You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report_ Authentication Diary Study say about 6.2.4 Management workload for infrequently used passwords? According to Report_ Authentication Diary Study, 6.2.4 Management workload for infrequently used passwords: Multiple participants described the difficulties of managing a password that needs to be renewed more than it is actually used: '[O]nce or twice a year I have to log into a foreign application we have here, and fill out a form, BizFlow, and I usually have to get my password reset because I don't remember what it was. I try a few times, and before I get to the right one I'm locked out.' (P14) 'I don't travel very often, but when I do I have to log in to something called Travel Management. And that password expires just as fast as any other password. Every single time I go to log in to submit my expense reports, first of all, my account is locked because I haven't changed my password in a few months. So then I have to figure out how to unlock it. Then I've got to go change it.' (P19) 'And e-Approval is something that I use so infrequently that each of the past few times I've had to do something in there, I've had to get my password reset, and it is very embarrassing.' (P11) 'Once again security has gotten in my way and it takes me extra time because now I got to look that one up because I don't use that one often enough.' (P17)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report_ Authentication Diary Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Test Personal Identity Verification (PIV) Cards Version 2 say about CRL Distribution Points :? According to NIST Test Personal Identity Verification (PIV) Cards Version 2, CRL Distribution Points ::

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Taxonomic Rules for Password Policies_ Translating the Informal to the Formal Language say about 2 IDENTIFYING WITHIN SCOPE STATEMENTS? According to Taxonomic Rules for Password Policies_ Translating the Informal to the Formal Language, 2 IDENTIFYING WITHIN SCOPE STATEMENTS: Upon initial perusal, many password policies make similar types of statements. Policies contain length and character set requirements, restrictions on how passwords are stored and whether they can be communicated, and warnings about consequences for a user who enters a password incorrectly too many times. While individual requirements, restrictions, and consequences may di er slightly, the impression is that all policies cover largely similar territory. However, upon closer examination, di erences emerge in the topics covered by di erent policies. Some policies regulate applications' and system administrators' behavior as well as users'. Some policies discourage passwords entirely, recommending either a security token or long passphrases with dramatically di erent composition requirements. Some policies lay out multiple sub-policies, each pertaining to passwords for di erent kinds of accounts (e.g., shared, normal user, privileged user, or system accounts).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Taxonomic Rules for Password Policies_ Translating the Informal to the Formal Language.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Notional Supply Chain Risk Management Practices for Federal Information Systems say about 4.4.2 Integrators - General Requirements? (Part 3) According to Notional Supply Chain Risk Management Practices for Federal Information Systems, 4.4.2 Integrators - General Requirements: uality processes ISO/IEC 9001, ISO/IEC 27001, ISO 28000, and other certifications, which can be leveraged to help ascertain existence of responsible quality practices as they pertain to SCRM; and - b. Measures such as Common Vulnerability Scoring System (CVSS) scores for vulnerabilities and fixes that they release publicly above a particular severity level, before the product ships. - j) Protect against disclosing the uses of system, elements, or processes by which elements are designed, developed, produced, tested, delivered, or supported, or convey technological or operational advantage. - k) Report supply chain threats and incidents in operational environments to agreed-upon recipient(s) within established time frame parameters.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Notional Supply Chain Risk Management Practices for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-7(12) in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Control SI-7(12): Provenance Tracking Detect, Exert

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Electronic Health Records on Mobile Devices provide? (Section 45) c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P . 1 8 0 0 - 1 . Appendix A References [1] M. Souppaya and K. Scarfone, Guidelines for Managing the Security of Mobile Devices in the Enterprise, NIST Special Publication 800-124 Revision 1, National Institute of Standards and Technology, Gaithersburg, Maryland, June 2013, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-124r1.pdf [accessed 4/24/2018]. [2] [3] [4] [5] [6] [7] Fifth Annual Benchmark Study on Privacy and Security of Healthcare Data, Ponemon Institute, May 2015, [accessed 4/24/2018]. J. Pritts, HHS Mobile Devices Roundtable: Health Care Delivery Experts Discuss Clinicians’ Use of and Privacy & Security Good Practices for mHealth, The Office of the National Coordinator for Health Information Technology, Department of Health and Human Services [Website], [accessed 4/24/2018]. R. Kissel, Glossary of Key Information Security Terms, NISTIR 7298 Revision 2, National Institute of Standards and Technology, Gaithersburg, Maryland, May 2013, [accessed 4/24/2018]. Mobile Devices – Secure Exchange of Electronic Health Information, Final Draft, National Cybersecurity Center of Excellence, National Institute of Standards and Technology, Gaithersburg, Maryland, November 2014, description-final.pdf [accessed 4/24/2018].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.3 Scenarios and Findings according to NIST Mobile Device Security_ Bring Your Own Device (BYOD) According to Mobile Device Security_ Bring Your Own Device (BYOD), 5.3 Scenarios and Findings: One aspect of the security evaluation involved assessing how well the reference design addresses the security characteristics that it was intended to support. The Cybersecurity Framework and Privacy Framework Subcategories were used to provide structure to the security assessment by consulting the specific sections of each standard that are cited in reference to a subcategory. Using these subcategories as a basis for organizing the analysis allowed systematic consideration of how well the reference design supports the intended security and privacy characteristics. This section of the publication provides findings for the security and privacy characteristics that the example solution was intended to support. These topics are described in the following subsections: - development of the Cybersecurity Framework and NICE Framework mappings - development of the Privacy Framework mappings - TEs related to security and example solution architecture mitigations - problematic data actions related to privacy and potential mitigations that organizations could employ An example scenario that demonstrates how an organization may use NIST SP 1800-22 and other NIST tools to implement a BYOD use case is discussed more in the NIST SP 1800-22 Supplement, Example Scenario: Putting Guidance into Practice of this practice guide.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Computer Security Log Management? (Part 14) Control ES-1: | List of Figures | List of Figures | | Figure 2-1. Security Software Log Entry Examples ................................................................ | Figure 2-1. Security Software Log Entry Examples ................................................................ | 2-3 | | Figure 2-2. Operating System Log Entry Example ................................................................. | Figure 2-2. Operating System Log Entry Example ................................................................. | 2-4 | | Figure 2-3. Web Server Log Entry Examples ......................................................................... | Figure 2-3. Web Server Log Entry Examples ......................................................................... | 2-6 | | Figure 3-1. Examples of Syslog Messages ............................................................................ | Figure 3-1. Examples of Syslog Messages ............................................................................ | 3-6 | | List of Tables | List of Tables | List of Tables | | Table 4-1. Examples of Logging Configuration Settings......................................................... | Table 4-1. Examples of Logging Configuration Settings......................................................... | 4-6 | ## This page has been left blank intentionally. ## Executive Summary A log is a record of the events occurring within an organization's systems and networks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Computer Security Log Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Engineering Trustworthy Secure Systems say about J.3.1. Security Purpose? According to Engineering Trustworthy Secure Systems, J.3.1. Security Purpose: - -Identify security considerations for projects to meet the strategic objectives of the organization.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4 say about 7. Appendix B - Sample Benchmark File? (Part 4) According to Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4, 7. Appendix B - Sample Benchmark File: stract="1" cluster-id="finger"> <cdf:title>IOS - no IP finger service</cdf:title> <cdf:description> Disable the finger service, it can reveal information about logged in users to unauthorized parties. (For <cdf:sub idref="os-name"/> version 11.3 and later.) </cdf:description> <cdf:question>Prohibit the finger service</cdf:question> <cdf:ident system="http:/cce.mitre.org/">CCE-12345</cdf:ident> <cdf:impact-metric>AV:R/AC:L/Au:N/C:P/I:N/A:N</cdf:impact-metric> <cdf:fixtext fixref="no-finger" xml:lang="en"> Turn off the finger service altogether, it is <htm:i>very</htm:i> rarely used.