You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Policy Machine_ Features, Architecture, and Specification say about 8. Related Work? (Part 2) According to Policy Machine_ Features, Architecture, and Specification, 8. Related Work: trust relationships, PolicyMaker and its successor KeyNote utilize public key infrastructure environments, certificate-based trust, and binding of cryptographic keys to actions [Bla98, Bla99]. Five basic components can be identified: a mechanism for identifying principals, a language for describing security-critical actions, a language for specifying application policies, a language for specifying delegation credentials, and a compliance checker that factors all of the above in its decisions. Unlike other access control approaches focused mainly on centralized operating environments, trust management is particularly suited for situations where security policy is decentralized and distributed across a network, such as multisystem applications and data services that cross departmental and organizational boundaries [Bla99]. In this regard, it is similar to the PM framework. A family of usage control (UCON) models was devised as a conceptual framework for access control [Par04]. The UCON models offer a broad and diverse scope of coverage that encompasses digital rights management and other modern access control models. The complete family of models is collectively termed UCONABC, since to provide a richer and finer decision capability, decision-related factors are delineated into three categories: Authorizations (A), oBligations (B), and Conditions (C). Authorizations concern the evaluation of authorization rules and usage rights together with subject and object attributes in reaching a usage decision. Attributes are used to represent key characteristics of subjects and objects, such as identities, security labels, properties, and capabilities. Obligations are treated as requirements that subjects have to perform before or during (or even after, in case of a global obligation) obtaining or exercising usage rights.

Explanation: NIST publication on credential and access management. Topics: access control, authorization, sso. Contains security framework guidance for authentication systems. Source: Policy Machine_ Features, Architecture, and Specification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessment of Access Control Systems say about - SQL-RBAC? (Part 2) According to Assessment of Access Control Systems, - SQL-RBAC: cation of privileges and control over creation of new relations and views. SQL2 fixes some of these shortcomings. However, SQL2's GRANT and REVOKE instructions apply only to database users. This is extended in SQL3 by considering that these instructions also apply to roles as suggested in the RBAC model. In the meantime, some vendors have implemented RBAC; other vendors have started to deliever products incorporating mandatory access controls for multilevel security. There is a recognition that SQL needs to evolve to take some of these developments into consideration. If it does, stronger and better access controls can be expected in future products.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessment of Access Control Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Fiscal Year 2023 Cybersecurity and Privacy Annual Report say about RISK MANAGEMENT? According to Fiscal Year 2023 Cybersecurity and Privacy Annual Report, RISK MANAGEMENT: Organizations must balance an evolving cybersecurity and privacy threat landscape with the need to fulfill mission and business requirements - an effort that increasingly calls for a collaborative approach to managing risks. Risk management is integrated into NIST standards and guidelines to help organizations understand, measure, manage, and reduce cybersecurity and privacy risks in a larger context.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Fiscal Year 2023 Cybersecurity and Privacy Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control WE-1000 in Hardware Security Failure Scenarios_ Potential Hardware Weaknesses? (Part 63) Control WE-1000: for Outbound Error Messages and Alert Signals * - CWE-1323 B Improper Management of Sensitive Trace Data * - CWE-1334 B Unauthorized Error Injection Can Degrade Hardware Redundancy * - CWE-285 C Improper Authorization - o CWE-1256 B Improper Restriction of Software Interfaces to Hardware Features * - o CWE-1297 B Unprotected Confidential Information on Device is Accessible by OSAT Vendors * - o CWE-1328 B Security Version Number Mutable to Older Versions * - o CWE-732 C Incorrect Permission Assignment for Critical Resource -  CWE-276 B Incorrect Default Permissions * - o CWE-862 C Missing Authorization -  CWE-1314 B Missing Write Protection for Parametric Data Values * - o CWE-863 C Incorrect Authorization -  CWE-1244 B Internal Asset Exposed to Unsafe Debug Access Level or State * - CWE-287 C Improper Authentication - o CWE-306 B Missing Authentication for Critical Function -  CWE-288 B Authentication Bypass Using an Alternate Path or Channel - CWE-1299 B Missing Protection Mechanism for Alternate Hardware Interface * - CWE-923 C Improper Restriction of Communication Channel to Intended Endpoints - o CWE-420 B Unprotected Alternate Channel -  CWE-1299 B Missing Protection Mechanism for Alternate Hardware Interface * ## Appendix

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Hardware Security Failure Scenarios_ Potential Hardware Weaknesses.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Maintenance Testing for the Data Encryption Standard say about 2.1 The Permutations and E Operator? According to Maintenance Testing for the Data Encryption Standard, 2.1 The Permutations and E Operator: The role of the permutation P is to mix thoroughly the data bits. The operator E expands its 32 bit input to . a 48 bit output that is added mod 2 to the round key. The permutations in the key-schedule, PCI and PC2, intermix the key bits among the round keys in such a way as to equalize keybit utilization. No key bit is used more than 15 tines nor less th^n 12 times. The initial and final permutations, IP and IP , are byte oriented for efficient hardware implementation . Each permutation is a linear operator, and so can be thought of as an n x m matrix and can be validated completely if it operates correctly on an appropriate maximal linearly independent set of input vectors, i. e., a suitable basis.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Maintenance Testing for the Data Encryption Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector say about Contents? (Part 1) According to Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector, Contents: Contents | 1.2.1 | Relevant Standards and Guidance.............................................................................4 | |---------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------| | 3.4.1 | Threats .............................................................................................................. 10 | | 3.4.2 | Vulnerabilities......................................................................................................... 11 | | 3.4.3 | Risk .............................................................................................................. 12 | | 4.5.1 | Build 1 .............................................................................................................. 26 | | 4.5.2 | Build 2 .............................................................................................................. 29 | | 4.5.3 Build 3 ..............................................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Protecting Information and System Integrity in Industrial Control System Environments_ Cybersecurity for the Manufacturing Sector.