You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CA-3 in Security and Privacy Controls for Information Systems and Organizations? (Part 2) Control CA-3: onsider the risk related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security and privacy requirements and controls. This includes systems within the same organization and systems that are external to the organization. A joint authorization of the systems exchanging information, as described in CA-6(1) or CA-6(2), may help to communicate and reduce risk. Authorizing officials determine the risk associated with system information exchange and the controls needed for appropriate risk mitigation. The types of agreements selected are based on factors such as the impact level of the information being exchanged, the relationship between the organizations exchanging information (e.g., government to government, government to business, business to business, government or business to service provider, government or business to individual), or the level of access to the organizational system by users of the other system. If systems that exchange information have the same authorizing official, organizations need not develop agreements. Instead, the interface characteristics between the systems (e.g., how the information is being exchanged. how the information is protected) are described in the respective security and privacy plans. If the systems that exchange information have different authorizing officials within the same organization, the organizations can develop agreements or provide the same information that would be provided in the appropriate agreement type from

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Derived PIV Application and Data Model Test Guidelines say about 9.3.1.3 Public Key Size? (Part 1) According to Derived PIV Application and Data Model Test Guidelines, 9.3.1.3 Public Key Size: 9.3.1.3 Public Key Size | Test Assertion | TA-09.03.01.03 | |----------------------|-----------------------------------------------------------------------------------------| | Purpose | Verifies that the key size requirements are in accordance with Table 3-1 of [SP800-78]. | | DTR(s) | • DTR-07.03.01.12 | | Issuer Documentation | None. | | Precondition(s) | • A token with the Derived PIV Application is inserted into an appropriate token reader. • Suitable drivers have been loaded between the test system and an instance of the reader. • A Derived PIV Authentication certificate is present within the Derived PIV Application. | |--------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Test Scenario | 1. Send the SELECT command with • AID == 'A0 00 00 03 08 00 00 20 00 01 00' 2. Send GET DATA command with • Data field of the command containing the tag ('5FC105') of the X.509 Certificate for Derived PIV Authentication data object 3. Extract subjectPublicKeyInfo->algorithm->algorithm field value. 4. Extract the subjectPublicKeyInfo->subjectPublicKey from the certificate 5. Match the key size to Table 3-1 of [SP800-78]. | | Expected Result(s) | 1. From Step 1, the command returns the application property template with the status word '90 00'. 2. From Step 2, the command returns the requested data object along with the status word '90 00'. 3.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SC-03(02) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control SC-03(02): SECURITY FUNCTION ISOLATION | ACCESS AND FLOW CONTROL FUNCTIONS

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RC-725 in A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems? (Part 8) Control RC-725: nt support is needed after the distribution as all of the activity comes from the subject side. A credential is private by default, and a subject can redeem it only if they want to use or transfer it. However, the list of all the identifiers the Merkle airdrop was issued to must be available to the subjects to redeem their NFT (both the private key and the list of all the identifiers included in the Merkle airdrop are needed to build the Merkle proof and mint the NFT). In Merkle airdrops, tokens must be pulled by the users while for traditional airdrops tokens are pushed to them without any approval needed. ## 4.4.2.2 Offchain Object In this architecture, a credential takes the form of an offchain object that acts as a self-contained vehicle for transmitting information directly between parties. This can go hand in hand with the bring-your-own blockchain address architecture (discussed in Section 4.4.1.2) to establish a lightweight identity management system that can operate at scale. It best matches use cases where the lifecycle of a credential is predetermined. However, verification of a credential (see Lifecycle Determination at Origination in Section 4.2.1) may require chain access (see Efficiency and Cost in Section 4.3). In particular, if revocability is permitted, onchain artifacts are required for one to check the credential revocation status, such as credential revocation registries (see Offchain Objects Coupled with Global Credentials Registry in Section 4.4.3). It can provide a high level of control and autonomy to the subjects as they can manage the storage of their own credentials offchain. It ensures privacy by default and need not be constrained to a specific blockchain. This architecture may use, for example, the JWT format (see Section 3.4 on Building Blocks ), as in Blockstack [49]. ## 4.4.3 Combination Patterns It is possible to combine the architectures for identifiers, credentials, or both.

Explanation: NIST publication on credential and access management. Topics: identity management, token. Contains security framework guidance for authentication systems. Source: A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Information Security Handbook_ A Guide for Managers? (Part 115) Control PD-12: in Phase 3. The steps to develop a business case are based on industry practices and mandated guidance, including Office of Management and Budget (OMB) Circular A-11, the Clinger-Cohen Act, and GPRA. The results of the prior three phases will be included in the business case as supporting evidence. NIST SP 800-55 provides guidance on security practitioners' inputs into the CPIC process and on their role in core development. Each agency should follow agency-specific business case guidance during this phase. Typically, the components and analysis of the business facilitate the completion of internal and external budget requests. A thorough examination of the business case will support and facilitate the obtaining resources process. 48 Also see Chapter 10, Risk Management, and Chapter 11, Certification, Accreditation, and Security Assessments, of this guide for additional guidance on prioritizing corrective actions. ## 7.4.5 Apply Corrective Actions Phase 6 of the process, Apply Corrective Actions, involves implementing corrective actions as determined through data analysis and as defined in an applicable business case or a POA&M. After corrective actions are applied, the cycle completes itself and restarts with subsequent data collection and analysis. Iterative data collection, analysis, and reporting will track the progress of corrective actions through the POA&M, among others, measure improvement, and identify areas for further improvement to be included in tactical plans, Program Management Plans, or other agency planning mechanisms. The iterative nature of the cycle ensures that the progress is monitored, and the corrective actions are affecting system security control implementation in an intended way.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain SOLUTION according to NIST Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation According to Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation, SOLUTION: The NCCoE Secure InterDomain Routing (SIDR) Project is improving internet security by demonstrating how to use ROV to protect against route hijacks. The SIDR Project has produced a proof -of-concept example that demonstrates the use of BGP ROV in realistic deployment scenarios, has developed detailed deployment guidance, has addressed implementation and use issues, and has generated best practices and lessons le arned. Project results are presented in this publicly available NIST Cybersecurity Practice Guide. This guide describes the following concepts : - security objectives that are supported by implementing BGP ROV that uses Resource Public Key Infrastructure (RPKI) mechanisms - an example solution of methods and tools that demonstrate and enable a practical implementation of BGP ROV - how to protect your own internet addresses from route hijacking by registering them with trusted sources, thereby gaining assurance that traffic intended for your organization will not be hijacked when it is forwarded by entities that perform BGP ROV - how to perform BGP ROV on received BGP route updates to validate, if possible, whether the entity that originated the route is in fact authorized to do so - how to more precisely express your routing security requirements and/or service offerings While the NCCoE used a suite of available products to address this challenge, this guide does not endorse these particular products, nor does it guara ntee compliance with any regulatory initiatives. Your organization's information security experts should identify the products that will best integrate with your existing tools and information technology (IT) system infrastructure. Your organization can adopt this solution or one that adheres to these guidelines in whole, or you can use this guide as a starting point for tailoring and implementing parts of a solution.

