelines that the manufacturer is currently embracing. Manufacturers can determine activities that are important to critical service delivery and can prioritize investments to maximize the impact of each dollar spent. Ultimately, the Profile is aimed at reducing and better managing cybersecurity risks. The Profile, along with the Cybersecurity Framework, are not one-size-fits-all approaches to managing cybersecurity risk for critical infrastructure. Manufacturers will continue to have unique risks - different threats, different vulnerabilities, different risk tolerances - and how they implement security practices will vary.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Version 1.1 Manufacturing Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways provide? (Section 57) ities and provide mitigation actions, including missing updates for endpoints. See NIST SP 1800-31 Volume C for additional information on each of the technologies we used to demonstrate the scenarios. It explains each technology, summarizes their integration into the laboratory environment, and documents our security decisions and associated configurations. Section 3.4.7 describes Scenario 6, 'Patch management system security (or other system with administrative privileged access).' In support of Scenario 6, this appendix describes recommended security practices for systems like patch management systems which have administrative privileged access over many other systems as defined as 'critical software' in Executive Order (EO) 14028. It then summarizes how the example solution components described in this practice guide could support each of those recommended security practices. The table below defines security measures for software of critical importance. Note that these security measures are not intended to be comprehensive. They are based on those in the NIST publication Security Measures for 'EO-Critical Software' Use Under Executive Order (EO) 14028 . A security measure (SM) is a high-level security outcome statement that is intended to apply to critical software or to all platforms, users, administrators, data, or networks (as specified) that are part of running critical software. The security measures are grouped by five objectives: 1. Protect critical software and critical software platforms (the platforms on which critical software runs, such as endpoints, servers, and cloud resources) from unauthorized access and usage. 2. Protect the confidentiality, integrity, and availability of data used by critical software and critical software platforms. 3. Identify and maintain critical software platforms and the software deployed to those platforms to protect the critical software from exploitation. 4.

Explanation: NIST publication on credential and access management. Topics: sso, privileged access. Contains security framework guidance for authentication systems. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Foundations of a Security Policy for Use of the National Research and Educational Network provide? (Section 12) esearch and educational institutions, libraries, government laboratories, and industry.^ As the NREN continues to evolve, the problem of computer information security is expected to become more acute. The purpose of this report is to explore the foundations of a national network security policy and propose a draft policy for the NREN. Within this context, a network is defined to be a collection of autonomous computers interconnected by some communication media. The term security refers to computer and network information security. References to the NREN are generally intended to include not only the backbone transmission facilities, but also entities connecting to the NREN: local networks, host computers, and end users themselves. To that end, the scope of the proposed ^The NREN is envisioned as the evolution of existing networks, including those of the Federal Agency currently being developed as the Interagency Interim National Research and Education Network (IINREN), to a multigigabyte/second network that is expected to mature by 1996. security policy is broad, addressing the responsibilities of users, managers, system administrators, system developers, vendors, network service providers, and a national coordinating body. The policy presented here is at an abstract 'first-level', somewhat higher than typical policies or directives that establish organization-specific requirements and depend on technology-specific security mechanisms. In order to derive actual security practices from the security policy, further refinements are necessary. Properly addressed, these refinements should culminate in the formulation of formal specifications for security services and supporting mechanisms. Such specifications could be used by service providing organizations or entities, in addition to user organizations, for uniformity and interoperability purposes in providing required protection.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Foundations of a Security Policy for Use of the National Research and Educational Network.