You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3 provide? (Section 69) nition | A container for a single component. The types of components are defined in Section 3.1.2. | A container for a single component. The types of components are defined in Section 3.1.2. | A container for a single component. The types of components are defined in Section 3.1.2. | | Properties | Properties | Properties | Properties | | Name | Type | Count | Property Definition | | id | literal - ID | 1 | The identifier for the component. This identifier SHALL be globally unique (see Section 3.1.3). | | timestamp | literal - dateTime | 1 | Indicates when the <ds:component> was created or last updated.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TR-1 in Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1? (Part 108) Control TR-1: ----------------------------------| | Category | The subdivision of a Function into groups of cybersecurity outcomes, closely tied to programmatic needs and particular activities. Examples of Categories include 'Asset Management,' 'Identity Management and Access Control,' and 'Detection Processes.' | | Critical Infrastructure | Systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on cybersecurity, national economic security, national public health or safety, or any combination of those matters. | | Cybersecurity | The process of protecting information by preventing, detecting, and responding to attacks. | | Cybersecurity Event | A cybersecurity change that may have an impact on organizational operations (including mission, capabilities, or reputation). | | Cybersecurity Incident | A cybersecurity event that has been determined to have an impact on the organization prompting the need for response and recovery. | | Detect (function) | Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event. | | Framework | A risk-based approach to reducing cybersecurity risk composed of three parts: the Framework Core, the Framework Profile, and the Framework Implementation Tiers. Also known as the 'Cybersecurity Framework.' | | Framework Core | A set of cybersecurity activities and references that are common across critical infrastructure sectors and are organized around particular outcomes. The Framework Core comprises four types of elements: Functions, Categories, Subcategories, and Informative References.

Explanation: NIST publication on credential and access management. Topics: access control, identity management. Contains security framework guidance for authentication systems. Source: Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EG-21 in Guidelines for Access Control System Evaluation Metrics? (Part 21) Control EG-21: The syntax is a strict subset of XACML; it is suitable for specifying a wide range of policies, including authorization, quality-of-service, quality-of protection, reliable messaging, privacy, and application-specific service options.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Guidelines for Access Control System Evaluation Metrics.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Standard Security Label for GOSIP_ an Invitational Workshop provide? (Section 15) Mr. Housley added that there should be a reference in the SSL text that indicates what document provides usage rules for this label. The full text of the Xerox comments appear later in this document. Hilary Hosmer (Data Security) presented the concept of multipolicy. She pointed out that OSI security labels should be able to support co-existing security policies . Ms. Hosmer stated that allowing only one Security Level field in the SSL is a serious limitation because it makes it difficult to support multiple security policies. David Crawford (Canadian Defense) discussed Canada *s coexisting security policies. He explained the relationship between security levels that cover the equivalents to U.S. Classified and Unclassified but Sensitive. Thomas Bartee (IC Staff) presented a position paper justifying a request for an additional tag type for the Standard Security Label (SSL) . Mr. Bartee *s argument was that the tags currently specified in the SSL are geared towards indicating restriction markings. The addition of a "reversed' bit map type would make it easier to specify permissive markings such as release indicators. He mentioned that such an approach is currently used in the Director of Central Intelligence Office (DCI) Extended IP Security Option and by the Compartmented Workstation program. Most of the second day of the workshop was devoted to discussion of issues raised in the presentations of the first day. The group listed and prioritized the different issues. This ordered list guided the discussion of the relevant topics. After discussing each issue an informal vote was taken. The position taken by the group was recorded as the workshop's output. That output is presented in the following section. The following list of issues were identified and discussed by the workshop attendees. The statements listed under each issue were subject to an informal vote and represent the group's position. This list constitutes the workshop's output.

Explanation: NIST publication discussing classified information handling. References: classified, compartmented. Contains guidance on protecting sensitive government information. Source: Standard Security Label for GOSIP_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is This publication is available free of charge from according to Report on Lightweight Cryptography? This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8114

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report on Lightweight Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control BP-92049 in Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI? (Part 100) Control BP-92049: CD: POSIX Conformance Document, HP 9000 Computers, Fourth Edition, 1994. as modified by POSIX Conformance Document, HP-UX Compartment Mode Workstation Addendum, HP 9000 Computers, First Edition, 1994. GTI - Supported by Product MFS - Supported by Product MC - Supported by Product AP - Supported by Product 151-2IBM001 Issued: 03/08/94 Type: Native Product Supplier: International Business Machines Corporation Product: MVS/ESA 4.3 OpenEdition“ 1.0 PCD: OpenEdition MVS POSIX 1 Conformance Document, Document Number SC23-30 11-00 GTI - NOT Provided by Product MFS - Supported by Product MC - NOT Provided by Product AP - Supported by Product Computer Hardware Supplier: International Business Machines Corporation Computer Hardware Product: ES/9000-570 C Compiler: IBM SAA AD/Cycle® C/370 Version 1 Release 2 APTL 100342 Mindcraft, Inc. 151-2IBM002 Issued: 02/17/94 Type: Native Product Supplier: International Business Machines Corporation Product: AIX Version 3-2.5 for RISC System/6000 with RTFs: U423984, U424399, U424507, U424590, U425456, U424587, U425384, U425988, U425997, U426001, U426014, U425858 PCD: AIX Version 3.2 POSIX Conformance Document GTI - Supported by Product MFS - Supported by Product MC - Supported by Product AP - Supported by Product Computer Hardware Supplier: International Business Machines Corporation Computer Hardware Product: RISC System/6000, Model 590 Computer Hardware Supplier: Hewlett-Packard Company Computer Hardware Product: Series 9000 Model 770 C Compiler: XLC Version 1 , Release 3 APTL 100342 Mindcraft, Inc. C Compiler: HP C Compiler Version XI 0.1 APTL 100342 Mindcraft, Inc. 151-2HPC009 Issued: 03/02/95 Product Supplier: Hewlett-Packard Company Type: Native Product: HP-UX Release 10.00 PCD: POSIX Conformance Document, HP 9000 Computers, Third Edition, 1994.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Derived Personal Identity Verification (PIV) Credentials? (Part 50) Control AC-1: es an authentica- tion certificate, which is an X.509 public key certificate that has been issued in accordance with the re- quirements of NIST SP 800-157 and the X.509 Certificate Policy for the U.S. Federal PKI Common Pol- icy Framework [25] | PR.AC-1 | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Component | Product | Version | Function | Cybersecurity Framework Subcategories | |------------------------------------------|------------------------------------|------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------| | PKI Certificate Authority | Verizon Shared Service Pro- vider | Not appli- cable | Entity that issues an authentica- tion certificate, which is an X.509 public key certificate that has been issued in accordance with the re- quirements of NIST SP 800-157 and the X.509 Certificate Policy for the U.S.

