You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management provide? (Section 65) and outbound remote connections are encrypted. • Laptops with proprietary facility information do not have full-disk encryption. • Email systems are configured to provide limited data loss prevention. | • External adversary (who has gained network access may quickly recognize and exfiltrate unencrypted, sensitive information in databases or within cleartext network traffic) • Internal user (may unintentionally send sensitive records without encryption, while data loss prevention tools might impede that error) | | DE.CM | Security Continuous Monitoring | • Physical security is monitored through cameras and access log reviews. • Information security logs are aggregated and stored securely. • Intrusion Detection products monitor for risks. | • Internal User (steals valuable equipment due to a lack of diligent video and log monitoring) • External User (is not quickly detected and thwarted due to ineffective monitoring) | | RS.RP | Response Planning | • Response processes and procedures are executed and maintained. • Supply chain partners have not been included in planning or exercises. | • Supply Chain Partner (is not able to provide the Security Operations Center with system log information and is unable to restore data to a known-good recovery point) | | RC.RP | Recovery Planning | • Incident recovery processes are included in response plans.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: adversary, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers say about 2.1 StrongKey CryptoEngine FIDO U2F Server? According to Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers, 2.1 StrongKey CryptoEngine FIDO U2F Server: This section of the guide provides installation and configuration guidance for the SKCE, which provides FIDO authentication services.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Derived PIV Application and Data Model Test Guidelines say about 7.3.1 X.509 Certificate for Derived PIV Authentication? (Part 2) According to Derived PIV Application and Data Model Test Guidelines, 7.3.1 X.509 Certificate for Derived PIV Authentication: | | DTR-07.03.01.04 | If the public key algorithm is elliptic curve, then the parameters field contains the namedCurve choice populated with the OID for Curve P-256 (1.2.840.10045.3.1.7). | • [PROF], Worksheet titled - Derived PIV Authentication Certificate Profile | | DTR-07.03.01.05 | The keyUsage extension shall assert only the digitalSignature bit. No other bits shall be asserted. | • [PROF], Worksheet titled - Derived PIV Authentication Certificate Profile | | DTR-07.03.01.06 | The policyIdentifier field in the certificatePolicies must assert id-fpki- | • [PROF], Worksheet titled - Derived PIV | | DTR No: | DTR Description | Spec.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Report on the Privilege (Access) Management Workshop provide? (Section 46) formation Security and Privacy Series, Second Edition, ISBN 13: 9789-1-59693-113-8, ARTECH HOUSE, INC., 68 Canton Street, Norwood, Massachusetts 02062. - [FERR-07b] Ferraiolo, D. F., V. Atluri, and S. Gavrila, 2007, The Policy Machine: A StandardsDriven Enterprise-Wide Access Control Enforcement Mechanism , pages 87-92, Defense Standardization Program Journal, Defense Standardization Program Office, 8725 John J. Klingman Road, Stop 6233, Fort Belvoir, VA 22060-6221. - [FICAM-09] Identity, Credential, and Access Management (ICAM) Subcommittee, June 15, 2009, Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance , DRAFT Version 0.2, Federal Information Security & Identity Management Committee (ISIMC). - [GREG-07] Gregory, M., March 14, 2007, A Mechanism for Risk Adaptive Access Control (RAdAC) , Presentation in PDF format, National Information Assurance Research Laboratory (NIARL). - [HENG-05] Hengartner, U., 2005, Access Control to Information in Pervasive Computing Environments , ADA457117, DoD-XA. - [HU-01] Hu, V., D. A. Frincke, and D. F. Ferraiolo, 2001, The Policy Machine for Security Policy Management , pages 494-503, Computational Science -- ICCS 2001, ISBN 3-54042233-1, Springer-Verlag Berlin, Heidelberg, New York. - [ILLI-07] Illinois University, June 1, 2007, PolicyMorph: Interactive Policy Transformations for a Logical Attribute-Based Access Control Framework , ADA482461, Illinois University at Urbana-Champaign, Department of Computer Science. - [McGR-UN] McGraw, R. W., undated, Risk-Adaptable Access Control (RAdAC) , Presentation in PDF format, publisher not indicated; available 12-9-2009 at - [McGR-09] McGraw, R. W., September 2009, Risk Adaptable Access Control (RAdAC) , Presentation in PDF format, Information Assurance Architecture and Systems Security Engineering Group, National Security Agency, Ft. Meade, Maryland.

Explanation: NIST publication on credential and access management. Topics: access control, identity management. Contains security framework guidance for authentication systems. Source: A Report on the Privilege (Access) Management Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-512 in Computer Security Division 2009 Annual Report? (Part 54) Control HA-512: ludes several proof-ofconcept implementations of security mechanisms suited for the capabilities and limitations of such devices. Detailed descriptions can be found on the project website (see below). This past year we published an additional conference paper on the design and implementation of an authentication mechanism that uses wireless security beacons to provide location data and control device behavior. We also finalized NIST SP 800-124, Guidelines on Cell Phone and PDA Security . This publication provides an overview of security issues with mobile devices and offers insights into making informed security decisions. It includes details about the threats and technology risks involved and the available safeguards to mitigate them. Users of cell phones and other business-oriented mobile devices, as well as security professionals and officials responsible for information technology security in government and elsewhere, should find the information useful. Prior work at NIST in the mobile device forensics area examined the quality and use of forensic tools and identified ways to remove impediments to the practice of cell phone forensics. During FY2009, our work has progressed along both fronts. We improved our methodology for validating the correct functioning of forensic tools quickly and accurately. The approach, called identity module programming, automatically populates devices with reference test data that serves as baseline reference material for validating the correct functioning of related forensic tools. An application and set of reference test data was developed that illustrates the methodology for identity modules of certain classes of cell phones. The distribution package can be found at the project website.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Digital Identity Guidelines_ Federation and Assertions provide? (Section 193) that they expect to be in the transaction with in the first place. Different techniques provide different degrees of assurance, depending on the federation protocol in use and the needs of the system. For example, the Authorization Code Flow of [OIDC] allows the RP to register a shared secret or private key with the IdP prior to the transaction, allowing the IdP to strongly authenticate the RP's request in the back channel to retrieve the assertion. In addition, the Proof Key for Code Exchange protocol in [RFC7636] allows the RP to dynamically create an unguessable secret that is transmitted in hashed form in the front channel and then transmitted in full in the back channel along with the assertion reference. These techniques can be combined for even greater assurance. Federation authorities can also facilitate the authentication process. If the RP registers its public key and identifier with the federation authority, the IdP only needs to retrieve the appropriate verification keys from the federation authority instead of requiring the RP to register itself ahead of time. Technical profiles of specific federation protocols are out of the scope of these guidelines, but high-security profiles such as [FAPI] provide extensive guidelines for implementers to deploy secure federation protocols. - 9.13. Cloud Wallet An agency's CSP allows its subscribers to issue attribute bundles to a cloud-hosted wallet service. In this scenario, the CSP onboards the cloud wallet service on behalf of the subscriber through a dedicated onboarding process. The subscriber authenticates to the cloud wallet and initiates the onboarding process of the cloud wallet at the CSP. The subscriber authenticates to the CSP and authorizes the issuance of attribute bundles to the cloud wallet. The CSP generates and delivers these attribute bundles to the cloud wallet, the cloud wallet stores the attribute bundles on behalf of the subscriber.