Explanation: NIST publication on credential and access management. Topics: pki, sso. Contains security framework guidance for authentication systems. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Conformance Test for FDDI Medium Access Control (MAC) provide? (Section 180) ") flush_queue () ; PHInvalidRSOb () ; DL_POSTAMBLE ( ) print_verdict ("End test case PHInvalidRSOb ") Output_trace ("\n\nStarting test case DetectTokenEDl "); flush_queue () ; DetectTokenEDl () DL_POSTAMBLE ( ) print_verdict ("End test case DetectTokenEDl "); Output_trace ("\n\nStarting test case DetectTokenED2 "); flush_queue () ; DetectTokenED2 () DL_POSTAMBLE ( ) print_verdict ("End test case DetectTokenED2 "); exit ( ) ``` ``` /* NIST TTCN Translator Version 1.0 4/89 */ include <stdio.h> include "sysdef.h" typedef unsigned char BYTE; typedef struct { union { long v; char *ptr; } value; char tag; } CONSTARG; extern int _level, _time.

Explanation: NIST publication on credential and access management. Topics: access control, token. Contains security framework guidance for authentication systems. Source: A Conformance Test for FDDI Medium Access Control (MAC).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is DES according to A Study of OSI Key Management? DES: Data Encryption Standard.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Study of OSI Key Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices provide? (Section 587) HE ESTABLISHMENT OF THE DEPARTMENT OF HOMELAND SECURITY [See http://www.state.gov/documents/organization/22978.doc.] Section 19. Functions of Certain Officials in the Department of Homeland Security. The Secretary of Homeland Security, the Deputy Secretary of Homeland Security, the Under Secretary for Information Analysis and Infrastructure Protection, Department of Homeland Security, and the Assistant Secretary for Information Analysis, Department of Homeland Security, each shall be considered a 'Senior Official of the Intelligence Community' for purposes of Executive Order 12333, and all other relevant authorities, and shall: (a) recognize and give effect to all current clearances for access to classified information held by those who become employees of the Department of Homeland Security by operation of law pursuant to the Homeland Security Act of 2002 or by Presidential appointment; (b) recognize and give effect to all current clearances for access to classified information held by those in the private sector with whom employees of the Department of Homeland Security may seek to interact in the discharge of their homeland security-related responsibilities; (c) make all clearance and access determinations pursuant to Executive Order 12968 of August 2, 1995, or any successor Executive Order, as to employees of, and applicants for employment in, the Department of Homeland Security who do not then hold a current clearance for access to classified information; and (d) ensure all clearance and access determinations for those in the private sector with whom employees of the Department of Homeland Security may seek to interact in the discharge of their homeland security- related responsibilities are made in accordance with Executive Order 12829 of January 6, 1993.

Explanation: NIST publication discussing classified information handling. References: classified, secret. Contains guidance on protecting sensitive government information. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Risk Management Framework Development, Implementation, and Assessment according to NIST 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report According to 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report, Risk Management Framework Development, Implementation, and Assessment: The Risk Management Framework (RMF) Development, Implementation, and Assessment Panel featured panelists from federal agencies, national laboratories, and academia, all of whom extensively utilize HPC to support operational research missions. The goal of the panel was to discuss how the NIST RMF supports their HPC cybersecurity programs and share valuable insights, best practices, future challenges and opportunities, and lessons learned. Two panelists presented their work on developing a security framework for scientific HPC facilities and supporting the implementation of RMF, and a moderated discussion to exchange ideas followed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, rmf, fips. General security reference material without sensitive content. Source: 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cloud Computing Synopsis and Recommendations provide? (Section 95) jack a consumer's cloud resources. These risks apply to non-cloud environments as well; however in cloud computing, the reliance upon safe, end-user, client applications and networking may be greater. By relying on a consumer's browser for software application interfaces, the SaaS approach also raises a risk that, if a consumer visits a malicious Web site and the browser becomes contaminated, subsequent access to a SaaS application might compromise the consumer's data. Another risk is that data from different SaaS applications might be inadvertently mixed on consumer systems within consumer Web browsers. In Figure 9, for example, client C1 is concurrently running applications B and C. Depending on the data processed by B and C, it may be important to keep them separated. Additionally, although Figure 9 depicts applications B and C as being served by the same provider, in other scenarios they may originate from different organizations and require careful separation. Prominent Web browsers provide features, such as sandboxes to separate Web pages (and the interactive code that they contain) from one another, but sandboxing relies on Web browsers' robust resistance to attack. Unfortunately, as is evidenced by numerous competitions [Por10, Mar09], Web browsers are often vulnerable to malicious Web sites. One work-around to this issue is for consumers to use multiple browsers and to dedicate specific browsers to important SaaS applications and not to perform general-purpose Web surfing that may expose them to attack. Another work-around is for consumers to use a virtual desktop when connecting to cloud-hosted applications, which provides a secure, fully functional work platform that is governed by strict policies for limiting what can or cannot be accessed elsewhere, while connected to a cloud. The availability of a SaaS application depends on a reliable and continuously available network.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cloud Computing Synopsis and Recommendations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does PIV Data Model Test Guidelines say about 11.2.2.3 Verify expira tion dates consistency? (Part 2) According to PIV Data Model Test Guidelines, 11.2.2.3 Verify expira tion dates consistency: field value from (2.16.840.1.103.3.7.2.48.0)>> h the following parameters andle (2.16.840.1.10 • (IN) c • (OUT) data 4. Extract validity->notAfter->ut the certificate 5. Set OID := << CHUID ata wit 6. Call pivGetD • (IN) cardH • (IN) OID • (OUT) data | |--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Expected Result(s) | The expiration date of the digital signature certificate is not beyond the ration date of the CHUID i.e. the PIV card expi . |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity of Genomic Data say about 4.1.1. U.S. Government Resources? (Part 1) According to Cybersecurity of Genomic Data, 4.1.1. U.S. Government Resources: 4.1.1. U.S. Government Resources For the U.S. Federal government, the Federal Information Security Management Act (FISMA 2002) served as the initial driver for cybersecurity risk management programs. The Office of Management and Budget (OMB) Circular A-130, 'Managing Federal Information as a Strategic Resource' requires executive agencies to leverage NIST guidance. The NIST RMF and the Federal Risk and Authorization Management Program (FedRAMP) are examples of risk management processes used by federal agencies. FISMA requires each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other sources. The Federal Information Security Modernization Act (FISMA 2014) [40] includes updates to address evolving cybersecurity concerns, reduce reporting burdens, strengthen continuous monitoring in systems, and reporting incidents. OMB Circular A-130 requires executive agencies within the federal government to plan for security, ensure that appropriate officials are assigned security responsibility, periodically review the security safeguards in their systems, and authorize system processing prior to operations and periodically, based on risk. The NIST RMF (defined in NIST SP 800-37 Revision 2) [37] provides a structured, yet flexible, process for managing cybersecurity and privacy risk that includes steps for preparation, system categorization, control selection, control implementation, control assessment, system authorization, and continuous monitoring. Risk management involves more than complying with regulations or technical controls and should be tailored to each organization's mission, regulatory environment, and risk tolerance. Table 1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, rmf, fips. General security reference material without sensitive content. Source: Cybersecurity of Genomic Data.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography say about 5.8.2.2 Two-step Key-Derivation (Extraction-then-Expansion)? According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, 5.8.2.2 Two-step Key-Derivation (Extraction-then-Expansion): For the two-step key-derivation method specified in SP 800-56C, FixedInfo is a bit string that contains component data fields such as a Label , Context information, and [ L ]2, where: - Label is a binary string that identifies the purpose of the derived keying material. The encoding method for the label is defined in a larger context, for example, in a protocol using the key-derivation method. - Context is a binary string containing information relating to the derived keying material. Section 5.8.2 provides a list of context-specific information that may be appropriate for the inclusion in this string. - [ L ]2 is a binary string that specifies the length (in bits) of the keying material to be derived. Different orderings of the component data fields of FixedInfo may be used, and one or more of the data fields may be combined (or omitted under certain circumstances). See Section 5 in SP 800-56C, and Sections 5, 7.4, 7.5 and 7.6 in SP 800-108 for details

