You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) provide? (Section 160) all support AES-128 in the CMAC mode as the default for Low and Moderate impact-levels and AES-256 in the CMAC mode as the default for High impact- levels, as specified in [FIPS 197] and [SP 800-38B]. | | PR:7.3 | When interoperability is required, and a symmetric block- cipher algorithm is to be used for authenticated encryption, a Federal CKMS shall support AES-128 in the GCMmode as the default for Low and Moderate impact-levels, and AES- 256 in the GCMmode as the default for High impact-levels, as specified in [FIPS 197] and [SP 800-38D]. | | PR:7.4 | When interoperability is required, and a symmetric block- cipher algorithm is to be used for key wrapping, a Federal CKMS shall support AES-128 in the GCMmode as the default for Low and Moderate impact-levels, and AES-256 in the GCMmode as the default for High impact-levels, as specified in [FIPS 197] and [SP 800-38D]. | | PR:7.5 | When interoperability is required, and a hash function is to be used for a purpose that requires collision resistance 10 , an FCKMS shall support SHA-256 as the default for Low and Moderate impact-levels, and SHA-384 as the default for High impact-levels, as specified in [FIPS 180]. | 9 As opposed to authenticated encryption, which is addressed in PR:7.3 . 10 E.g., for the generation of a digital signature. | PR:7.6 | When interoperability is required, and digital signature generation and verification is to be performed using DSA, the hash function used during signature generation and verification shall be selected as specified in PR:7.5 .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation provide? (Section 87) | | [APNIC1] | G. Michaelson, 'MyAPNIC RPKI service now supports AS0 ROA creation,' APNIC technical note online, November 2018. https://blog.apnic.net/2018/11/09/myapnic-rpki-service-now-supports- as0-roa-creation/ | | [Arbor] | 'NETSCOUT Arbor's 13th Annual Worldwide Infrastructure Security Report' (2018). https://pages.arbornetworks.com/rs/082-KNA- 087/images/13th_Worldwide_Infrastructure_Security_Report.pdf | | [Arbor2] | 'NETSCOUT Arbor's 14th Annual Worldwide Infrastructure Security Report' (2019). 03/SECR_005_EN-1901%E2%80%93WISR.pdf | | [ARIN1] | 'Using RPKI at ARIN to certify resources,' ARIN online. https://www.arin.net/resources/rpki/using_rpki.html#hosted | | [ARIN2] | M. Kosters, 'ARIN Provisioning in RPKI,' NANOG 67, June 2016.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Resilient Interdomain Traffic Exchange_ BGP Security and DDoS Mitigation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST provide? (Section 25) n entry is signed, permissions can be automatically set to make the entry read-only for all users. However, the original author should be able to add a signed addendum to the entry if the need arises. It may also be beneficial to include singleauthor project notebooks in this database. Scientists often find it useful to share information by consulting a peer's notebook during information searches and work flow coordination. In an electronic environment, a centralized database for the ERN that permits simultaneous access over a network would be most convenient. Another important reason for storing the ERNs in a central database is that the central database management system can provide the crucial time-stamping and digital signature capabilities for the ERNs. Most scientists use a variety of software tools such as spreadsheets, statistical packages, finite element analysis packages, etc. Ideally, these should be linked to the ERN in order to integrate important data and prevent needless repetition. Since many scientists use visual browsing to search for particular notebook entries, it would be useful for the ERN to provide a similar capability. This may be done by placing a series of thumbnail sketches of consecutive entries on the screen. Using visual recognition as a search mechanism might prove to be faster in some cases than using hypertext to retrieve important data. In the previous section, the required ERN features were presented. In this section, current technologies as well as commercial products that are relevant for the design of the ERN are reviewed. The enabling technologies to support the ERN design include: - Electronic notepad and PDA technology; - Handwriting recognition technology; - Optical Character Recognition (OCR) technology; - Multimedia technology; - Object-oriented technology; - Database management technology; - Digital signature technology; - Time-stamping technology.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Prerequisites according to Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality? Prerequisites: block cipher algorithm; key K ; counter generation function; formatting function; MAC length Tlen . Input : valid nonce N ; valid payload P of length Plen bits; valid associated data A ; Output : ciphertext C.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Electronic Health Records on Mobile Devices say about puppet will install here? (Part 103) According to Securing Electronic Health Records on Mobile Devices, puppet will install here: ntrols T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P . 1 8 0 0 - 1 . Company Product V. Architecture Element* Use Open source Open source Fedora PKI Manager 9 2 BIND 9.9.4 3, 5 Open source Puppet Enterprise 3.7 5 Cisco Identity Services Engine 1.2 7, 15 Cisco ASAv 9.4 Open source UrBackup 1.4.8 12 Root CA cryptographically signs identity certificates to prove authenticity of users and devices Domain name system (DNS) server performs host or fully qualified domain resolution to Internet Protocol (IP) addresses Secure configuration manager for creation, continuous monitoring, and maintenance of secure server and user hosts Local and remote mobile network access control (NAC), RADIUSbased authentication, authorization, and accounting management server Enterprise-class VPN server based on both TLS and IPsec Online remote backup system used to provide disaster recovery Cisco RV220W 6.0.4 16, 17 Wi-Fi access point NIST SP 1800-1D: Securing Electronic Health Records on Mobile Devices 24 NIST Cybersecurity Framework Function Detect (DE) T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f Reference to NIST 800-53 Rev 4 Controls AC-2, AC-4, AU-12, CA-3, CA-7, CM-2, CM-3, CM-8, PE-3, PE-6, PE-20, RA-5, SC-5, SC-7, SI-3, SI-4 c h a r g e f r o m : h t t p : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P Respond (RS) AU-6, CA-2, CA-7, CP-2, PE-6, IR-4, IR-5, IR-8, SI-4 . 1 8 0 0 - 1 . Company Product V.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Control according to Trustworthy Email? Control: The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed [ Assignment: organization-defined actions to be covered by non-repudiation ].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Notional Supply Chain Risk Management Practices for Federal Information Systems provide? (Section 46) ationships with integrators or suppliers. Note: (1) Use information as available, including information from commercial sources, U.S. government agencies, and intelligence information as appropriate. (2) Respond to such changes when appropriate, e.g., by adding additional countermeasures (such as additional practices from this document) or changing to a less risky integrator or supplier; - Integrate ICT SCRM considerations in continuous monitoring activities; and - Collect feedback on integrator or supplier responsiveness and effectiveness at mitigating risks per acquirer requests. The acquirer should use the practices in Section 4 to address supply chain assurance when acquiring replacement components or field additions/modifications/upgrades, particularly if they do not go through traditional acquisition processes that examine ICT supply chain risks. Acquirers and integrators need to be aware of the time frame within which their elements and systems are expected to become obsolete and plan for replacing and upgrading these elements and systems. Systems that have a long life cycle may require a substantial number of elements that are no longer available from the original component manufacturer or through their franchised distributors. In some cases, upgrades may not be compatible with the system (backwards compatible) or supported by the original manufacturer. Acquirers and integrators should identify and plan for when elements become obsolete. This section provides ten practices that federal department and agency acquirers (acquirers) should consider when creating the list of practices that they employ as part of their ICT SCRM strategy. Each practice is a blend of programmatic activities, validation/verification activities and requirements, as well as general and technical implementation requirements.