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Digital Identity Guidelines_ Federation and Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS) say about SOME THOUGHTS ON DATA INTEGRITY? According to Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS), SOME THOUGHTS ON DATA INTEGRITY: Data can be said to have integrity when it is as good as we think it is. [Courtney] That is to say, when it agrees with our expectation. Data can be said to have integrity when it agrees with that which it intends to describe. For example, inventory data can be said to have integrity when it tells us accurately and completely just what quantity of which items we have. Of course, it never does that, but as long as it does it well enough to support the decisions that we want to make, then it is probably good enough.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 268) s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ may need to be taken offline, or replicated to the extent feasible, before testing can be conducted. If systems must be taken offline for testing, the tests are scheduled to occur during planned system outages whenever possible. If the testing cannot be conducted on operational systems, organizations employ compensating controls. Related Controls: None. (3) CONFIGURATION CHANGE CONTROL | AUTOMATED CHANGE IMPLEMENTATION Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: organization-defined automated mechanisms]. Discussion: Automated tools can improve the accuracy, consistency, and availability of configuration baseline information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization. Related Controls: None. (4) CONFIGURATION CHANGE CONTROL | SECURITY AND PRIVACY REPRESENTATIVES Require [Assignment: organization-defined security and privacy representatives] to be members of the [Assignment: organization-defined configuration change control element]. Discussion: Information security and privacy representatives include system security officers, senior agency information security officers, senior agency officials for privacy, or system privacy officers.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does U.S. Department of Energy Risk Assessment Methodology say about DEPARTMENT OF ENERGY ADP SYSTEM RISK ASSESSMENT? (Part 9) According to U.S. Department of Energy Risk Assessment Methodology, DEPARTMENT OF ENERGY ADP SYSTEM RISK ASSESSMENT: ^/ yj V yj 4 4 | | INTENTIONAL HUMAN THREATS: | INTENTIONAL HUMAN THREATS: | INTENTIONAL HUMAN THREATS: | INTENTIONAL HUMAN THREATS: | INTENTIONAL HUMAN THREATS: | | TERRORIST INCIDENT BOMBING RIOT/CIVIL DISORDER STRIKES kTONARRfl^ ASSAULT | V V V *T < | •4 yi yj V V | V r * V | 4 4 4 4 V 4 | | UNINTENTIONAL HUMAW THREATEs | UNINTENTIONAL HUMAW THREATEs | UNINTENTIONAL HUMAW THREATEs | UNINTENTIONAL HUMAW THREATEs | UNINTENTIONAL HUMAW THREATEs | | ACCIDENTS OPERATIONAUPROCEDURAL ERRORS EMOTIONAL MENTAL HEALTH PROBLEMS | | V | >/ V | , v , X3l | | HEATINQCOOUNG SYSTEM FAILURE POWER OUTAGE structural FAILUR8 | | >/ | | 4 | <!-- image --> | DEPARTMENT OP ENERGY ADP SYSTEM RISK ASSESSMENT | THREATS TO AND VULNERABILITIES INFORMATION, AND (DATA) | OP DATA, EMISSIONS | STEP 4 RESOURCE TABLE R4.3a | |----------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------|----------------------|-------------------------------| | INFORMATION AND DATA DAMAGE | DESTRUCTION | DISCLOSURE | DENIAL | | NATURAL THREATS; .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: U.S. Department of Energy Risk Assessment Methodology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to Computer Security Division 2011 Annual Report? http: //csrc.nist.gov/publications/PubsSPs.html Contacts:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography say about 7.2.1.3 RSASVE Recovery Operation (RSASVE.RECOVER)? According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography, 7.2.1.3 RSASVE Recovery Operation (RSASVE.RECOVER): RSASVE.RECOVER recovers a secret value from ciphertext using an RSA private key. Once recovered, the secret value is considered to be a shared secret.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case say about 4.3.5.4 Additional Information? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case, 4.3.5.4 Additional Information: Video tutorials 58 are available on the CSET YouTube Channel to help you better understand how to use this tool.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CP-02(04) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control CP-02(04): CONTINGENCY PLAN | RESUME ALL MISSION AND BUSINESS FUNCTIONS [WITHDRAWN: Incorporated into CP-02(03).]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain APPENDIX E: COMPUTER SECURITY AREA AND SOW-SPECIFIC REFERENCES according to NIST Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out According to Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out, APPENDIX E: COMPUTER SECURITY AREA AND SOW-SPECIFIC REFERENCES: The following are federal requirements or guidance used as references for each SOW. These are the basic references used to ensure that the tasks conducted, recommendations made, and products delivered are consistent with government requirements. These references are not intended to be all inclusive. Individual organization computer security directives should be identified, added to a SOW, and complied with, where applicable. For a description of many of the references listed below, please see Appendix A. See note at the end of this section regarding definition and usage of computer security terms. The following abbreviations are used: - o FIPS PUB - Federal Information Processing Standards Publication - o NBS - National Bureau of Standards - o NBSIR - National Bureau of Standards Information Report - o NCSC - National Computer Security Center - o (N)CSL - (National) Computer Systems Laboratory - o NIST - National Institute of Standards and Technology - o NISTIR - National Institute of Standards and Technology Information/Internal Report - o NIST SP NIST Special Publication - o OMB - Office of Management and Budget - o OPM - Office of Personnel Management - o PCMI - Presidents Council on Management Improvement

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure provide? (Section 152) ---------------------------------------------------------------------------------------------------------------------------------------| | DS-4: Adequate capacity to ensure availability is maintained. | Ecosystem: Measures to augment capacity may include: • Formal procedures and activities to monitor system performance • Redundant transmission systems • Alternate transmission systems (such as radio frequency (RF), wired or optical systems) Methods such as load balancing address abnormal server loads due to elevated traffic from user activity, incorrect server configurations, or cybersecurity events. | [NIST-SP800-53r5] AU-4, CP-2, CP-6, CP-7, PE-11, SC-5 [NIST-SP800-160V1] Appendix F.4 IEC62439-3 4, 5, Appendix P.2.3, 4.6, 4.8, 4.9, 4.12, 4.13 NERC CIP 009-6-R1 | | DS-4 | EV | This may include availability of the EV infrastructure that manages networks, processing, and storage capacities. | [NIST-SP800-53r5] CP-2, CP-6, CP-7 [NIST-SP800-160V1] Appendix F.4 | | DS-4 | XFC/EVSE | This may include availability of the XFC/EVSE charging network, supporting processes for charging, and information from EV owners, EV/XFC partners, and suppliers/vendors. | [NIST Handbook 44] 3.40 S.3.4 (c) ISA/IEC 62443-3- 3:2013 SR 7.1, SR 7.2 OIML G22:2022 4.4.9.2.2 OIML D31:2019 | | DS-4 | Cloud/Third-Party | This may include information from EV owners, EV/XFC partners, customers, and cloud and payment processing vendors. Cloud and third-party system providers may consider implementing high-availability networks with the required redundancy of gateways, servers, etc.