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Framework for Multi-mode Authentication_ Overview and Implementation Guide say about Table of Contents? (Part 5) According to A Framework for Multi-mode Authentication_ Overview and Implementation Guide, Table of Contents: | | Appendix A - Handler Library..................................................................................................... | 26 | | Types......................................................................................................................................... | 26 | | Functions................................................................................................................................... | 26 | | Appendix B - Mandatory Access Control Settings ...................................................................... | 28 | | Hardware Related...................................................................................................................... | 28 | | Software Related....................................................................................................................... | 29 | | Appendix C - MAMGlobal Variables.........................................................................................

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: A Framework for Multi-mode Authentication_ Overview and Implementation Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Use of PIV Credentials in Facility Access provide? (Section 47) usion areas. It also ensures that credential validation is done in either case. Notes (4) and (5) add some flexibility in the case of discretionary access control among areas at the same impact level. The previous version of this document included the combined VIS + CHUID authentication mechanism as an option to transitioning from Unrestricted to Controlled areas. VIS + CHUID, however, is not included in this version of the document since both VIS and CHUID provide 'LITTLE or NO' confidence in the identity of the cardholder. Other authentication mechanisms other than the CHUID authentication mechanisms must be implemented. Newly purchased systems must support other authentication mechanisms (e.g., PKI-CAK) besides the CHUID mechanism. PIV authentication mechanisms can be mapped to perimeter crossings in many ways, provided that the requirements of this section are met. Figure 4-2 below provides some examples of mapping PIV authentication mechanisms to the perimeter crossings within a facility. Figure 4-2: Examples of Mapping PIV Authentication Mechanisms <!-- image --> Figure 4-2 illustrates five different examples. Other sequences of authentication mechanisms are possible. Refer to Appendix B for a complete list of possible combinations of PIV authentication mechanisms that could be used in federal agency facility environments. Each example below is labeled with a number and is described as follows: 1. The PKI-CAK, SYM-CAK and BIO authentication mechanisms provide one-factor authentication and can be used to cross from Unrestricted to Controlled areas. 2. The BIO-A, PKI-AUTH and OCC-AUTH authentication mechanisms provide two-factor authentication and can be used to cross into Limited areas. The example shows these authentication mechanisms to cross from Controlled to Limited areas. 3. Authentication in context can be leveraged if the 'Controlled, Limited, Exclusion' areas are nested.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, pki. Contains security framework guidance for authentication systems. Source: Guidelines for the Use of PIV Credentials in Facility Access.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Technical Guide to Information Security Testing and Assessment? (Part 87) Control ES-1: t provides a snapshot of security at a given point in time, organizations may choose to require more frequent assessments. Important technical considerations can also help determine testing frequency. For example, if a system is believed to have several weaknesses, testing might be conducted sooner to confirm the presence of the weaknesses-or delayed until the weaknesses have been mitigated, to confirm they have been resolved. The timing used depends on the testing objective. Another consideration is whether any system or network activities required by the testing may impact the functionality or security of the environmentfor example, if a major upgrade is about to be conducted, testing might be delayed until the upgrade has been completed. Another example of a technical consideration is when an organization wants to identify rogue devices on wired networks. This could be accomplished using one or more techniques, such as performing network discovery through passive sniffing or active scanning, or reviewing data collected by network management software, network intrusion detection sensors, or other devices that routinely monitor network activity. If these monitoring devices are able to generate alerts as soon as a new, potentially rogue device is observed on the network, there may be little or no need to perform periodic testing for rogue devices because effective testing is continuously being performed. Organizations also need to carefully consider resource availability. Resources should first be identified for high-priority systems, after which lower-priority systems may be tested with less frequency and in descending order. If a gap exists between required and available resources, the organization may need to allocate additional resources and consider reducing the scope of its planned assessments.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technical Guide to Information Security Testing and Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Domain Name System-Based Electronic Mail Security say about 3 Device Configuration and Operating Recommendations? According to Domain Name System-Based Electronic Mail Security, 3 Device Configuration and Operating Recommendations: This section provides additional information regarding for installing, configuring and operating Email and DNS security applications. Section 3.1 provides specific recommendations regarding certificate generation. Section 3.2 describes cryptographic operation and management by users on Outlook and Thunderbird. Section 3.3 describes setting up Exchange and Postfix MTAs to provide server-to-server encryption of email. Section 3.4 provides links to some tools and utilities that are useful in installing, configuring, provisioning, and maintaining DNS-based email security software. It is recommended that the installation, configuration, and operation of DNS servers be conducted in conformance to NIST SP 800-81-2, the Secure Domain Name System (DNS) Deployment Guide . Appendix D provides a checklist for management of secure DNSs. Installation, configuration, and operation of email applications should follow the recommendations of SP 800-177, Trustworthy Email .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Use of ISO_IEC 24727 say about C O M P U T E R S E C U R I T Y? According to Use of ISO_IEC 24727, C O M P U T E R S E C U R I T Y: Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 August 2009 <!-- image --> U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Dr. Patrick D. Gallagher, Deputy Director