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, continuous monitoring. General security reference material without sensitive content. Source: Notional Supply Chain Risk Management Practices for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Information Technology Security Services provide? (Section 29) 's policy meets a higher standard, will 'the service provider's' have trouble meeting this higher standard? If lower, will 'the service provider' abide by the stricter policies of the organization? 3. How does 'the service provider' address the comingling of its data with that of another organization? Are processes in place to ensure that an organization's data is protected? | 1 The organization is the unit that acquires and ultimately receives the security service from the service provider. An organizational conflict of interest (OCI) may exist when a party to an agreement has a past, present or future interest related to the work performed (or to be performed), which may diminish its capacity to provide impartial, technically sound, objective service or results in an unfair competitive advantage. Of course, it is best to avoid organizational conflicts before they arise. The Federal Acquisition Regulation (FAR) (subpart 9.5) describes two underlying principles why avoiding an OCI is important: -  Preventing the existence of conflicting roles that might bias a [service provider's] judgment -  Preventing unfair competitive advantage According to the FAR, an unfair competitive advantage exists where a [service provider] possesses proprietary information that was obtained from a Government official without proper authorization or source selection information that is relevant to the contract but is not available to all competitors, and such information would assist that [service provider] in obtaining the contract. Although the FAR applies to Federal contracts, any organization should be aware that an OCI could occur in any phase of the IT security services lifecycle and may provide an unfair competitive advantage. -  There are several methods that an organization can take to avoid, neutralize, or minimize the effect of an OCI. They can include: modify or eliminate the offending parts of the agreement, statement of work, contract, etc.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Information Technology Security Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in Guidelines for the Use of PIV Credentials in Facility Access? (Part 80) Control PD-12: aster than RSA private key operations, PCIs should consider issuing PIV Cards with ECC Card Authentication keys rather than RSA. The performance of the PIV Card is partially dependent upon the reader. The PKI-CAK authentication mechanism is usually performed over the contactless interface, with the PIV Card being powered by the reader's magnetic field, and cards will operate more slowly when they are underpowered. Improper installation of the reader may lead to the card being underpowered, and it may also create interference that makes communication between the card and the reader unreliable, which would also lead to increased transaction times. Recommendation C.2 : Make use of Qualified HSPD-12 Service Providers 22 to ensure that PACS components are properly installed and that readers are properly tested and tuned to provide optimal performance. In order to maximize performance, the PIV Card needs to be held correctly within the reader's magnetic field. So, departments and agencies should provide information to their cardholders on the proper way to present their cards to the readers. Placing an image on the reader depicting the proper orientation of the card may also be helpful. Preregistration of PIV Cards can help to speed up many of the steps in the PKI-CAK authentication mechanism. If the card's Card Authentication certificate was obtained during the preregistration process then it doesn't need to be read from the card at the time of authentication. 23 Instead, the reader can obtain an identifier from the card (e.g., by reading the initial portion of the CHUID and extracting the FASC-N, Card UUD, or Cardholder UUID) and can then use the identifier to look up the certificate in the local cache. In addition, status information for the Card Authentication certificate may be obtained from a caching status proxy rather than performing certificate validation at the time of authentication.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Guidelines for the Use of PIV Credentials in Facility Access.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Digital Identity Guidelines_ Identity Proofing and Enrollment provide? (Section 126) haustive list of types of identity evidence grouped by strength. Fair Evidence Examples A.1. The qualities and features of the different types of FAIR evidence vary based on how they are implemented. CSPs must evaluate and document the evidence types that it will accept based on the requirements provided in these guidelines. Table 4.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Digital Identity Guidelines_ Identity Proofing and Enrollment.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications provide? (Section 42) and 15. The Random Excursions Variant Test. This section (Section 2) consists of 15 subsections, one subsection for each test. Each subsection provides a high level description of the particular test. The corresponding subsections in Section 3 provide the technical details for each test. Section 4 provides a discussion of testing strategy and the interpretation of test results. The order of the application of the tests in the test suite is arbitrary. However, it is recommended that the Frequency test be run first, since this supplies the most basic evidence for the existence of non-randomness in a sequence, specifically, non-uniformity. If this test fails, the likelihood of other tests failing is high. (Note: The most time-consuming statistical test is the Linear Complexity test; see Sections 2.10 and 3.10). Section 5 provides a user's guide for setting up and running the tests, and a discussion on program layout. The statistical package includes source code and sample data sets. The test code was developed in ANSI C. Some inputs are assumed to be global values rather than calling parameters. A number of tests in the test suite have the standard normal and the chi-square ( χ 2 ) as reference distributions. If the sequence under test is in fact non-random, the calculated test statistic will fall in extreme regions of the reference distribution. The standard normal distribution (i.e., the bell-shaped curve) is used to compare the value of the test statistic obtained from the RNG with the expected value of the statistic under the assumption of randomness. The test statistic for the standard normal distribution is of the form z = (x µ )/ σ , where x is the sample test statistic value, and µ and σ 2 are the expected value and the variance of the test statistic. The χ 2 distribution (i.e., a left skewed curve) is used to compare the goodness-of-fit of the observed frequencies of a sample measure to the corresponding expected frequencies of the hypothesized distribution.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Audit and Evaluation of Computer Security provide? (Section 125) m. process of aggregation hierarchically until all microscopic levels of control adequacy on the (lowest) line item level have been trans- lated into macroscopic parameters on higher subsystem levels. It is perfectly conceivable, even at this very preliminary stage of the investigation, that a "standard" scale for system security may even- tually evolve from the crude beginnings postulated here. These criti- 6-19 I I 1 I 1 1 1 1 I I — — 1 1 CQ >-O< C_)o QC ZD ce: t— o 2:oo 00 00 LUOo =3: CD O O) +->c CDO cn 4-> Q. E oo OJ cn cu o cn OJ +-> (/) >. CD n3 S- CD o s- Q_ i- OJ CO 4-5 =3 o a. s- n3 OJ Ci3 X OJ o I o CD I O I I CM I O O o I— I— d: oo —I o O _l Q_o cc: 00 I— h- ^ 2r 0003:0 O LU O HH t— o I— LU 00 —I C_) h- <C •-" LU Q. 00 ^ S O ZD Q. s: d; o 00 s: UJ ca; I—t o Q. CQ Q o H-i Q. E o cu o cn_j CD r— >- O I— C_) I— ^ CQO cC O Q::O =) —1 CO 00 O oo LU o cc: I t t 1^0 I 000^ i I 1010 CM CM O I— I CM CVJ CM I I— CM I 00 2: 00 q; I— LU O O 00 o q; <C u-1 I— LU cc: ^ S C3i o oo >- o 00 1—1 s 00 q; o LU CD O LU h- <_> I— o< ^ LU < 2: Q^ < LU C!3 o h- o q: cc cn I—I Q_ LU a: cx: I T3 N CD CD > LO •1 13 +J -l-> •r— z: +-) fO cu S- 3 CD 2: +-> o cc LU Q_ 00 o 2: OO Q. O _l 00 1— 1—I LU H- < q; <o [— LU 1— CC ^ Q I—I 2: =) cC O <C Ll_ O CD 'q. +-> t— 00 CD 2: 0 -»-> 1— 0 [— E X 1— <D 1— LU CC M CC s: 1— =c 1— in > 00 CC < LU 0 00 0 u_ 00 a: LU 1— 0 0 CC AT EE 0 EM <: C_) cc: LU 1— cc _J 0 Q_ 00 LU Cl_ LU >- >- 00 D_ Q 1— 00 =) < U_ 00 LU CO ct: LU Z3 CC Q =3 LUQ O LU OO QCO CL. Ct: OO 00 LU 00 C_) LU OO <C eC LUo c_> LU cC 00 LU 00 cc LU ZD cc: Q 00 =3 LU LU Q O q; LU o ZD o cc: Q O Q. LU ccO Q_ H- o LU Cc: D- LU 2: LU LU a. LU CQ :r D.^ oo —I 00 LU cc > LU LU D. Q CD a CD CJ > •r- S- > cu S- 00 (D 00 > M- •r— 0 ^- cn +-> 0 cu LO fO +-> <+- ^- 0 cu 0 u cu ^ CL 0 1 Q 1— 00 _l 1/1 No AT LU LU Q- CC >- zr I— f— I—I C_) ei: _J LU 00 a.