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST_SP_800-37r2_Risk_Management_Framework say about GLOSSARY? (Part 33) According to NIST_SP_800-37r2_Risk_Management_Framework, GLOSSARY: es (e.g., people, hardware, software, policies, procedures) and the capabilities in place to comply with applicable privacy requirements and manage privacy risks and to react as the situation changes. | | privacy program plan [OMB A-130] | A formal document that provides an overview of an agency's privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the Senior Agency Official for Privacy and other privacy officials and staff, the strategic goals and objectives of the privacy program, and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | privacy requirement | A requirement that applies to an information system or an organization that is derived from applicable laws, executive orders, directives, policies, standards, regulations, procedures, and/or mission/business needs with respect to privacy. Note: The term privacy requirement can be used in a variety of contexts from high-level policy activities to low-level implementation activities in system development and engineering disciplines.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2010 Annual Report say about Table of Contents? (Part 4) According to Computer Security Division 2010 Annual Report, Table of Contents: 39 | | Laboratory Accreditation Algorithm Validation Program Automated Security Testing andTest Suite Development ISO Standardization of Cryptographic ModuleTesting | | Automated Vulnerability Management | | | CryptographicTechnology Group | | Security Metrics | | | | 19 | Technical Vulnerability Measurement and Scoring | 40 | | | 19 | | 40 | | Cryptographic Standards Toolkit Hash Algorithms and the Secure Hash Standard | 19 | Network Security Analysis Using Attach | 40 | | Competition Block Cipher Modes of Operation | 20 20 | Graphs Infrastructure Services, Protocols, and Applications | | | | | Internet Protocol Version 6 and Internet Protocol | 41 41 | | Key Management | | Security Securing the Domain Name System | 41 | | Transitioning of Cryptographic Algorithms and Key Lengths Internet Security | 21 21 | CSD's Part in National and International IT Security Standards | | | | | Processes | 42 | | Quantum Computing | 22 | Honors and Awards | 47 | | Authentication | | Computer Security Division Publications Released | | | | 22 | | | | | | in FY2010 & Abstracts | 48-60 | | Security Aspects of Electronic Voting

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Computer Security Division 2010 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.1 Objects on Smart Identity Tokens according to NIST A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification According to A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification, 4.1 Objects on Smart Identity Tokens: The following are the common set of electronic objects (as opposed to the visual printed objects) in a smart card used as identity tokens along with their classifiers:

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain SDNS SECURITY MANAGEMENT USING BUILT-IN SYSTEM MANAGEMENT FUNCTIONS according to NIST Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992 According to Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992, SDNS SECURITY MANAGEMENT USING BUILT-IN SYSTEM MANAGEMENT FUNCTIONS: - EVENT REPORTING - CONTROLS TRANSMISSION OF EVENT REPORTS - INCLUDES DESTINATION AND BACKUP ADDRESSES FOR REPORTS - LOG CONTROL - PRESERVES INFORMATION ABOUT EVENTS FROM MULTIPLE SYSTEMS - SERVES AS A BASIS FOR DISTRIBUTED AUDITING - ACCESS CONTROL - ALLOWS REPRESENTATION OF ACCESS CONTROL INFORMATION - ALLOWS AN ARBITRARY ACCESS CONTROL POLICY TO BE SPECIFIED II ^ <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the NSF_NIST Workshop on NSFNET_NREN Security, July 6-7, 1992.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IR-6462 in COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0? (Part 285) Control IR-6462: trols will be implemented and (2) the CSPP-OS requirement does not specify a specific set of procedures, this component is within the range of best commercial practice and should be a part of CSPP-OS. | | ADO_IGS.1 | Installation, generation, and start- up procedures | It is necessary and reasonable to expect an IT security product to include guidance to the user on secure installation, generation, and start-up. Therefore this must be a part of an effective CSPP-OS. | | ADV_HDL.1 | Descriptive high-level design | If using best commercial practice, the vendor can be expected to have the high- level design for the TOE required by this component. Since it is a reasonable expectation, it should be included in CSPP-OS. | | ATE_IND.2 (EAL1 has IND.1) | Independent testing - sample | Having the evaluator execute a sample of the vendor tests, as a check on their validity, is a low-cost, reasonable action well within the bounds of the basic goals for CSPP-OS assurance.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2015 Annual Report provide? (Section 237) ectives for Cybersecurity, provides additional background on international cybersecurity standardization. This document describes a privacy risk management framework for federal information systems. The framework provides the basis for the establishment of a common vocabulary to facilitate a better understanding of and communication about privacy risks and the effective implementation of privacy principles in federal information systems. This publication focuses on the development of two key pillars to support the application of the framework: privacy engineering objectives and a privacy risk model. This guidance provides an overview of the capabilities and usage of Software Identification (SWID) tags as part of a comprehensive software life cycle. As instantiated in the International Organization for Standardization (ISO)/ International Electrotechnical Commission (ISO/IEC) 197702 standard, SWID tags support numerous applications for software asset management and information security management. This report introduces SWID tags in an operational context, provides guidelines for the creation of interoperable SWID tags, and highlights key usage scenarios for which SWID tags are applicable. The Security Content Automation Protocol (SCAP) is a suite of specifications that standardize the format and nomenclature by which software flaw and security configuration information is communicated, both to machines and humans. SCAP version 1.2 requirements are defined in SP 800-126 Revision 2. Over time, certain stylistic conventions regarding the authoring of SCAP 1.2 content have become best practices. While these best practices are not required, they improve the quality of the SCAP content in several ways, such as improving the accuracy and consistency of results, avoiding performance problems, reducing user effort, lowering content maintenance burdens, and enabling content reuse.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2015 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171 say about STANDARDS, GUIDELINES, AND REPORTS? (Part 4) According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171, STANDARDS, GUIDELINES, AND REPORTS: PR, Millar T, Grance T, Scarfone KA (2012) Computer Security Incident Handling Guide. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-61, Rev. 2. https://doi.org/10.6028/NIST.SP.800-61r2 | | [SP 800-63-3] | Grassi PA, Garcia ME, Fenton JL (2017) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-3, Includes updates as of March 2, 2020. | | [SP 800-83] | Souppaya MP, Scarfone KA (2013) Guide to Malware Incident Prevention and Handling for Desktops and Laptops. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-83, Rev. 1. https://doi.org/10.6028/NIST.SP.800-83r1 | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | [SP 800-86] | Kent K, Chevalier S, Grance T, Dang H (2006) Guide to Integrating Forensic Techniques into Incident Response. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-86.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 1 – General say about 5.3.3.1 Communications versus Storage? According to Recommendation for Key Management_ Part 1 – General, 5.3.3.1 Communications versus Storage: Keys that are used for confidentiality protection of communication exchanges may often have shorter cryptoperiods than keys used for the protection of stored data. Cryptoperiods are generally made longer for stored data because the overhead of generating new keys and re-encrypting all data that was encrypted using the old keys may be burdensome.