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Use of ISO_IEC 24727.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Audience according to NIST Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop According to Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop, Audience: The main audiences for this publication are IoT device manufacturers, consumer organizations, and other stakeholders in the consumer home IoT market. This publication may also help IoT device customers or integrators who are incorporating IoT devices intended for the home market into their residence or business, especially small business networks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Technical Guide to Information Security Testing and Assessment say about Executive Summary? (Part 1) According to Technical Guide to Information Security Testing and Assessment, Executive Summary: Executive Summary An information security assessment is the process of determining how effectively an entity being assessed (e.g., host, system, network, procedure, person-known as the assessment object ) meets specific security objectives. Three types of assessment methods can be used to accomplish this-testing, examination, and interviewing. Testing is the process of exercising one or more assessment objects under specified conditions to compare actual and expected behaviors. Examination is the process of checking, inspecting, reviewing, observing, studying, or analyzing one or more assessment objects to facilitate understanding, achieve clarification, or obtain evidence. Interviewing is the process of conducting discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or identify the location of evidence. Assessment results are used to support the determination of security control effectiveness over time. This document is a guide to the basic technical aspects of conducting information security assessments. It presents technical testing and examination methods and techniques that an organization might use as part of an assessment, and offers insights to assessors on their execution and the potential impact they may have on systems and networks. For an assessment to be successful and have a positive impact on the security posture of a system (and ultimately the entire organization), elements beyond the execution of testing and examination must support the technical process. Suggestions for these activities-including a robust planning process, root cause analysis, and tailored reporting-are also presented in this guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report) say about APPENDIX H APPLICABLE GUIDANCE AS REPORTED BY CSPPs? (Part 7) According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report), APPENDIX H APPLICABLE GUIDANCE AS REPORTED BY CSPPs: s IAW FIPS PUBS IBM Manuals IEEE 802.3 IG AUDITS INTERNATIONAL MOU'S IRM P 2100.5 IRS CODE (AS AMENDED) SECTS. 6103(1)01), 6103(P)(4), & 6402(C) I TAR Immigration and Naturalization Act Info Tech. Security Manual National Finance Center provided guidance Info Resources Management Manual InteCom and VMX Manuals Internal Control Review Directive Internal Management Decision JANAP 128, Fed Personnel Manual 732 JDC -Congressional mandate executed by JDC JPL Computer & Network Security G/LS/Handbook JPL SPI 4-19 JPL Software Management Std D-4000 JSC AIS Handbook & AIS Security Plan JSC AISSP JSC Equipment Management Manual JSCM 1600C Security Manual KMI 2410. 4A LIMS Acceptance Test Plan l TU§ RFP LMI 2410.3A & LMI 2410.9 LOCAL REGS FOR BUILDING Low Observables Security Classification Guide M204 STD MANUAL OF OPS & ADMIN (MOA SECT 2, CHAPT 900) MASS Program Devel Plan D-5179 MCCC Devel Section Standard Practice D 1816-15 Mission OPS & Data Sys Directorate Sys Mgmt Policy Document MMI 2410.6 MP-6 MSFC FORM 2683 OCT. 1982 MSFC Source Evaluation Board Guide Management of Fed Info Resources Memo 1/12/87 from AAAG for Adnin. Re Natl. Policy on Protection Mission Operations CorrpuSec Training Model Framework for Mgt. Control over AIS NAS10-10600, S.W.O., WB.B.S 1.4.1, BOC STD & Procedures NASA ADP Risk Analysis G/L/NASA Conn Div Sec Proc Manual NASA AIS Program Handbook NASA Financial Management Manual NASA G/LS for certifying sensitive applications NASA G/LS for contingency planning NASA Handbook 1620.3B. NASA Info Resource Handbook 2410.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Personal Identity Verification (PIV) of Federal Employees and Contractors provide? (Section 49) y agency policy. Reissuance is the process by which a new PIV Card is issued to a cardholder without the need to repeat the entire identity proofing and registration process. The reissuance process may be used to replace a PIV Card that is nearing expiration, in the event of an employee status or attribute change, or to replace a PIV Card that has been compromised, lost, stolen, or damaged. The cardholder may also apply for reissuance of a PIV Card 15 A reasonable basis to believe occurs when a disinterested observer with knowledge of the same facts and circumstances would reasonably reach the same conclusion. if one or more logical credentials have been compromised. The identity proofing, registration, and issuance processes, as described in Section 2.7 and Section 2.8, SHALL be repeated if the issuer does not maintain a PIV enrollment record that includes biometric data records for the cardholder. If the expiration date of the new PIV Card is later than the expiration date of the old card, or if any data about the cardholder is being changed, the card issuer SHALL ensure that an adjudicative entity has authorized the issuance of the new PIV Card. The issuer SHALL ensure that the adjudicative entity has verified that there is a PIV eligibility determination in an authoritative record, such as the agency's IDMS or the Central Verification System (or successor). The issuer SHALL perform a biometric verification of the applicant to the biometric data records of the PIV enrollment record or to the biometric data records of the PIV Card using the BIO-A or OCC-AUTH authentication mechanisms. Minimum accuracy requirements for the biometric verification are specified in [SP 800-76].