Explanation: NIST publication on credential and access management. Topics: pki, certificate authority. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN) say about 4.3.1. Detect: Anomalies and Events Category? (Part 4) According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN), 4.3.1. Detect: Anomalies and Events Category: e interface activity, user reports, and administrator reports. Standards-based data formatting and serialization promotes communication, interoperability, and exchange of HSN data and supporting data. Correlate events and cross-check detected anomalies from the different data and service providers. Consider including events from external and authoritative shared resources (such as open source, | NIST SP 800-53 Rev. 5 AU-6, CA-7, CP-2, IR-4, IR-5, IR-8, SI-4 NIST SP 800-160v1 3.3.7, Appendix G.2, Appendix G.3 | | DE.AE-4: The impact of events is determined. | In addition to the impact on the organization, consider the impact on the data and service providers participating in the HSN. | NIST SP 800-53 Rev. 5 CP-2, IR-4, IR-5, IR-8, SI-4 | | Subcategory | Applicability to HSNs | Informative References | |-----------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------| | DE.AE-5: Incident alert thresholds are established. | Discussions regarding the setting and review of thresholds should include external stakeholders.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in Fiscal Year 2021 Cybersecurity and Privacy Annual Report? (Part 58) Control HA-256: ology (NIST) in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3541. Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would be appreciated by NIST. ## HOW TO CITE THIS NIST TECHNICAL SERIES PUBLICATION O'Reilly PD, II, Rigopoulos KG, Feldman L, Witte GA (2022) Fiscal Year 2021 Cybersecurity and Privacy Annual Report. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-220. https://doi.org/10.6028/NIST.SP.800-220 ## DISCLAIMER A ny mention of commercial products or organizations is for informational purposes only; it is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the products identified are necessarily the best available for the purpose.

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Fiscal Year 2021 Cybersecurity and Privacy Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RA-3(3) in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Control RA-3(3): CONTROL NAME RISK ASSESSMENT | DYNAMIC THREAT AWARENESS

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is System Supplier according to Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI? System Supplier: Sequent Computer Systems Inc.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings say about 6 Conclusion? According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, 6 Conclusion: We have described the motivations for identity federation and for attribute-based authorization in Grids. We have described our plans for addressing these motivations through integration of Shibboleth and the Globus Toolkit in order to produce a system capable of enabling attribute-based authorization in Grids, leveraging existing campus Shibboleth infrastructure, and allowing for pseudonymity.

Explanation: NIST publication on credential and access management. Topics: authorization, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Digital Identity Guidelines_ Federation and Assertions provide? (Section 72) ttributes, trust agreements SHOULD use a runtime decision to control attribute release, as discussed in Sec. 4.6.1.3. When the federation transaction uses an ephemeral provisioning mechanism (see Sec. 4.6.3), the IdP SHOULD request to the RP to prevent the RP from storing or correlating information between use an ephemeral federated identifier for each authorization sessions. The IdP SHALL limit the transmission of subscriber information to only that which is necessary for the system to function and is stipulated and disclosed by the trust agreement. These functions include the following: - Identity proofing, authentication, or attribute assertions (collectively 'identity service'); - A specific subscriber request to transmit the information; - Fraud mitigation related to the identity service; or - Responding to a security incident related to the identity service. If an IdP discloses information on subscriber activities at an RP to any party or processes the subscriber's attributes for any purpose other than these cases, the IdP SHALL implement measures to maintain predictability and manageability commensurate with the privacy risks that arise from the additional processing. Measures MAY include providing clear notice, obtaining subscriber consent, or enabling the selective use or disclosure of attributes. When an IdP gathers the subscriber's consent to use information outside the identity transaction, the IdP SHALL NOT make consent for the additional processing a condition of the identity service. For example, an IdP cannot require a subscriber to consent to receiving a newsletter in order to allow the subscriber to log into an RP.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Digital Identity Guidelines_ Federation and Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls say about APPLICATION SYSTEM VULNERABILITIES (Published in FIPS PUB 65, pp 22-27)? (Part 3) According to Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls, APPLICATION SYSTEM VULNERABILITIES (Published in FIPS PUB 65, pp 22-27): area. - -Remote terminals may not be adequately protected from use by unauthorized - persons - -An unauthorized user may gain access to the system via a dial-in line and an authorized user's password. - -Passwords may be inadvertently revealed to unauthorized individuals. A user may write his password in some convenient place, or the password may be obtained from card decks, discarded printouts, or by observing the user as he types it. - -A user may leave a logged-in terminal unattended, allowing an unauthorized - person to use it. - -A terminated employee may retain access to ADP system because his name and password are not immediately deleted from authorization tables and control lists - -An unauthorized individual may gain access to the system for his own purposes (e.g., theft of computer services or data or programs, modification of data, alteration of programs, sabotage, denial of services). - -Repeated attempts by the same user or terminal to gain unauthorized access to the system or to a file may go undetected. 4. INEFFECTIVE SECURITY PRACTICES FOR THE APPLICATION. Inadequate manual checks and controls to insure correct processing by the ADP system or negligence by those responsible for carrying out these checks results in many vulnerabilities. - -Poorly defined criteria for authorized access may result in employees not knowing what information they, or others, are permitted to access. - -The person responsible for security may fail to restrict user access to only those processes and data which are needed to accomplish assigned tasks. - -Large funds disbursements, unusual price changes, and unanticipated Inventory usage may not be reviewed for correctness. - -Repeated pajnnents to the same party may go unnoticed because there is no review. - -Sensititve data may be carelessly handled by the application staff, by the mail service, or by other personnel within the organization.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Intrusion Detection and Prevention Systems (IDPS) provide? (Section 210) k traffic it is monitoring must pass through it. Intrusion Detection: The process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents. Intrusion Detection and Prevention: The process of monitoring the events occurring in a computer system or network, analyzing them for signs of possible incidents, and attempting to stop detected possible incidents. See also 'intrusion prevention'. Intrusion Detection System Load Balancer: A device that aggregates and directs network traffic to monitoring systems, such as intrusion detection and prevention sensors. Intrusion Detection System: Software that automates the intrusion detection process. Intrusion Prevention: The process of monitoring the events occurring in a computer system or network, analyzing them for signs of possible incidents, and attempting to stop detected possible incidents. See also 'intrusion detection and prevention'. Intrusion Prevention System: Software that has all the capabilities of an intrusion detection system and can also attempt to stop possible incidents. Also called an intrusion detection and prevention system. Jamming: Emitting electromagnetic energy on a wireless network's frequencies to make them unusable by the network. Malware: A program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system or of otherwise annoying or disrupting the victim. Management Network: A separate network strictly designed for security software management. Management Server: A centralized device that receives information from sensors or agents and manages them.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Guide to Intrusion Detection and Prevention Systems (IDPS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Engineering Trustworthy Secure Systems say about The Concept of an Adequately Secure System? (Part 1) According to Engineering Trustworthy Secure Systems, The Concept of an Adequately Secure System: The Concept of an Adequately Secure System Adequate security is a concept that enables meaningful judgments about the idealistic nature of security objectives. The definition of security expresses an ideal that encapsulates three essential characteristics of a secure system: - It enables the delivery of the required system capability despite intentional and unintentional forms of adversity. - It enforces constraints to ensure that only the desired behaviors and outcomes associated with the required system capability are realized while satisfying the first characteristic. - It enforces constraints based on a set of rules to ensure that only authorized human-tomachine and machine-to-machine interactions and operations are allowed to occur while satisfying the second characteristic. These characteristics are to be achieved to the extent practicable, resulting in a gap between the ideal secure system and the security performance that the system can dependably achieve. 24 The judgment that a system is adequately secure 25 requires an evidence-based determination that security performance is optimized against all other performance objectives and constraints. The scope of conditions relevant to security and the acceptable level of security are specific to stakeholder needs. To be adequately secure, the system: - Meets minimum tolerable levels 26 of security, as determined by experience, analysis, or a combination of both - Is as secure as reasonably practicable (ASARP) 21 Active entities exhibit behavior (e.g., a process in execution) while passive entities do not (e.g., data, file). 22 At the highest level of assurance, security policies are formally specified and verified. 23 Privileges are also referred to as authorizations or rights. 24 Because system security is asymmetric - that is, things can be observed to be insecure, but no observation allows one to declare an arbitrary system secure [22] - the ideal cannot be achieved without some uncertainty.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Test Personal Identity Verification (PIV) Cards Version 2 say about Authority Key Identifier :? According to NIST Test Personal Identity Verification (PIV) Cards Version 2, Authority Key Identifier :: A1:A9:F2:66:2C:F8:29:F4:13:0C:7B:ED:5B:64:68:94:3D:F3:F1:BC