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Device Security_ Bring Your Own Device (BYOD) provide? (Section 114) ent Analyst PR-INF-001: Cyber Defense Infrastructure Support Specialist PR-CDA-001: Cyber Defense Analyst | | | | DE.AE-5: Incident alert thresholds are established. | IR-4: Incident Handling IR-5: Incident Monitoring IR-8: Incident Response Plan | A.16.1.4: Assessment of and decision on information security events | CSC 6: Maintenance, Monitoring, and Analysis of Audit Logs CSC 19: Incident Response and Management | PR-CIR-001: Cyber Defense Incident Responder AN-TWA-001: Threat/Warning Analyst | | Specific product used | Function | Applicable NIST Cybersecurity Framework Subcategories | Applicable NIST SP 800-53 Revision 5 Controls | ISO/IEC 27001:2013 | CIS 6 | Applicable NIST SP 800-181 NICE Framework Work Roles (2017) | |-----------------------------------------------------------|---------------------------------------------------------|--------------------------------------------------------------------------------|------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------|------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------| | | | DE.CM-5: Unauthorized mobile code is detected.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Control Baselines for Information Systems and Organizations provide? (Section 94) | W: Incorporated into AU-14. | W: Incorporated into AU-14. | W: Incorporated into AU-14. | | AU-14(3) | REMOTE VIEWING AND LISTENING | | | | | | AU-15 | Alternate Audit Logging Capability | W: Moved | to | AU-5(5). | AU-5(5). | | AU-16 | Cross-Organizational Audit Logging | | | | | | AU-16(1) | IDENTITY PRESERVATION | | | | | | AU-16(2) | SHARING OF AUDIT INFORMATION | | | | | | AU-16(3) | DISASSOCIABILITY | | | | | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Table 3-4 provides a summary of the controls and control enhancements assigned to the Assessment, Authorization, and Monitoring Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a 'W' and an explanation of the control or control enhancement disposition in light gray text.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Control Baselines for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain FY 2024 event topics included: according to NIST Fiscal Year 2024 Cybersecurity and Privacy Annual Report According to Fiscal Year 2024 Cybersecurity and Privacy Annual Report, FY 2024 event topics included:: | Cryptography | Education and Workforce | Identity and Access Management | Internet of Things | NIST Frameworks | |----------------|---------------------------|----------------------------------|----------------------|-------------------| | Privacy | Risk Management | Securing Emerging Technologies | Small Businesses | Software | Learn more about this priority area

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Fiscal Year 2024 Cybersecurity and Privacy Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2011 Annual Report? (Part 133) Control HA-3: es together, and to use NIST's security policies, best practices and tools more effectively. She was cited as one of the most trusted government advisers on cybersecurity. ## Federal CIO 50 Award Dr. Ron Ross The InformationWeek Federal CIO 50 Award recognizes a select number of individuals within federal, state, and local government based on their technology vision, influence among peers in other agencies, and an ability to show tangible, measurable results in the field of information technology. ## INCITS Service Award for 2011 ## Dan Benigni INCITS would like to recognize Dan Benigni's many contributions. As INCITS/CS1 Chairman, his management skills and willingness to accept responsibilities are one of the major contributing factors for the successful and timely development of standards nationally and internationally within ISO/IEC JTC 1/SC 27. Dan's knowledge and dedication on important issues reflect his commitment to standardization efforts. Without question, Dan Benigni has earned this award, and INCITS would like to recognize his contributions to INCITS. <!-- image --> <!-- image --> ## V. Lee Conyers Award Dr. Ron Ross The V. Lee Conyers Award was created by the ISACA®-National Capital Area Chapter (NCAC-ISACA) to honor and remember V. Lee Conyers, a distinguished member of the chapter. The award recognizes an outstanding chapter member in the field of IT Audit, Security, and Control.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Training & Awareness Course Compendium provide? (Section 63) what preventive and detective controls are available to mitigate control weaknesses within the LAN or from external connections. LAN Management and the role of the LAN officer is discussed in detail. Special emphasis is placed on management of the hardware and connectivity along with the selection of software. These key items often limit the overall usefulness of the LAN and inhibit the achievement of connectivity and productivity objectives. Each participant will receive detailed audit programs, common control weaknesses and sample recommendations. These are the key tools they need to conduct LAN audits. COURSE TITLE: COURSE LENGTH: 3 DAY Auditing Datacomm Networks VENDOR: Canaudit Inc. P.O. Box 4150 Simi Valley, CA 93093 (805) 583-3723 Wide area networks are the lifeblood of corporate information processing and connectivity, yet many organizations have yet to do a complete audit of network operations and management. This seminar provides the IS auditor with a structured audit approach directed to identifying critical control weaknesses in the network, the carriers, the media and network management Proven solutions to common control weaknesses will be provided to each participant. Focus in this seminar is on a complete audit approach for data and voice communications from a security and cost perspective. Network management tools and problem resolution techniques are the cornerstone of network operations. Special emphasis is placed on using NETVIEW, a popular network management tool to identify network problems. Participants in this session will receive detailed audit programs and checklists which will provide a strong starting point for their first Network Audit. COURSE TITLE: COURSE LENGTH: 3 DAY Computer Security & Contingency Planning VENDOR: Canaudit Inc. P.O. Box 4150 Simi Valley, CA 93093 (805) 583-3723 Security Administration is now a reality in many organizations.