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Personal Identity Verification (PIV) of Federal Employees and Contractors.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-20(02) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control AC-20(02): the use of organizaon-controlled portable storage devices by authorized individuals is restricted on external systems using <AC-20(02)_ODP restricons>. POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security of Personal Computer Systems_ A Management Guide say about 1.2.3. NATURE OF DATA BEING HANDLED? According to Security of Personal Computer Systems_ A Management Guide, 1.2.3. NATURE OF DATA BEING HANDLED: The information processed and stored on personal computer systems often can be more sensitive and accessible than that found on larger, multi-user systems. This is due primarily to the fact that the information on a given machine is often associated with one person or a well-defined group. This information is likely to be in the form of memoranda, reports, spreadsheets, or simple lists which are readily accessible using software tools familiar to all personal computer users. Finally, such data will tend to be in relatively "final" form, rather than being a mass of unanalyzed or unprocessed raw data. Al 1 of this may make the job of searching for specific information much easier than on a large systems with thousands of users and data files. The personal computer has been called the electronic equivalent of the desk or file cabinet. This is a useful analogy, since users of personal computers should have an inherent understanding of the nature and need to protect items in their desks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security of Personal Computer Systems_ A Management Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways provide? (Section 164) the public internet, a NAT rule needs to be created to allow the public IP address for the firewall to be used for external network traffic from internal network endpoints using private IP addresses. To create a NAT policy, perform the following steps: 1. Select Devices > NAT. 2. Click New Policy > Threat Defense NAT to create a new policy. Give the policy a name, optionally assign devices to it, and click Save . 3. Click Edit ( ) to edit the Threat Defense NAT policy. 4. Click Add Rule , then select Auto NAT Rule . 5. Under Interface Objects , leave any under Source Interface Objects , and place Outside\_Zone under Destination Interface Objects . <!-- image --> 6. Under the Translation tab, select IPv4-Private-10.0.0.0-8 under Original Source , and under Translated Source select Destination Interface IP . 7. Click Ok , then click Save. 8. Click Deploy > Select Device > Deploy to deploy the NAT policy. <!-- image --> Cisco ISE is a network administration product that allows for enforcement of administrator-created security and access control policies. Cisco ISE captures attributes about devices, such as IP address, MAC address, and OS in order to enforce custom policies. Cisco ISE can be deployed as a standalone system or as a primary and secondary node for high-availability deployments. Our build utilized a single ISE VM node set in standalone deployment. The installation process for deploying a virtualized version of Cisco ISE requires you to download the OVA from and deploy it using VMware. Note that you will need a Cisco account to be able to download software from Cisco. Follow the steps here for deploying the Cisco ISE OVA template. After deploying the ISE OVA, launch the VM console from VMware. At the Cisco ISE CLI, type setup to start the ISE setup wizard. Use it to configure hostname and IP address information and to create admin credentials for the Web Admin portal.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CP-09 in Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations? (Part 6) Control CP-09: 800-192 [24], IR 7874 [25], IR 7966 [26] ## 03.01.03 Information Flow Enforcement Enforce approved authorizations for controlling the flow of CUI within the system and between connected systems. ## DISCUSSION Information flow control regulates where CUI can transit within a system and between systems (in contrast to who is allowed to access the information) and without regard to subsequent accesses to that information. Flow control restrictions include keeping CUI from being transmitted in the clear to the internet, blocking external communications traffic that claims to be sourced from within the organization, restricting requests to the internet that are not from the internal web proxy server, and limiting CUI transfers between organizations based on data structures and content. Transferring CUI between organizations may require an agreement that specifies how the information flow is enforced (see 03.12.05). Transferring CUI between systems that represent different security domains with different security policies introduces the risk that such transfers violate one or more domain security policies. In such situations, information owners or stewards provide guidance at designated policy enforcement points between interconnected systems. Organizations consider mandating specific architectural solutions when required to enforce specific security policies. Enforcement includes prohibiting CUI transfers between interconnected systems (i.e., allowing information access only), employing hardware mechanisms to enforce one-way information flows, and implementing trustworthy regrading mechanisms to reassign security attributes and security labels. Organizations commonly use information flow control policies and enforcement mechanisms to control the flow of CUI between designated sources and destinations (e.g., networks, individuals, and devices) within systems and between interconnected systems.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report on Lightweight Cryptography say about 2.3.1 Lightweight Block Ciphers? (Part 2) According to Report on Lightweight Cryptography, 2.3.1 Lightweight Block Ciphers: g around 2 32 blocks for some of the approved modes of operations. Depending on the algorithm, this may lead to attacks such as plaintext recovery or key recovery or with non-negligible probabilities. - -Smaller key sizes: Some lightweight block ciphers use small key sizes (less than 96 bits) for efficiency (e.g., 80-bit PRESENT). At the time of this writing, the minimum key size required by NIST is 112 bits [4]. - -Simpler rounds: The components and operations used in lightweight block ciphers are typically simpler than those of conventional block ciphers. In lightweight designs using Sboxes, 4-bit S-boxes are preferred over 8-bit S-boxes. This reduction in size results in significant area savings. For example, the 4-bit S-box used in PRESENT required 28 GEs, whereas the AES S-box required 395 GEs in [21]. For hardware-oriented designs, bit permutations (such as those used in PRESENT), or recursive MDS matrices (as in PHOTON [24] and LED [25]) may be preferred over complex linear layers. When rounds are simpler, they may need to be iterated more times to achieve security. - -Simpler key schedules: Complex key schedules increase the memory, latency and the power consumption of implementations; therefore, most of the lightweight block ciphers use simple key schedules that can generate sub-keys on the fly. This may enable attacks using related keys, weak keys, known keys or even chosen keys. Using a secure key derivation function (KDF) can prevent some of these attacks (for examples, see [11, 12, 15, 64]). - -Minimal implementations: There are several modes of operation and protocols that require only the encryption function of a block cipher. Some applications may require a device to only support one of the encryption or decryption operations. Implementing only the necessary functions of a cipher may require fewer resources than implementing the full cipher.