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers provide? (Section 101) [5] FIDO Alliance. (n.d.). FIDO® Certified [Online]. Available: https://fidoalliance.org/certification/fido-certified-products/. - [6] Splunk Inc. (n.d.). [Online]. Available: https://www.splunk.com/. - [7] International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC). (Oct. 2013). ISO/IEC 27001:2013: Information technology-Security techniquesInformation security management systems-Requirements [Online]. Available: - [8] National Institute of Standards and Technology (NIST). (Apr. 16, 2018). NIST Cybersecurity Framework, Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1 [Online]. Available: - [9] NIST Special Publication (SP) 800-30 Rev. 1, Guide for Conducting Risk Assessments. (Sept. 2012). [Online]. Available: - [10] NIST SP 800-37 Rev. 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach. (June 5, 2014). [Online]. Available: - [11] NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations. (Apr. 2013). [Online]. Available: - [12] NIST SP 800-63-3, Digital Identity Guidelines. (June 2017). [Online]. Available: https://pages.nist.gov/800-63-3/. - [13] NIST SP 800-63A, Digital Identity Guidelines, Enrollment and Identity Proofing. (June 2017). [Online]. Available: https://pages.nist.gov/800-63-3/. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ - [14] NIST SP 800-63B, Digital Identity Guidelines, Authentication and Lifecycle Management. (June 2017). [Online].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, risk management framework. General security reference material without sensitive content. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain C O M P U T E R S E C U R I T Y according to NIST Personal Identity Verification Demonstration Summary According to Personal Identity Verification Demonstration Summary, C O M P U T E R S E C U R I T Y: Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD, 20899-8940 August 2006 <!-- image --> U.S. Department of Commerce Carlos M. Gutierrez, Secretary National Institute of Standards and Technology William A. Jeffrey, Director

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Personal Identity Verification Demonstration Summary.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 provide? (Section 177) | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | INTENDED EFFECT | IMPACT ON RISK | EXPECTED RESULTS | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Scrutinize Analyze threat events and artifacts associated with threat events-particularly with respect to patterns of exploiting vulnerabilities, predisposing conditions, and weaknesses-to inform more effective detection and risk response.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Secure Data Network Systems (SDNS) Key Management Documents provide? (Section 112) an Estat KPDU to the responder, then the connection is terminated and the TEK generated is discarded by both parties. The KMASE K-TEK-ATTRIBUTES service provides the attribute negotiation activities. The K-TEK-ATTRIBUTES service verifies the cryptographic compatibility with the TEK, negotiates the communication and security attributes associated with the TEK, and exchanges Compromised Key List (CRL) numbers. Additionally, K-TEK-ATTRIBUTES allows a KMAP to associate the attributes of a previous TEK with a new TEK. The K-TEK-ATTRIBUTES parameters are illustrated in Table 1. Table 1 - K-TEK-ATTRIBUTES parameters | Parameter Name | Req | ind | rsp | cnf | |------------------|-------|----------|-------|--------| | init-kid | | | M | M( = ) | | resp-kid | M | M( = ) | | | | proposed-options | U | U( = ) | | | | selected-options | | | M | M( = ) | | add-info | U | U( = ) | U | U( = ) | | old-resp-kid | U | U{ = ) | | | | cri-ver | M | IVI( = ) | | | | result | | | M | M( = ) | Legend: blank - not applicable M - presence is mandatory U - presence is user option = - p value is semantically equal to value to its left in the table This K-TEK-ATTRIBUTES parameter is required on the response primitive. It is passed on the confirm primitive. It contains the identifier the initiator KMAP associates with the TEK. This service parameter is specified in SDN.902, and its KPDU ASN.l specification described in SDN.903. This K-TEK-ATTRIBUTES parameter is required on the request primitive, and passed on the indicate primitive. It contains the identifier the responder KMAP associates with the TEK. This service parameter is specified in SDN.902, and its KPDU ASN.l specification described in SDN.903.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3 say about Appendix B: Existing Standards in Relation to the Security and Privacy Fabric? (Part 69) According to NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3, Appendix B: Existing Standards in Relation to the Security and Privacy Fabric: | 'Person or organization having responsibility for the development, procurement, integration, modification, operation and maintenance, and/or final disposition of an information system.' | | Technical Privacy Security Controls | CNSSI-4009 | See also Technical Reference Model adapted for Privacy | 'Security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system.' | | Privacy - Threat definition, analysis, assessment, event, scenario, source | NIST SP 800-27, CNSSI-4009 | | | | Tracking cookie | NIST SP 800-83 | | | | Traffic Analysis | NIST SP 800-24, NIST SP 800-98 | Highly applicable to privacy in IoT | 'A form of passive attack in which an intruder observes information about calls (although not necessarily the contents of the messages) and makes inferences, e.g., from the source and destination numbers, or frequency and length of the messages.' | | Trusted Agent TBD | See trusted identification forwarding and related terms | Earliest or most responsible (TBD) direct digital connection to a person whose data is private | | | Term | Sources | Security and Privacy Fabric | Comments

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Secure Domain Name System (DNS) Deployment Guide? (Part 5) Control HA-1: ous command options (parameters) denote the following: -a option: the name of the hashing algorithm that will use the key (HMAC-SHA256 is preferred, but may not be available in older implementations. Use of HMAC-SHA1 is allowed, but migration to HMAC-SHA256 should be done when available) ``` -b option: the length of the key (here - a minimum of 112 bits) -n option: the type of key (in this case, the HOST) last parameter: the name of the key (ns1-ns2.example.com) ``` The dnssec-keygen program generates the following files, each containing the key string: ``` Kns1-ns2.example.com.+157+34567.key Kns1-ns2.example.com.+157.34567.private ``` When the program is generating a pair of keys (one public and the other private), the file with the extension key will contain the public key string and the file with extension private will contain the private key. Because in this case only the secret key is being generated, the key strings in both files will be the same for the TSIG implementation. The key string from any of these files is then copied to a file called the key file. This file is then referenced using an include statement within the key statement. ## 8.2.2 Defining the Keys in the Communicating Name Servers The key generated by using the dnssec-keygen utility has to be defined within the named.conf configuration file of the two communicating servers (generally one primary name server and one secondary name server). This is accomplished by using the key statement of BIND: ``` key 'ns1-ns2.example.com.' { algorithm hmac-sha256; include '/var/named/keys/secretkey.conf'; }; ``` where the file secretkey.conf will contain the keyword secret and the actual key string (in this example): ``` secret 'MhZQKc4TwAPkURM=='; ``` ## 8.2.3 Defining the Keys in a NSD Configuration File In NSD, declaring a TSIG key is very similar to the example above, with some minor syntax changes: ``` key: name: ns1-ns2.example.com.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Domain Name System (DNS) Deployment Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about Interview? According to Assessing Security Requirements for Controlled Unclassified Information, Interview: [SELECT FROM: personnel with boundary protection responsibilities; personnel with information security responsibilities; system developers; system administrators]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives provide? (Section 25) | 56 | | | A.2 | Technology lenses & adoption curve ............................................................ | 57 | | | A.3 | Win/win and production possibility frontier .................................................... | 60 | | | A.4 | Intermediation, disintermediation, classic make/buy.....................