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Audit and Evaluation of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition provide? (Section 7) ......................................................................................9 ................................................................................................................ | | | 4.3 CubeHash | 9 | | | 4.3.1 Security | 10 | | | 4.3.2 | ....................................................................................................... Performance................................................................................................ 11 | | | 4.3.3 | Discussion................................................................................................... 12 | | | 4.4 ECHO.....................................................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NSTIC Pilots_ Catalyzing the Identity Ecosystem say about 5.1. Acronyms? According to NSTIC Pilots_ Catalyzing the Identity Ecosystem, 5.1. Acronyms: AAAE American Association of Airport Executives AAMVA The American Association of Motor Vehicle Administrators ACT-IAC American Council for Technology - Industry Advisory Council AP Attribute provider AXN Attribute Exchange Network COI Community of interest COPPA Children's Online Privacy Protection Act COTS Commercial off the shelf CSDII The Cross Sector Digital Identity Initiative CSP Credential Service Provider DHS Department of Homeland Security DMV Department of Motor Vehicles FFO Federal funding opportunity FICAM Federal Identity and Access Management FIPS Federal information processing standards FNS Food and Nutrition Services FTC Federal Trade Commission FY Fiscal Year GP Guiding Principles GSA General Services Administration GTRI Georgia Tech Research Institute IDESG Identity Ecosystem Steering Group IDEF Identity Ecosystem Framework IdP Identity provider ITL Information Technology Laboratory KBA Knowledge-based authentication LoA Level of assurance MFA Multi-factor authentication NCRIC Northern California Regional Intelligence Center NIEF National Identity Exchange Federation NIST National Institute of Standards and Technology NSTIC National Strategy for Trusted Identities in Cyberspace NPO National Program Office OIDC OpenID Connect OMB Office of Management and Budget PDS Personal Data Store PIV Personal Identity Verification PKI Public key infrastructure PRIVO Privacy Vaults Online RNS Resilient Network Systems

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, mfa. Contains security framework guidance for authentication systems. Source: NSTIC Pilots_ Catalyzing the Identity Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Supporting Roles according to NIST_SP_800-37r2_Risk_Management_Framework? Supporting Roles: System Owner or Common Control Provider; Information Owner or Steward; System Security Officer; System Privacy Officer; Senior Agency Information Security Officer; Senior Agency Official for Privacy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identity and Access Management for Electric Utilities say about Java Application? (Part 55) According to Identity and Access Management for Electric Utilities, Java Application: Reconciliation for: Users e. Reconciliation Type: Incremental Reconciliation f. Reconciliation Triggers: AlertDbConnectorTrigger g. Select the schedule as Immediate, Once, Periodically, or Advance. For Periodically, specify the Start At, End At, and Rerun every (duration of job frequency, which should be no less than every 2 minutes). T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . NIST SP 1800-2C: Identity and Access Management for Electric Utilities 220 Figure 9-47 Guardian Reconciliation Job T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . Click Save. 10 PACS Server: RS2 Access It! Universal Server Installation The Access It! Universal RS2 Technologies PACS Server is installed on the PACS Network to help control physical access to simulated facilities, rooms, etc. RS2 Technologies cards and card readers were also included in both builds. The RS2 Technologies PACS Server is installed on a VM that is running the Windows Server 2012 R2 OS. . 10.1 Security Characteristics Cybersecurity Framework Categories: PR.AC-2: Physical access to assets is managed and protected. NIST SP 800-53 Revision 4 Security Controls: PE-2, PE-3, PE-4, PE-5, PE-6, PE-9 NIST SP 1800-2C: Identity and Access Management for Electric Utilities 221 10.2 System Environment The system for the PACS-Console Server configured by the NCCoE contains the following configuration settings and environmental constraints:  Windows Server 2012 R2  VM with CPU Quad Core 2.199 GHz  VM with 8,192 MB of memory  virtual hard disk containing 240 GB of storage 10.3 AIUNIVERSAL Installation T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Analysis of First Responder Mobile and Wearable Devices say about Description? According to Security Analysis of First Responder Mobile and Wearable Devices, Description: A police officer selects a device from a charging station. Although this device is different from the device the officer used yesterday, the officer proceeds to log into the device. After login, the device is automatically configured with the officer's Quality of Service, Priority, and Preemption (QPP) information, and public safety mobile applications are configured with the appropriate settings.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Analysis of First Responder Mobile and Wearable Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Security and Privacy in Public Cloud Computing say about Abstract? According to Guidelines on Security and Privacy in Public Cloud Computing, Abstract: Cloud computing can and does mean different things to different people. The common characteristics most interpretations share are on-demand scalability of highly available and reliable pooled computing resources, secure access to metered services from nearly anywhere, and displacement of data and services from inside to outside the organization. While aspects of these characteristics have been realized to a certain extent, cloud computing remains a work in progress. This publication provides an overview of the security and privacy challenges pertinent to public cloud computing and points out considerations organizations should take when outsourcing data, applications, and infrastructure to a public cloud environment. Keywords: Cloud Computing; Computer Security and Privacy; Information Technology Outsourcing

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Security and Privacy in Public Cloud Computing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.3 WHERE WERE THESE EVENTS TAKING PLACE? according to NIST Report_ Authentication Diary Study According to Report_ Authentication Diary Study, 4.3 WHERE WERE THESE EVENTS TAKING PLACE?: For each authentication event recorded, participants were asked to record whether they were on or off the NIST campus at the time of the event. Figure 5 shows the number of events recorded by each participant, while distinguishing the location (i.e., whether they were on- or off-campus). Figure 5: Participants' authentication events by location <!-- image --> Table 2 provides a delineation of all participants' authentication events by location (oncampus or off-campus) and type (work-related or personal). It should be noted that authentication events recorded on the NIST campus were not always work-related; likewise, not all events that were recorded off-campus were personal. Table 2: Authentication events by location and type | | Event Type | Event Type | | |----------------|--------------|--------------|-----------| | Event Location | Personal | Work-related | All Types | | NIST | 26 | 359 | 385 | | Off-campus | 63 | 80 | 143 | | All Locations | 89 | 439 | 528 | Additionally, the data show that 72.92% of the recorded authentication events took place on-campus, while 27.08% took place off-campus. This is to be expected, given that most of our participants worked on-campus during the diary day. Two participants were telecommuting at the time of the study, and one was on work-related travel.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report_ Authentication Diary Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Labels for Open Systems_ an Invitational Workshop say about Advantages? According to Security Labels for Open Systems_ an Invitational Workshop, Advantages: - The passport can be distributively administered - The simplest form can be quickly established because it only contains ID and authentication information, requiring no lengthy and controversial negotiations on meanings of privileges. Most countries in the world agree, regardless of their politics or ideologies, on use of passports. - Use of visas allow privileges to be included in passports to simplify border decisions. - The token should be small enough to be included as a label in every PDU that directly or vicariously represents a user. - The privilege information can be locally held at destinations of service/access requests instead of at origins, simplifying administration at each domain and reducing trust negotiations among domains. - The same credentials (passport, token) can be used at convenient intervening checkpoints (security interfaces between major components) such as between a workstation application and its communications system (airport passport check), at the entrance to and exit from a network, at the entrance to a host or other network, at the application within a host or server. This reduces the amount of credential information carried by the PDUs and increases useable communication bandwidth. - The passport applies the benefits of an already-working solution that has stood the test of time in world diplomacy to distributed systems security.