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.3. SSC Security for CI/CD Pipelines - Implementation Strategy according to NIST Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines, 5.3. SSC Security for CI/CD Pipelines - Implementation Strategy: The extensive set of steps needed for SSC security cannot be implemented all at once in the SDLC of all enterprises without a great deal of disruption to underlying business processes and operational costs. Rather, solutions that provide SSC security can be broadly classified into the following types [17]: 1. Solutions that ensure SSC security through features associated with each task in the DevSecOps pipelines: - a. Verifying that the software is built correctly by ensuring tamper-proof build pipelines, such as by providing verified visibility into the dependencies and steps used in the build [18], since compromised dependencies or build tools are the greatest sources for poisoned workflows. - b. Including features for the specification of checklists for each step of the delivery pipeline to provide guidance for implementation and to check and enforce controls for complying with checklists. 2. Solutions that ensure integrity and provenance through digital signatures and attestations 3. Strategy to ensure that running code is up to date, such as instituting a 'build horizon' (i.e., code that is older than a certain time period should not be launched), to keep production as close as possible to the committed code in the repositories. 4. Securing CI/CD clients to prevent malicious code from stealing confidential information (e.g., proprietary source code, signing keys, cloud credentials), reading environment variables that may contain secrets, or exfiltrating data to an adversary-controlled remote endpoint.

Explanation: NIST publication discussing classified information handling. References: classified, secret. Contains guidance on protecting sensitive government information. Source: Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Scripting Language according to Guidelines on Active Content and Mobile Code? Scripting Language: A definition of the syntax and semantics for writing and interpreting scripts.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Active Content and Mobile Code.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST_SP_800-37r2_Risk_Management_Framework say about SYSTEM LIFE CYCLE CONSIDERATIONS? According to NIST_SP_800-37r2_Risk_Management_Framework, SYSTEM LIFE CYCLE CONSIDERATIONS: OTHER FACTORS EFFECTING THE EXECUTION OF THE RMF ll systems, including operational systems, systems under development, and systems that are undergoing modification or upgrade, are in some phase of the SDLC. 166 Defining requirements is a critical part of an SDLC process and begins in the initiation phase. 167 Security and privacy requirements are part of the functional and nonfunctional 168 requirements allocated to a system. The security and privacy requirements are incorporated into the SDLC simultaneously with the other requirements. Without the early integration of security and privacy requirements, significant expense may be incurred by the organization later in the life cycle to address security and privacy concerns that could have been included in the initial design. When security and privacy requirements are defined early in the SDLC and integrated with other system requirements, the resulting system has fewer deficiencies, and therefore, fewer privacy risks or security vulnerabilities that can be exploited in the future. A Integrating security and privacy requirements into the SDLC is the most effective, efficient, and cost-effective method to ensure that the organization's protection strategy is implemented. It also ensures that security and privacy processes are not isolated from the other processes used by the organization to develop, implement, operate, and maintain the systems supporting ongoing missions and business functions. In addition to incorporating security and privacy requirements into the SDLC, the requirements are integrated into the organization's program, planning, and budgeting activities to help ensure that resources are available when needed and program and project milestones are completed. The enterprise architecture provides a central record of this integration within an organization.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: rmf, fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Recovering from Ransomware and Other Destructive Events say about ABSTRACT? According to Data Integrity_ Recovering from Ransomware and Other Destructive Events, ABSTRACT: Businesses face a near-constant threat of destructive malware , ransomware, malicious insider activities, and even honest mistakes that can alter or destroy critical data. These data corruption events could cause a significant loss to a company's reputation, business operations, and bottom line. These types of adverse events, that ultimately impact data integrity, can compromise critical corporate information including emails, employee records, financial records, and customer data. It is imperative for organizations to recover from a data integrity attack and trust the accuracy and precision of the recovered data. The National Cybersecurity Center of Excellence (NCCoE) at NIST built a laboratory environment to explore methods to effectively recover from a data corruption event in various Information Technology (IT) enterprise environments. NCCoE also implemented auditing and reporting IT system use to support incident recovery and investigations. This NIST Cybersecurity Practice Guide demonstrates how organizations can implement technologies to take immediate action following a data corruption event. The example solution outlined in this guide encourages effective monitoring and detection of data corruption in standard, enterprise components as well as custom applications and data composed of open-source and commercially available components.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Maintain Environmental Safety according to NIST Cybersecurity Framework Manufacturing Profile According to Cybersecurity Framework Manufacturing Profile, Maintain Environmental Safety: Manage cybersecurity risks that could adversely affect the environment, including both accidental and deliberate damage. Cybersecurity risk on the manufacturing system could potentially adversely affect environmental safety. Personnel should understand cybersecurity and environmental safety interdependencies.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2 provide? (Section 104) ated with <dt:signature-info> as specified in [TMSAD]. 2. The first <dsig:Reference> element in a <dsig:Signature> element MUST be to the <arf:asset-report-collection> element. The element MUST be referenced in the @URI attribute using the empty string convention ''. 3. Two XPath Filter 2 transforms MUST exist on the first <dsig:Reference> element in a <dsig:Signature> element. Both MUST specify a filter type of 'subtract'. The first transform MUST specify the XPath '/arf:asset-report-collection/arf:extendedinfos[count(arf:extended-info[dsig:Signature]) = count(*)]'. The second transform MUST specify the XPath '/arf:asset-report-collection/arf:extended-infos/arf:extended-info[dsig:Signature]'. In both cases, the namespace prefix 'arf' MUST map to the ARF namespace specified in this document. 4. The second <dsig:Reference> element MUST be to the <dsig:SignatureProperties> element captured in a <dsig:Object> element with the <dsig:Signature> element. The <dsig:SignatureProperties> element MUST be referenced in the @URI attribute using '#' + @Id of the <dsig:SignatureProperties> element. 5. Key information SHOULD be provided on the <dsig:Signature> element. In situations where it is desirable to countersign a result data stream (e.g., when a content consumer automatically signs a result data stream and then a person also wants to sign the results), the following requirements apply. 1. The <arf:extended-info> element containing the original signature SHALL be removed from the resulting document. 2. The original signature SHALL be captured as a <dsig:Object> element on the new <dsig:Signature> element. 3. The first <dsig:Reference> element on the new <dsig:Signature> element SHALL reference the <dsig:Object> element containing the original signature.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings provide? (Section 245) are rather trivial. When A performs a single sign-on, she and her authentication server R first perform mutual authentication using a shared password, and then establish a secure channel (as before). Subsequently, R runs the PARTIAL-PRIVATE-KEY EXTRACT algorithm and issues a partial private key ( S R + s R P ¯ A ) to A , along with other information such as the system parameters and an updated IRL. ¯ When A receives the partial private key, she runs the LOWER-LEVEL SETUP algorithm to randomly pick a seA can then use the proxy cret value s . This secret value, in turn, is used to compute ¯ A her proxy public/private key pair. credential to perform mutual authentication and delegation with a hosting server. Since the value s is unknown to R , A 's new proxy private key is kept secret from R , which is not the case in the protocols described in Section 3.3. ¯ A The cryptographic set-up in CL-PKC allows users to create more than one public key for the same partial private key [3]. For example, A can randomly select two different secret values s and s ′ , and compute two sets of dis-¯ tinct public/private key pairs. However, we believe that this property would not cause any major issues within a grid environment. This is because partial private keys produced by the authentication server are short-lived. In fact, the users can take advantage of this property by extracting different proxy key pairs for different job submissions to increase key freshness, before the expiry of their respective partial private keys. ¯ A A In the context of CL-PKC, we must trust the authentication server not to mount active impersonation attacks against its users. Such attacks are possible because the authentication server can always select a secret value (for some 'victim') and calculate a private key based on the victim's partial private key to which it necessarily has access.