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Random Number Generation Using Deterministic Random Bit Generators say about CTR\_DRBG Instantiate Process:? According to Recommendation for Random Number Generation Using Deterministic Random Bit Generators, CTR\_DRBG Instantiate Process:: 1. temp = len ( personalization\_string ). Comment: Ensure that the length of the personalization\_string is exactly seedlen bits. Note that in Section 9.1, processing step 3 obtained an entropy\_input of seedlen bits using Table 3 to define the minimum and maximum lengths, which are both equal to seedlen bits. 2. If ( temp < seedlen ), then personalization\_string = personalization\_string || 0 seedlen temp . 3. seed\_material = entropy\_input ⊕ personalization\_string . - Key = 0 keylen 4. - . Comment: keylen bits of zeros. - V = 0 blocklen 5. . Comment: blocklen bits of zeros. 6. ( Key , V ) = CTR\_DRBG\_Update ( seed\_material , Key , V ). 7. reseed\_counter = 1. 8. Return ( V , Key , reseed\_counter ).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Number Generation Using Deterministic Random Bit Generators.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog say about Related SP 800-53 Rev. 5 Controls: CP-9? According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog, Related SP 800-53 Rev. 5 Controls: CP-9: Requirements that may be necessary: 1. Provide training explaining how to create and restore from IoT device data backups. Education and supporting materials that may be necessary to provide include details and actions such as: - a. Providing education to IoT device customers covering the instructions and details necessary for them to create accurate backups, and to recover the backups when necessary. - b. Providing education to IoT device customers that includes instructions describing how to back up data from systems where IoT device data is stored. - c. Providing awareness reminders and tips to IoT device customers (e.g., directly in person, in videos, in an online webinar) for various aspects involved with backing up the IoT device data.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines on Electronic Mail Security? (Part 88) Control ES-1: | Completed | Action | |-------------|--------------------------------------------------------------------------------------------------------------------| | | Limit privileges for most system-related tools to authorized system administrators | | | Install and configure additional security controls | | | Select, install, and configure additional software to provide needed controls not included in the operating system | | | Test the security of the operating system | | | Test operating system after initial install to determine vulnerabilities | | | Test operating system periodically to determine new vulnerabilities | ## 6. Securing Mail Servers and Content Hardening mail server applications is an important step in protecting mail servers from compromise. This section provides recommendations for securely installing mail servers and configuring operating system and mail server access controls. Another important part of mail security is protecting the email content that traverses the server, which includes content filtering, malware scanning, and spam prevention. Securing access to mailboxes by encrypting communications, including Web-based mail access, is also addressed in this section. Email content security can also involve email encryption to preserve confidentiality and digital signatures to support integrity and non-repudiation; these are discussed in Section 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is NOTICE according to A Security Perspective on the Web3 Paradigm? NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Security Perspective on the Web3 Paradigm.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Use of PIV Credentials in Facility Access provide? (Section 26) mechanisms. In other words, the PACS has to support at least one PIV authentication mechanism that is supported by all PIV Cards. 8 The interoperability goal of a PIV-enabled PACS can be stated: 1. Any PIV Card can provide verification of identity to the PACS (access is granted only if the identity is so authorized). 2. After a successful authentication, the authentication mechanism provides the cardholder's authenticated identity (see Section 6.1) to the relying party. + The PACS supports at least one PIV authentication mechanism that is supported by all PIV Cards. For example, a PACS may use the PKI-AUTH authentication mechanism to authenticate all cardholders. Alternatively, the PACS may use the BIO authentication mechanism to authenticate most cardholders but use the PKI-AUTH authentication mechanism to authenticate those cardholders from whom fingerprints could not be collected. + A relying PACS application needs to support all acceptable algorithms, key lengths, and key material that could be presented, either by a PIV Card or by the PIV infrastructure. For PIV Card, these data objects and keys are placed on a PIV Card during issuance and use specific cryptographic algorithms selected from the acceptable algorithms in [SP800-78], Cryptographic Algorithms and Key Sizes for Personal Identity Verification . The PACS application interrogates the card to learn which algorithms are used. 5. o If the PKI-CAK authentication mechanism is performed by a PACS application, the PACS should support all of the asymmetric algorithms permitted for the asymmetric Card Authentication key, as specified in Table 3-1 of [SP800-78], i.e., RSA 2048 and ECDSA P-256, and the PACS should accept all valid Card Authentication certificates. 8 Section 4.2 indicates which authentication mechanisms can be implemented using only data objects that are mandatory under FIPS 201-2.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Guidelines for the Use of PIV Credentials in Facility Access.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-1 in Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services? (Part 190) Control AM-1: system lifecycle. A PNT system lifecycle can include the consideration of the acquisition, integration, deployment, operations and maintenance, repair, and replacement of PNT components and services. A comprehensive, well-documented, and disciplined risk management process for PNT systems allows for continuous monitoring of threats, likelihoods, and impacts, in order to provide efficient identification and analysis of risks and effectiveness of the controls applied to manage those risks. Equally important, an agile risk management approach enables continuous adaptation to evolving threats through adoption of innovative and rapid advances in technology and current best practices. Organizations evolve the operational reliability and effectiveness throughout a PNT system's lifecycle by continuously monitoring risks and assessing risk mitigation strategies, such as: - new techniques and technologies to improve the ability to identify, protect, detect, respond, and recover from PNT system attacks - the emergence of exploitable PNT vulnerabilities - methods to mitigate vulnerabilities and operational impacts - operational environment changes in which the PNT-dependent system is deployed to determine if updates are required to the system's cybersecurity controls Table 26 illustrates how the PNT Profile can be used by a notional organization to address example scenarios and apply the five functions of the CSF to manage the risk to PNT systems. Equipment manufacturers and end users can address the scenarios through resiliency and redundancy. Table 26.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, csf, fips. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Electronic Mail Security say about 4. Planning and Managing Mail Servers? According to Guidelines on Electronic Mail Security, 4. Planning and Managing Mail Servers: The most critical aspect of deploying a secure mail server is careful planning before installation, configuration, and deployment. Careful planning will ensure that the mail server is as secure as possible and in compliance with all relative organizational policies. Many mail server security and performance problems can be traced back to a lack of planning or management controls. The importance of management controls is difficult to overstate. In many organizations, the information technology support structure is highly fragmented. This fragmentation leads to inconsistencies, and these inconsistencies can lead to security vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2016 NIST_ITL Cybersecurity Program Annual Report say about CONTACT:? According to 2016 NIST_ITL Cybersecurity Program Annual Report, CONTACT:: Dr. Morris Dworkin (301) 975-2354 morris.dworkin@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 1 – General say about 8.2.2.2 Key Recovery Function? According to Recommendation for Key Management_ Part 1 – General, 8.2.2.2 Key Recovery Function: Keying material that is in active memory or stored in normal operational storage may sometimes be lost or corrupted (e.g., from a system crash or power fluctuation). Some of the keying material is needed to continue operations and cannot easily be replaced. An assessment needs to be made of which keying material needs to be preserved for possible recovery at a later time. The decision as to whether key recovery is required should be made on a case-by-case basis. The decision should be based on: 1. The type of key (e.g., private signature key or symmetric data-encryption key); 2. The application in which the key will be used (e.g., interactive communications or file storage); 3. Whether the key is 'owned' by the local entity (e.g., a private key), by another entity (e.g., the other entity's public key), or is shared (e.g., a symmetric data-encryption key shared by two entities); 4. The role of the entity in a communication (e.g., sender or receiver); and 5. The algorithm or computation in which the key will be used (e.g., does the entity have the necessary information to perform a given computation if the key were to be recovered). 100 The factors involved in a decision for or against key recovery should be carefully assessed. The trade-offs are concerned with the continuity of operations versus the risk of possibly exposing the keying material and the information it protects if control of the keying material is lost. If it is determined that a key needs to be recovered, and the key is still active (e.g., the cryptoperiod of the key has not expired, and the key has not been compromised), then the key may need to be replaced in order to limit the exposure of the data protected by that key (see Section 8.2.3). Issues associated with key recovery and discussions about whether or not different types of cryptographic material need to be recoverable are provided in Appendix B.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2015 Annual Report say about Conference Papers? (Part 5) According to Computer Security Division 2015 Annual Report, Conference Papers: luate the degree to which a group of countries can disconnect two other countries, isolate a set of countries from the Internet, or even break the Internet up into non-communicative clusters. To do this, we create an interconnectivity map of the worldwide Internet routing infrastructure at a country-level of abstraction. We then examine how groups of countries may use their pieces of routing infrastructure to filter out the traffic of other countries (or to block entire routes). Overall, bounds analysis indicates that the ability of countries to perform such disruptions to connectivity has diminished significantly between 2008 and 2013. However, we show that the majority of the gains in robustness go to countries that had already displayed significant robustness to the types of attacks that we consider. The countries that displayed higher initial vulnerability to such attacks did not become significantly more robust over the time period of analysis. D. Moody, R. Perlner and D. Smith-Tone, 'An Asymptotically Optimal Structural Attack on the ABC Multivariate Encryption Scheme,' 6th International Workshop on Post-Quantum Cryptography (PQCrypto 2014), Waterloo, Ontario, Canada, October 1-3, 2014. In Lecture Notes in Computer Science 8772, Post-Quantum Cryptography, M. Mosca, ed., Berlin: Springer International, 2014, pp. 180-196. doi: 10.1007/978-3319-11659-4\_11. <!-- image --> Historically, multivariate public key cryptography has been less than successful at offering encryption schemes that are both secure and efficient. At PQCRYPTO '13 in Limoges, Tao, Diene, Tang, and Ding introduced a promising new multivariate encryption algorithm based on a fundamentally new idea: hiding the structure of a large matrix algebra over a finite field. We present an attack based on the subspace differential invariants inherent to this methodology.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2015 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance say about Appendix B: Acronyms? (Part 2) According to Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance, Appendix B: Acronyms: d PKI Public Key Infrastructure PRF Pseudorandom Function PVM Path Validation Module RA Registration Authority RFC Request for Comment RR Resource Record RSA Rivest, Shamir, and Adleman. S/MIME Secure/Multipart Internet Mail Extensions SA Security Association SEP Secure Entry Point SHA Secure Hash Algorithm SMTP Simple Mail Transfer Protocol SSL Secure Socket Layer TCG Trusted Computing Group TDEA Triple Data Encryption Algorithm TEK Traffic Encryption Key TGS Ticket Granting Service TLS Transport Layer Security TPM Trusted Platform Module TS Target Server TSIG Transaction Signature URL Uniform Resource Locator VPN Virtual Private Network XOR Exclusive-Or operation ZSK Zone Signing Key

Explanation: NIST publication on credential and access management. Topics: pki, key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.2 Cryptographic Key Management Systems according to NIST Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms According to Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms, 5.2 Cryptographic Key Management Systems: Several publications have been developed for the development of key-management systems: SP 800-130 74 (see Section 5.2.1), SP 800-152 75 (see Section 5.2.2), and documents relating to the Public Key Infrastructure used for asymmetric-key cryptography (see Section 5.2.3). A Cryptographic Key Management System (CKMS) includes policies, procedures, components, and devices that are used to protect, manage, and distribute key information. A CKMS includes all devices or subsystems that can access a key or the other information associated with it. The devices could be computers, cell phones, tablets, or other smart devices, such as cars, alarm systems, or even refrigerators.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Card Technology Developments and Gap Analysis Interagency Report provide? (Section 129) sts to verify their compliance with the standards. Nevertheless any new technology will have such early tweaking requirements and adding a new technology on a card will require monitoring for a while. D-38 Presentation: Migration Strategies Presented By: Michael L. Davis, OmniTek File Size: 227 KB PDF File Capabilities: In the access control marketplace, contactless with smart cards are the ideal medium for access control and as proof of that, we now use a technology called Prox which enjoys a very large penetration rate. But it's an older technology and it's very prevalent. But with the new contactless smart cards, we wish to talk about some migration strategies. Lessons Learned : If you're starting from scratch, that's always a much better solution. That applies to almost any endeavor that one takes. But unfortunately, there's a lot of product out there now and we have to make it seamless for the end users and the community to move to a new technology. Technology/Capabilities/Standards/Limitations : So Prox, as it's talked about in the United States, is actually 125 kilohertz. And it's basically, a nice technology, very reliable, very mature. But it suffers from some negatives. The biggest negative is that it's read only typically. You can write cards. But you can't do them on the fly. You can't actually present them and rewrite the data. And the security is pretty low. You can actually find the data sheets for the manufacturers, the chips used inside right on the Internet. And there's no ISO standard. And, of course, the biggest significant factor is it's not multiapplication. Comparison: So we're all experts in here about contactless smart cards. But as you can see, it shares many of the same features as Proxs, but it adds some new ones like larger memory, multi-application, very high security, true read/write and extremely high security again when compared to Proxs and it's ISO standardized.