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Security Labels for Open Systems_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 1143) isseminaon of security alerts and advisories]. T h i s p u b l i c a  o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h  p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P. 8 0 0 - 5 3 A r 5 CHAPTER FOUR PAGE 625 Reference produced from open data hps://github.com/usnistgov/oscal-content T h i s p u b l i c a  o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h  p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P. 8 0 0 - 5 3 A r 5 NIST SP 800-53A, REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS SI-06 SECURITY AND PRIVACY FUNCTION VERIFICATION ASSESSMENT OBJECTIVE: Determine if: SI-06_ODP[01] security funcons to be veriﬁed for correct operaon are deﬁned; SI-06_ODP[02] privacy funcons to be veriﬁed for correct operaon are deﬁned; SI-06_ODP[03] SI-06_ODP[04] SI-06_ODP[05] SI-06_ODP[06] SI-06_ODP[07] SI-06_ODP[08] SI-06a.[01] SI-06a.[02] SI-06b.[01] SI-06b.[02] SI-06c.[01] SI-06c.[02] SI-06d.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain INTRUSION DETECTION according to NIST U.S. Department of Energy Risk Assessment Methodology According to U.S. Department of Energy Risk Assessment Methodology, INTRUSION DETECTION: - CCTV - Alarms - -Balanced magnetic switches - Motion - -Volumetric - -Infrared

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: U.S. Department of Energy Risk Assessment Methodology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Attribute Metadata_ A Proposed Schema for Evaluating Federated Attributes provide? (Section 37) hould not be confused with the concept of a Derived pedigree, which focuses on generating the attribute's value rather than verifying it. 6. Not Verified - The attribute's value has not been verified. Table 8 - Currency Metadata | Metadata Element | Description | Recommended Values | |--------------------|----------------------------------------------------------------------------------------------------------------------|----------------------| | Last Verification | The date and time when the attribute value was last verified as being true and belonging to the specified individual | No restrictions | | Last Refresh | The date and time when the attribute was last refreshed | No restrictions | | Metadata Element | Description | Recommended Values | |--------------------|--------------------------------------------------|----------------------| | Expiration Date | The date an attribute's value is no longer valid | No restrictions | RPs may not trust certain attribute values unless they have been verified within a certain time period. This is particularly true for certain values associated with attributes such as Role or Security Clearance , where the original established date of the value alone may not be sufficient for granting access to national security systems or data. Last Verification provides the most recent date and time at which the value was verified as true and belonging to the specified individual. This metadata provides only the last date that verification occurred, and does not include any information about method of verification. Last Refresh contains information on the date and time when an attribute's value was last refreshed. The age of the attribute can be derived from this attribute value.

Explanation: NIST publication discussing classified information handling. References: security clearance, national security. Contains guidance on protecting sensitive government information. Source: Attribute Metadata_ A Proposed Schema for Evaluating Federated Attributes.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report) say about PAGE? (Part 2) According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report), PAGE: | . | . | . . | III-17 | | III-13 | Physical/Environmental Protection-GADPS | | . | . | . | III-17 | | III-14 | Controls-GADPS | | | | | III-17 | | III-15 | Production, I/O Emergency, Backup, and Cont. Planning-GADPS | | | | | III-18 | | III-16 | Software and Maintenance-GADPS | . | . | . | . | III-18 | | III-17 | System Security Awareness and Training-GADPS | . | . | . | . | III-18 | | III-18 III-19 | Authorization and Access Controls-GADPS Audit Trail Mechanisms-GADPS | | . . | . . | . . | III-19 III-19 | | III-20 | Confidentiality Controls-GADPS | | | | | III-19 | | III-21 | Integrity Controls-GADPS | | | | | III-20 | | III-22 | User | Identification/Authorization-GADPS | . | . | . | III-20 | | III-23 | Assignment Security Responsibility-MAS | | | . | . | III-22 | | III-24 | Personnel Screening-MAS . | . | | . | .

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.23.1 Security Benefit according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance, 6.23.1 Security Benefit: Incident management tools enable manufacturers to minimize downtimes due to incidents and increase the efficiency and productivity of the manufacturing system. Information gained during incident handling can be used to better prepare for handling any future incident. Incident response plans enable organizations to act proactively before an incident or immediately after an incident is noticed to limit the impact from incidents.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Manageability is an important system property enabling several of the FIPPs according to An Introduction to Privacy Engineering and Risk Management in Federal Systems? Manageability is an important system property enabling several of the FIPPs: access and amendment; accountability; minimization; quality and integrity; and individual participation. If agencies cannot administer individuals' information with sufficient granularity, they cannot be confident that inaccurate information can be identified and corrected, obsolete information is disposed of, only necessary information is collected or disclosed, and that individuals' privacy preferences about uses of their information are implemented and maintained.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: An Introduction to Privacy Engineering and Risk Management in Federal Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Report on the Privilege (Access) Management Workshop say about Summary? (Part 2) According to A Report on the Privilege (Access) Management Workshop, Summary: facilitate integration of products from various vendors. Existing definitions serve the purpose of effective discourse, but there is currently no generally accepted definition of privilege management. This report uses a definition of privilege management 15 that aligns with the draft definition of privilege management made by the Identity, Credential, and Access Management (ICAM) Subcommittee of the Federal Information Security & Identity Management Committee. The eXtensible Access Control Markup Language (XACML), an OASIS standard for managing access control policy, provides some of what is needed to support enterprise-level privilege management. Also needed are capabilities for creation and maintenance of policy, policy enforcement, attribute collection, maintenance, and retrieval, and definition of resource attributes. In the area of access control methods, this report concludes that a formal standardized definition of attribute-based access control (ABAC) is needed. Although there has been much socialization of the term ABAC, there are still many variations in its description. Toward the end of standardizing its meaning, a definition of ABAC was offered as a starting point. There are three access control methods that are clearly distinguishable from one another: identity-based access control (IBAC), role-based access control (RBAC), and attribute-based access control (ABAC). Although policy-based access control (PBAC) does not need to be considered a separate access control method, the ideas associated with views of it make it clear 15 Privilege management is the definition and management of attributes and policies that are used to decide whether a user's request for access to some resource should be granted. that full realization of ABAC's potential requires better attribute and policy management capabilities at the enterprise level.