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report on Lightweight Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cell Phone Forensic Tools_ an Overview and Analysis Update say about Motorola V300? (Part 1) According to Cell Phone Forensic Tools_ an Overview and Analysis Update, Motorola V300: Motorola V300 The following scenarios were conducted on an unlocked Motorola V300 GSM phone. Connectivity was established using Susteen's Motorola 2 Penguin cable. Connectivity and Retrieval: Proper authentication had to be provided to the password-protected device and the SIM card had to be inserted before contents were successfully acquired. Basic subscriber information (i.e. IMEI/ESN) was found and reported. Memory size is not reported. (Meet) PIM Applications: All active phone book entries were found and reported. Active calendar entries were found. Deleted PIM data was not found. (Below) Dialed/Received Phone Calls: Dialed/received phone calls were not found. (Miss) SMS/MMS Messaging: All active incoming and outgoing SMS messages were found and reported. Deleted SMS and MMS message data (i.e., images, sound bytes) were not found. (Below) Internet Messaging: No data was found. (Miss) Web Applications: Visited URLs, search queries performed, textual Web content and graphical images of visited sites were not found. (Miss) Text File Formats: Data content associated with text files (e.g., . txt , . doc , . pdf ) was not found. (Miss) Graphics Files Format: A connection could not be established allowing the transfer of graphic files (e.g., . bmp , . jpg , . gif . png , . tif ) to the Motorola V300. Images were created by using the picture camera. Active data was found and reported. (Meet). Compressed File Archive Formats: N.A. - The Motorola V300 does not support compressed archive files (e.g., . zip , . rar , . exe , . tgz ). (NA) Misnamed Files: N.A. - The Motorola V300 does not support misnamed files (e.g., . txt file renamed with a . dll extension). (NA) Peripheral Memory Cards: N.A. - The Motorola V300 does not allow for removable media. (NA) Acquisition Consistency: N.A. - SecureView does not provide an internal hashing algorithm for individual files or overall phone acquisition.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Technical Guide to Information Security Testing and Assessment say about Appendix E-Resources? (Part 2) According to Technical Guide to Information Security Testing and Assessment, Appendix E-Resources: ation. Table E-1 contains a list of NIST documents that complement this guide, and Table E-2 provides a list of online resources that organizations may reference for additional information. Table E-1. Related NIST Documents 48 | NIST Document | URL | |------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------| | SP 800-30, Risk Management Guide for Information Technology Systems | | | SP 800-40 Version 2.0, Creating a Patch and Vulnerability Management Program | | | SP 800-53 Revision 2, Recommended Security Controls for Federal Information Systems | final.pdf | | SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems | sz.pdf | | SP 800-64 Revision 1, Security Considerations in the Information System Development Life Cycle | | | SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities | http://csrc.nist.gov/publications/nistpubs/800-84/SP800-84.pdf | | SP 800-92, Guide to Computer Security Log Management | http://csrc.nist.gov/publications/nistpubs/800-92/SP800-92.pdf | | SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS) | http://csrc.nist.gov/publications/nistpubs/800-94/SP800-94.pdf | Table E-2.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Technical Guide to Information Security Testing and Assessment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Service Mesh Proxy Models for Cloud-Native Applications provide? (Section 33) gated based on the degree of isolation of the host (i.e., container versus micro-VM versus VM). The likelihood of exploiting a shared L7 ingress or egress gateway is the same across all architectures. Threat Description : Client libraries are not updated frequently or consistently across the estate of microservices, leading to potential vulnerabilities and weaknesses that can be exploited. Proxy Function Impacted : The proxy's infrastructure code is decoupled from its application code. Impact Score = 1 : The mesh infrastructure is separate from the application itself and, therefore, not directly impacted by application vulnerabilities. Instead, a compromised application would use the functioning mesh to hijack the application's identity. Some application vulnerabilities can be mitigated via policies enforced by the mesh (e.g., mesh-enforced web application firewall (WAF) policy can help mitigate an application vulnerability like Log4j while the organization is patching applications). Likelihood Score = 1 : The likelihood is the same, regardless of architecture. Threat Description : There is a conventional DoS threat. Proxy Function Impacted : Because the proxy is a per app instance, a DoS needs to be executed per app. Because the proxy shares resources with the application, a DoS on the mesh data plane directly competes for resources with the app instance itself. The overall blast radius of the DoS is as strong as the underlying isolation mechanism that protects workloads (i.e., pods) from each other (e.g., VMs, micro-VMs, containers). Impact Score = 1 : There is a single instance of a single application. Likelihood Score = 1 : L4 and L7 code may be exploited. However, the attack must be executed across each instance of the target. There is not a central resource to target to achieve a DoS other than a shared ingress gateway that is identical across all architectures under discussion.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Service Mesh Proxy Models for Cloud-Native Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Derived Personal Identity Verification (PIV) Credentials provide? (Section 12) Technical Requirements....................................................................................................................10 | | | 3.1 | CERTIFICATE POLICIES ............................................................................................................................10 | CERTIFICATE POLICIES ............................................................................................................................10 | | | 3.2 | CRYPTOGRAPHIC SPECIFICATIONS ...........................................................................................................10 | CRYPTOGRAPHIC SPECIFICATIONS ...........................................................................................................10 | | | 3.3 | CRYPTOGRAPHIC TOKEN TYPES ..............................................................................................................10 | CRYPTOGRAPHIC TOKEN TYPES ..............................................................................................................10 | | | | 3.3.1 3.3.2 | Removable (Non-Embedded) Hardware Cryptographic Tokens ..............................................11 | | | 3.4 | Embedded Cryptographic Tokens.............................................................................................12 ACTIVATION DATA ..................................................................................................................................13 | Embedded Cryptographic Tokens.............................................................................................12 ACTIVATION DATA ..................................................................................................................................13 | | | List of Appendices | List of Appendices | List of Appendices | List of Appendices | | Appendix A-Digital Signature and Key Management Keys (Informative)......................................15 | Appendix A-Digital Signature and Key Management Keys (Informative)......................................15 | Appendix A-Digital Signature and Key Management Keys (Informative)......................................15 | | | Appendix B-Data Model and Interfaces for Removable (Non-Embedded) Hardware | Appendix B-Data Model and Interfaces for Removable (Non-Embedded) Hardware | Appendix B-Data Model and Interfaces for Removable (Non-Embedded) Hardware | Appendix B-Data Model and Interfaces for Removable (Non-Embedded) Hardware | | Cryptographic | Tokens (Normative)........................................................................................................16 | Tokens (Normative)........................................................................................................16 | ........................................................16 | | B.1 DERIVED | B.1.1 | PIV APPLICATION DATA MODEL AND REPRESENTATION Derived PIV Application Identifier...........................................................................................16 | | | | B.1.2 | Derived PIV Application Data Model Elements.......................................................................16 |