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Usability and Security Considerations for Public Safety Mobile Authentication provide? (Section 9) dios (LMRs) without authentication for voice communication, they should not be required to authenticate in order to use mission-critical communication services on their next-generation mobile devices. - In order to mitigate the usability issues identified, research should be prioritized by focusing on authentication methods rated as readily feasible, then by investigating other less feasible authentication methods. - Research is needed on the associated enterprise policies guiding mobile authentication implementation and deployment. For example, research on timeout policies and SSO implementation is necessary. For first responders in the field, the timeout policy would ideally be lifted, such that a single authentication event would suffice for an entire shift or incident, especially since their mobile devices would remain on their person. SSO will allow first responders to authenticate one time and receive access to multiple applications, systems, and domains within a variety of authentication mechanisms [24]. | Executive Summary..................................................................................................... iii | Executive Summary..................................................................................................... iii | Executive Summary.....................................................................................................

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Usability and Security Considerations for Public Safety Mobile Authentication.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IP-3 in Data Integrity_ Recovering from Ransomware and Other Destructive Events? (Part 4) Control IP-3: | ## 1 Summary Businesses face a near-constant threat of destructive malware, ransomware, malicious insider activities, and even honest mistakes that can alter or destroy critical data.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Attribute-based Access Control for Microservices-based Applications using a Service Mesh provide? (Section 27) y a label that is a name/value pair. A node is a physical or virtual machine that houses a set of pods as well as the interfaces necessary to run the housed pods. The set of nodes is called a cluster. The control plane's components make global decisions about the cluster (for example, scheduling), as well as detecting and responding to cluster events (for example, starting up a new pod when workload increases). Some key control plane components include: Kubernetes API (application programming interface) server, a key/value store, a scheduler, and a set of controllers. The node controller is one such controller that manages various aspects of nodes. To ensure adequate performance and continued availability, it is imperative to have some clusterlevel mechanisms for the clusters that are configured using the hosts of the application components (i.e., microservices). Considering a scenario where the host is a node of a Kubernetes platform cluster and the application components are running inside of a container with a pod (i.e., a group of containers) as a deployment artifact, the following cluster-level mechanisms are required. For example, one of the most well-known features of Kubernetes is pod-level horizontal scaling . This means that when services receive more traffic, more instances will be generated across machines that grow or shrink on demand. Kubernetes supports auto-vertical scaling on the pod level. Thus, a cluster could be configured to scale the machine on which a pod runs up or down to more accurately fit the anticipated power needs of any microservice. For example, if certain subsets of nodes saw spikes in traffic at key times, with the right usage analysis, one could potentially reschedule those jobs across machines in order to save costs and optimize performance [7]. Similarly, Kubernetes offers features to monitor the health of the microservices (e.g., check the status and readiness).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Attribute-based Access Control for Microservices-based Applications using a Service Mesh.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2014 Annual Report provide? (Section 172) t conferences and research labs; and a joint development of enhanced fault location tools with Johns Hopkins University Applied Physics Lab. http:/ /csrc.nist.gov/groups/SNS/acts/ Mr. Rick Kuhn (301) 975-3337 kuhn@nist.gov Dr. Raghu Kacker (301) 975-2109 raghu.kacker@nist.gov Modern computing devices consist of various hardware, firmware, and software components at multiple layers of abstraction. Many security and protection mechanisms are currently rooted in software that, along with all underlying components, must be trusted and not tampered with. A vulnerability in any of those components could compromise the trustworthiness of the security mechanisms that rely upon those components. Stronger security assurances may be possible by grounding security mechanisms in roots of trust. Roots of trust are highly reliable and secure hardware, firmware, and software components that perform specific, critical security functions. Because roots of trust are inherently trusted, they must be secure by their design. As such, many roots of trust are implemented in hardware or protected firmware so that malware cannot tamper with the functions they provide. Roots of trust provide a firm foundation from which to build security and trust. NIST CSD's work aims to encourage the use of roots of trust in computers to provide stronger security assurances. A focus area for this work has been securing mobile devices, using roots of trust to provide device integrity, data and application isolation, and protected storage. As part of this work, CSD is revising SP 800-164, Guidelines on HardwareRooted Security in Mobile Devices, based on the public comments that were received on the draft. A revised draft will be released in FY 2015.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware. Contains technical security guidance that could inform defensive posture. Source: Computer Security Division 2014 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Telehealth Remote Patient Monitoring Ecosystem say about C-4 Threats? (Part 1) According to Securing Telehealth Remote Patient Monitoring Ecosystem, C-4 Threats: C-4 Threats In this practice guide, the NCCoE identified a threat taxonomy for the entire system. Threats may manifest differently to the system depending on the domain in which they appear. Environments that may have resources to maintain security tools and procedures may have mitigating circumstances that reduce the likelihood of attack and minimize impact based on pervasive controls. This practice guide considers scenarios where patient homes may have less resource and capability to minimize threats when compared with telehealth platform providers and HDOs. Also, for the purposes of this practice guide, some threats may target HDOs to a greater extent than patient homes or telehealth platform providers, given a more target-rich data set that may attract threat actors. The following tables describe events and consider the likelihood of variation based on this context. Note that the assigned values are notional. Practitioners who perform similar exercises may determine different assignments. For purposes of this exercise, likelihood is categorized using a range that extends from very low to very high, consistent with a model described in Appendix G of NIST 800-30 [9]. An abstract of the table appears below. The qualitative values from the Table C-2 describes threat likelihood. Table C-2 Assessment Scale: Likelihood of Threat Event Initiation | Qualitative Values | Frequency (derived from nonadversarial table) | Description (derived from adversarial table) | |----------------------|-----------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------| | very high | Error, accident, or act of nature is almost certain to occur or occurs more than 100 times per year. | Adversary is almost certain to initiate the threat event.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: threat actor, adversary. Contains technical security guidance that could inform defensive posture. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Note according to Automation Support for Security Control Assessments_ Software Vulnerability Management? Note: Since any given vulnerability scanner might only check for a portion of known vulnerabilities, each scanner defines the desired state differently.