You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identity and Access Management for Electric Utilities provide? (Section 231) / / 1 1 0 0 6 6 0 0 2 2 8 8 / / N N I I S S T T . . S S P P 1 1 8 8 0 0 0 0 - - 2 2 . . . . From System >View Submitted tasks, click Search. Verify that the Create User task completed successfully. Connect to the AE Database. Verify that the user was created successfully. Connect to the Active Directory Domain Controller. Verify that the user was created successfully. Repeat all of the steps above for Modify User, Enable User, and Disable User. 6.18 Test Creation of a User with a CSV file Download the file HRBulkUsers4.csv from and unzip to use. Modify the CSV file to enter the desired values for the new users to be created. Keep in mind the policy rules that must be followed as described above. From System > Bulk Loader, Browse for the CSV file. What field represents the action to perform on the object: action. What field will be used to uniquely identify the object: uid. Click Next. What is the Primary Object: USER. Select a task to execute for action “create”: Create User Click Finish. Repeat Steps 4 through 7 above, and the steps from Section 6.17, to approve the users and to verify that they were successfully created. Identity Management and Governance: RSA (Build #2) 7 RSA IMG implements the central IdAM workflow in Build #2. It receives input from an HR system, in the form of CSV files. The access and authorization for each user is based on the business and security rules implemented in workflows within RSA IMG. The workflows include management approval chains as well as approval/denial data logging. Once IMG has processed the access and authority request, the updated user access and authorization data is pushed to the central identity store. The central identity store contains the distribution mechanism for updating the various downstream (synchronized) directories with user access and authorization data.

Explanation: NIST publication on credential and access management. Topics: authorization, identity management. Contains security framework guidance for authentication systems. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Report on the Privilege (Access) Management Workshop provide? (Section 58) cument and provides added detail-the functional boxes 'Policy Consumption,' 'Attribute Consumption', and 'Translated into Digital Policy.' It takes Figure 5 a step closer to a possible implementation. In addition, it expands the scope of privilege management to include the box labeled 'Governance and 'P'olicy. This addition seems reasonable and leads to a number of new questions that one could address-for example, what kind of automated assistance makes sense and how would it interface to 'Translated into Digital Policy.' Also, the overall architecture displayed in the proffered diagram leads to the question of how the details and increased scope can be dealt with in the alternate architecture described in Figure 6 of this document. Thus, there are many considerations here that could inform an approach for a follow-on workshop on privilege management.] [Editor: The figure and caption in question are as follows: Figure 5. Interfaces of Privilege Management - View One <!-- image --> -end of Editor comment.]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Report on the Privilege (Access) Management Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EU-73 in Design Alternatives for Computer Network Security? (Part 79) Control EU-73: e handled by merely adding one more relay operation; namely from the destination ICD back to the Master-ICD at the SC. This would complete the "loop and thereby inform the SC of the connection status. It would require that the destination ICD "fill in the blanks," e.g., insert a condition-code, to indicate the status, and would require that the SC set up one additional encipherment key to be utilized for this ICD-to-SC (Master-ICD) transmission. For the non relay mode, in which the Master-ICD would "prime" ti\e two end ICD's, a different approach would be necessary. Either one of the ICD's could be charged with performing this function (or both) in a similar manner to that required to notify the SC when a connection is broken. However, the two function are quite different when an ICD has a single port to work with, since in the former case it is "tied up" with the working connection, while it is free after having broken a connection. ## 4.4 ACCESS CONTROL AT THE ICD LEVEL; USAGE OF A CONNECTION In the simplest case, two ICD's might be considered to be in-line with the communications and therefore would be transparent to the usage of the line, just as a pair of modems perform their transformation/inverse transformation, and otherwise are transparent to the communication. However, the cryptographic equipments do introduce side effects, primarily related to their synchronization requirement Therefore, we should consider the various options that we have in this area, and determine their network-related tradeoffs. We also need to consider the impact of utilizing multiplexed cryptographic equipment, particularly at multi-port devices such as HOST computers, and the associated problems that multiplexing introduces due to the need to pass more control information past the encryption mechanism. Finally, we need to consider the effects of errors on all of these factors and the performance degradation due to the usage of the ICD's.