Explanation: NIST publication on credential and access management. Topics: access control, identity management, sso. Contains security framework guidance for authentication systems. Source: A Report on the Privilege (Access) Management Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Subject Public Key Info according to NIST Test Personal Identity Verification (PIV) Cards Version 2? Subject Public Key Info: rsaEncryption, 2048-bit modulus, e=65537

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations say about REFERENCES? According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, REFERENCES: Source Control: MA-05 Supporting Publications: None

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Computer Security Log Management say about 5.2.3 Comparing System-Level and Infrastructure-Level Analysis? (Part 1) According to Guide to Computer Security Log Management, 5.2.3 Comparing System-Level and Infrastructure-Level Analysis: 5.2.3 Comparing System-Level and Infrastructure-Level Analysis Analysis is typically very similar for system-level and infrastructure administrators. The main difference is that for infrastructure administrators, log analysis is often a primary responsibility, whereas for systemlevel administrators it is often a secondary responsibility, particularly if the infrastructure administrators are reviewing the most important log entries from systems. In such an arrangement, infrastructure administrators typically perform log analysis on an ongoing basis each day, and system-level administrators perform periodic reviews (e.g., daily, weekly) commensurate with the criticality of each system and its information. Also, infrastructure administrators might have access to more sophisticated tools than system-level administrators do because it is cost-prohibitive to have them available for all systems. Regardless of how much analysis is performed at the infrastructure level, system-level administrators usually need to perform analysis for the following types of entries: - GLYPH<c=31,font=/APONEK+Webdings> Entries that are of interest or importance at the system level but are not forwarded to the infrastructure because of their relative priority - GLYPH<c=31,font=/APONEK+Webdings> Entries for log sources that cannot automatically participate in the infrastructure (e.g., unusual proprietary formats, standalone systems, legacy systems, appliances) - GLYPH<c=31,font=/APONEK+Webdings> Entries that cannot be understood without context that is only available at the system level. System-level administrators can usually perform their reviews and analysis using a variety of tools and techniques. On some systems, particularly those with many log sources, it is effective to establish a local log infrastructure and store the data from all of the system's log sources there.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Computer Security Log Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Electronic Health Records on Mobile Devices provide? (Section 98) thentication No internal or external identity source is required for the EAP-TLS certificate-based authentication method because the identity is validated based on the trusted certificate in the PKI. However, you must set up the Certificate Authentication Profile in the ISE as the external identity source. Instead of authenticating via the traditional username and password, Cisco ISE compares a certificate received from a client with one in the server to verify the authenticity of a user or device. Note that although internal or external identity sources are not needed for TLS authentication, internal or external identity sources can be added and used for authorization of a policy condition, if desired. To create a Certificate Authentication Profile: 1. Use the Administration Portal to navigate to the path Administration > Identity Management > External Identity Sources > Certificate Authentication Profile and click Add. NIST SP 1800-1C: Securing Electronic Health Records on Mobile Devices 27 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 1 . . 2. Fill out the form with proper parameters. Be sure to select the Subject Name as the Principal Username X509 attribute because it is the field that will be used to validate the authenticity of the client. 7.3.5 Set Authentication Protocols Cisco ISE uses authentication protocols to communicate with external identity sources. Cisco ISE supports many authentication protocols, such as the Password Authentication Protocol, Protected Extensible Authentication Protocol, and the EAP-TLS. For this build, we used the EAP-TLS protocol for user and machine authentication. To specify the allowed protocols services in Cisco ISE: 1. From the Administration Portal, navigate to the path Policy > Policy Elements > Results > Authentication > Allowed Protocols > Add. 2.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, identity management. Contains security framework guidance for authentication systems. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Developing Security Plans for Federal Information Systems say about COMMON TERMS AND DEFINITIONS? (Part 5) According to Guide for Developing Security Plans for Federal Information Systems, COMMON TERMS AND DEFINITIONS: commended controls in the low, moderate, or high baselines described in NIST SP 800-53, that provide equivalent or comparable protection for an information system. | | Confidentiality [44 U.S.C., Sec. 3542] | Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. | 32 | Configuration Control [CNSS Inst. 4009] | Process for controlling modifications to hardware, firmware, software, and documentation to ensure that the information system is protected against improper modifications before, during, and after system implementation. | |-----------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Countermeasures [CNSS Inst. 4009] | Actions, devices, procedures, techniques, or other measures that reduce the vulnerability of an information system. Synonymous with security controls and safeguards. | | Executive Agency [41 U.S.C., Sec. 403] | An executive department specified in 5 U.S.C., Sec. 101; a military department specified in 5 U.S.C., Sec. 102; an independent establishment as defined in 5 U.S.C., Sec. 104(1); and a wholly owned Government corporation fully subject to the provisions of 31 U.S.C., Chapter 91. | | Federal Enterprise Architecture [FEA Program Management | A business-based framework for government-wide improvement developed by the Office of Management and Budget that is intended to facilitate efforts to transform the federal government to one that is citizen-centered, results-oriented, and market-based. | | Federal Information System [40 U.S.C., Sec.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Guide for Developing Security Plans for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Confidentiality_ Identifying and Protecting Assets Against Data Breaches say about 5.3.1 User Login with Multifactor Authentication? (Part 1) According to Data Confidentiality_ Identifying and Protecting Assets Against Data Breaches, 5.3.1 User Login with Multifactor Authentication: 5.3.1 User Login with Multifactor Authentication Phishing-resistant multifactor authentication is a security best practice. The architecture recommends the use of a password, pin (personal identification number) or biometric with an asymmetric cryptographic key for authentication. However, it is common practice for organizations to offer a variety of MFA solutions. This can include user-owned mobile devices, which may impact privacy risk [17]. Figure 5-1 Multifactor Authentication Data Flow Diagram <!-- image --> Table 5-8 User Login with Multifactor Authentication Data Actions | Data Type | Data Action | Privacy Impact | |---------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Username | Username is stored by the user workstation and transferred across the authentication process to help identify the trans- action. | Usernames potentially contain inferable PII such as user's first and last names. | | Client IP Ad- dress | The client IP (Internet Protocol) address is stored by the user workstation, and transferred as part of communica- tions where it is an endpoint.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa. Contains security framework guidance for authentication systems. Source: Data Confidentiality_ Identifying and Protecting Assets Against Data Breaches.