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain C.2.4.2 Continuity of Operations Information Type according to NIST Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, C.2.4.2 Continuity of Operations Information Type: Continuity of operations involves the activities associated with the identification of critical systems and processes, and the planning and preparation required to ensure that these systems and processes will be available in the event of a catastrophic event. The recommended provisional security categorization for the continuity of operations information type is as follows: Security Category = {(confidentiality, Moderate), (integrity, Moderate), (availability, Moderate)}

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms provide? (Section 109) (2001) Introduction to Public Key Technology and the Federal PKI Infrastructure. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-32. SP 800-32 was developed to assist agency decision-makers in determining if a PKI is appropriate for their agency and how PKI services can be deployed most effectively within a federal agency. It is intended to provide an overview of PKI functions and their applications. SP 800-38 SP 800-38A SP 800-38B SP 800-38C SP 800-38D A series of publications specifying modes of operation for block cipher algorithms (see below). Dworkin MJ (2001) Recommendation for Block Cipher Modes of Operation: Methods and Techniques. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-38A. https://doi.org/10.6028/NIST.SP.800-38A SP 800-38A defines five confidentiality modes of operation for use with an underlying symmetric-key block cipher algorithm: Electronic Codebook (ECB), Cipher Block Chaining (CBC), Cipher Feedback (CFB), Output Feedback (OFB), and Counter (CTR). When used with an approved underlying block cipher algorithm (i.e., AES or TDEA), these modes can provide cryptographic protection for sensitive computer data. Dworkin MJ (2005) Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-38B, Includes updates as of October 6, 2016. https://doi.org/10.6028/NIST.SP.800-38B SP 800-38B specifies a message authentication code (MAC) algorithm based on a symmetric-key block cipher (i.e., AES or TDEA). This block cipher-based MAC algorithm, called CMAC, may be used to provide assurance of the source and integrity of binary data.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Cloud and Hybrid Builds say about DISCLAIMER? According to Mobile Device Security_ Cloud and Hybrid Builds, DISCLAIMER: Certain commercial entities, equipment, products, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST or NCCoE, nor is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose. National Institute of Standards and Technology Special Publication 1800-4C, Natl. Inst. Stand. Technol. Spec. Publ. 1800-4C, 109 pages, February 2019, CODEN: NSPUE2

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Cloud and Hybrid Builds.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Implementation of DevSecOps for a Microservices-based Application with Service Mesh say about 3 DevSecOps - Organizational Preparedness, Key Primitives, and Implementation? According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh, 3 DevSecOps - Organizational Preparedness, Key Primitives, and Implementation: DevSecOps incorporates security into the software engineering process early on. It integrates and automates security processes and tooling into all of the development workflow (or pipeline as later explained) in DevOps so that it is seamless and continuous. In other words, it can be looked upon as a combination of the three processes: Development + Security + Operations [12]. This section discusses the following aspects of DevSecOps: - Organizational preparedness for DevSecOps - DevSecOps Platform - Fundamental building blocks or key primitives for DevSecOps