Explanation: NIST publication on credential and access management. Topics: authentication, pki, single sign-on. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Function call according to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography? Function call: RecoverPrimeFactors( n , e , d )

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Telehealth Remote Patient Monitoring Ecosystem provide? (Section 76) §§ 164.310(a)(2)(ii) 164.310(a)(2)(iii) | A.11.1.1 A.11.1.2 | | NIST Cybersecurity Framework v1.1 | NIST Cybersecurity Framework v1.1 | NIST Cybersecurity Framework v1.1 | NIST Cybersecurity Framework v1.1 | NIST NICE | Sector-Specific Standards and Best Practices | Sector-Specific Standards and Best Practices | Sector-Specific Standards and Best Practices | |-------------------------------------|-------------------------------------|-------------------------------------------------------------------------------------------------|--------------------------------------|----------------------------------|------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------| | Function | Category | Subcategory | NIST SP 800-53 Revision 5 | Framework (NIST SP 800-181) | IEC TR 80001-2-2 | HIPAA Security Rule | ISO/IEC 27001 | | | | potential cybersecurity events | | AN-TWA- 001 | | | | | | | DE.CM-4: Malicious code is detected | SC-44 SI-3 SI-4 SI-8 | | IGAU MLDP | 45 C.F.R.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.6 Monitor, Evaluate, and Adjust according to NIST Integrating Cybersecurity and Enterprise Risk Management (ERM) According to Integrating Cybersecurity and Enterprise Risk Management (ERM), 3.6 Monitor, Evaluate, and Adjust: Step 6 in Figure 2 (Monitor, Evaluate, and Adjust) focuses on managing cybersecurity risk to support mission and business objectives. By protecting the value provided by enterprise information and technology; it requires the continual balancing of benefits, resources, and risk considerations. As an input to ERM, CSRM requires a dynamic and collaborative process to maintain that balance by continually monitoring risk parameters, evaluating their relevance to organizational objectives, and responding accordingly when necessary (e.g., by adjusting controls). The risk register provides a formal communication vehicle for sharing and collaborating on cybersecurity risk activities as an input to ERM decision makers. Beginning with the initial agreement and understanding of internal/external context and continuing to discussion and determination and implementation of risk response, ongoing dialogue is needed among all relevant stakeholders. While such discussions often occur within a given business unit or subordinate organization, the enterprise will benefit from broader, frequent, and transparent communication regarding risk options, decisions, changes, and adjustments because it will improve the quality of information used in making enterprise-level decisions. The evolving cybersecurity risk registers and profiles provide a formal method for communicating institutional knowledge and decisions regarding cybersecurity risks and their contributions to ERM.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Integrating Cybersecurity and Enterprise Risk Management (ERM).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Practical Combinatorial Testing say about Appendix D - REFERENCES? (Part 3) According to Practical Combinatorial Testing, Appendix D - REFERENCES: n Computer Aided Verification CAV , volume 1102 of Lecture Notes in Computer Science , pages 419422, New Brunswick, NJ, USA, July/August 1996. Springer Verlag. 19. M.B. Cohen, J. Snyder, G. Rothermel. Testing Across Configurations: Implications for Combinatorial Testing, Workshop on Advances in Model-based Software Testing , Raleigh, Nov. 2006, pp. 1-9 20. D. M. Cohen, S. R. Dalal, J. Parelius, G. C. Patton The Combinatorial Design Approach to Automatic Test Generation, IEEE Software , Vol. 13, No. 5, pp. 83-87, September 1996 21. L. Copeland, A Practitioner's Guide to Software Test Design , Artech House Publishers, Boston, 2004. 22. Apilli, B. S., L. Richardson, C. Alexander, Fault-based combinatorial testing of web services. In Proc. 24th ACM SIGPLAN Conference Companion on Object Oriented Programming Systems Languages and Applications (Orlando, October 25 29, 2009) 23. Dalal, S.R., C.L. Mallows, Factor-covering Designs for Testing Software, Technometrics , v. 40, 1998, pp. 234-243. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ 24. S. Dunietz, W. K. Ehrlich, B. D. Szablak, C. L. Mallows, A. Iannino. Applying design of experiments to software testing, Proceedings of the Intl. Conf. on Software Engineering, (ICSE '97) , 1997, pp. 205-215, New York 25. L. du Bousquet, Y. Ledru, O. Maury, C. Oriat, J.-L. Lanet, A case study in JMLbased software validation. Proceedings of 19th Int. IEEE Conf. on Automated Sofware Engineering , pp. 294-297, Linz, Sep. 2004 26. M. Grindal, J. Offutt, S.F. Andler, Combination Testing Strategies: a Survey, Software Testing, Verification, and Reliability , v. 15, 2005, pp. 167-199. 27. C.A.R. Hoare, 'Assertions, a Personal Perspective', IEEE Annals of the History of Computing, vol. 25, no. 2, pp. 14-25, 2003. 28. R. Kramer, 'iContract - The Java Design by Contract Tool'.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Practical Combinatorial Testing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Labels for Open Systems_ an Invitational Workshop provide? (Section 57) il 1977. - [2] ISO 7498, Information Processing Systems - Open Systems Interconnection Basic Reference Model. - [3] ISO 7498/2, Addendum to ISO 7498 on Security Architecture. - [4] Branstad, Dennis K. "Categories of Information Requiring Protection," Proceedings from INTEROP 89, Advanced Computing Environments, October 1989. 5. Estrin, Deborah. "Requirements for a Commercial-Use IP Security Option" Proceedings from INTEROP 89, Advanced Computing Environments, October 1989. [5] "Security Labels in Open Systems" (Presentation Slides) , Russell Housley (Xerox Corporation) . r Russell Housley Xerox Special Information Systems McLean, Virginia 31 May 1990 \ ) r V - The measures taken to protect data from accidental, unauthorized, intentional, or malicious modification, destruction, or disclosure. - A condition that results from the establishment and maintenance of protective measures. Xerox Special Information Systems J r - Security labels tell the protocol processing how to handle data communicated between open systems. That is, the security label indicates what measures need to be taken to preserve the condition of security. - "Handle" denotes the activities performed on data such as collecting, processing, transferring, storing, retrieving, sorting, transmitting, disseminating, and controlling. Xerox Special Information Systems r V - Data integrity service - Biba integrity - Data confidentiality service - Bell & LaPadula secrecy Xerox Special Information Systems A J r V.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Labels for Open Systems_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Remote Electronic UOCAVA Voting say about 7.3.4 Social Engineering? According to Security Considerations for Remote Electronic UOCAVA Voting, 7.3.4 Social Engineering: Social engineering is a class of attack where malicious (or curious) individuals manipulate legitimate users of a system into divulging sensitive information, such as login credentials for a system. Phishing and pharming can be considered a type of large-scale, automated social engineering attack, but social engineering attacks could be highly targeted and interactive. For instance, an attacker conducting a social engineering attack could call an election official or system administrator claiming to be from the service provider hosting the voting system and convince the victim to divulge his or her password. Social engineering is a class of attacks, and the objective of the attacker may not be solely to steal login credentials. The objectives of social engineers can be to obtain any type of sensitive information that may help them conduct an attack.