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N say about <Policy PolicyId = 'Policy 1' rule-combining-algorithm='permit-overrides'>? (Part 1) According to A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N, <Policy PolicyId = 'Policy 1' rule-combining-algorithm='permit-overrides'>: <Policy PolicyId = 'Policy 1' rule-combining-algorithm='permit-overrides'> ``` // Doctor Access to Medical Records // <Target> /* :Attribute-Category :Attribute ID :Attribute Value */ :access-subject :Role :doctor :access-subject :Role :intern :resource :Resource-id :medical-records :action :Action-id :read :action :Action-id :write </Target> <Rule RuleId = 'Rule 1' Effect='Deny'> <Condition> ``` ``` Function: string-not-equal ``` ``` /* :Attribute-Category :Attribute ID */ :access-subject :WardAssignment :resource :WardLocation </Condition> </Rule> <Rule RuleId = 'Rule 2' Effect='Deny'> <Condition> Function: and Function: string-equal /* :Attribute-Category :Attribute ID :Attribute Value */ :access-subject :Role :intern Function: string-equal /* :Attribute-Category : Attribute ID :Attribute Value */ :action :Action-id :write </Condition> </Rule> <Rule RuleId = 'Rule 3' Effect='Permit'> <Condition> Function: and Function: string-equal /* :Attribute-Category :Attribute ID :Attribute Value */ :access-subject :Role :doctor Function: string-equal /* :Attribute-Category :Attribute ID :Attribute Value */ :resource :PatientStatus :critical </Condition> </Rule> </Policy> ``` Together policies (PolicySets and Policies) and attribute assignments define the authorization state. Table 1 defines the authorization state for Policy 1 by specifying attribute names and values.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile provide? (Section 83) R1: Allow incident handlers to manually select and perform containment actions instead of or in addition to automated | |---------------|-------------------------------------------------------------------------|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | RS.MI-02 | Incidents are eradicated | High | containment measures.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: csf, fips, security control. General security reference material without sensitive content. Source: Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PS-15413 in Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations? (Part 173) Control PS-15413: prise's information sharing policy. The C-SCRM PMO can help identify C-SCRM stakeholders to include in threat information sharing, as well as potential sources of information for supply chain threats. Level(s): 1, 2 ## PM-17 PROTECTING CONTROLLED UNCLASSIFIED INFORMATION ON EXTERNAL SYSTEMS Supplemental C-SCRM Guidance: The policy and procedures for controlled unclassified information (CUI) on external systems should include protecting relevant supply chain information. Conversely, it should include protecting agency information that resides in external systems because such external systems are part of the agency supply chain. Level(s): 2 ## PM-18 PRIVACY PROGRAM PLAN Supplemental C-SCRM Guidance: The privacy program plan should include C-SCRM. Enterprises should require their prime contractors to implement this control and flow down this requirement to relevant sub-tier contractors. Level(s): 1, 2 ## PM-19 PRIVACY PROGRAM LEADERSHIP ROLE Supplemental C-SCRM Guidance: The privacy program leadership role should be included as a stakeholder in applicable C-SCRM initiatives and activities. Level(s): 1 ## PM-20 DISSEMINATION OF PRIVACY PROGRAM INFORMATION Supplemental C-SCRM Guidance: The dissemination of privacy program information should be protected from cybersecurity risks throughout the supply chain. Level(s): 1, 2 ## PM-21 ACCOUNTING OF DISCLOSURES Supplemental C-SCRM Guidance: An accounting of disclosures should be protected from cybersecurity risks throughout the supply chain. Level(s): 1, 2 ## PM-22 PERSONALLY IDENTIFIABLE INFORMATION QUALITY MANAGEMENT Supplemental C-SCRM Guidance: Personally identifiable information (PII) quality management should take into account and manage cybersecurity risks related to PII throughout the supply chain.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Cybersecurity Framework Version 1.1 Manufacturing Profile? (Part 57) Control AM-1: to each verified user, device, and process interacting with the manufacturing systems. Ensure credentials are authenticated and the unique identifiers are captured when performing system interactions. | IA-5 | | PROTECT | Identity Management, Authentication and Access Control (PR.AC) | PR.AC-7 | Low Impact | | | PROTECT | Identity Management, Authentication and Access Control (PR.AC) | PR.AC-7 | Perform a risk assessment on manufacturing user transactions to document and implement the authentication mechanisms required (e.g. single- or multi-factor) for each transaction.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Cybersecurity Framework Version 1.1 Manufacturing Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Gema Howell according to Guidelines for Managing the Security of Mobile Devices in the Enterprise? Gema Howell: 0000-0002-0428-5045 Murugiah Souppaya: 0000-0002-8055-8527

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Managing the Security of Mobile Devices in the Enterprise.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: Hardware integrity verification allows organizations to detect unauthorized

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2005 Annual Report say about e-AUTHENTICATION? (Part 1) According to Computer Security Division 2005 Annual Report, e-AUTHENTICATION: e-AUTHENTICATION T he Office of Management and Budget (OMB) has identified the remote identification of users, or e-authentication, as a crosscutting impediment to the provision of Internetbased government services. To fully realize the benefits of electronic government, government agencies require e-authentication policies and corresponding technical guidance tailored to the protection of government systems and data. This project establishes a policy structure for eauthentication within the U.S. government, promoting consistent implementation of eauthentication across Federal agencies. This consistency will in turn help to enhance government efficiency by securing electronic processes needed to conduct more transactions through egovernment applications. OMB released memorandum M-04-04, EAuthentication Guidance for Federal Agencies , in December 2003. This OMB policy <!-- image --> memorandum defined four levels of authentication - Levels 1 to 4 - in terms of the assurance that an asserted identity is valid. The OMB guidance requires agencies to perform a risk assessment to determine the appropriate authentication level for an application based on the likely consequences of an authentication error. This means a system using Level 4 authentication - a system that allows a user access to more sensitive, personal information for example - has a much higher assurance that a user's identity is what it is claimed it to be. After completing a risk assessment and mapping the identified risks to the required assurance level, OMB guidance directs agencies to identify and implement appropriate authentication mechanisms based on NIST technical guidance. In 2004, our e-authentication technical guidance was published as SP 800-63, Recommendation for Electronic Authentication .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Computer Security Division 2005 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AU-8 in Guidelines for Smart Grid Cybersecurity? Control AU-8: Time Stamps 2.16.8 Time Stamps CIP 007-3a (R5.1.2, R6.3) SG.AU-9 Protection of Audit Information