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Implementation of DevSecOps for a Microservices-based Application with Service Mesh.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Guidelines for Storage Infrastructure say about 4.3.3 Account Management Recommendations? (Part 1) According to Security Guidelines for Storage Infrastructure, 4.3.3 Account Management Recommendations: 4.3.3 Account Management Recommendations AC-SS-R14 - Use of accounts not associated with system users: Accounts not associated with any system user (e.g., not in Active Directory, such as 'guest,' 'anonymous,' 'nobody') should be disabled. In situations where they need to be used, they should not be mapped to any system user, and all of their default configurations (e.g., password, privileges) should be changed to conform to organization-wide policies. AC-SS-R15 - Account lockout: Users should be locked out after a certain number of unsuccessful login attempts. Certain implementations of account locking include automatic reset (account unlock) after a certain period of time or a power cycle. Automatic reset should not be allowed on sensitive storage systems. AC-SS-R16 -A local user account for emergency purposes: A single local user account should be maintained for access to storage resources in order to provide emergency-only access if the centralized authentication system is down. This account should conform to all organizational policies (e.g., password length). In addition, its usage should be allowed from a special physically protected location, and following well documented procedures that include appropriate approval of relevant stakeholders, and notification of use. AC-SS-R17 - Eliminate or disable default user accounts: The default user accounts that come with the storage system installations should be eliminated or disabled immediately, if the feature exists. When the feature to disable or eliminate does not exist or there is a justified reason to keep any of those accounts, the privileges assigned to this account should be kept to the minimum necessary. AC-SS-R18 - Limit local and default user accounts: As much as possible, eliminate the use of local and default accounts. In situations where this is not possible: - (a) Limit the use of such accounts and the privileges they have.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Security Guidelines for Storage Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PA-5250 in Implementing a Zero Trust Architecture_ High-Level Document? (Part 7) Control PA-5250: latform, Mandiant MSV, Okta Identity Cloud, Okta Verify App, Radiant Logic RadiantOne Intelligent Identity Data Platform, SailPoint IdentityIQ, Tenable.ad, Tenable.io, Tenable NNM, and Zimperium MTD. -  Enterprise 2 Build 4 (E2B4) (SDP and SASE; Broadcom (with Symantec products) as PE) uses products from Broadcom (with VMware and Symantec products), Google Cloud, IBM, Mandiant, Okta, Radiant Logic, SailPoint, and Tenable. Certificates from DigiCert are also used. E2B4 components consist of Symantec Cloud Secure Web Gateway (Cloud SWG), Symantec Zero Trust Network Access (ZTNA), Symantec Cloud Access Security Broker (CASB), Symantec Endpoint Security Agent, VMware Workspace ONE UEM, Symantec DLP Cloud Detection Service, Symantec ZTNA Connector, Okta Identity Cloud, Okta Verify App, Radiant Logic RadiantOne Intelligent Identity Data Platform, SailPoint IdentityIQ, IBM Security QRadar XDR, Tenable.io, Tenable.ad, Tenable NNM, Mandiant MSV, Google Cloud, and DigiCert CertCentral. -  Enterprise 3 Build 4 (E3B4) (SDP; F5 as PE) uses products from F5, Forescout, Mandiant, Microsoft, Palo Alto Networks, and Tenable. Certificates from DigiCert are also used. E3B4 components consist of F5 BIG-IP, F5 NGINX Plus, F5 Access App, Microsoft AD, Microsoft Azure AD, Microsoft Azure AD Identity Governance, Microsoft Intune, Microsoft Sentinel, Tenable.io, Tenable.ad, Tenable NNM, Mandiant MSV, Forescout eyeControl, Forescout eyeExtend, Forescout eyeSight, Forescout eyeSegment, Microsoft Azure (IaaS), and DigiCert CertCentral. -  Enterprise 4 Build 4 (E4B4) (SDP; Microsegmentation, and EIG; Broadcom (with VMware products) as PE) uses products from Broadcom (with VMware products), IBM, Mandiant, and Tenable. Certificates from DigiCert are also used.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Implementing a Zero Trust Architecture_ High-Level Document.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is EMS Data according to Cell Phone Forensic Tools_ an Overview and Analysis Update? EMS Data: Active and deleted incoming EMS Messages that exceed 160 characters were found and reported. An EMS message containing an embedded picture was found. However, the image was not correctly decoded and presented, though the text was. (Below)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Securing Property Management Systems? (Part 159) Control AM-1: he enterprise. <!-- image --> Remediant SecureONE is the privileged access management solution within the reference architecture. Additionally, it maps to the Security Analytics component of the ZTA. ## 2.6.1 Privileged Access Management System-Remediant SecureONE-Overview Remediant SecureONE provides detection and response capabilities for violations of privileged access within the enterprise. In the PMS reference design, SecureONE was deployed as a prebuilt VM appliance from the vendor. We configured the appliance with parameters necessary for our environment. The network security in place in the architecture relies on the appropriate authentication of privileged users. Once that authentication is secured, it is trusted. It is the purview of the PAM solution to prevent abuse of this trust. The location of the PAM system in the reference architecture is highlighted in Figure 2-5 below. Figure 2-5 Privileged Access Management System in the Reference Architecture <!-- image --> ## 2.6.2 Privileged Access Management System-Remediant SecureONERequirements The following subsections document the software, hardware, and network requirements for the PAM system Remediant SecureONE. Both the hardware and software requirements were included in the managed deployment provided by Remediant. ## 2.6.2.1 Hardware Requirements for the Privileged Access Management System This installation occurred on a machine with 4 CPUs, 8 GB of memory, and 100 GB of storage. ## 2.6.2.2 Software Requirements for the Privileged Access Management System This build utilized an Ubuntu 14.04 OS for the SecureONE server. ## 2.6.2.3 Network Requirements for the Privileged Access Management System Network connectivity must be available to the web server hosted on the Remediant SecureONE device. Please note that a zero trust networking solution such as CryptoniteNXT can limit availability of network resources when improperly configured.

Explanation: NIST publication on credential and access management. Topics: authentication, privileged access. Contains security framework guidance for authentication systems. Source: Securing Property Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Enhanced Security Requirements for Controlled Unclassified Information say about 3.14.6e? (Part 7) According to Assessing Enhanced Security Requirements for Controlled Unclassified Information, 3.14.6e: | The correctness of <3.14.7e_ODP[1]: security critical or essential software components> is verified using <3.14.7e_ODP[4]: verification methods or techniques> . | | | 3.14.7e[b] | The correctness of <3.14.7e_ODP[2]: security critical or essential firmware components> is verified using <3.14.7e_ODP[4]: verification methods or techniques> .

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Enhanced Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management_ Part 1 – General provide? (Section 180) rovided by a FIPS 140-validated cryptographic module at a security level that is consistent with the FIPS 199 impact level associated with the data to be protected by the key (see SP 800-152). -OR- 3. Physical protection provided by secure storage with controlled access (e.g., a safe or protected area). Keying material is used with a given cryptographic mechanism (e.g., to generate a digital signature or establish keys) or with a particular application. Protection shall be provided to ensure that the keying material is not used incorrectly (e.g., not only must the usage or application be associated with the keying material, but the integrity of this association must be maintained). This protection can be provided by separating the keying material from that of other mechanisms or applications or by the use of appropriate metadata associated with the keying material. Section 6.2.3 addresses the metadata associated with keys. Some key information needs to be correctly associated with another entity (e.g., the key source or an entity that owns or uses the key), and the integrity of this association shall be maintained. For example, a secret symmetric key used for the encryption of key information or the computation of a MAC needs to be associated with the other entity (or entities) that share the key. Public keys need to be correctly associated (e.g., cryptographically bound) with the owner of the key pair (e.g., using public-key certificates). The key information shall retain its association during storage by separating the key information by 'entity,' by application, or by using appropriate metadata for the key information when required. Section 6.2.3 addresses the use of the metadata. An association may need to be maintained between protected key information and the keying material that is used to protect that key information. In addition, keys may require association with other keying material (see Section 6.2.1.6).

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Considerations for Identity Management in Public Safety Mobile Networks say about Appendix D-Summary of Token Requirements? (Part 3) According to Considerations for Identity Management in Public Safety Mobile Networks, Appendix D-Summary of Token Requirements: irement B OR requirement C. In addition, Token A has to satisfy requirement D. Token B has to satisfy either requirement E OR [requirements F AND G]. In addition, Token B has to satisfy requirement H. | Level of Assurance 1 Type Tokens | Level of Assurance 1 Type Tokens | Level of Assurance 1 Type Tokens | Level of Assurance 1 Type Tokens | |-----------------------------------------------|---------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------| | Token Description | Requirements | Requirements | Requirements | | Memorized Secret Token (Something you know) | User chosen string of 6 or more characters from a 90 or more character alphabet | 4 or more digit PIN generated randomly | A secret with equivalent strength 13 | | Memorized Secret Token (Something you know) | Failed authentication attempts limited to 100 or fewer in any 30-day period | Failed authentication attempts limited to 100 or fewer in any 30-day period | Failed authentication attempts limited to 100 or fewer in any 30-day period | | Pre-Registered Knowledge Token (Something you | The secret provides at least 14 bits of entropy | The entropy in the secret cannot be directly calculated (e.g.