Explanation: NIST publication on credential and access management. Topics: key management, token. Contains security framework guidance for authentication systems. Source: Guidelines for Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems say about 2.2 Temporal Metrics? According to The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems, 2.2 Temporal Metrics: The threat posed by a vulnerability may change over time. Three such factors that CVSS captures are: confirmation of the technical details of a vulnerability, the remediation status of the vulnerability, and the availability of exploit code or techniques. Since temporal metrics are optional they each include a metric value that has no effect on the score. This value is used when the user feels the particular metric does not apply and wishes to 'skip over' it.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control MA-04 in Assessing Security and Privacy Controls in Information Systems and Organizations? Control MA-04: NONLOCAL MAINTENANCE ASSESSMENT OBJECTIVE: Determine if:


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Service Mesh Proxy Models for Cloud-Native Applications say about 5.1.6. Outdated Client Libraries in Applications (TR-6)? According to Service Mesh Proxy Models for Cloud-Native Applications, 5.1.6. Outdated Client Libraries in Applications (TR-6): Threat Description : Client libraries are not updated frequently or consistently across the estate of microservices, leading to potential vulnerabilities and weaknesses that can be exploited. Proxy Function Impacted : The proxy's infrastructure code is decoupled from its application code. Impact Score = 1 : The mesh infrastructure is separate from the application itself and, therefore, not directly impacted by application vulnerabilities. Instead, a compromised application would use the functioning mesh to hijack the application's identity. Some application vulnerabilities can be mitigated via policies enforced by the mesh (e.g., mesh-enforced web application firewall (WAF) policy can help mitigate an application vulnerability like Log4j while the organization is patching applications). Likelihood Score = 1 : The likelihood is the same, regardless of architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2006 Annual Report say about Overview? (Part 2) According to Computer Security Division 2006 Annual Report, Overview: and outreach programs. Activities in this area have historically, and continue to, involve large amounts of collaboration and the facilitation of relationships with other entities. Federal agencies that have collaborated recently with these activities are the Department of State, the Department of Commerce, the Department of Defense, the General Services Administration, the National Aeronautics and Space Administration, the National Security Agency, the Department of Energy, the U.S. Office of Management and Budget, the Social Security Administration, the United States Postal Service, the Department of Veterans Affairs, the Federal Aviation Administration, and NIST's National Voluntary Laboratory Accreditation Program. The list of industry entities that have worked with us in this area is long and includes the American National Standards Institute (ANSI), Oracle, Cisco Systems, Lucent Technologies, Microsoft Corporation, International Business Machines (IBM), VISA, MasterCard, Computer Associates, RSA Security, Research in Motion, Sun Microsystems, Network Associates, Entrust, and Fortress Technologies. The Division also has collaborated at the global level with Canada, the United Kingdom, France, Germany, India, Japan, and Korea in this area.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2006 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Information Security Handbook_ A Guide for Managers provide? (Section 1) NIST Special Publication 800-100 <!-- image --> Recommendations of the National Institute of Standards and Technology Pauline Bowen Joan Hash Mark Wilson Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 <!-- image --> Carlos M. Gutierrez, Secretary Robert Cresanti, Under Secretary of Commerce for Technology William Jeffrey, Director The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of nonnational-security-related information in federal information systems. This Special Publication 800 series reports on ITL's research, guidelines, and outreach efforts in information system security and its collaborative activities with industry, government, and academic organizations. This document has been developed by the National Institute of Standards and Technology (NIST) in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, and for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Key Notarization System for Computer Networks provide? (Section 12) to every encrypted password stored in system memory. Each user is expected to manage the encrypted keys which belong to him, but he will not know any clear keys. Yet, key encryption is not sufficient. A method is required to protect against key substitution and to insure that each user correctly identifies the user with whom he is communicating. The KNF contains a DES encryption device. It will have a control microprocessor and memory to implement commands and data transfers. The KNF must also store the unencrypted interchange keys and the states of active users. An active state consists of a user identifier along with an initialization vector and an unencrypted data key for both transmitting and receiving data. A user is act ive as soon as his identifier is loaded into active user memory in the KNF. He may then proceed to load the rest of his state. The KNF contains a key generator which is capable of generating unpredictable keys. At any time a user should be able to predict the next key to be generated with only a 1/ (2**56) probability of success where 2**56 is two raised to the 56'th power. One possible key generator is proposed in the Appendix. Once the 56-bit keys are generated the proper parity Is determined and the entire 64-bit key is encrypted before it is returned to the host. Thus, no clear keys are known outside the KNF . The key generator is also used to generate 64-bit initialization vectors which initialize the DBS cryptoal gor i thm . Since the KNF contains clear keys, the encryption algorithm, the commands program, and the key generator, it must be physically protected. Cryptographic facilities containing a single master key are used in Ehrsam, et al [4] to perform encryption and execute key management commands. Our key notarization facilities hold several keys and the key generator. They employ a different key hierarchy, a different set of commands, and are the enforcers of key notarization.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: A Key Notarization System for Computer Networks.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.1.6 Retrieval Time according to NIST PIV Card to Reader Interoperability Guidelines According to PIV Card to Reader Interoperability Guidelines, 2.1.6 Retrieval Time: Retrieval time 1 for 12.5 kilobytes (KB) of data through the contact interface of the reader shall not exceed 2.0 seconds.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Card to Reader Interoperability Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Primary Responsibility according to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy? Primary Responsibility: System Owner; Common Control Provider; Senior Agency Information Security Officer; Senior Agency Official for Privacy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, fips, security control. General security reference material without sensitive content. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain · Safeguard sensitive information from disclosure to otfiers. according to NIST Computer Users' Guide to the Protection of Information Resources According to Computer Users' Guide to the Protection of Information Resources, · Safeguard sensitive information from disclosure to otfiers.: People often forget to lock up sensitive reports and computer media containing sensitive data when they leave their work areas. Information carelessly left on top of desks and in unlocked storage can be casually observed, or deliberately stolen. Every employee who works with sensitive information should have lockable space available for storage when information is not in use. If you aren't sure what infor- mation should be locked up or what locked storage is available, ask your manager. While working, be aware of the visibility of data on your personal computer or terminal display screen. You may need to reposition equipment or furniture to eliminate over-the-shoulder viewing. Be especially careful near windows and in public areas. Label all sensitive diskettes and other computer media to alert other employees of the need to be especially careful. When no longer needed, sensitive information should be deleted or discarded in such a way that unauthorized individuals cannot recover the data. Printed reports should be finely shredded, while data on magnetic media should be overwritten. Files that are merely deleted are not really erased and Ccui still be recovered.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Users' Guide to the Protection of Information Resources.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DS-2 in Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD)? (Part 66) Control DS-2: i): [mud@localhost ~]$ wget 192.168.20.222 --2019-07-24 15:30:01-- / Connecting to 192.168.20.222:80... connected. HTTP request sent, awaiting response... 200 OK Length: 10701 (10K) [text/html] Saving to: ‘index.html’ 100%[======================================>] 10,701 --.-K/s in 0s 2019-07-24 15:30:01 (139 MB/s) - ‘index.html’ saved [10701/10701] Procedure 3 (from pi to laptop): (unapproved): --2019-07-10 17:37:09-- Connecting to 192.168.20.238:80... failed: Connection refused. Procedure 4 (from pi to local hosts): (approved): --2019-07-10 19:02:34-- Connecting to 192.168.20.110:443... connected. HTTP request sent, awaiting response... 200 OK Length: 10701 (10K) [text/html] Saving to: ‘index.html.28’ 0K .......... 100% 11.2M=0.001s NIST SP 1800-15D: Securing Small-Business and Home Internet of Things Devices 159 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 Test Case Field Description 2019-07-10 19:02:34 (11.2 MB/s) - ‘index.html.28’ saved [10701/10701] (approved): --2019-07-10 19:00:10-- Connecting to 192.168.20.232:80... connected. HTTP request sent, awaiting response... 200 OK Length: 277 Saving to: ‘index.html.14’ 0K 100% 10.9M=0s 2019-07-10 19:00:10 (10.9 MB/s) - ‘index.html.14’ saved [277/277] (approved): --2019-07-10 18:59:40-- Connecting to 192.168.20.117:80... connected. HTTP request sent, awaiting response... 200 OK Length: 10701 (10K) [text/html] Saving to: ‘index.html.12’ 0K ..........