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Card Technology Developments and Gap Analysis Interagency Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TR-2997 in Standard Security Label for GOSIP_ an Invitational Workshop? (Part 3) Control TR-2997: ecurity Labels Jon Graff, Ph.D. ## I. Security Policies Security Policies form the foundation for the architecture and design of a Trusted Computer Base (TCB) or a Trusted Computer system or network. The policy defines the philosophy and methods for obtaining and assuring security of the information and processes within the system. The security policies set forth in the DoD Trusted Computer System Evaluation Criteria (Orange Book) and the DoD Trusted Network Interpretation (Red Book) arc based on the trusted "reference monitor" concept. The reference monitor's function is to ensure that access is only permitted when the subject's and object's label meet the requirements set forth in the security policy. TTie concept calls for the trusted reference monitor to examine "labels" to determine if a "subject" (an active agent, such as a calling program or a human) has permission to access an "object" (passive resource such as a piece of data). The subject's label indicates the characteristics that an object must have in order for a subject to be permitted to access the object. The object's label identifies what characteristics the subject must have in order to be permitted to access the object. ## A. The Bell and LaPadula Family of Security Policies The Bell and LaPadula family of security policies (BLFSP) are based on a reference monitor that requires sensitivity-levels as a mechanism for policy inforcement. The model is based on the environment in which multiple subjects may have access to multiple objects. The reference monitor adjudicates the access control between subjects and objects by comparing their "sensitivity labels" according to the Mandatory Access Control (MAC) policy. The reference monitor permits a subject to access an object only if the subject's and object's sensitivity labels fulfill the requirements of the security policy. The important point of this discussion is that sensitivity labeling is a required pan of maintaining the BLFSP. ## B.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Standard Security Label for GOSIP_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Review of U.S. and European Security Evaluation Criteria provide? (Section 37) nge Book; Red Book; security evaluation criteria, trust; trusted computer system 13. AVAILABIUTY UNUMITED FOR OFFICIAL DISTRIBUTION. DO NOT RELEASE TO NATIONAL TECHNICAL INFORMATION SERVICE (NTIS). JL ORDER FROM SUPERINTENDENT OF DOCUMENTS, U.S. GOVERNMENT PRINTING OFFICE, WASHINGTON, DC 20402. ORDEP FROM NATIONAL TECHNICAL INFORMATION SERVICE (NTIS), SPRINGFIELD, VA 22161. 14. NUMBER OF PRINTED PAGES 29 - IS. PRICE A03 1. PUBUCATION OR REPORT NUMBER NISTIR 4774 2. PERFORMINQ ORGANIZATION REPORT NUMBER 3. PUBUCATION DATE MARCH 1992 'oi'(ft3i''''o-> ocieuS niSH' s. ; <t>x 3 4'} c^'i- . 0 •''4 ';» ^.iiX'i'iV.y . '7 vy S-'~- • - \ . '>\ iVv % -T V,. ^ ' i, ' ' -•>'<f'»/'' v'', • '' 5SI Jfi. vy?v v-^yryw m iiiA: mn

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Review of U.S. and European Security Evaluation Criteria.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.6.2 Configure Stealthwatch to Forward Events according to NIST Data Confidentiality_ Detect, Respond to, and Recover from Data Breaches According to Data Confidentiality_ Detect, Respond to, and Recover from Data Breaches, 2.6.2 Configure Stealthwatch to Forward Events: 1. Log on to the Stealthwatch Management Console web interface. 2. Navigate to Configure > Response Management . 3. Click the Actions tab. 4. Click the three dots next to Send to Syslog and click Edit . 5. Set the action to Enabled . 6. Enter the address of the Helix Communications Broker. 7. Enter the port that you selected earlier. <!-- image --> 8. Click Save . 9. Click the Rules tab. 10. On the Actions tab, you can use some of the existing rules or create your own. 11. To create your own, click Add New Rule . For the purposes of this example, we select FlowCollector System Alarm . 12. Enter a name for the rule. 13. Ensure the rule is Enabled . 14. Click the plus sign under 'Rule is triggered if'. You can select conditions for the rule to trigger, based on severity, processing time, and type. <!-- image --> <!-- image --> 15. Enable Send to Syslog in the Associated Actions section. You can enable syslog messages for when the alarm becomes active and inactive. 16. You can also configure email alerts through this interface to improve the response time for incidents (this is a separate Action that needs to be edited on the Actions tab). 17. Click Save . <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Confidentiality_ Detect, Respond to, and Recover from Data Breaches.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN) say about 4.1.6. Identify: Supply Chain Risk Management? (Part 1) According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN), 4.1.6. Identify: Supply Chain Risk Management: 4.1.6. Identify: Supply Chain Risk Management The organization's priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has established and implemented processes to identify, assess, and manage supply chain risks. Supply chain risk management (SCRM) is typically an intra-organization function. In the context of HSNs, organizations may consider the partner's SCRM so that the impacts of any risk inherited by partners are understood and within the level of the organization's tolerance. The Supply Chain Risk Management category has five subcategories that apply to HSNs. Table 6. Supply Chain Risk Management Category for the Identify Function. | Subcategory | Applicability to HSNs | Informative References | |----------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------|---------------------------------------------------------------------------| | ID.SC-1: Cyber supply chain risk management processes are identified established, assessed, managed, and agreed to by organizational stakeholders. | Applicable, no HSN-specific considerations. | NIST SP 800-53 Rev.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities provide? (Section 34) he pathway for the exploita/t\_i.ligaon of a vulnerability. - A security failure is a viola/t\_i.ligaon of a system security requirement caused by the exploita/t\_i.ligaon of a security vulnerability. The BF security concept de/uniFB01ni/t\_i.ligaons are contextually visualized in Fig. 7. Following the blue solid ini/t\_i.ligaal arrow, a security vulnerability may start with a so/f\_t.ligaware or /uniFB01rmware security bug (i.e., a code or speci/uniFB01ca/t\_i.ligaon defect within an opera/t\_i.ligaon). Following the green dashed arrow, a vulnerability chain may also start from a hardware defect-induced fault . For more details, refer to the forthcoming SP 800-231A, Bugs Framework: Security Concepts . Fixing the bug or hardware defect-induced fault will resolve the vulnerability, as well as any other vulnerability with the same root cause. Fixing a propagated fault, including the cause of the /uniFB01nal error at the sink, will only mi/t\_i.ligagate the vulnerability. Occasionally, several vulnerabili/t\_i.ligaes must converge at their /uniFB01nal errors for an exploit to be harmful. Fixing the bug or star/t\_i.ligang fault of at least one of the chains would avoid the failure. An exploit of a vulnerability may result in a fault star/t\_i.ligang a new faults-only vulnerability. Fixing the bug or star/t\_i.ligang fault of the /uniFB01rst vulnerability will resolve the en/t\_i.ligare chain of vulnerabili/t\_i.ligaes. Fig. 7. BF security concepts <!-- image --> The BF security bugs and related faults landscape covers the opera/t\_i.ligaons (i.e., the BF opera/t\_i.ligaons) in so/f\_t.ligaware, /uniFB01rmware, and hardware execu/t\_i.ligaon phases at appropriate levels of abstrac/t\_i.ligaon. A BF opera/t\_i.ligaon is the minimal input-process-output code that -because of a bug or fault -results in an error that propagates to another fault or is /uniFB01nal (see Sec. 3.1).