Explanation: NIST publication on credential and access management. Topics: authentication, identity management, token. Contains security framework guidance for authentication systems. Source: Considerations for Identity Management in Public Safety Mobile Networks.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Information System Security Best Practices for UOCAVA-Supporting Systems say about 4.2.1 Management Access Control? (Part 2) According to Information System Security Best Practices for UOCAVA-Supporting Systems, 4.2.1 Management Access Control: one. Controlling management of servers requires attention to at least three areas: - Minimize the number of users who can manage a computer to the bare minimum needed to reliably maintain the system. This is not as simple as it initially sounds: having too few administrators makes recovering from emergencies difficult because it may be hard to reach anyone who has management authorization, but allowing too many increases the risk that any one might be impersonated by an attacker. - Use strong authentication for every user who is allowed to administer the computer. Use of passwords that might be easily guessed or copied from other servers to which an attacker may have access is not strong enough for servers of high value. - Record all logins to a server in a way that even an administrator cannot easily change. Anyone who can impersonate a user who has administrative privileges can often make changes that are difficult to trace unless reliable audit trails are kept. Access control goes well beyond these three topics, but implementing them greatly reduces exposure to typical attacks on servers and makes such attacks easier to detect and possibly fix.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Information System Security Best Practices for UOCAVA-Supporting Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Practical Combinatorial Testing say about Practical Combinatorial Testing? (Part 1) According to Practical Combinatorial Testing, Practical Combinatorial Testing: Practical Combinatorial Testing \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ number of random tests. Although ACTS pairwise tests provide better 3-way coverage than the random tests, at other interaction strengths and values of t , the random tests are roughly the same or slightly better in combination coverage than ACTS. Recall from Section 7.1 that pairwise combinatorial tests detected slightly fewer events than the equivalent number of random tests. One possible explanation may be that the superior 4-way and 5-way coverage of the random tests allowed detection of more events. Almost paradoxically, an algorithm that produces a larger, sub-optimal covering array may provide better failure detection because the A less optimal (by size) array may provide better failure detection because it includes more interactions at t+1, t+2, etc. larger array is statistically more likely to include t +1, t +2, and higher degree interaction tests as a byproduct of the test generation. Again, however, the less optimal covering array is likely to more closely resemble the random test suite in failure detection. Note also that the number of failures in the SUT can affect the degree to which random testing approaches combinatorial testing effectiveness. For example, suppose the random test set covers 99% of combinations for 4-way interactions, and the SUT contains only one 4-way interaction failure. Then there is a 99% probability that the random tests will contain the 4-way interaction that triggers this failure. However, if the SUT contains m independent failures, then the probability that combinations for all m failures are included in the random test set is .99 m .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Practical Combinatorial Testing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2010 Annual Report say about NISTIR 7676, Maintaining and Using Key History on Personal Identity Verification (PIV) Cards? According to Computer Security Division 2010 Annual Report, NISTIR 7676, Maintaining and Using Key History on Personal Identity Verification (PIV) Cards: Group: Cryptographic Technology NIST Special Publication 800-73-3, Interfaces for Personal Identity Verification - Part 1: End-Point PIV Card Application Namespace, Data Model and Representation, discusses methods for storing retired Key Management Keys within the Personal Identity Verifi cation (PIV) Card Application on a PIV Card. NISTIR 7676 comple ments SP 800-73-3 by providing some of the rationale for the design of the mechanism for storing retired Key Management Keys on PIV Cards and by providing suggestions to smart card vendors, PIV Card Issuers, and middleware developers on the use of the Key History mechanism.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2010 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification provide? (Section 20) d be on the Identity Token Usage phase. However, we find that in order to arrive at a meaningful authentication strength metric, we need to examine all three phases because of the following rationale. - The overall authentication strength in authentication use cases deployed in the Identity Token Usage phase is derived from the combination of trust levels in its constitutent authentication mechanisms. The trust level of an authentication mechanism, in turn, is based on the number of trust bindings (embedded in credential objects) it verifies. - The trust in the set of credential objects that are provisioned to the smart identity token during the Identity Token Issuance phase comes from the bindings it embodies and from the overall security of the system processes used in their generation - security for the data repositories holding the enrollment records, trust in attestion authority that is vouching for credential bindings (e.g., Certificate Authorities (CAs) for digital certificates). - The basis for creation of credential objects in turn is the 'Proofed Identity' which is embodied in the set of data records called enrollment records that are created after a successful 'Identity Proofing' process in the Identity Token Eligibility Determination phase. Thus we see that the trust marker or 'Proofed Identity' for the individual being authenticated is established in the Token Eligibility Determination Phase which together with other data in the enrollment records forms the basis for creation of credential objects in the Token Issuance phase. The credential objects by definition embody a 'stamp of authority' or trust binding in each of them. Since the purpose of any authentication mechanism is to 1 We will the two terms interchangeably in this document verify/validate those bindings, any assessment of its strength should involve the set of bindings it verifies as a prime metric.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events say about 3.4.1 Risk? (Part 2) According to Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events, 3.4.1 Risk: impact on the organization's reputation . Analyses of the threats, vulnerabilities, and potential impact to an organization give us an understanding of the risk to an organization with respect to DI. NIST SP 800-39, Managing Information Security Risk, focuses on the business aspect of risk, namely at the enterprise level. This understanding is essential for any further risk analysis, risk response/mitigation, and risk monitoring activities. The following summary lists the strategic risk areas we identified and their mitigations: -  Impact on system function: ensuring the availability of accurate data or sustaining an acceptable level of DI reduces the risk of systems' availability being compromised. -  Cost of implementation: implementing asset identification and protection from DI events once and using it across all systems may reduce system continuity costs. -  Compliance with existing industry standards contributes to the industry requirement to maintain a continuity of operations plan. -  Maintenance of reputation and public image helps reduce level and likelihood of impact as well as facilitates the information required for impact reduction. -  Increased focus on DI includes not just loss of confidentiality but also harm from unauthorized alteration of data (per NISTIR 8050). We subsequently translated the risk factors identified to security Functions and Subcategories within the NIST Cybersecurity Framework. In Table 3-1, we mapped the categories to NIST SP 800-53 Rev. 4 controls.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Data Integrity_ Identifying and Protecting Assets Against Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Definition according to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Definition: Offload supportive but