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Labels for Open Systems_ an Invitational Workshop say about HOW ESO's ARE PROCESSED? According to Security Labels for Open Systems_ an Invitational Workshop, HOW ESO's ARE PROCESSED: - o CSESO & RMESO -used for MAC, bit encoded Why two ESO' s? - o Default for CSESO if missing: - all 0's - o Default for RMESO if missing: - all 1's - Both what DNSIX calls Network Level ESO's (NLESO) - o SDESO -integer encoded, processing potentially unique per value - o SIESO -integer encoded, all datagrams without known SIESO' s rejected

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Labels for Open Systems_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Intrusion Detection and Prevention Systems (IDPS) provide? (Section 79) onnaissance and attacks (e.g., banner grabbing, buffer overflows, format string attacks, password guessing, malware transmission). Most network-based IDPSs analyze several dozen application protocols. Commonly analyzed ones include Dynamic Host Configuration Protocol (DHCP), DNS, Finger, FTP, HTTP, 22 Internet Message Access Protocol (IMAP), Internet Relay Chat (IRC), Network File System (NFS), Post Office Protocol (POP), rlogin/rsh, Remote Procedure Call (RPC), Session Initiation Protocol (SIP), Server Message Block (SMB), SMTP, SNMP, Telnet, and Trivial File Transfer Protocol (TFTP), as well as database protocols, instant messaging applications, and peer-to-peer file sharing software. - GLYPH<c=31,font=/HHCKCL+Webdings> Transport layer reconnaissance and attacks (e.g., port scanning, unusual packet fragmentation, SYN floods). The most frequently analyzed transport layer protocols are TCP and UDP. - GLYPH<c=31,font=/HHCKCL+Webdings> Network layer reconnaissance and attacks (e.g., spoofed IP addresses, illegal IP header values). The most frequently analyzed network layer protocols are IPv4, ICMP, and IGMP. Many products are also adding support for IPv6 analysis. The level of IPv6 analysis that network-based IDPSs can 22 Although network-based IDPSs can analyze HTTP protocol activity, they usually cannot perform analysis on the use of Web services, such as Simple Object Access Protocol (SOAP) and Extensible Markup Language (XML) messages carried over HTTP. Security technologies known as XML gateways or XML firewalls have been created specifically to analyze Web services activity. In addition to providing intrusion prevention functions, these technologies also perform firewalling, authentication and authorization services, access control, and audit logging. More information on XML gateways is available from NIST SP 800-95, Guide to Web Services Security (DRAFT) , which is available at

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control WE-1000 in Hardware Security Failure Scenarios_ Potential Hardware Weaknesses? (Part 7) Control WE-1000: scenarios: 1. Description / Extended Description Detailed explanation of the fault type 2. Relationships / Memberships Taxonomic information to organize weaknesses into hierarchies and categories 3. Modes of Introduction Descriptions of the life cycle phase in which the CWE can be introduced 4. Applicable Platforms Involved languages and technologies 5. Common Consequences Affected security attributes and likelihoods (e.g., confidentiality, integrity, availability, access control, authentication, and authorization) 6. Demonstrative Examples Hypothetical examples of the weakness 7. Observed Examples Actual observed examples of the weaknesses, usually with CVE references 8. Potential Mitigations Protection methods ## Weakness Abstractions The CWE weaknesses model is composed of four layers of abstraction: pillar (P), class (C), base (B), and variant (V) 1 . The abstraction reflects the extent to which issues are being described in terms of five dimensions: behavior, property, technology, language, and resource. Variant weaknesses are at the most specific level of abstraction and describe at least three dimensions. Base weaknesses are more abstract than variants and more specific than classes; they describe two to three dimensions. Class weaknesses are very abstract and not typically specific about any language or technology; they describe one to two dimensions. Pillar weaknesses are at the highest level of abstraction. In this work, pillars and classes are used to organize the HW security failure scenarios. ## Weakness Views CWE designators (i.e., CWE-XXXX) are given to weaknesses, views, and categories. A view provides a hierarchical organization of CWEs from a particular perspective (e.g., software development, research, or hardware design). A category is a simpler construct that groups a set of CWEs that have some similarity. Views may contain categories within their hierarchy. As of February 9, 2024, the CWE contains 49 views and 374 categories.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Hardware Security Failure Scenarios_ Potential Hardware Weaknesses.