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Vulnerability Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Information Security Handbook_ A Guide for Managers provide? (Section 170) risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application. Minor applications are typically included as part of a GSS. 53 See NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems , and Chapter 11, Certification and Accreditation, of this guide for additional guidance on the C&A process. 54 Caution should be exercised when one individual fills multiple roles in the security planning process to ensure that the individual retains an appropriate level of independence and remains free from conflicts of interest. 55 See Chapter 2, Governance, Chapter 5, Capital Planning, Chapter 11, Certification, Accreditation, and Security Assessments, and Chapter 14, Configuration Management, of this guide for additional guidance on roles and responsibilities. 56 When an agency has not designated a formal CIO position, the Federal Information Security Management Act (FISMA) requires the associated responsibilities to be handled by a comparable agency official. - Designating an SAISO who shall carry out the CIO's responsibilities for system security planning; - Developing and maintaining information security policies, procedures, and control techniques to address system security planning; - Managing the identification, implementation, and assessment of common security controls; - Ensuring that personnel with significant responsibilities for system security plans are trained; - Assisting senior agency officials with their responsibilities for system security plans; and - Identifying and developing common security controls for the agency. The information system owner 57 is the agency official responsible for the overall procurement, development, integration, modification, and operation and maintenance of the information system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 239) Control HA-1: tions on Previous Work All of the existing IBE systems have their own limitations. Shamir's system signed but did not encrypt. Cocks's system needs care to avoid an adaptive chosen ciphertext attack. It is also inefficient, but still efficient enough for use on reasonable communications paths. While others have proofs of security, there is a notoriously poor relationship between proofs of security and actual system security. Security proofs can show where a system is safe, but not protect against new assumptions that an adversary can bring to bear against the system nor against uses of a system that its creators did not think of which may be outside of the scope of the original threat model. Still other subtle problems have shown up on other systems, such as the ability in early HIBE systems for colluding users to determine the PKG's master key. With the exception of Shamir's system, IBE systems rely on new public-key cryptosystems, most often Weil pairing. Consequently, they are not compatible with existing systems that use RSA, Elgamal, or DSA. This limits their practical application, since there are many existing systems built upon these cryptosystems. Also, experience and comfort with the security of these established systems is high. A key advantage that Shamir's system has over all those that follow it is that it was based on established public key cryptography, and thus (had it been successful in being both a signing and encrypting system) interoperable with non-IBE systems. Had Shamir's system been successful at encrypting, an RSA-based IBE system would likely be the dominant IBE system today, if for no other reason than its interoperability with deployed systems. This is an important observation - if we can construct an IBE system that uses traditional, integer-based, public key cryptography, the barriers to adoption of IBE systems might be lowered. The value that IBE has can be fully realized if it can be made to work with these established systems.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Other Compressed Archive Formats according to PDA Forensic Tools_ an Overview and Analysis? Other Compressed Archive Formats: Not Applicable - When compressed files (i.e., . tar , . tar . gz , . tgz , . rar and . exe ) are transferred to the Palm device via the Quick Install protocol, the files are automatically uncompressed before being uploaded to the device.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PDA Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2009 Annual Report say about SCAP? (Part 1) According to Computer Security Division 2009 Annual Report, SCAP: SCAP SCAP is a suite of specifications that use the eXtensible Markup Language (XML) to standardize the format and nomenclature by which security software products communicate information about software flaws and security configurations. SCAP includes software flaw and security configuration standard reference data, also known as SCAP content . This reference data is provided by the NVD (The National Vulnerability Database can be found at http:// nvd.nist.gov/), which is managed by NIST and sponsored by the Department of Homeland Security (DHS). SCAP is a multi-purpose protocol that supports automated vulnerability checking, technical control compliance activities, and security measurement. The U.S. Government, in cooperation with academia and private industry, is adopting SCAP and encourages its use in support of security automation activities and initiatives. Draft NIST SP 800-126 is the SCAP technical specification (http:// csrc/publications/drafts/sp800-126/Draft-SP800-126.pdf.) CSD plans to publish SP 800-126, The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.1 , in final form in the first quarter of FY2010.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does PIV Data Model Test Guidelines provide? (Section 283) 1: | 11.4.2.3: Verify FASC-N | The tester shall validate the presence of the FASC-N in the subjectAltName extension in the card authentication certificate issued by the vendor. | | TE07.04.10.01 | 11.4.1.7: Verify interim status extension | The tester shall validate that the piv-interim extension by the vendor. is present in the card authentication certificate issued | | TE 07.04.11.01 | 11.4.2.1: Verify public key size | The tester shall validate that the public key size is in accordance with Table 3-1 of SP 800-78. | | TE07.04.12.01 | ymmetric 11.4.2.2: Verify as key pair | The tester shall validate that the public key present in the card authentication certificate is part of the key pair corresponding to the private key on the PIV card. | | TE07.04.13.01 | ASC-N 11.4.2.3: Verify F | The tester shall validate that the FASC-N in the subjectAltName field in the card authentication CHUID in the PIV card. certificate is the same as the FASC-N present in the | | TE0 7.04.14.01 | 11.4.2.4: Verify RSA exponent | exponent size is greater than or equal to 65,537.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector say about SOLUTION? According to Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector, SOLUTION: This practice guide demonstrates how an organization may implement a solution to mitigate identified cybersecurity and privacy risks. The reference architecture features technical and process controls to implement: -  a defense-in-depth solution, including network zoning that allows more granular control of network traffic flows and limits communications capabilities to the minimum necessary to support business function -  access control mechanisms that include multifactor authentication for care providers, certificate-based authentication for imaging devices and clinical systems, and mechanisms that limit vendor remote support to medical imaging components -  a holistic risk management approach that includes medical device asset management, augmenting enterprise security controls, and leveraging behavioral analytic tools for near realtime threat and vulnerability management in conjunction with managed security solution providers The NCCoE sought existing technologies that provided the following capabilities: -  role-based access control -  microsegmentation -  behavioral analytics -  data security -  cloud storage While the NCCoE used a suite of commercial products to address this challenge, this guide does not endorse these particular products, nor does it guarantee compliance with any regulatory initiatives. Your organization's information security experts should identify the products that will best integrate with your existing tools and IT system infrastructure. Your organization can adopt this solution or one that adheres to these guidelines in whole, or you can use this guide as a starting point for tailoring and implementing parts of a solution.