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Training & Awareness Course Compendium say about VENDOR:? According to Computer Security Training & Awareness Course Compendium, VENDOR:: Skill Dynamics - An IBM Company One IBM Plaza 19th Floor Chicago, IL 60611 (800) IBM-TEACh (800) 426-8322 This course teaches you the necessity for and the implementation of effective controls in the MVS operating system. You will learn the MVS security-sensitive areas and the associated system and business impact of exposures in these areas. You will learn the proper use and implementation of controls to reduce security risks. Through hands-on use of the MVS system functions, you will gain valuable experience in maintaining effective and consistent system security. Although this course does not address the implementation of any specific security program (RACF™, CA-TOP SECRET™, etc.) the topics discussed will apply to MVS environments in general. *CA-TOP SECRET is a trademark of Computers Associates, Inc. COURSE TITLE: COURSE LENGTH: 1 DAY Practical Approach to Auditing MVS Security

Explanation: NIST publication discussing classified information handling. References: secret, top secret. Contains guidance on protecting sensitive government information. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974 say about Prescription? (Part 3) According to Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974, Prescription: ndomly generated and of sufficient length to avoid compromise. - b. Be changed periodically, preferably every time used. - c. Be protected at least in accordance with the level of data they safeguard. The access control system should be sufficiently flexible to support a variety of constraints and mixes of objects. Users could be checked against terminals, programs, or data. An access list could be attached to any or all of the above depending on the needs of a particular installation. Every access to a given file or device must be capable of being trapped through the access control system in order to give the capability for additional authorization or identification checks. In addition, code words (lock words) should be placed within files to prevent reading of sensitive information. 3. The security system should support separate identification for individual users, terminal stations by location, individual programs or jobs by name and function and data to at least the file level. 4. All unauthorized access and I/O requests must result in termination of job, sounding of an alarm, purging of queues and refusal of service to the offending terminal/station. A maximum of three invalid log-ons or requests for information must be alowed before a given process is terminated. 5. A journal or accounting log must be used to capture information related to log-ons, terminal/ user identification, data requested, files accessed, data created and security violations. This raw data can then be formatted by user written programs to produce meaningful reports. These specs won't guarantee security, but they provide a useful departure point. They also provide a very small subset of what is required. The main point is that they address some of the real needs of contemporary systems.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Approaches to Privacy and Security in Computer Systems_ Proceedings of a Conference Held at the National Bureau of Standards March 4-5, 1974.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 259) Control HA-1: cribing some of its details and user feedback we received -, an analysis of the merits of our tool's UI is beyond the scope of this paper, for it requires entirely different approaches and techniques. What we want here is to show one possible way it can be done. Besides general familiarity with the X.509/PKIX/PKCS standards and PKIs in general, this text assumes the reader has considerable familiarity with the HTTP [1] and HTTPS [2, 3] protocols. ## 4th Annual PKI R&D Workshop -- Proceedings Figure 1: Overall architecture of the client proxy, which runs in the same computer as the browser. The engager changes the browser's proxy settings so that it uses our own local proxy. Before doing that, though, it detects which HTTP and HTTPS proxies the browser was using and configures our dispatchers to use them. This effectively puts us in the middle of the proxy chain. New HTTP requests originated by the browser will pass through our proxy, where our filters may act upon them. In fact, we have two filter chains, one for the outgoing requests and other for the incoming responses; some of them act upon the headers, other upon the bodies. Some features actually require several filters in cooperation to implement. If none of the filters actually consume the request (i.e., take it out of the chain), it reaches the default dispatcher in the end of the chain and it is sent as an HTTP request. The Encryption Domain filterset is a special set of filters that reroutes the requests that match certain criteria to be sent over as HTTPS. The HTTPS dispatcher makes use of the certificate store services (not shown in this picture) to validate the certificates and perform client authentication (with a friendly UI) if the site so requests. <!-- image --> ## 2 OVERALL ARCHITECTURE Our tool, code-named Kapanga, is an executable program that typically (although not necessarily) runs in the same computer as the user's web browser.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control OS-1100 in Computer Security Training & Awareness Course Compendium? (Part 127) Control OS-1100: Systems | 41 | | Auditing the Data Center for Controls, Efficiency, and Cost-Effectiveness | 68 | | Computer Security & Contingency Planning | 51 | | Continuity of Operations/Disaster Rec.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD) provide? (Section 926) vice—second DHCP request: sensor ] date Tue Sep 3 15:03:10 EDT 2019 sensor ] dhc Internet Systems Consortium DHCP Client 4.3.5 Copyright 2004-2016 Internet Systems Consortium. All rights reserved. For info, please visit https://www.isc.org/software/dhcp/ Listening on LPF/wlan0/00:13:ef:20:1d:6b Sending on LPF/wlan0/00:13:ef:20:1d:6b Sending on Socket/fallback DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 8 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 19 DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 12 DHCPREQUEST of 10.0.41.182 on wlan0 to 255.255.255.255 port 67 DHCPOFFER of 10.0.41.182 from 10.0.41.1 DHCPACK of 10.0.41.182 from 10.0.41.1 bound to 10.0.41.182 -- renewal in 17132 seconds. NIST SP 1800-15D: Securing Small-Business and Home Internet of Things Devices 435 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 Test Case Field Description MUD manager—log file showing cached file in use: 2019-09-03 15:03:51,666 | INFO | on-dispatcher-99 | Mud- FileFetcher | 93 - gov.nist.antd.sdnmud-impl - 0.1.0 | Found file in mud cache length = 9548 2019-09-03 15:03:51,666 | INFO | on-dispatcher-99 | Mud- FileFetcher | 93 - gov.nist.antd.sdnmud-impl - 0.1.0 | read 9548 characters MUD file server—log after second fetch (no change in output): sudo -E python mudfile-server.py DoGET /nistmud1 127.0.0.1 - - [03/Sep/2019 15:02:53] "GET /nistmud1 HTTP/1.1" 200 - Read 9548 chars DoGET /nistmud1/mudfile-sensor.p7s 127.0.0.1 - - [03/Sep/2019 15:02:55] "GET /nistmud1/mudfile- sensor.p7s HTTP/1.1" 200 - Read 3494 chars Overall Results Pass IPv6 is not supported in this implementation.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Blockchain for Access Control Systems say about Blockchain for Access Control Systems? According to Blockchain for Access Control Systems, Blockchain for Access Control Systems: Vincent C. Hu This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8403 <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain for Access Control Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments provide? (Section 221) -5 | NIST800 53-VI- NET- CFG- 00318 | Built-in | NSX | Log into vSphere Web Client with credentials authorized for administration. Navigate to Networking and Security >> Firewall . Expand rule sections as necessary to view rules. If there are no rules configured to enforce authorizations, this is a finding. | Procedural | | CCE- 8453 1-3 | NIST800 53-VI- NET- CFG- 00321 | Built-in | NSX | From the vSphere Web Client, go to Administration >> Single Sign-On >> Configuration >> Policies >> Password Policy . View the values of the password format requirements. If Lower-Case Characters is not set to at least 1, this is a finding. | 1 | | CCE- 8453 2-1 | NIST800 53-VI- NET- CFG- 00322 | Built-in | NSX | From the vSphere Web Client, go to Administration >> Single Sign-On >> Configuration >> Policies >> Password Policy . If Upper-Case Characters is not set to at least 1, this is a finding.