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IP-002 in Guidelines for Smart Grid Cybersecurity? (Part 235) Control IP-002: the level of module physical security required. 4.2.2 Key Management Systems for Smart Grid 4.2.2.1 Public Key Infrastructure 4.2.2.1.1 Background Certificates are issued with a validity period. The validity period is defined in the X509 certificate with two fields called “notBefore” and “notAfter.” The notAfter field is often referred to as the expiration date of the certificate. As will be shown below, it is important to consider certificates as valid only if they are being used during the validity period. If it is determined that a certificate has been issued to an entity that is no longer trustworthy (for example the certification was issued to a device that was lost, stolen, or sent to a repair depot), the certificate can be revoked. Certificate revocation lists are used to store the certificate serial number and revocation date for all revoked certificates. An entity that bases its actions on the information in a certificate is called a Relying Party (RP). To determine if the RP can accept the certificate, the RP needs to check the following criteria, at a minimum: 1. The certificate was issued by a trusted CA. (This may require the device to provide or the RP to obtain a chain of certificates back to the RP’s trust anchor.) 2. The certificates being validated (including any necessary chain back to the RP’s trust anchor) are being used between the notBefore and notAfter dates. 3. The certificates are not in an authoritative CRL. 4. Other steps may be required, depending on the RP’s local policy, such as verifying that the distinguished name of the certificate subject or the certificate policy fields are appropriate for the given application for which the certificate is being used. This section focuses primarily on steps 2 and 3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in PIV Data Model Test Guidelines? (Part 164) Control HA-256: icate expiration date value is earlier than or equal to the sunset date specified in Table 3-3 of SP80078 for the ithm from Step 4. that field is populated with SHA-256 (OID = 2.16.840.1.101.3.4.2.1). For the other RSA algorithms, the pulated with NULL. For ECDSA, the d is absent. algor 3. From Step 4: If the algorithm value is id-RSASSA-PSS, verify the signature->parameters parameters fiel parameters fiel d is po | ## 11.1.1.2 Verify subject public key algorithm | Purpose | Co firms that the public key algorithm used for generating the keys is n as specified in Table 3-5 of SP80078. | |--------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Reference(s) | 1. 3. SP80078, Section 3.2.1 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Security strategies for preventing credential abuse and stuffing attacks (MS-SS-11): according to NIST Security Strategies for Microservices-based Application Systems According to Security Strategies for Microservices-based Application Systems, Security strategies for preventing credential abuse and stuffing attacks (MS-SS-11):: - A run-time prevention strategy for credential abuse is preferable to an offline strategy. A threshold for a designated time interval from a given location (e.g., IP address) for the number of login attempts should be established; if the threshold is exceeded, preventive measures must be triggered by the authentication/authorization server. This feature must be present when a bearer token is used, to detect its reuse and enforce prevention. - A credential-stuffing detection solution has the capability to check user logins against the stolen credential database and warn legitimate users that their credentials have been stolen. - Configure IDS and boundary devices to detect the following: (a) a denial of service attack and raise an alert before the service is no longer accessible, and (b) a distributed network probe. - Configure service hosts to scan file uploads and the contents of each container's memory and file system for resident malware threats.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, token. Contains security framework guidance for authentication systems. Source: Security Strategies for Microservices-based Application Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Network Security Center_ a System Level Approach to Computer Network Security say about 4.0 THE OVERALL NETWORK SECURITY APPROACH? (Part 1) According to The Network Security Center_ a System Level Approach to Computer Network Security, 4.0 THE OVERALL NETWORK SECURITY APPROACH: 4.0 THE OVERALL NETWORK SECURITY APPROACH The network security solution approach which is advocated here is based on the usage of one or more Network Security Centers (NSCs) as global access control and auditing mechanisms, as well as a "security interface" between each site and the network. This interface includes a remotely keyable cryptographic device which, due to its capabilities of key management and interface protocols, is called a Network Cryptographic Device (NCD). All such encryption is end-to-end across the network, i.e., between the NCDs at the two communicating sites. In addition to the usual message protection on the communication links, end-to-end encryption has the following advantages over link-by-link encryption: - (1) Information is protected in intermediate switches as well as on the communication links. This also minimizes the verification concerns for the switches. - (2) Any misdelivered messages are unintelligible to the recipient. - (3) The ongoing (properly deciphered) communication gives implicit and continual authentication of the two communicating devices. - (4) The encryption keying mechanism can be utilized to initially authenticate the NCD (and its data processing device) to the NSC. - (5) Access control enforcement is possible by means of the keying of the two NCDs (by the NSC). Only NCDs with matching keys can communicate. The operation of the NCDs and the NSC can best be described by an example. Suppose that a user is operating a terminal which is connected to the network via an NCD. The user wishes to communicate with a host computer which is also connected to the network via an NCD.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, key management. Contains security framework guidance for authentication systems. Source: The Network Security Center_ a System Level Approach to Computer Network Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain B.3.11 Ephemeral Key Pairs according to NIST Recommendation for Key Management_ Part 1 – General According to Recommendation for Key Management_ Part 1 – General, B.3.11 Ephemeral Key Pairs: Ephemeral key-agreement keys are generated and distributed during a single key-agreement transaction (e.g., at the beginning of a communication session) and should not be reused. These key pairs are used to establish a shared secret (often in combination with static key pairs); the shared secret is subsequently used to derive shared keying material. Not all key-agreement schemes use ephemeral key pairs, and when used, not all entities have an ephemeral key pair (see SP 800-56A).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations say about 6.2.13 Key Backup, Archiving and Recovery? According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations, 6.2.13 Key Backup, Archiving and Recovery: OMB Guidance to Federal Agencies on Data Availability and Encryption , 26 November 2001, states that agencies must address information availability and assurance requirements through appropriate data recovery mechanisms such as cryptographic key recovery. For each CKMS, the CKMS PS should prescribe any roles, responsibilities, facilities, and procedures necessary for all organizational elements to backup, archive and recover critical key information, with the necessary integrity mechanisms successfully verified for the stored information, in the event of the loss or expiration of the operational copy of cryptographic keys under which the data is protected. Backups support recovering the current operational keys. Archives support the recovery of keys, primarily for the recovery of information after the key's cryptoperiod has expired. Key backup, archive and recovery are normally the responsibility of the Central Oversight Authority, or its organizational equivalent, although mechanisms to support recovery may be included in other components of a CKMS. Part 1, Appendix B.5, contains general key recovery recommendations that should be included in or referenced by the CKMPS. Examples of key recovery policies include the Key Recovery Policy for The Department of the Treasury Public Key Infrastructure (PKI) , Federal Public Key Infrastructure Key Recovery Policy, and Key Recovery Policy for External Certification Authorities .