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-1 in Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers? (Part 124) Control CM-1: ctions document the software, hardware, and network requirements for Magento Open Source 2.1.X. ## 2.2.2.1 Software Requirements For this implementation, Magento was installed on a CentOS 7.0 server. Magento Open Source developer's documentation states that Magento can operate on Linux operating systems, such as these: -  Red Hat Enterprise Linux -  CentOS -  Ubuntu -  Debian Magento Open Source 2.1.X requires the following installations: -  Web Server: Apache 2.2 or 2.4 or NGINX 1.X -  Database: MySQL 5.6, MariaDB, Percona, or other binary-compatible MySQL technologies -  Hypertext Preprocessor (PHP): 7.0.2, 7.0.4, 7.0.6-7.0.X, or 7.1.X -  Secure Sockets Layer (SSL) -  Mail Server: Redis 3.0, Varnish 3.5, memcached See Magento's developer's documentation for additional details and download links: https://devdocs.magento.com/guides/v2.1/install-gde/system-requirements-tech.html. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ ## 2.2.2.2 Hardware Requirements Magento requires installing Magento Open Source on a server with at least 2 GB of RAM. ## 2.2.3 Magento Preinstallation Magento requires the Linux, Apache, MySQL, PHP (LAMP) software stack. This section describes the process of installing and configuring the LAMP software stack that uses versions compatible with Magento. 1. Open a terminal window, and enter the following command to log in as root: sudo su - a. After entering the command, you will be prompted to enter the password for the current user. 2. To install wget from the terminal, enter the following command: <!-- image --> yum install wget \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ <!-- image --> 3.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Guidance for First Responder Mobile and Wearable Devices provide? (Section 89) ing by remotely logging into the DUT. Most mobile devices do not allow authenticated scans without root account access, which is often restricted or prohibited by the manufacturer or service provider. Like Test 6, all network ports should be analyzed to determine a device's integrity. Guidance: Like guidance in Test 6, devices under a common administration should be routinely scanned over a managed local network using for potential network vulnerabilities. An MDM solution and mobile management policy should be implemented to ensure periotic scanning. Only applications required for mission-critical operations should be present on the device. Nonessential applications should be removed to ensure no external network connections can be made to the device. Authenticated scans are typically performed on devices running an MDM and an associated scanner plugin. The scanner application works in conjunction with the MDM application to provide detailed analysis of device applications and patches. Devices that cannot be scanned or are scanned using unauthenticated methods should have an MTD installed and scheduled to run daily. For more information on MDM implementation, consult NIST SPECIAL PUBLICATION 1800-4, 'Mobile Device Security Cloud and Hybrid Builds.' This publication includes detailed procedures on how to architect enterprise-class protection for mobile devices accessing corporate resources. [27] Benefits: External vulnerability scans allow the user to determine if the mobile device is exploitable. When possible, the scanning software will attempt to determine OS type, hardware platform, exploitable applications, services and exploit unpatched systems. Security Objective(s) : Mobile device confidentiality Test Description: Device confidentiality and autonomy can be maintained using MAC address randomization.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Security Guidance for First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations say about PM-13 SECURITY AND PRIVACY WORKFORCE? According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, PM-13 SECURITY AND PRIVACY WORKFORCE: Supplemental C-SCRM Guidance: Security and privacy workforce development and improvement should ensure that relevant C-SCRM topics are integrated into the content and initiatives produced by the program. Section 2 provides information on C-SCRM roles and responsibilities. NIST SP 800-161 can be used as a source of topics and activities to include in the security and privacy workforce program. Level(s): 1, 2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2008 Annual Report provide? (Section 56) We expect to issue an additional publication, SP 800-56B, Recommendation for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography (e.g., RSA) for public review in FY2009. Wireless Local Area Network (LAN) and Metropolitan Area Network (MAN) technologies are being widely adopted by government agencies. While wireless technologies can provide connections for mobile users, wireless devices and networks are also vulnerable to various attacks. The Institute of Electrical and Electronics Engineers (IEEE), the Internet Engineering Task Force (IETF), and other industry standards bodies have developed security protocols for wireless networks and communications. A new feature for many wireless services is a fast 'handoff' or transition between different access points. Fast handoff poses a new challenge for cryptographic key management. To make the handoff truly fast, cryptographic keys are derived and distributed among different access points so that whenever a mobile station is roaming to a different access point, the keys are ready for a secure connection. A key hierarchy is derived from a master key for the fast handoff. The primary security concerns relate to key establishment among multiple key holders. This is further complicated because, unlike a cellular system, a mobile LAN or MAN station determines when to make a transition from one access point to another. This makes it more difficult for the network to coordinate key establishment among multiple parties in a secure manner. In 2008, we completed draft NIST SP 800-108, Recommendation for Key Derivation Using Pseudorandom Functions, and requested public comments on the draft. The draft of SP 800-108 specifies three families of key derivation functions using pseudorandom functions. They incorporate the most commonly used key derivation functions in wireless applications. We expect to publish SP 800-108 in FY2009 after the public comments are resolved.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2008 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is https according to Guide to Operational Technology (OT) Security? https: //www.cisa.gov/resources-tools/resources/emergency-services-sector-cybersecurity-

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2004 Annual Report say about AUTHORIZATION MANAGEMENT AND ADVANCED ACCESS CONTROL MODELS? (Part 2) According to Computer Security Division 2004 Annual Report, AUTHORIZATION MANAGEMENT AND ADVANCED ACCESS CONTROL MODELS: cess control policies directly impacts its ability to execute its mission - by determining the degree to which its volumes of resources may be protected and shared among its user community. Whether in regard to the Government's war on terror or a company's formation of a strategic partnership, the focus on sharing information is becoming increasingly acute. Unfortunately, when it comes to access control mechanisms, one size does not fit all. At the request and support of the Department of Homeland Security (DHS), CSD has initiated a project in pursuit of a standardized access control mechanism that is general enough to configure and enforce any attribute-based access control policy, referred to as the Policy Machine (PM). A core feature is the PM's ability to configure and enforce arbitrary attribute-based access control policies and its ability to protect resources under multiple instances of these policies. It is not our intent to devise a completely new access control mechanism, but instead to redefine, implement and transfer to industry an access control mechanism that we believe includes abstractions, properties and functions common to most if not all access control mechanisms. If successful, we believe that the PM will benefit organizations in a number of ways including: - Increased user productivity through the increased sharing of resources - Decreased insider crime through the ability to enforce organization-specific access control policies - Increased administrator productivity through better interfaces in configuring access control policy - Increased cooperation among organizations through the potential for the coordination and exchange of interoperability of access control data Development of the PM has been ongoing during the last year and will continue in the coming year. Contact: Mr. David Ferraiolo (301) 975-3046 david.ferraiolo@nist.gov

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Computer Security Division 2004 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2 provide? (Section 98) r a benchmark. While a benchmark can be tailored in place by setting properties of various elements, <xccdf:Profile> elements allow one benchmark document to hold several independent tailorings. The <xccdf:select> element children of the <xccdf:Profile> affect which <xccdf:Group> and <xccdf:Rule> elements are selected for processing when the <xccdf:Profile> is in effect. The <xccdf:refine-rule> element allows modification of properties in <xccdf:Group> and <xccdf:Rule> elements, while the <xccdf:refine-value> element allows modification of <xccdf:Value> properties, including selection of the effective value. Finally, <xccdf:set-value> and <xccdf:setcomplex-value> allow an <xccdf:Value> element's value to be set directly to a simple or complex setting, respectively. The example below shows a simple <xccdf:Profile> . ``` <xccdf:Profile id="xccdf_org.example_profile_strict" prohibitChanges="1" extends="xccdf_org.example_profile_lenient" note-tag="strict-tag"> <xccdf:title>Strict Security Settings</xccdf:title> <xccdf:description> Strict lockdown rules and values, for hosts deployed to high-risk environments. </xccdf:description> <xccdf:set-value idref="xccdf_org.example_value_password-len">10</xccdf:set-value> <xccdf:refine-value idref="xccdf_org.example_value_session-timeout" selector="quick"/> <xccdf:refine-rule idref="xccdf_org.example_value_session-auth-rule" selector="harsh"/> <xccdf:select idref="xccdf_org.example_value_password-len-rule" selected="1"/> <xccdf:select idref="xccdf_org.example_value_audit-cluster" selected="1"/> <xccdf:select idref="xccdf_org.example_value_telnet-disabled-rule" selected="1"/> <xccdf:select idref="xccdf_org.example_value_telnet-settings-cluster" selected="0"/> </xccdf:Profile> ``` An <xccdf:Profile> MAY extend another <xccdf:Profile> in the same benchmark by using the @extends attribute.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2.