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Remote Electronic UOCAVA Voting.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Domain Name System-Based Electronic Mail Security say about Test Sequence 2: MUA/MTA/DNS Service Combinations Exchanged Signed and Encrypted Email with an NLnet Labs Site and a Secure64 Site? According to Domain Name System-Based Electronic Mail Security, Test Sequence 2: MUA/MTA/DNS Service Combinations Exchanged Signed and Encrypted Email with an NLnet Labs Site and a Secure64 Site: Outlook and Thunderbird MUAs, configured to use a Postfix MTA with Dovecot IMAP support, were configured in turn to use BIND and Secure64's DNS Authority, DNS Cache, and DNS Signer implementations. Each of the six configurations exchanged email with a Secure64 site that included a ThunderBird MUA, DNS Cache/DNS Signer/DNS Authority DNS services, and Postfix/ Dovecot MTA and an NLnet Labs MUA/MTA/ DNS service stack that included a ThunderBird MUA, NSD4, Unbound, and OpenDNSSEC DNS services and a Postfix/Dovecot MTA. The test events include using Well-Known CA issued (TLSA/SMIMEA CU=1), Enterprise CA issued (CU=2), and Self-Signed Certificates (CU=3). Email messages between MTAs were encrypted and successfully decrypted. (Scenario 1). Signature and encryption were logged. All messages were S/MIME signed. Outlook attempted to verify received messages (Scenario 2). Signature verification results were noted. DNS name verification results were noted. Figure 2.1 on Page 8 depicts the set-up for laboratory support for this test sequence, with connections selected for Event 7 below.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-37r2_Risk_Management_Framework provide? (Section 295) The risk executive (function) coordinates with senior leaders and executives to: - Establish risk management roles and responsibilities; - Develop and implement an organization-wide risk management strategy that provides a strategic view of security risks for the organization 120 and that guides and informs organizational risk decisions (including how risk is framed, assessed, responded to, and monitored over time); - Provide a comprehensive, organization-wide, holistic approach for addressing risk-an approach that provides a greater understanding of the integrated operations of the organization; - Manage threat, vulnerability, and security and privacy risk (including supply chain risk) information for organizational systems and the environments in which the systems operate; - Establish organization-wide forums to consider all types and sources of risk (including aggregated risk); - Identify the organizational risk posture based on the aggregated risk from the operation and use of systems and the respective environments of operation for which the organization is responsible; - Provide oversight for the risk management activities carried out by organizations to help ensure consistent and effective risk-based decisions; - Develop a broad-based understanding of risk regarding the strategic view of organizations and their integrated operations; - Establish effective vehicles and serve as a focal point for

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Measuring the Common Vulnerability Scoring System Base Score Equation say about Measuring the Common Vulnerability Scoring System Base Score Equation? According to Measuring the Common Vulnerability Scoring System Base Score Equation, Measuring the Common Vulnerability Scoring System Base Score Equation: Peter Mell Jonathan Spring Domain Expert Co-authors: Dave Dugal Srividya Ananthakrishna Francesco Casotto Troy Fridley Christopher Ganas Arkadeep Kundu Phillip Nordwall Vijayamurugan Pushpanathan Daniel Sommerfeld Matt Tesauro Chris Turner This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8409 <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Measuring the Common Vulnerability Scoring System Base Score Equation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain NISTIR 7756 (DRAFT): CAESARS Framework Extension: An Enterprise Continuous Monitoring Technical Reference Architecture Group: Systems and Emerging Technologies Security Research according to NIST Computer Security Division 2011 Annual Report According to Computer Security Division 2011 Annual Report, NISTIR 7756 (DRAFT): CAESARS Framework Extension: An Enterprise Continuous Monitoring Technical Reference Architecture Group: Systems and Emerging Technologies Security Research: This publication and its supporting documents present an enterprise continuous monitoring technical reference model that extends the framework provided by the DHS Federal Network Security CAESARS architecture. This extension enables added functionality, defines each subsystem in more detail, and further leverages security automation standards. It also extends CAESARS to allow for large implementations that need a multitier architecture and focuses on the necessary intertier communications. The goal of this document is to facilitate enterprise continuous monitoring by presenting a reference model that enables organizations to aggregate collected data from across a diverse set of security tools, analyze that data, perform scoring, enable user queries, and provide overall situational awareness. The model design is focused on enabling organizations to realize this capability by leveraging their existing security tools and thus avoiding complicated and resource-intensive custom tool integration efforts.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, continuous monitoring. General security reference material without sensitive content. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4 say about Profile? (Part 4) According to Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4, Profile: Multiple platform URIs may be listed if the Profile applies to several platforms | | reference | string + URL | 0-n | A reference to a document or resource where the user can learn more about the subject of this Profile: a string and optional URL | | selectors | special | 0-n | References to Groups, Rules, and Values, see below (references may be the unique id of an Item, or a cluster id) | | signature | special | 0-1 | Digital signature over this Profile, optional | A Profile object is a named tailoring of a Benchmark. While a Benchmark can be tailored in place, by setting properties of various objects, only Profiles allow one Benchmark document to hold several independent tailorings. A Profile can extend another Profile in the same Benchmark. The set of platform, reference, and selector properties of the extended Profile are prepended to the list of properties of the extending Profile. Inheritance of title, description, and reference properties are handled in the same way as for Rule objects. The note-tag property is a simple identifier. It specifies which profile-note properties on Rules should be associated with this Profile. Benchmark authors can use the Profile's 'status' property to record the maturity or consensus level of a Profile. If the status is not given explicitly in a Profile definition, then the Profile is taken to have the same status as its parent Benchmark. Note that status properties are not inherited. Each Profile contains a list of selectors which express a particular customization or tailoring of the Benchmark. There are four kinds of selectors: - select - a Rule/Group selector. This selector designates a Rule, Group, or cluster of Rules and Groups.