Explanation: NIST publication on credential and access management. Topics: pki, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition say about Second Round Candidates? According to Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition, Second Round Candidates: | BLAKE | Grøstl | Shabal | |--------------------|----------|-----------| | BLUE MIDNIGHT WISH | Hamsi | SHAvite-3 | | CubeHash | JH | SIMD | | ECHO | Keccak | Skein | | Fugue | Luffa | | In a few cases, a submitted design was selected in part for its uniqueness and elegance. NIST generally favored those designs that were based on clear design principles or otherwise illustrative of an innovative idea. NIST feels that the diversity of designs will provide an opportunity for cryptographers and cryptanalysts to expand the scope of ideas in their field, and it will also be less likely that a single type of attack will eliminate the bulk of the candidates remaining in the competition.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cloud Computing Synopsis and Recommendations say about Service Models:? (Part 2) According to Cloud Computing Synopsis and Recommendations, Service Models:: g network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations. Cloud Infrastructure as a Service (IaaS). The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications; and possibly limited control of select networking components (e.g., host firewalls).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cloud Computing Synopsis and Recommendations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4.2.3.3 Round 3 Analysis according to NIST Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition According to Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition, 4.2.3.3 Round 3 Analysis: Naya-Plasencia et al. [39] extended their previous analysis to produce semi-free-start internal near collisions on 37 rounds of the JH compression function, with 2 352 time and 2 57.6 memory complexity, and used similar techniques to find differential characteristics for all 42 rounds of the E8 permutation, with 2 304 time and 2 57.6 memory complexity. Table 13 summarizes the cryptanalysis results on JH's Round 3 submission. Table 13. Summary of Cryptanalysis Results on JH's Round 3 Submission | Target | Attack type | Output | Variant | CF Call | Memory | Reference | |-------------|-----------------------|----------|-----------|-----------|----------|-------------| | Permutation | Differential Property | all | 42 rounds | 2 304 | 2 57.6 | [39] | | Permutation | Differential Property | all | 42 rounds | 2 352 | 2 57.6 | [39] | | CF | SFS near collision | all | 37 rounds | 2 352 | 2 57.6 | [39] | | CF | SFS near collision | all | 26 rounds | 2 112 | 2 57.6 | [39] |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Managing Information Security Risk_ Organization, Mission, and Information System View say about 2.6.1 Establishing Trust Among Organizations? (Part 4) According to Managing Information Security Risk_ Organization, Mission, and Information System View, 2.6.1 Establishing Trust Among Organizations: use of the services/information or the participation in the partnership, is at an acceptable level; and - Recognize that decisions to establish trust relationships are expressions of acceptable risk. The degree of trust that an organization places in external organizations can vary widely, ranging from those who are highly trusted (e.g., business partners in a joint venture that share a common business model and common goals) to those who are less trusted and may represent greater sources of risk (e.g., business partners in one endeavor who are also competitors or adversaries). The specifics of establishing and maintaining trust can differ from organization to organization based on mission/business requirements, the participants involved in the trust relationship, the criticality/sensitivity of the information being shared or the types of services being rendered, the history between the organizations, and the overall risk to the organizations participating in the relationship. Appendix G provides several trust models that organizations can use when dealing with external organizations. In many situations, the trust established between organizations may not allow a full spectrum of information sharing or a complete provision of services. When an organization determines that 50 External information system services are services that are implemented outside of the system's traditional authorization boundary (i.e., services that are used by, but not a part of, the organizational information system). 51 External providers or mission/business partners can be public or private sector entities, domestic or international.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Managing Information Security Risk_ Organization, Mission, and Information System View.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Malware Incident Prevention and Handling for Desktops and Laptops say about 2.2 Attacker Tools? (Part 2) According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops, 2.2 Attacker Tools: b browser plug-in provides a way for certain types of content to be displayed or executed through a web browser. Malicious web browser plug-ins can monitor all use of a browser. -  E-Mail Generators. An email generating program can be used to create and send large quantities of email, such as malware and spam, to other hosts without the user's permission or knowledge. -  Attacker Toolkits. Many attackers use toolkits containing several different types of utilities and scripts that can be used to probe and attack hosts, such as packet sniffers, port scanners, vulnerability scanners, password crackers, and attack programs and scripts. Because attacker tools can be detected by antivirus software, some people think of them as forms of malware. However, attacker tools have no infections capability on their own; they rely on malware or other attack mechanisms to install them onto target hosts. Strictly speaking, attacker tools are not malware, but because they are so closely tied to malware and often detected and removed using the same tools, attacker tools will be covered where appropriate throughout this publication.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware. Contains technical security guidance that could inform defensive posture. Source: Guide to Malware Incident Prevention and Handling for Desktops and Laptops.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 507) rvices procured and implemented by organizaon; third-party credenal veriﬁcaon records; evidence of third-party credenals; third-party credenal authorizaons; other relevant documents or records]. IA-08(02)-Interview [SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/ network administrators; system developers; organizaonal personnel with account management responsibilies]. IA-08(02)-Test [SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies; mechanisms that accept external credenals]. T h i s p u b l i c a  o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h  p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P. 8 0 0 - 5 3 A r 5 CHAPTER FOUR PAGE 267 Reference produced from open data hps://github.com/usnistgov/oscal-content T h i s p u b l i c a  o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h  p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P. 8 0 0 - 5 3 A r 5 NIST SP 800-53A, REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS IA-08(03) IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) | USE OF FICAM-APPROVED PRODUCTS [WITHDRAWN: Incorporated into IA-08(02).] IA-08(04) IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) | USE OF DEFINED PROFILES ASSESSMENT OBJECTIVE: Determine if: IA-08(04)_ODP identy management proﬁles are deﬁned; IA-08(04) there is conformance with <IA-08(04)_ODP identy management proﬁles> for identy management. POTENTIAL ASSESSMENT METHODS AND OBJECTS: IA-08(04)-Examine [SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3 provide? (Section 130) Table 1: Draft Security Operational Taxonomy Mapping to the NBDRA Components | Activities | Description | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | System Orchestrator | | | • Policy Enforcement • Security Metadata Model • Data Loss Prevention, Detection • Data Life Cycle Management • Threat and Vulnerability Management • Mitigation • Configuration Management • Monitoring, Alerting • Malware Surveillance and Remediation • Resiliency, Redundancy, and Recovery • Accountability • Compliance • Forensics • Business Risk Model | Several security functions have been mapped to the System Orchestrator block, as they require architectural level decisions and awareness.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware. Contains technical security guidance that could inform defensive posture. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3 provide? (Section 227) Available: http://dx.doi.org/10.1109/PST.2016.7907022 | Brief Description | Safety Level 1 | Safety Level 2 | Safety Level 3 | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------| | Integration of key management practices with domain models | Integration of key management practices with domain models | Integration of key management practices with domain models | Integration of key management practices with domain models | | Tokenization and key management practices are frequently central to managing proper access to systems and data, especially across enterprises.