Explanation: NIST publication on credential and access management. Topics: authorization, password policy, single sign-on. Contains security framework guidance for authentication systems. Source: Trusted Cloud_ Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities say about D-Day Minus 5? According to Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, D-Day Minus 5: In response to the U.S. declaration to send troops and materiel to the region, hostile nations vow to take whatever actions are necessary to 'strike a vicious blow against the American imperialists.' They state that any war that the U.S. provokes will also be fought on the American homeland. U.S. intelligence agencies soon detect an increase of cyber attacks against U.S. and threats to carry out terrorist attacks against the U.S. government. Intelligence also indicates that hostile foreign interests within the U.S. are increasingly active and terrorist cells in other countries have been activated to potentially carry out attacks against the U.S., both overseas and within U.S. borders. U.S. government officials suspect that the hostile nations hope to weaken U.S. public support and impede the military's capability to deploy by engaging in actions that might include the use of weapons of mass destruction and cyberterrorism. Nevertheless, the U.S. military continues to deploy to the region.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Product Supplier according to Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI? Product Supplier: Microsoft Coiporation

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Cryptographic Key Generation say about 2.1 Definitions? (Part 8) According to Recommendation for Cryptographic Key Generation, 2.1 Definitions: | Amethod of encrypting and decrypting keys and (possibly) associated data using symmetric-key cryptography; both confidentiality and integrity protection are provided; see SP 800-38F. 6 | | Key-wrapping key | A key used as an input to a key-wrapping method; see SP 800-38F. | | MACkey | A symmetric key used as input to a security function to produce a message authentication code (MAC). | | Message Authentication Code (MAC) | A cryptographic checksum on data that uses an approved security function and a symmetric key to detect both accidental and intentional modifications of data. | | Min-entropy | The min-entropy (in bits) of a random variable X is the largest value m having the property that each observation of X provides at least m bits of information (i.e., the min-entropy of X is the greatest lower bound for the information content of potential observations of X ). The min- entropy of a random variable is a lower bound on its entropy. The precise formulation for min-entropy is - log 2 (max p i ) for a discrete distribution having event probabilities p 1 , ..., p k . Min-entropy is often used as a worst-case measure of the unpredictability of a random variable. | | Module | See Cryptographic module. | | Nonce | A time-varying value that has (at most) an acceptably small chance of repeating. For example, the nonce may be a random value that is generated anew for each use, a timestamp, a sequence number, or some combination of these.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Cryptographic Key Generation.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security of Personal Computer Systems_ A Management Guide say about 7.1.4.2. Personnel Screening? According to Security of Personal Computer Systems_ A Management Guide, 7.1.4.2. Personnel Screening: Many security controls ultimately depend on trust in individuals. Therefore, there should be some process to screen personnel who are authorized to access sensitive information systems. This does not imply, however, that special screening is needed simply because a person will be using a computer system. Most organizations have pre-employment screening procedures and, if needed, security background investigations. If such screening is considered sufficient for the employee's position description, it should be irrelevant whether or not a computer is used as part of the job.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security of Personal Computer Systems_ A Management Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Access Control for SAR Systems say about 2.1 Policy Identification? (Part 1) According to Access Control for SAR Systems, 2.1 Policy Identification: 2.1 Policy Identification The first phase of the policy lifecycle involves the identification of laws, statutes and policies pertinent to granting or denying access to domain resources. The identification of laws, statutes and policies pertinent to granting or denying access to domain resources requires not only intimate knowledge of pertinent federal, state, local, tribal, and domainspecific laws, statutes and policies, but also of domain resources, it's users and actions that users may invoke on those resources. In general, access control policies are motivated by laws, statutes, and policies that ensure the privacy of sensitive information including classified data and personally identifiable information (PII). After pertinent laws, statutes and policies have been identified, work must be conducted to map these laws, statutes and policies to domain-specific policies. The first step in this process entails the mapping of general laws, statutes and policies into Attribute-Based Access Control (ABAC) [Blaze, Brown, Pimlott] rules. An ABAC rule is a triple SAARA , , where SA represents a set of domain subject (i.e., user or process) attributes, RA represents a set of domain resource attributes, and A represents a set of actions that users may invoke on resources. The set SA is defined by a subject attribute data model that defines subject attributes (and their interrelationships) required to render a policy decision (i.e., permit or deny access to a resource). Such attributes may include, for example, the role, rank and operating unit of an employee. The set RA is defined by a resource attribute data model that defines resource attributes (and their interrelationships) required to render a policy decision. Such attributes may include, for example, the fields of a resource database record or the clearance level of the resource (i.e., public, secret, or top secret).