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Report on Lightweight Cryptography provide? (Section 39) oe, C., PRESENT: An Ultra-Lightweight Block Cipher . Proc. 9th International Workshop on Cryptographic Hardware and Embedded Systems (CHES 2007), Vienna, Austria, September 10-13, 2007, LNCS 4727, pp. 450-466, - [10] Borghoff, J., Canteaut, A., Güneysu, T., Kavun, E.B., Knezevic, M., Knudsen, L.R., Leander, G., Nikov, V., Paar, C., Rechberger, C., Rombouts, P., Thomsen, S.S., and Yalçın, T., PRINCE - A Low-Latency Block Cipher for Pervasive Computing Applications . Proc. 18th International Conference on the Theory and Application of Cryptology and Information Security (ASIACRYPT 2012), Beijing, China, December 2-6, 2012, LNCS 7658, pp. 208-225, - [11] Chen, L., Recommendation for Key Derivation through Extraction-then-Expansion , NIST Special Publication (SP) 800-56C, National Institute of Standards and Technology, Gaithersburg, Maryland, November 2011, https://doi.org/10.6028/NIST.SP.800-56C - [12] Chen, L., Recommendation for Key Derivation Using Pseudorandom Functions (Revised) , NIST Special Publication (SP) 800-108, National Institute of Standards and Technology, Gaithersburg, Maryland, October 2009, https://doi.org/10.6028/NIST.SP.800-108 - [13] Cryptographic Research and Evaluation Committees, http://www.cryptrec.go.jp/english/ [accessed August 11, 2016] - [14] Cryptographic Research and Evaluation Committees, CRYPTREC Report 2014 , Report of the Cryptographic Technology Evaluation Committee, 296 pages, March 2015, - [15] Dang, Q., Recommendation for Existing Application-Specific Key Derivation Functions , NIST Special Publication (SP) 800-135 Revision 1, National Institute of Standards and Technology, Gaithersburg, Maryland, December 2011, - [16] De Cannière, C., and Preneel, B., Trivium : 'New Stream Cipher Designs - The eSTREAM Finalists' (Springer, 2008), LNCS 4986, pp.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Report on Lightweight Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PD-12 in 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings? (Part 99) Control PD-12: , D. Engert, I. Foster, C. Kesselman, S. Tuecke, J. Volmer, an d V. Welch, 'A National-Scale Authentication Infrastructure,' IEEE Computer , 33(12):60 66, December 2000. Doster, W., M. Watts, and D. Hyde, 'The KX.509 Protocol,' U niversity of Michigan, Ann Arbor, MI, 2001 (. citi.umich.edu/techreports/reports/citi-tr-01 2.pdf). Foster, I., and C. Kesselman, 'Globus: A Metacom puting Infrastructure Toolkit.' Intl J. Supercomputer Applications , 11(2):115128, 1997. Heimdal Kerberos Implementation (http:// www.pdc.kth.se/heimdal/), October 5, 2006. Komar, B., 'Microsoft Windows Server 2003 PKI and Certificate Security,' Microsoft PKI Team, Microsoft Press, Redmond, WA, 2004. Microsoft Corporation, '2821A: Design ing and Managing a Micros oft Windows Public Key Infrastructure,' Microsoft Official Curriculum 2821A, Redmond, WA, 2003. Neuman, B.C., and T. Ts'o, 'Kerberos: An Authentication Service for Computer Networks,' IEEE Communications , 32(9):33-38, September 1994. Open Smart Card Project ( . opensc-project.org/), October 5, 2006. RSA Laboratories, PKCS #11 v2.20: Cryptographic Token Interface Standar d , Bedford, MA, June 2004. Sun Documentation (http://docs.sun.com/, http://docs.sun.com/app/do cs/prod/entsys.05 q4#hic). Sun Java Enterprise Server 2005Q4, (.sun.com/software/javaenterpris esystem/index.xml). U.S. Department of Homeland Security, Homeland Security Presidential Directive (HSPD-12): Policy for a Common Identification Standard for Federal Employees and Contractors (. whitehouse.gov/news/releases/2004/08/2004 0827-8.html), August 27, 2004. Zhu, L., and B. Tung, RFC 4556 Public Key Cryptography for Initial Authent ication in Kerberos (PKINIT) , The Internet Society, June 2006. ## 6th Annual PKI R&D Workshop - Proceedings 1 Microsoft offers both Standard Certificate Services and Enterprise Certificate Services.

Explanation: NIST publication on credential and access management. Topics: authentication, pki, token. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation provide? (Section 265) 0 - Configure the RUT with the VCs by using the following file: - Verify that the RUT received all VRPs in the RPKI database coming from Cache s 1 and 2. - The RUT receives Update 10.100.0.0/16 65510. - Verify that the RUT received the update from Step 6 and validated it as valid . - The RUT receives Update 10.100.0.0/16 65511. - Verify that the RUT received the update from Step 8 and validated it as invalid . - Shut down Cache 1. - Verify that the validation state of both updates did not change. <!-- image --> Each of the expected results in Steps 1, 4, 6, 8, and 10 above will be verified. Results were as expected. The vendor implementations act differently, mainly controlled by their configurations. This means that one implementation identified the loss of the cache faster than the other. We determined that the router that kept data longer cleared stale data after a configured time span between one minute and one hour. Test SIDR Requirements CR-6.6.1 when working with IPv4/6 addresses. Show that the RUT receives and installs VRPs of two RPKI caches with a slightly different view on the RPKI into the RPKI database properly. Then, Cache 1 disappears. The testbed is configured with the topology, IP addressing scheme, and ASNs as depicted in the Testbed Architecture in Figure E-1 and Figure E-2. The RUT's cache is empty, and RPKI validator/ Caches 1 and 2 are empty. <!-- image --> | IPv4 or IPv6? | Both | Both | |-----------------|--------|--------| | Procedure | Verify | | - Connect the RUT to RPKI Cache 1 and receive three ROAs: - 10.100.0.0/16 16 65510 - 10.100.0.0/16 20 65510 - FD00::10.100.0.0/64 64 65510 - Connect the RUT to RPKI Cache 2 and receive three ROAs: - 10.100.0.0/16 16 65511 - 10.100.0.0/16 20 65511 - FD00::10.100.0.0/64 64 65511 - Configure the RUT with the VCs by using the following file: - Verify that the RUT received all VRPs in the RPKI database coming from Caches 1 and 2. - The RUT receives Update 10.100.0.0/16 65510.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting the Integrity of Internet Routing_ Border Gateway Protocol (BGP) Route Origin Validation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities? (Part 21) Control ES-1: tablishing an event schedule; and documenting the TT&E event methodology. Section 3 briefly discusses the role of training in a TT&E program and how training is related to exercises and tests. Section 4 contains information on determining the need for tabletop exercises, and designing, developing, conducting, and evaluating an exercise event. This section describes the design phase in detail, including determining the topics and scope; identifying the objectives; identifying participants and training staff; and coordinating logistics. Sections 5 and 6 contain similar information for functional exercises and tests, respectively. This document also contains several appendices. Appendices A, B, and C contain samples of the documentation associated with tabletop exercises, functional exercises, and tests, respectively. Appendix D contains a glossary, and Appendix E contains an acronym list. Appendix F identifies print and online resources that may be helpful in scoping, planning, documenting, conducting, and evaluating TT&E events. Appendix G contains an index for the publication. ## 2. Establishing a Test, Training, and Exercise Program An organization's IT plans need to be maintained to sustain the organization's ability to prepare for, respond to, manage, and recover from disasters affecting its mission. 2 Common types of IT plans used for this purpose are as follows: - GLYPH<c=31,font=/KKMIHL+Webdings> Contingency plan: Recovering and reconstituting IT systems. 3 Contingency plans include continuity of operations plans, business continuity plans, and disaster recovery plans. - GLYPH<c=31,font=/KKMIHL+Webdings> Incident response plan: Reporting and managing computer security incidents. 4 The following are the major types of events used to maintain these plans: - GLYPH<c=31,font=/KKMIHL+Webdings> Tests.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Small Business Information Security_ The Fundamentals say about 1.2 Organization of this Publication? According to Small Business Information Security_ The Fundamentals, 1.2 Organization of this Publication: The rest of this publication is organized as follows: - Section 2 describes how an information security program can be implemented. - Section 3 discusses those key actions small businesses can take to develop or improve their information security and cybersecurity. - Section 4 identifies several key practices directed towards users which you can implement immediately and which will protect your system and information. - Appendix A provides a glossary of key terms and acronyms used in this publication. - Appendix B contains sources referenced throughout this publication. - Appendix C contains a description of the NIST Framework for Improving Critical Infrastructure Cybersecurity [CSF14] . - Appendix D provides worksheets useful in conducting a risk analysis. - Appendix E contains example information security policy and procedure statements.