Explanation: NIST publication on credential and access management. Topics: key management, token. Contains security framework guidance for authentication systems. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Derived Personal Identity Verification (PIV) Credentials say about Appendix D References? (Part 3) According to Derived Personal Identity Verification (PIV) Credentials, Appendix D References: ederal Networks and Critical Infrastructure , May 11, 2017. Available: - [17] M. Barrett et al., The Cybersecurity Framework: Implementation Guidance for Federal Agencies, Draft, NIST Interagency Report 8170, Gaithersburg, Md., May 2017. Available: - [18] C. Brown et al., Assessing Threats to Mobile Devices & Infrastructure: The Mobile Threat Catalogue, Draft, NIST Interagency Report 8144, Gaithersburg, Md., Sept. 2016. Available: - [19] NIST. National Vulnerability Database. [Online]. Available: https://nvd.nist.gov/. - [20] NIST. CVE-2016-6716 Detail, National Vulnerability Database. [Online]. Available: https://nvd.nist.gov/vuln/detail/CVE-2016-6716. - [21] S. Quirolgico et al., Vetting the Security of Mobile Applications , NIST SP 800-163, Gaithersburg, Md., Jan. 2015. Available: https://doi.org/10.6028/NIST.SP.800-163 - [22] The MITRE Corporation . Common Vulnerabilities and Exposures (CVE). [Online]. Available: https://cve.mitre.org/. - [23] U.S. General Services Administration, Decision for Standard Assessment & Authorization, Authorization to Operate Letter, Nov. 3, 2016. Available: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ - [24] E. Simmon, DRAFTEvaluation of Cloud Computing Services Based on NIST 800-145, NIST SP 500-322, Gaithersburg, Md., Apr. 2017. Available: ng\_services\_based\_on\_nist\_800-145\_20170427clean.pdf.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, cve-. Contains technical security guidance that could inform defensive posture. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2017 NIST_ITL Cybersecurity Program Annual Report say about Cryptographic Hash Algorithms? (Part 2) According to 2017 NIST_ITL Cybersecurity Program Annual Report, Cryptographic Hash Algorithms: ons will produce unrelated outputs. In December 2016, NIST further expanded the uses of KECCAK with the publication SP 800-185, SHA3 Derived Functions: cSHAKE, KMAC, TupleHash and ParallelHash . It provides four new types of functions, as indicated in the title, each with the same two supported security strengths: - cSHAKE128 and cSHAKE256 are XOFs that can be 'customized' for individual users or applications, so that their outputs would be unrelated to any other SHAKE variants; - KMAC128 and KMAC256 are keyed-hash functions with variable-length outputs, i.e., pseudorandom functions (PRFs); - TupleHash128 and TupleHash256 are hash functions on tuples of input strings; and - ParallelHash128 and ParallelHash256 are hash functions that can exploit parallel processing to efficiently hash long messages. NIST is currently considering the development of a parallelizable hashing mode and XOF mode for generic hash functions (e.g., SHA-2). These modes would allow the SHA-2 family to achieve some of the functionality of the SHA-3 family.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) provide? (Section 66) tection, rather than on reliable, automated security mechanisms, makes it critical that trust and reliability assessments of management, operators, and maintenance personnel are current and upto-date. Many of the assessment procedures rely on interactions among the Assessor, issuer management, and facilities staff. Interviews with all involved personnel and observations of all PIV processes are required. On-site visits, real-time observations, and reviews of processes are essential, as the Assessor must not rely solely on documentation to determine if a given issuer control has been implemented. In order to assess the capability and reliability of an issuer, one or more assessment procedures associated with each issuer control have to be completed. An assessment procedure is carried out using one or more of the following assessment methods. (The assessment methods associated with an assessment procedure are given in parenthesis in Table G.1 and Table G.2.) -  Review - An evaluation of documentation that describes plans, policies, and procedures in order to verify that they are adequate, understood by management and operations personnel, and that they are in accordance with applicable policies, regulations, standards, technical guidelines, and organizational guidance. -  Interview - a directed conversation with one or more issuer personnel in which both preestablished and follow-on questions are asked, responses documented, discussion encouraged, and conclusions reached. -  Observe - a real-time viewing of PIV processes in operation, including all information system components of the issuer involved in creation, issuance, maintenance, and termination of PIV Cards or Derived PIV Credentials. -  Test - an evaluation of a component against a set of relevant PIV specifications using applicable test methods and metrics (as given in the associated assessment procedure in Table G.1 and Table G.2).

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters? (Part 67) Control HA-1: Glossary ## base point A fixed elliptic curve point that generates the group used for elliptic curve cryptography. ## group order Cardinality of the group. ## identity Unique group element 0 for which x + 0 = x for each group element x , relative to the binary group operator +. ## inverse For some group element x , the unique element y for which x + y is the identity element relative to the binary group operator + ( y is usually denoted as -x ). ## isogeny A (non-constant) mapping from an elliptic curve to a second elliptic curve, which preserves point addition and fixes the identity point. ## isomorphism (of elliptic curves) A bijective mapping from one elliptic curve to another, which maps addition (on the first curve) to addition (on the image curve). ## point at infinity Identity element of a Montgomery curve or a curve in short-Weierstrass form. ## point order Smallest non-zero multiple of a group element that results in the group's identity element. ## quadratic twist Certain elliptic curve related to a specified elliptic curve. ## square The property that some element x of a finite field GF( q ) can be written as x = z 2 for some element z in the same field GF( q ).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identity and Access Management for Electric Utilities say about Java Application? (Part 16) According to Identity and Access Management for Electric Utilities, Java Application: a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Automation Support for Security Control Assessments_ Software Vulnerability Management provide? (Section 16) | 6 | | | | 2.3.1 Common Vulnerabilities and Exposures (CVEs) ..................................7 | | | | | 2.3.2 Common Weakness Enumerations (CWEs).......................................10 | | | | | 2.3.3 Roles for Mitigation of CVEs and CWEs.............................................11 | | | | 2.4 Example VUL Data Requirements................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Vulnerability Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does SHA-3 Derived Functions_ cSHAKE, KMAC, TupleHash, and ParallelHash provide? (Section 2) o copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-185 Natl. Inst. Stand. Technol. Spec. Publ. 800-185, 32 pages (December 2016) CODEN: NSPUE2 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-185 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: SP800-185@nist.gov All comments are subject to release under the Freedom of Information Act (FOIA).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: SHA-3 Derived Functions_ cSHAKE, KMAC, TupleHash, and ParallelHash.