Explanation: NIST publication discussing classified information handling. References: classified, secret, top secret. Contains guidance on protecting sensitive government information. Source: Access Control for SAR Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines on Active Content and Mobile Code provide? (Section 99) est security advisories from the United States Computer Emergency Readiness Team (US-CERT) and the Computer Emergency Response Team (CERT) Coordination Center, and subscribe to security mailing lists. - GLYPH<c=31,font=/BAADDB+Webdings> Periodically cross-check products against published lists of known vulnerabilities, such as the National Vulnerability Database (NVD), 10 that provide pointers to solution resources and patch information. - GLYPH<c=31,font=/BAADDB+Webdings> Regularly audit systems and networks, quickly remedying any deficits noted. - GLYPH<c=31,font=/BAADDB+Webdings> Know who to contact and what steps to take when discovering evidence of an intrusion. One typical and common sense approach is to improve the security infrastructure incrementally over time. At each step, apply safeguards against the most critical risk items. For example, start with firewalls and gateway servers capable of screening active content and executable email attachments and successfully defending against a high percentage of Internet launched attacks. Later, for additional protection, complement antivirus software with behavioral controls, intrusion detection capabilities, or other technologies. Regular site security audits also help to identify vulnerabilities and appropriate safeguards, and to decide whether the remaining risks warrant further expenditures of time and money. 10 The NVD is hosted by NIST at http://nvd.nist.gov/.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Guidelines on Active Content and Mobile Code.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does CVSS Implementation Guidance provide? (Section 49) ons upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout. Analysis: Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P Base Score: 4.6 CWE: CWE-310 - Cryptographic Issues | Metric | Value | Explanation | |-------------------|---------|----------------------------------------------------------| | Access Vector | Local | From keyword 'physically proximate' | | Access Complexity | Low | No special conditions exist | | Authentication | None | Not required | | Confidentiality | Partial | Attacker obtains the credentials of the application user | | Integrity | Partial | Attacker obtains the credentials of the application user | | Availability | Partial | Attacker obtains the credentials of the application user | The Bluetooth stack in Microsoft Windows XP SP2 and SP3, and Vista Gold and SP1, allows physically proximate attackers to execute arbitrary code via a large series of Service Discovery Protocol (SDP) packets. From reference link [1], the range of the Bluetooth radio in this context is listed as 0 m to 100 m. Analysis: Vector: AV:A/AC:L/Au:N/C:C/I:C/A:C Base Score: 8.3 CWE: CWE-20 - Improper Input Validation | Metric | Value | Explanation | |-------------------|------------------|--------------------------------------------------------------------------------------------------------------------| | Access Vector | Adjacent Network | From keyword 'physically proximate' and within Bluetooth range. See Additional Considerations .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: CVSS Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guide to Secure Web Services? (Part 222) Control ES-1: ----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------| | Hamid R. Motahari Nezhad, et al: 'Securing Service-Based Interactions: Issues and Directions' ( IEEE Distributed Systems Online, April 2005) | ndex.jsp?pageID=dso_level1&path=dsonline/topi cs/was/papers&file=motahari.xml&xsl=article.xsl | | Ken Birman, Cornell University: 'The Untrustworthy Web Services Revolution' ( IEEE Computer, Feb. 2006) | To purchase from IEEE Computer Society: 006.73 | | Marek Hatala, et al, Simon Fraser University (Surrey, BC, Canada): 'Federated Security: Lightweight Security Infrastructure for Object Repositories and Web Services' ( Proceedings of the 2005 International Conference on Next Generation Web Services Practices , 2005 [NWeSP'05]) | federated-security.pdf | | Neal Leavitt: 'Are Web Services Finally Ready to Deliver?' ( IEEE Computer, Nov.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain risk according to NIST Engineering Trustworthy Secure Systems According to Engineering Trustworthy Secure Systems, risk: Effect of uncertainty on objectives. [28] Note 1: An effect is a deviation from the expected, positive or negative. A positive effect is also known as an opportunity. Note 2: Objectives can have different aspects (i.e., financial, health and safety, and environmental goals) and can apply at different levels (i.e., strategic, organization-wide, project, product, and process). Note 3: Risk is often characterized by reference to potential events and consequences or a combination of these. Note 4: Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated likelihood of occurrence. Note 5: Uncertainty is the state, even partial, of deficiency of information related to the understanding or knowledge of an event, its consequence, or likelihood.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Situational Awareness for Electric Utilities provide? (Section 218) administrator password, then click Finish. - In the Project Explorer window, right-click Tofino SAs, and select New Tofino SA. A folder can also be created for the SAs to help organize multiple areas. Figure 2-35 Administrator Password <!-- image --> Figure 2-36 Project Explorer Window <!-- image --> - In the Tofino ID field, enter the MAC address listed on the firewall hardware sticker. Fill out the rest of the fields as necessary, then click Finish. Figure 2-37 Tofino SA/MAC Address <!-- image --> Figure 2-38 Project Explorer <!-- image --> - Right-click on the Assets icon in the Project Explorer frame, then click New Asset. - In the New Asset window, set the name and type of the device and all other fields as necessary, then click Next. Figure 2-39 New Asset <!-- image --> - Fill in the IP address and/or the MAC address fields, then click Finish. - Repeat for all devices on the network. When they are configured, click on the Assets icon in the Project Explorer frame (if it is not already selected). There should be a list of all configured assets. - Under the Project Explorer frame, click the drop-down arrow next to Tofino SAs, then choose the SA created earlier. From there, click Firewall in the Project Explorer frame to display current firewall rules. This should currently be empty. Figure 2-40 Project Explorer Tofino SA Icon <!-- image --> - To create the first rule, click the + Create Rule button above the Tofino SA-Firewall title. Then, ensure the Standard rule radio button is selected, and click Next. - On the next screen, choose the interface for Asset 1. This is where traffic originates before going into the device. Select a source asset and a destination asset from the radio buttons below. Set the direction of the traffic by using the arrow buttons in the middle. When finished, select Next. - In the Asset Rule Profiles window, select the Manually create the firewall rules for the selected assets radio button, then click Next.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Situational Awareness for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Public Safety Mobile Application Security Requirements Workshop Summary provide? (Section 27) ction hierarchy for use in determining an application's level of data protection. -  Applications will declare what data they handle. -  Application will declare what data protection they implement. -  App discloses what location information is being provided, whether the GPS/location services of the device needs to be enabled, how location information is being determined (cell ID, GPS, AGPS), and whether 2D or 3D -  Adequate safeguards are in place to protect privacy, confidentiality Public safety mobile applications will have access to and use location information provided by mobile devices to enhance their utility to public safety practitioners. Location information is actually a special subset of the more general topic of mobile application data protection. Location information, however, has the potential to have more immediate and severe implications to first responders. In general, location information provided to mobile applications will either be two- or three-dimensional. There are at least three factors that will influence to what extent public safety should use the location information being provided: accuracy, integrity, and confidentiality. Location information can be derived using various sources and techniques with each providing varying levels of accuracy. The integrity of the location information may need to be protected so that false location information is not provided that interferes with a timely response. Under certain circumstances, location information being generated may need to be kept confidential so as to not endanger public safety personnel. That said; seamless, efficient, and ubiquitous location communication stands to both empower and enrich public safety as they seek to fulfill their mission.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Public Safety Mobile Application Security Requirements Workshop Summary.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2010 Annual Report say about Biometric Standards and Conformity Assessment Activities? (Part 5) According to Computer Security Division 2010 Annual Report, Biometric Standards and Conformity Assessment Activities: need ed) so that the suites are available at the time of publication of the standards or soon thereafter. Changes to the architecture leading towards the development of CTA Beta 3.0 are also planned. Such changes may include the re development of some of the Graphical User Interfaces to accom modate the diverse types of test suites planned (binary as well as tag-based testing) and to improve the usability of the tools. Some of the features also being researched and/or implemented are pro viding for full web services support and the development of a test 2 The CTA/CTS Download web page is rics/biocta\_download.cfm. The web page can be also reached from NIST/ITL Biometric Resource Center http://www.nist.gov/biometrics under ITL Computer Security Division (CSD)/Systems and Emerging Technologies Security Research Group - 'Standards and Related Technical Developments' 3 The released CTSs were developed to test implementations of four pub lished American National Standards: ANSI INCITS 378-2004 and 2009 (Finger Minutiae Format for Data Interchange) and ANSI INCITS 381-2004 and 2009 (Information Technology Finger Image-Based Data Interchange Format). 4 This work is sponsored, in part, by DHS/US-VISIT. suite developer's kit to promote third-party development of mod ules that can be incorporated into the architecture. Research is also planned on the need for the development of additional test suites for implementations of new biometric technical interface standards being developed internationally. The Biometric Consortium (the Consortium), co-chaired by NIST and the National Security Agency (NSA), serves as a focal point for research, development, testing, evaluation, and application of bio metric-based personal identification/verification technology.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Computer Security Division 2010 Annual Report.