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Contacts according to Computer Security Division 2007 Annual Report? Contacts: Mr. Kevin Stine (301) 975-4483 kevin.stine@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2007 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3. The 4-Chip DES according to NIST Computer Security and the Data Encryption Standard_ Proceedings of the Conference on Computer Security and the Data Encryption Standard According to Computer Security and the Data Encryption Standard_ Proceedings of the Conference on Computer Security and the Data Encryption Standard, 3. The 4-Chip DES: In summary, we are going to use four of these devices, where each device consists of two 8-bit shift registers for the data, four 8-bit shift registers for the key and two 64 X 4 ROM's for the S tables. Each device will have a parity check facility for the key and other required control logic. The four devices will work in parallel from a single clock. Our estimate of the speed is that it could be clocked at 5 megahertz. The two control lines that I mentioned would implement four control functions. The first is load key, the second is load data, the third instruction is to encrypt and the fourth is to decrypt data. The device will check parity of the key as it is entered and set a flag for the microprocessor control if the parity is incorrect. It will not, however, prevent operating with a "bad" key. It takes eight clock pulses to load the key and eight more clock pulses to load the data. Then the devices require sixteen more clock pulses to either encrypt or decrypt the data, and eight additional clock cycles to unload the devices. However, the next eight bytes can be loaded at the same time that the unloading is taking place. Therefore, only twenty- four cycles are used for a complete operation of the DES unit. With a clock operating at 5 megahertz, this gives an effective throughput of 13 million bits per second, or in other words, each 64-bit block requires 5 micro-seconds to encrypt or decrypt. Our company is planning to build these LSI devices and market them in various forms to our customers. <!-- image --> Howard Crumb Federal Reserve Bank 33 Liberty Street New York, N. Y. 10045 The following paper has been extracted from the verbal presentation of Mr. Crumb at the February 15th Conference. A written paper had not been submitted at the time of publication of these proceedings.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security and the Data Encryption Standard_ Proceedings of the Conference on Computer Security and the Data Encryption Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: Environmental controls include fire suppression and detection devices or

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Web Transactions_ TLS Server Certificate Management say about Microsoft Active Directory and Domain Services Installation and Configuration? According to Securing Web Transactions_ TLS Server Certificate Management, Microsoft Active Directory and Domain Services Installation and Configuration: Active Directory Services (ADS) and DNS work together to store directory data and make those resources available to administrators and users. For example, ADS stores information about user accounts such as names and passwords. Security is integrated with ADS through log-on authentication and enforced access control for user, file, directory, and other system objects in the directory of services. Administrators are able to manage directory data and organization roles across the enterprise. They can assign permissions to users, which allows users to access resources anywhere on the network. ADS authenticates and authorizes all users and computers in a Windows domain network. ADS works in conjunction with Group Policies Objects (GPOs) in assigning and enforcing security policies for all computers. A DNS is a protocol for how computers translate domain names. It manages a database used to resolve domain names to IP addresses, allowing computers to identify each other on the network. DNS is the primary locator service for AD. ADS is highly dependent on the DNS in most cases, and as a result, most implementations-including the TLS lab-opt to install the DNS service on the same server as the ADS.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Securing Web Transactions_ TLS Server Certificate Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-08(09) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control CM-08(09): SYSTEM COMPONENT INVENTORY | ASSIGNMENT OF COMPONENTS TO SYSTEMS ASSESSMENT OBJECTIVE: Determine if:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Enhanced Security Requirements for Controlled Unclassified Information provide? (Section 175) ng as intended. Also used to refer to units of related data fields (i.e., groups of data fields that can be accessed by a program and that contain the complete set of information on particular items). | | risk [OMB A-130] | A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically is a function of: (i) the adverse impact, or magnitude of harm, that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | risk assessment [SP 800-30] | The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of a system. | |-----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | sanitization | Actions taken to render data written on media unrecoverable by both ordinary and, for some forms of sanitization, extraordinary means. Process to remove information from media such that data recovery is not possible. | | security | A condition that results from the establishment and maintenance of protective measures that enable an organization to perform its mission or critical functions despite risks posed by threats to its use of systems.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Design Alternatives for Computer Network Security say about 5.4.2 Spoofability? According to Design Alternatives for Computer Network Security, 5.4.2 Spoofability: Depending on the encryption method, different spoofing methods can cause confusion, or at least errors, in communications. If a self-synchronizing method is utilized, then play-back of recorded messages is possible and must be countered by the usage of sequence numbers or time stamps. If these mechanisms are not provided, one might still be able to recognize a duplicate message, unless it had been modified. However, modification of the cipher text would result in the error propagation effect and thereby introduce a large number of erroneous bits, helping to ensure that the forgery was detected. (Check sums could also be utilized to detect changes in other encipherment schemes) Spoofing threats can be countered by: (1) detecting modified messages by use of error checks on the clear text, (2) detecting the "replaying" of legitimate messages by the use of encrypted sequence numbers or time stamps, and (3) discar< ing any messages that do not meet these checks.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Design Alternatives for Computer Network Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Trustworthy Email say about 5.2.2.3 Certificate Revocation? According to Trustworthy Email, 5.2.2.3 Certificate Revocation: Every certificate has a period of validity typically ranging from 30 days up to a numbe r of years. �ere may , however, be reasons to revoke a certificate prior to its expiration, such as the compromise or loss of the private key [RFC5280]. �e act of revocation is associated with the CA publishing a certificate revocation list . Part of authenticating a certificate chain is perusing the certificate revocation list (CRL) to determine if any certificate in the chain is no longer valid . �e presence of a revoked certificate in the chain should result in failure of authentication. Among the problems of CRL management, the lack of real-time revocation checks leads to nondeterminism in the authentication mechanism. Problems with revocation led the IETF to develop a realtime revocation management protocol, the Online Certificate Status Protocol (OCSP) [RFC6960]. Mozilla has now taken the step to deprecate CRLs in favor of OCSP.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.5.2 Preinstallation Steps according to NIST Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers According to Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers, 2.5.2 Preinstallation Steps: Before beginning installation, ensure that the following steps are completed: -  Download and install the TokenOne mobile application from either the Apple App Store or the Google Play Store. -  Speak with your TokenOne representative to receive the TokenOne10.zip file. -  Download the TokenOne10.zip file to the /home/magento/Downloads directory.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Assessing Security and Privacy Controls in Information Systems and Organizations? Control SI-11: ERROR HANDLING ASSESSMENT OBJECTIVE: Determine if:


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Wireless Infusion Pumps in Healthcare Delivery Organizations provide? (Section 378) rfaces Attached.......................... 0 No. Interface Groups Attached.................... 0 No. Wlans........................................ 0 No. Local Policies Attached...................... 0 mDNS AP Summary NIST SP 1800-8C: Securing Wireless Infusion Pumps 239 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P 1 8 0 0 - 8 . . Number of mDNS APs............................. 0 PMIPv6 Global Configuration PMIPv6 Profile Summary No Profile Created. PMIPv6 MAG Statistics PMIPv6 domain has to be configured first EoGRE Global Configuration Heartbeat Interval...............60 Max Heartbeat Skip Count.........3 Interface........................management EoGRE Gateway Configuration EoGRE Domain Configuration Domain Name Gateways Active Gateway -------------- ----------------- -------------------- NIST SP 1800-8C: Securing Wireless Infusion Pumps 240 EoGRE Profile Configuration WLAN Express Setup Information. WLAN Express Setup - ............................ False T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o Flex Avc Profile summary. Profile-Name Number of Rules status ============ =============== ======== i . . o r g / 1 0 6 0 2 8 / N I S T . S P 1 8 0 0 - 8 . . Flex Avc Profile Detailed Configuration. Certificate Summary. Web Administration Certificate................... 3rd Party Web Authentication Certificate................... Locally Generated Certificate compatibility mode:.................. off Lifetime Check Ignore for MIC ................... Disable NIST SP 1800-8C: Securing Wireless Infusion Pumps 241 Lifetime Check Ignore for SSC ................... Disable Smart-licensing status Summary. T h i s p u b l i c a t i o n Call-home Summary.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Annual Report 2018_ NIST_ITL Cybersecurity Program provide? (Section 17) and academia in the United States and around the globe to confront a variety of urgent technical and implementation challenges to cryptographic security. These included: - Post-Quantum Cryptography . In recent years, there has been a substantial amount of research on quantum computers-machines that exploit quantum mechanical phenomena to solve mathematical problems that are difficult or intractable for conventional computers. If large-scale quantum computers are ever built, they will be able to break many of the public key cryptosystems currently in use, seriously compromising the confidentiality and integrity of digital data. During FY18, NIST continued to prioritize work on post-quantum cryptography (also called quantumresistant cryptography) with the ambitious goal of developing cryptographic systems that are secure against both quantum and classical computers and can interoperate with existing communications protocols and networks. After an earlier call to the public to submit post-quantum algorithms 11 that could resist a quantum computer's onslaught, from FY18 to FY19 NIST worked with the larger cryptography community to narrow the field from 69 submitted algorithms to 26. The remaining algorithms are those which NIST mathematicians and computer scientists consider to be the strongest candidates. Next, NIST is asking the cryptography community to focus on analyzing how these algorithms will perform in the real world (e.g., how they will fit into the internet protocols currently in use). This second round of analysis focuses more heavily on evaluating the submissions' performance across a wide variety of systems, not just in big computers and smartphones. 11/emspace NIST Asks Public to Help Future-Proof Electronic Information, https:/ /www.nist.gov/news-events/news/2016/12/ nist-asks-public-help-future-proof-electronic-information - Lightweight Cryptography .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Annual Report 2018_ NIST_ITL Cybersecurity Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DS-3 in Cryptographic Key Management Workshop Summary -- June 8-9, 2009? (Part 62) Control DS-3: We have to support this interoperability among future systems. - Standards must not only be technically correct and precise, but they must be understandable to, and easily used by, the general public. We need to be able to communicate what we're doing and why we're doing it to the people who make policies, procurement regulations, and user instructions. - We need to create standards that are testable. Ideally, they should be tested automatically so we can minimize the effort of conducting manual product assurance. - Executive and legislative oversight and resource allocation must be in the proper context. Expectations must be consistent with technical reality. We must work with industry, not just from the standpoint of innovation and technical expertise, but making sure that the standards that result will be implemented, not just can be implemented. - We need to work with academia because we get many creative inputs from its members, who are not constrained by short-term corporate goals. We also rely on obtaining innovative ideas from our colleagues overseas. - IETF protocol efforts include: IKEv1 and IKEv2, TLS, Secure Shell, EAP, CMS, and Kerberos. - The Extensible Authentication Protocol (EAP) provides authentication for people and devices. - The IETF enrollment efforts include: KeyProv and a dynamic symmetric key provisioning protocol. - There is a clear need for standards in certificate enrollment, but previous attempts have failed. - There are few standards for: key generation, ordering, distribution, accounting, destruction, commercial implementation, and formats for keys. - NSA is helping to define standards packages and key formats in the IETF and PKIX for the Suite B cryptographic algorithms (i.e., those used to protect classified data up to SECRET).

Explanation: NIST publication discussing classified information handling. References: classified, secret. Contains guidance on protecting sensitive government information. Source: Cryptographic Key Management Workshop Summary -- June 8-9, 2009.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification say about 4.4 Personal Authentication Certificate Object? According to A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification, 4.4 Personal Authentication Certificate Object: Another common credential object found on a smart token is the Personal Authentication Certificate. This certificate contains the Person Identifier of the Cardholder/Credential Holder (in the Subject or the Subject Alternate Name field) and a Public Cryptographic key counterpart of a token-held secret (i.e., a private cryptographic key). Naturally, the digital signature of the CA that issued this certificate provides the binding between the two values. Therefore the Personal Authentication Certificate establishes the Person Identifier Token secret binding . Just as in the case of verifying the Card Issuer - Token Secret binding, the primary authentication mechanism for verifying the above binding consists of validating the Digital Authentication Certificate. Again as in the case of Card Issuer- Token Secret binding, the follow-on activity for verifying the Token Secret - Physical Token binding (which thus verifies the secret associated with Person Identifier) involves testing the presence of the private key counterpart (described in Sec. 4.6) of the public key of the certificate, which in this instance is the Personal Authentication Certificate.