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: csf, fips, security control. General security reference material without sensitive content. Source: Small Business Information Security_ The Fundamentals.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Report of the Workshop on Cryptography in Support of Computer Security provide? (Section 11) tion about its underlying structure. Tomorrow, we will break up into two working groups in order to explore in some detail two important areas of interest. The mathematics working group, headed by Dr. Howard Campaigne, will deal with the strictly mathematical aspects of the algorithm, especially from a cryptanalyt ic point of view. The applications working group, headed by Dr. Joseph Eachus, will deal with the very practical areas of key generation, usage, and distribution that are so important in the day-to-day use of an encryption scheme. Following Professor Bigelow's introduction, Dr. Ruth Davis, Director of the Institute for Computer Sciences and Technology, welcomed the participants, thanked them for their participation and outlined briefly the history of the NBS involvement with the Data Encryption Standard, the purpose of the standard and the anticipated contribution of the workshop DAVIS: It has long been recognized that a publicly available encryption technique was needed to protect data as it is stored in a computer or transmitted from one computer to another. To this end NBS has been working on a data encryption standard since 1972. The purpose of the standard is to provide a uniform technique for all Federal agencies to use. It is not intended to be universally applied wherever data is stored or transmitted within the United States. In selecting a candidate for a standard, NBS twice solicited in the Federal Register and selected the algorithm that best satisfied the requirements of a standard from among those submitted. In establishing a standard, the encryption algorithm is not left in vacuo. It will be embedded in a framework of guidelines that recommend procedures and environments in which the algorithm is used as only one part of an overall security system. We are now working on developing such guidelines.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Workshop on Cryptography in Support of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does PIV Data Model Test Guidelines say about ibute OID = 2.16.840.1.101.3.6.6). AS07.04.09: The FASC-N shall be populated in the subjectAltName extension using the pivFASC-N attr? According to PIV Data Model Test Guidelines, ibute OID = 2.16.840.1.101.3.6.6). AS07.04.09: The FASC-N shall be populated in the subjectAltName extension using the pivFASC-N attr: VE07.04.09.01: The vendor shall specify in its documentation the inclusion of the FASC-N in the subjectAltName extension as part of the card authentication certificate profile. TE07.04.09.01: The tester shall validate the presence of the FASC-N in the subjectAltName extension in the card authentication certificate issued by the vendor.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.1 Acceptance of the Second-Round Candidates according to NIST Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process According to Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process, 2.1 Acceptance of the Second-Round Candidates: NIST selected 26 candidate algorithms for the second round. Of the 26 candidates, 17 were keyestablishment mechanisms (KEMs) or public-key encryption schemes, while nine were digital signatures. Submission teams were allowed to make minor modifications and re-submit their packages, which had to meet the same requirements as the original submissions. Four of the candidates were mergers of first-round algorithms: LEDAcrypt (merged from LEDAkem and LEDApkc), NTRU (merged from NTRUEncrypt and NTRU-HRSS-KEM), ROLLO (merged from LAKE, LOCKER, and Ouroboros-R), and Round5 (merged from Hila5 and Round2). The complete updated specifications were posted on www.nist.gov/pqcrypto on April 10, 2019, for public review. Table 2: Second-Round Candidates | BIKE | LEDAcrypt | Rainbow | |--------------------|-------------|-------------| | Classic McEliece | LUOV | ROLLO | | CRYSTALS-DILITHIUM | MQDSS | Round5 | | CRYSTALS-KYBER | NewHope | RQC | | FALCON | NTRU | SABER | | FrodoKEM | NTRU Prime | SIKE | | GeMSS | NTS-KEM | SPHINCS+ | | HQC | Picnic | Three Bears | | LAC | qTESLA | |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.2.4 Installing AssetCentral according to NIST IT Asset Management According to IT Asset Management, 4.2.4 Installing AssetCentral: AssetCentral is installed on a hardened CentOS7 Linux system. AssetCentral requires PHP, Web Server (Apache) and MySQL database to be installed. Table 4-1 Recommended Versions for AssetCentral - Tier 3 | Vendor | Product | Version | |----------|-------------------------|---------------------------------| | RedHat | Enterprise Linux Server | Release 6.4 (Santiago) (x86_64) | | Apache | Web Server | httpd-2.2.15-26.el6.x86_64 | | mysql | Server | 5.1.6.6 | | php | | 5.3.3 or higher |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IT Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Section 102) | A system that does not meet the criteria for a federal system. | | network | A system implemented with a collection of interconnected components. Such components may include routers, hubs, cabling, telecommunications controllers, key distribution centers, and technical control devices. | | network access | Access to a system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, Internet). | | on behalf of (an agency) [32 CFR 2002] | A situation that occurs when: (i) a non-executive branch entity uses or operates an information system or maintains or collects information for the purpose of processing, storing, or transmitting federal information; and (ii) those activities are not incidental to providing a service or product to the Government. | | operational technology | The hardware, software, and firmware components of a system used to detect or cause changes in physical processes through the direct control and monitoring of physical devices. | | organization [FIPS 200, Adapted] | An entity of any size, complexity, or positioning within an organizational structure. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | penetration-resistant architecture | An architecture that uses technology and procedures to limit the opportunities for an adversary to compromise an organizational system and to achieve a persistent presence in the system.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Remote Electronic UOCAVA Voting say about 5.4.6 Formal Verification of Software? According to Security Considerations for Remote Electronic UOCAVA Voting, 5.4.6 Formal Verification of Software: Formal verification of software involves providing mathematical proofs of the correctness of a given piece of software. In order to do formal verification, it must be possible to very precisely describe correct behavior in an algorithm. For this reason, formal verification is very hard to do for large software systems since it is difficult to precisely capture the behavior of a complex system. However formal verification is sometimes done for smaller pieces of a larger software system, such as the software implementing a cryptographic algorithm or protocol. Formal verification of software is very expensive, and is only done in extraordinary applications. For example, the INTEGRITY-178B real-time operating system, one of only two formallyverified operating systems, is used in military and commercial avionics. Formal verification of system designs, while still uncommon, is required at Evaluation Assurance Levels 5, 6 and 7 of a Common Criteria security evaluation [25]. Again, these often involve verifying only a small piece of software within a larger system. Because of its considerable cost, formal verification of software or designs is likely not well-suited to mitigating risks of software defects or vulnerabilities in remote electronic voting systems.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Remote Electronic UOCAVA Voting.