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Securing Picture Archiving and Communication System (PACS)_ Cybersecurity for the Healthcare Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2004 Annual Report say about AUTHORIZATION MANAGEMENT AND ADVANCED ACCESS CONTROL MODELS? (Part 1) According to Computer Security Division 2004 Annual Report, AUTHORIZATION MANAGEMENT AND ADVANCED ACCESS CONTROL MODELS: AUTHORIZATION MANAGEMENT AND ADVANCED ACCESS CONTROL MODELS A ccess control is the administrative and automated process of defining and limiting which system users can perform which system operations on which system resources. These limitations are based on business rules or policies of a specific host organization. The ability to enforce policy can be of great economic and mission importance to an organization. Although often specified in terms of protection, the ability of an organization to enforce policy enables the sharing of greater volumes of data and resources to a greater and more diverse user community. Access control policies are enforced through a mechanism consisting of access control functions and access control data that together map a user's access request to a decision whether to grant or deny access. Today access control mechanisms come in a wide variety of forms, each with distinct policy advantages and disadvantages. Although each may meet specific access needs, the resulting technology has disappointed the marketplace. This is due to the reality that a given access control mechanism may meet the policy requirements within a particular market domain, while being completely inappropriate in another. The reality is that access control policies can be as diverse as the business applications that need to enforce them. This rigidity creates a problem when the protection required of an application/organization/agency is different from the policy(ies) built into the mechanism at hand.This problem is exasperated when there is a mission need to share and coordinate information among operational units. The ability of an organization to enforce its access control policies directly impacts its ability to execute its mission - by determining the degree to which its volumes of resources may be protected and shared among its user community.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Computer Security Division 2004 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-09 in A Report on the Privilege (Access) Management Workshop? (Part 42) Control AM-09: retrieval, and definition of resource attributes. In the area of access control methods, this report concludes that a formal standardized definition of attribute-based access control (ABAC) is needed. Although there has been much socialization of the term ABAC, there are still many variations in its description. Toward the end of standardizing its meaning, a definition of ABAC was offered as a starting point. There are three access control methods that are clearly distinguishable from one another: identity-based access control (IBAC), role-based access control (RBAC), and attribute-based access control (ABAC). Although policy-based access control (PBAC) does not need to be considered a separate access control method, the ideas associated with views of it make it clear 15 Privilege management is the definition and management of attributes and policies that are used to decide whether a user's request for access to some resource should be granted. that full realization of ABAC's potential requires better attribute and policy management capabilities at the enterprise level. An organization should consider the many factors regarding requirements for its access control system that are briefly described in Table 1 above. Policy capabilities for applications supporting both federal government and commercial enterprises are a key element for effective privilege management at the enterprise level. Policy developers should carefully consider what attributes are needed to implement the policies, gain an understanding of users and of the characteristics of the data involved, and consider whether there is a need to accommodate unanticipated users. ## Recommendations Based on the view of privilege management captured in this report, the following recommendations are made: -  Privilege Management Workshop Convene the second workshop on Privilege Management, a follow-up to the NIST-NSA Privilege (Access) Management Workshop.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: A Report on the Privilege (Access) Management Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain validation according to NIST Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control, validation: Confirmation (through the provision of strong, sound, and objective evidence and demonstration) that requirements for a specific intended use or application have been fulfilled and that the system, while in use, fulfills its mission or business objectives while being able to provide adequate protection for stakeholder and mission or business assets, minimize or contain asset loss and associated consequences, and achieve its intended use in its intended operational environment with the desired level of trustworthiness. [NIST-SP800-160V1, Adapted]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) provide? (Section 70) upports a security policy that is consistent with its higher-level policies (e.g., its Information Management Policy and Information Security Policy) and other applicable U.S. Government requirements. A Federal organization that is considering the procurement of a CKMS or the services of a CKMS provider should review the security policy of each candidate CKMS and verify that the CKMS has the necessary capabilities. An appropriate FCKMS Security Policy should then be created. The FCKMS Security Policy should specify the rules that can assure the availability, confidentiality, and integrity of the organization's cryptographic keys and bound metadata that will be used to protect the sensitive information to be protected by the FCKMS. An FCKMS service-using organization should verify that its security policies are consistent with, and can be supported by, an FCKMS service provider, both administratively and technically. The FCKMS Security Policy should specify how to protect each type of key and its associated metadata throughout their lifecycles, including when they are stored, transported, or used. An FCKMS service-using organization should assist in adopting, supporting, and enforcing its own security policies and implementation rules by providing for tutorials to new managers and users on how services should be managed and used. If a user can select and initiate security services for an application or category of information, then the FCKMS serviceproviding organization should assist in selecting appropriate security services by informing the user of the rules and how the rules can and should be followed. The FCKMS should be configured so as to minimize the likelihood that a user could select an inappropriate option. FR:4.1 The CKMS design shall specify the CKMS Security Policy, including the configurable options and sub-policies that it is designed to enforce.