Explanation: NIST publication on credential and access management. Topics: authentication, token, sso. Contains security framework guidance for authentication systems. Source: A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain D.3 Win/win and the production possibility frontier candidates according to NIST Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives According to Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives, D.3 Win/win and the production possibility frontier candidates: Traceability technologies can be said to move the PPF such that the Win/Win situation of having more of both can be realized. For some, this is counter-intuitive because protecting data has been a traditional method of securing it. As suggested in cases, efforts to share data to protect the objectives of an ecosystem can encounter a myriad of existing assessments, controls, and procedures, all enforced at the data owner's level. The responsibility for data and associated information can be burdensome as it can reflect IP (such as a bill of materials) or national security concerns as in export-controlled technology data. While we see our respondents' recognition of the value in cooperating to share data across supply lines, there is still the hard work of determining what information is crucial to the success of traceability efforts. Several avenues of research surface as a result: - What is the minimum set of data elements and associated message or process context to support a successful traceability project? Can strategies from previous efforts at design criteria, such as an hour-glass model (reference ACM on Hour-Glass Model) [36], or existing business exchange standards be leveraged to tackle this challenge. In one case an existing standards review did result in usable message types. - What cryptographical or other means allow data to both be shared and obscured at the same time? Blockchain and other traceability technology could be improved in ways unimagined today. - What other trade-offs between concerns exist that are today analyzed as zero-sum, but have technologies in the pipeline that would shift the PPF?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.16.1 Siemens RUGGEDCOM RX1501 (O1) Installation Guide according to NIST Situational Awareness for Electric Utilities According to Situational Awareness for Electric Utilities, 2.16.1 Siemens RUGGEDCOM RX1501 (O1) Installation Guide: The instructions for installation of the RUGGEDCOM RX1501 are very similar to those in Section 2.15, with the following additional information: - Ensure that the shared key used in this installation is the same as the one used in the previous installation. - The remote IPs and local IPs will be different for this installation as they are relative to the device. - NAT Traversal Negotiation Method will be on the left menu option (as opposed to the right listed earlier) and must be the same value (e.g., rfc-3947).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Situational Awareness for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RC-32 in Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series? (Part 10) Control RC-32: phant diffuser A (now deprecated) component in BitLocker Drive Encryption to increase resistance against ciphertext modification. ## encryption The process of transforming plaintext into ciphertext. ## exclusive-or The bitwise addition, modulo 2, of two bit strings of equal length. ## GiB (gibibyte) 2 30 bytes. [78, Sec. 4.3] ## integrity Guarding against improper information modification or destruction; includes ensuring information nonrepudiation and authenticity. [82] ## KiB (kibibyte) 2 10 bytes. [78, Sec. 4.3] ## MAC algorithm An algorithm that computes an authentication tag from a message and a key. The term 'MAC' is sometimes also used to refer to the authentication tag itself. ## MiB (mebibyte) 2 20 bytes. [78, Sec. 4.3] ## mode of operation (mode) An algorithm for the cryptographic transformation of data that is based on a block cipher. ## nonce A value that is only used once. ## password A string of characters (letters, numbers, and other symbols) that is used to authenticate an identity, to verify access authorization, or to derive cryptographic keys. ## PiB (pebibyte) 2 50 bytes. [78, Sec. 4.3] ## plaintext Intelligible data that has meaning and can be understood without the application of decryption. ## segment In the CFB mode, a sequence of bits whose length is a parameter that does not exceed the block size. ## semantic security What can be efficiently computed about some plaintexts from their ciphertexts can be computed, just as easily, in the absence of those ciphertexts. [14] ## TiB (tebibyte) 2 40 bytes. [78, Sec. 4.3]

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain <Signature>: according to NIST Representation of PIV Chain-of-Trust for Import and Export According to Representation of PIV Chain-of-Trust for Import and Export, <Signature>:: This element is optional and if used occurs only once. The element contains a JPEG image of the cardholder's signature. The <Signature> element is the value for Zone 3F on the front of the PIV Card. The data is provided in an xs:base64Binary format.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Representation of PIV Chain-of-Trust for Import and Export.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control GV-2 in Integrating Cybersecurity and Enterprise Risk Management (ERM)? (Part 8) Control GV-2: r management has taken action to alter its severity. Actual residual risk should be equal to or less than the target residual risk.' Cybersecurity risk identification is comprised of four inputs: 1. Identification of the organization's mission-supporting assets and their valuation 2. Determination of potential threats that might jeopardize the confidentiality, integrity, and availability of those assets and potential information and technology opportunities that might benefit the organization 3. Consideration of the vulnerabilities of those assets 4. Evaluation of the potential consequences of risk scenarios Risk practitioners often perform risk identification as both a top-down and bottom-up exercise. For example, after the organization has considered critical or mission-essential functions, it may consider various types of issues that could jeopardize those functions as an input to risk scenario development. Subsequently, as a detailed threat and vulnerability assessment occurs, assessors consider how those threats might affect various assets, conducting a bottom-up assessment. This bi-directional approach helps support holistic and comprehensive risk identification. Risk identification and analysis will be discussed in greater detail in a subsequent NIST publication. ## 3.2.1 Inventory and Valuation of Assets Since cybersecurity risk reflects, in part, the effect of uncertainty on digital components that support enterprise objectives, practitioners identify the assets that are necessary to achieve those objectives. SP 800-37 Revision 2 points out that risk could impact 'organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals.' Similarly, the Cybersecurity Framework describes assets as 'the data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes' [15]. The value of an asset extends beyond its replacement cost.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Integrating Cybersecurity and Enterprise Risk Management (ERM).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Digital Identity Guidelines_ Federation and Assertions provide? (Section 66) d a notice to the subscriber, as discussed in Sec. 5.4 of [SP800-63A]. For additional considerations on providing a notice to a subscriber about account management events, see Sec. 4.6 of [SP800-63B]. A single RP subscriber account MAY be associated with more than one federated identifier. This practice is sometimes known as account linking . If the RP allows a subscriber to link multiple subscriber accounts in this way, the RP SHALL require an authenticated session with the subscriber account for all linking functions. This authenticated session SHOULD require authentication using one existing federated identifier before linking the new federated identifier to the RP subscriber account. When a federated identifier is removed from an RP subscriber account, the RP SHALL disallow access to the RP subscriber account from the removed federated identifier. The RP MAY associate different access rights with the same account, depending on which federated account is used to access the RP. The means by which an RP determines authorization and access is out of scope for these guidelines. If the RP has access to existing information about a set of subscribers, and this information is not associated with a federated identifier, the RP performs a process known as account resolution to determine which set of subscriber information to associate with a new RP subscriber account. An RP that performs account resolution SHALL ensure that the attributes requested from the IdP are sufficient to uniquely resolve the subscriber within the RP's system before linking the federated identifier with the RP subscriber account and granting access. The intended use of each attribute by the RP is detailed in the trust agreement, including whether the attribute is used for account resolution in this manner.