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain II. Project Methodology according to NIST Notional Supply Chain Risk Management Practices for Federal Information Systems According to Notional Supply Chain Risk Management Practices for Federal Information Systems, II. Project Methodology: This project developed a tool to assess cyber-supply chain risk management capabilities by consolidating the collective inputs of the set of public and private actors engaged in supporting Initiative 11. The Department of Commerce (NIST and Bureau of Industry and Security, BIS), the Department of Homeland Security (DHS); the Department of Defense (DOD/CIO and DOD/NSA); and the Government Services Administration all provided formal inputs to design the assessment tool. Representatives from Safe Code and Tech America's SCRM sub-committee also contributed valuable inputs. This tool was then distributed to and validated with a sample of vendors of IT systems, software, hardware, and services. Our target participants included: small to mediumsized IT vendors traditionally under-represented in IT surveys; Chief Information Officers/Chief Security Officers nationally and in the Washington DC region; and Directors of Supply Chain. There were 131 respondents who completed the survey from beginning to end. This means our survey response rate equaled the 1% industry benchmark for Third Party IT Surveys (source: IDG List Services). This is especially impressive given the absence of official survey distribution; the length of time it takes to fill in the survey (approximately 30 minutes); the newness of the subject discipline; and the difficulties some companies reported in routing the survey to appropriate person(s) in the organization. An additional 159 respondents completed one or more sections of the survey. In total, 290 surveys were either partially or fully completed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Notional Supply Chain Risk Management Practices for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Electronic Health Records on Mobile Devices say about puppet will install here? (Part 249) According to Securing Electronic Health Records on Mobile Devices, puppet will install here: EMR3222 NIST SP 1800-1E: Securing Electronic Health Records on Mobile Devices 72 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 1 . . Appendix C References [1] K. Marchesini, Mobile Devices Roundtable: Safeguarding Health Information: Real World Usages and Real World Privacy & Security Practices, The Office of the National Coordinator for Health Information Technology, U.S. Department of Health & Human Services, March 16, 2012. https://www.healthit.gov/sites/default/files/onc_ocpo_mobile_device_roundtable_slides_3_16 _12.pdf [accessed 5/3/18]. [2] [3] [4] [5] [6] [7] [8] Mobile Devices – Secure Exchange of Electronic Health Information, Final draft, National Cybersecurity Center of Excellence, National Institute of Standards and Technology, Gaithersburg, Maryland. [accessed 5/3/18]. Guide for Conducting Risk Assessments, NIST Special Publication 800-30 Revision 1, National Institute of Standards and Technology, Gaithersburg, Maryland, September 2012, 15 pp. [accessed 5/3/18]. Guide for Conducting Risk Assessments, NIST Special Publication 800-30 Revision 1, National Institute of Standards and Technology, Gaithersburg, Maryland, September 2012, 29 pp. [accessed 5/3/18]. Guide for Conducting Risk Assessments, NIST Special Publication 800-30 Revision 1, National Institute of Standards and Technology, Gaithersburg, Maryland, September 2012, Table I-5: Template – Adversarial Risk, I-3 – I-4 pp. [accessed 5/3/18].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Electronic Health Records on Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 2017 NIST_ITL Cybersecurity Program Annual Report provide? (Section 105) ment and a collaboration with Intrinsic ID, Inc. - a company with complementing technology for constructing the initial key on the client side by extracting it from SRAM memory cells. The team also established a collaborative relationship with Crypto4A and 2Keys Corp. from Canada on developing a common protocol for EaaS. The team coordinated with the research team working on the NIST Beacon for developing common back-end components for the two services. The team plans to leverage these common components in the NIST EaaS implementation. Dr. Apostol Vassilev (301) 975-3221 apostol.vassilev@nist.gov The engine for many of the techniques in CSD's cryptographic toolkit is a block cipher algorithm, such as the Advanced Encryption Standard (AES) algorithm. A block cipher transforms some fixedlength binary data (i.e., a 'block' of data) into seemingly random data of the same length. The transformation is determined by the choice of some secret data called the 'key.' The same key is used to reverse the transformation and recover the original block of data. A cryptographic technique (e.g., for encryption and/or authentication) that is constructed from a block cipher is called a 'mode of operation.' Several modes of operation have been specified in the SP 800-38 series of publications. The latest installment in the series, Special Publication 80038G, Recommendation for Block Cipher Modes of Operation: Methods for Format-Preserving Encryption , was published in 2016. It specifies two AES modes of operation, called FF1 and FF3, for 'format-preserving encryption' (FPE), based on proposals that were submitted from the private sector, specifically, the payments industry. Recently, two academic researchers, Vaudenay and Dürak, developed a cryptanalytic attack on the FF3 mode.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Output : according to NIST Recommendation for Block Cipher Modes of Operation_ Methods for Key Wrapping According to Recommendation for Block Cipher Modes of Operation_ Methods for Key Wrapping, Output :: Plaintext P or indication of inauthenticity, FAIL .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Block Cipher Modes of Operation_ Methods for Key Wrapping.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control WE-1000 in Hardware Security Failure Scenarios_ Potential Hardware Weaknesses? (Part 38) Control WE-1000: ph with memory-related weaknesses highlighted <!-- image --> ## 7. Software Assurance Trends Categories In addition to the views previously presented, there is a Software Development view (CWE699). Figure 25 shows the View-699 CWEs that overlap with the complete HW CWEs graph (from Fig. 1). This overlap is shown in olive green. Fig. 25. View-699 CWEs that overlap with View-1194 highlighted <!-- image --> Only 12 CWEs are both in View-1194 and View-699. Organized by the View-699 categories, they are: - CWE View-699> CWE Category: Permission Issues - (CWE-275) - o CWE-276: Incorrect Default Permissions - CWE View-699> CWE Category: Cryptographic Issues - (CWE-310) - o CWE-325: Missing Cryptographic Step - CWE View-699> CWE Category: Behavioral Problems - (CWE-438) - o CWE-440: Expected Behavior Violation - CWE View-699> CWE Category: Documentation Issues - (CWE-1225) - o CWE-1053: Missing Documentation for Design - o CWE-1110: Incomplete Design Documentation - o CWE-1111: Incomplete I/O Documentation - o CWE-1112: Incomplete Documentation of Program Execution - o CWE-1118: Insufficient Documentation of Error Handling Techniques - CWE View-699> CWE Category: Authorization Errors - (CWE-1212) - o CWE-1220: Insufficient Granularity of Access Control - CWE View-699> CWE Category: Information Management Errors - (CWE-199) - o CWE-319: Cleartext Transmission of Sensitive Information - CWE View-699> CWE Category: Cryptographic Issues - (CWE-310) - o CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation - o CWE-1241: Use of Predictable Algorithm in Random Number Generator Figure 26 provides a separate view of these 12 CWEs. Fig. 26. The 12 CWEs in both View-1194 and View-699 <!-- image --> ## 8. Conclusion Historically held notions that hardware is invulnerable have been shown to be incorrect.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Hardware Security Failure Scenarios_ Potential Hardware Weaknesses.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is FR according to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)? FR: 4.4 The CKMS design shall specify other related security policies that support the CKMS Security Policy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 1.4 Document Conventions according to NIST Representation of PIV Chain-of-Trust for Import and Export According to Representation of PIV Chain-of-Trust for Import and Export, 1.4 Document Conventions: Throughout this document key words are used to identify requirements. The key words 'optional', 'required', 'shall', 'shall not', and 'should' are used. These words are a subset of the IETF Request For Comments (RFC) 2119 [RFC2119] key words, and have been chosen based on convention in other normative documents. In addition to the key words, the words 'need,' 'can,' and 'may' are used in this document, but are not intended to be normative.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Representation of PIV Chain-of-Trust for Import and Export.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Mapping Types of Information and Information Systems to Security Categories say about Privacy Information? (Part 2) According to Guide for Mapping Types of Information and Information Systems to Security Categories, Privacy Information: ired to conduct Privacy Impact Assessments (PIAs) before developing IT systems that contain personally identifiable information or before collecting personally identifiable information electronically. The impact of privacy violations should consider any adverse effects experienced by individuals or organizations as a result of the loss of PII confidentiality. Examples of adverse effects experienced by individuals may include blackmail, identity theft, discrimination, or emotional distress. Examples of adverse effects experienced by organizations may include administrative burden, financial losses, loss of public reputation and confidence, and the penalties associated with violation of the relevant statutes and policies. Categorizations should be reviewed to ensure that the adverse effects of a loss of PII confidentiality have been adequately factored into impact determinations. The confidentiality impact level should generally fall into the moderate range.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST say about B, Computer familiarity? According to Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST, B, Computer familiarity: . Do you currendy make frequent use of a computer for your lab work? If so, what kind is it? Is it attached to the NIST Local Area Network? . Would you feel comfortable using a computer-based electronic notebook? . Are you comfortable working in a Windows environment on the computer? If not, please explain why.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control MP-4 in Control Baselines for Information Systems and Organizations? (Part 9) Control MP-4: protection needs, and assessments of risk. The combination of control baseline selection and control tailoring processes can help organizations satisfy their stated security and privacy requirements. ## 1.2 TARGET AUDIENCE This publication is intended to serve a diverse audience, including: - Individuals with system, information security, privacy, or risk management and oversight responsibilities, including authorizing officials, chief information officers, senior agency information security officers, and senior agency officials for privacy - Individuals with system development responsibilities, including mission owners, program managers, system engineers, system security engineers, privacy engineers, hardware and software developers, system integrators, and acquisition or procurement officials - Individuals with logistical or disposition-related responsibilities, including program managers, procurement officials, system integrators, and property managers - Individuals with security and privacy implementation and operations responsibilities, including mission or business owners, system owners, information owners or stewards, system administrators, and system security or privacy officers - Individuals with security and privacy assessment and monitoring responsibilities, including auditors, Inspectors General, system evaluators, control assessors, independent verifiers and validators, and analysts - Commercial entities, including industry partners, who produce component products and systems and develop security and privacy technologies ## 1.3 ORGANIZATIONAL RESPONSIBILITIES Organizations have the responsibility to choose a control selection approach in accordance with [SP 800-37].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Control Baselines for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Secure Virtual Network Configuration for Virtual Machine (VM) Protection say about 2.5.2 Disadvantages? According to Secure Virtual Network Configuration for Virtual Machine (VM) Protection, 2.5.2 Disadvantages: A given network segment (a particular VXLAN ID) can exist in any virtualized host in the data center. This means that routing packets between any two VMs requires large mapping tables for the MAC addresses of the remote VMs and their corresponding VTEP IP addresses. As previously stated, the preferred way to build the mapping tables is to using a centralized or decentralized controller. However, the introduction of this control plane increases the overhead of network management. Another factor to watch for is the size of the mapping table; this can be controlled by carefully limiting the span of overlay segment by proper definition of Layer 2 Transport Zones (as is the case in typical production networks).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Virtual Network Configuration for Virtual Machine (VM) Protection.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Integrating Forensic Techniques into Incident Response provide? (Section 234) the clientGLYPH<146>s behalf to the desired destination. Remote Access Server: Devices, such as virtual private network gateways and modem servers, that facilitate connections between networks. Reporting: The final phase of the computer and network forensic process, which involves reporting the results of the analysis; this may include describing the actions used, explaining how tools and procedures were selected, determining what other actions need to be performed (e.g., forensic examination of additional data sources, securing identified vulnerabilities, improving existing security controls), and providing recommendations for improvement to policies, guidelines, procedures, tools, and other aspects of the forensic process. The formality of the reporting step varies greatly depending on the situation. Sector: The smallest unit that can be accessed on media. Security Event Management Software: Software that imports security event information from multiple data sources, normalizes the data, and correlates events among the data sources. Slack Space: The unused space in a file allocation block or memory page that may hold residual data. Steganography: Embedding data within other data to conceal it. Subdirectory: A directory contained within another directory. Volatile Data: Data on a live system that is lost after a computer is powered down. Wiping: Overwriting media or portions of media with random or constant values to hinder the collection of data. Write-Blocker: A tool that prevents all computer storage media connected to a computer from being written to or modified. This page has been left blank intentionally. Selected acronyms used in the Guide to Integrating Forensic Techniques into Incident Response are defined below.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Integrating Forensic Techniques into Incident Response.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is References according to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy? References: [SP 800-30]; [SP 800-88]; [IR 8062].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, fips, security control. General security reference material without sensitive content. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research provide? (Section 98) Table 6: LOA Mapping to Cryptographic Tokens <!-- image --> | NIST SP 800-63-2 Assurance | PIV Assurance Level | Target Guidance: | Target Guidance: | Cryptographic Token FIPS 140-2 Validation Level | Cryptographic Token Type | PIV Derived Authentication Certificate | Enrollment Method | |------------------------------|-----------------------|--------------------------------------|-----------------------------------------------------|---------------------------------------------------|--------------------------------------------------------------------|------------------------------------------|---------------------| | Level | | M-06-16 /M-07-16 for Separate Tokens | Future Alternate OMB Guidance for Integrated Tokens | | | Policy | | | LOA-3 | Very High | No |  | FIPS 140-2 Level 1 | Hybrid hardware/software token • Windows 8.1 • TPM • Microsoft CSP | id-fpki- common- pivAuth- derived | Remote enrollment | | LOA-3 | High | No |  | FIPS 140-2 Level 1 | Software token • Android/iOS • MyID Identity Agent | id-fpki- common- pivAuth- derived | Remote enrollment | The major controls in the NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations 47 control catalog that affect the DPC proof of concept research are: Related controls: AC-2, AC-9, AC-14, IA-5 Related controls: AC-3, AC-7, AC- 18, AC-20, CA-9, CM-2, IA-2, IA-3, MP-2, MP-4, MP-5, PL-4, SC-7, SC-43, SI-3, SI-4 References: OMB M-06-16; NIST SPs 800-114, 800-124, and

Explanation: NIST publication on credential and access management. Topics: authentication, pki, token. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials (DPC) Proof of Concept Research.