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, sso. Contains security framework guidance for authentication systems. Source: Digital Identity Guidelines_ Federation and Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does An Introduction to Privacy Engineering and Risk Management in Federal Systems say about 2.3.2 The Utility of Risk Management? (Part 4) According to An Introduction to Privacy Engineering and Risk Management in Federal Systems, 2.3.2 The Utility of Risk Management: a Protection Regulation,' Regulation (EU) 2016/679 of the European Parliament and of the Council (2016) available at 50 Stuart S. Shapiro, et al., 'Privacy Engineering Framework,' The MITRE Corporation (AUG 2014), available at http://www.mitre.org/publications/technical-papers/privacy-engineering-framework; Centre for Information Policy 2016), available at Leadership, 'Protecting Privacy in a World of Big Data: The Role of Risk Management,' Hunton & Williams LLP (FEB the\_role\_of\_risk\_management\_16\_february\_2016.pdf; Centre for Information Policy Leadership, 'Risk, High Risk, Risk Assessments and Data Protection Impact Assessments under the GDPR,' Hunton & Wiliams LLP (DEC 2016), available at 16.pdf; and 'LINDDUN: A Privacy Threat Assessment Framework,' available at In addition, the 'NIST Roadmap for Improving Critical Infrastructure Cybersecurity' (FEB 2014) highlights the need for a risk management model, available at 51 'Situating Anonymization Within a Privacy Risk Model,' supra note 36. 52 Notably, the World Economic Forum has highlighted how security risk models are inappropriate for understanding the full nature of privacy risk. See 'Rethinking Personal Data,' supra note 31, at p. 18.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: An Introduction to Privacy Engineering and Risk Management in Federal Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-2 in Status Report on the Final Round of the NIST Lightweight Cryptography Standardization Process? (Part 63) Control HA-2: -bit 32-bit 32-bit 32-bit | 16 MHz 16 MHz 48 MHz 64 MHz 80 MHz 80 MHz 80 MHz 84 MHz | 32 KB 48 KB 256 KB 1MB 128 KB 512 KB 4MB 512 KB | 2 KB 6 KB 32 KB 256 KB 16 KB 32 KB 80 KB 96 KB | | Renner et al. [254] | ATmega328P STM32F103C8T6 STM32F746ZG ESP32WROOM Kendryte K210 | AVR ARMCortex-M3 ARMCortex-M7 Tensilica Xtensa LX6 RISC-V (Dual Core) | 8-bit 32-bit 32-bit 32-bit 64-bit | 16 MHz 72 MHz 216 MHz 240 MHz 400 MHz | 32 KB 64 KB 1MB 4MB 16MB | 2 KB 20 KB 320 KB 520 KB 8MB | | Weatherley [255] | ATmega2560 AT91SAM3X8E ESP32 | AVR ARMCortex-M3 Tensilica Xtensa LX6 | 8-bit 32-bit 32-bit | 16 MHz 84 MHz 240 MHz | 256 KB 512 KB 4MB | 8 KB 96 KB 520 KB | ∗ PIC32MX340F512H microcontroller used with PlatformIO's PIC32MX320F128H board profile ## 4.1.1. Microcontroller Benchmarking by NIST The NIST team evaluated the performance of the finalists on microcontrollers and compared them against the NIST standards AES-GCM and SHA-256. The implementations were collected from the submission packages, GitHub repositories of the finalists, and the repositories of other benchmarking initiatives. In total, 275 AEAD, 153 hash and 103 com- bined implementations were used on two 8-bit MCUs and six 32-bit MCUs [253] (See Table 9). This benchmarking effort focused on two metrics: code size and execution time. Results were analyzed under each metric independently, as well as jointly. Code size is measured in the amount of flash used, in bytes, upon successful compilation of each implementation under test. Execution time is measured in either microseconds or cycles depending on the platforms. Table 9.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Final Round of the NIST Lightweight Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Usability and Security Considerations for Public Safety Mobile Authentication provide? (Section 13) | 3.2 EMS................................................................................................................ | 7 | | | 3.2.1 Current Authentication Practice............................................................8 | | | | 3.3 Law Enforcement............................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Usability and Security Considerations for Public Safety Mobile Authentication.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Use of Passwords for Controlled Access to Computer Resources say about · Mathematical Sciences (Section B)? According to The Use of Passwords for Controlled Access to Computer Resources, · Mathematical Sciences (Section B): Studies and compilations designed mainly for the mathematician and theoretical physicist. Topics in mathematical statistics, theory of experiment design, numerical analysis, theoretical physics and chemistry, logical design and programming of computers and computer systems. Short numerical tables. Issued quarterly. Annual subscription: Domestic, $9.00; Foreign, $11.25. DIMENSIONS/NBS (formerly Technical News Bulletin) -This monthly magazine is published to inform scientists, engineers, businessmen, industry, teachers, students, and consumers of the latest advances in science and technology, with primary emphasis on the work at NBS. The magazine highlights and reviews such issues as energy research, fire protection, building technology, metric conversion, pollution abatement, health and safety, and consumer product performance. In addition, it reports the results of Bureau programs in measurement standards and techniques, properties of matter and materials, engineering standards and services, instrumentation, and automatic data processing. Annual subscription: Domestic, .$12.50; Foreign, $15.65.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Use of Passwords for Controlled Access to Computer Resources.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about ASSESSMENT OBJECTIVE? According to Assessing Security Requirements for Controlled Unclassified Information, ASSESSMENT OBJECTIVE: Determine if: A.03.05.11: feedback of authentication information during the authentication process is obscured.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Network Security Center_ a System Level Approach to Computer Network Security provide? (Section 73) uthentication consists of comparing a pre-stored pair <subject identifier, authenticator>, with a similar pair offered by the subject. The NSC data structure used is a set called AUTHENTICATION. AUTHENTICATION contains 2-tuples of the form <subject identifier, authenticator>. There will be at least one such tuple in AUTHENTICATION for each valid subject known to the NSC. The authentication module in the NSC acts as a predicate. The input is a tuple <subject identifier, password> offered by the subject. The output is either TRUE or FALSE, depending on whether the password is a proper authenticator for that subject identifier. The authentication module will perform range checking on the form of the input parameters. To authenticate the tuple <subject identifier, password>: IF subject identifier is valid AND password is valid AND <subject identifier, password> is a member of AUTHENTICATION THEN TRUE ELSE FALSE; - 3.1.2 Authorization. The conceptual model of the access authorization structure is a three-dimensional matrix. The axes are Subject Identifier, Object Identifier, Access Right. The entries in the matrix are Boolean flags that indicate whether the corresponding triple (<subject identifier, object identifier, access right>) defines an authorized access. This can be represented in a set model of NSC data structures as a set AUTHORIZATION. AUTHORIZATION contains 4-tuples of the form <subject identifier, object identifier, access right, Boolean flag>. The set will contain one such tuple for each possible combination of subject identifier, object identifier, and access right. The Boolean flag will be TRUE if the specified triple defines a permitted access and FALSE if it defines a prohibited access. The object identifier element has some additional structure to it. Object identifier is itself a 2-tuple of the form <host name, resource name>.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: The Network Security Center_ a System Level Approach to Computer Network Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.20.5.4 Hardening Network Devices according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case, 4.20.5.4 Hardening Network Devices: 1. Disable unsecure services such as Telnet, SNMP (v1 and v2). If SNMP is required, change the default community string or use SNMP v3. 2. Following vendor recommended hardening guidelines

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case.