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Design Alternatives for Computer Network Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Version 1.1 Manufacturing Profile say about 7. Manufacturing Profile Subcategory Guidance? (Part 27) According to Cybersecurity Framework Version 1.1 Manufacturing Profile, 7. Manufacturing Profile Subcategory Guidance: IDENTIFY | Supply Chain (ID.SC) | | Identify and document key personnel from suppliers and third-party partners to include as stakeholders in response and recovery planning activities. | CP-4, IR-3, IR-4 | | Function | Category | Subcategory | Manufacturing Profile Guidance | Reference | |------------|----------------------------------------------------------------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------| | PROTECT | Identity Management, Authentication and Access Control (PR.AC) | PR.AC-1 | Low Impact Establish and manage identification mechanisms and credentials for users of the manufacturing | ISA/IEC 62443-2- 1:2009 4.3.3.5.1; SR 1.1, 1.2, 1.3, 1.4, 1.5,1.7 IA-Family AC-2(1) | | PROTECT | Identity Management, Authentication and Access Control (PR.AC) | PR.AC-1 | system.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Cybersecurity Framework Version 1.1 Manufacturing Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations provide? (Section 98) Federal enterprises should establish processes to effectively engage with the FASC's government agencies and acting as a central, government-wide facilitator for C-SCRM information-sharing activities. information-sharing agency, which is responsible for facilitating information sharing among NIST SP 800-150 describes key practices for establishing and participating in SCRI-sharing relationships, including: - Establish information-sharing goals and objectives that support business processes and security policies - Identify existing internal sources of SCRI - Specify the scope of information-sharing activities 27 - Establish information-sharing rules - Join and participate in information-sharing efforts - Actively seek to enrich indicators by providing additional context, corrections, or suggested improvements - Use secure, automated workflows to publish, consume, analyze, and act upon SCRI - Proactively establish SCRI-sharing agreements - Protect the security and privacy of sensitive information - Provide ongoing support for information-sharing activities As shown in Table 2, below, SCRI describes or identifies the cybersecurity supply chain relevant characteristics and risk factors associated with a product, service, or source of supply. It may exist in various forms (e.g., raw data, a supply chain network map, risk assessment report) and should be accompanied by the metadata that will facilitate an assessment of a level of confidence in and credibility of the information. Enterprises should follow established processes and procedures that describe whether and when the sharing or reporting of certain information is mandated or voluntary and if there are any necessary requirements to adhere to regarding information handling, protection, and classification.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IR-7864 in The Common Misuse Scoring System (CMSS)_ Metrics for Software Feature Misuse Vulnerabilities? (Part 54) Control IR-7864: ervice that impacts the availability of network functions, yet non-network functions remain available. With the base metric scores described above, the base score for this misuse vulnerability is 4.8. Temporal metrics describe the general prevalence of attacks against this vulnerability and the general availability of remediation measures. The General Remediation Level for the ARP cache poisoning vulnerability would be considered 'Low' because there are limited mitigation techniques available. For very small networks, administrators can configure static IP addresses and static ARP tables, but this approach quickly becomes unmanageable as the network grows in size. For larger networks, switches can be configured to allow only one MAC address for each physical port. ARP cache poisoning attacks occur against typical systems rarely, so the General Exploit Level is scored as 'Low'. Since the General Remediation Level is also scored as 'Low,' the temporal score would be 3.7. In general, the temporal score can be lower than the base score when the General Exploit Level is lower than 'Medium' or the General Remediation Level is higher than 'None.' Environmental metrics describe the vulnerability severity with respect to a particular organization. Consider an organization in which the Local Vulnerability Prevalence is 'High,' the Perceived Target Value is 'Medium', and the Local Remediation Level is rated 'None.' Because the Local Vulnerability Prevalence is higher than the default value and the Local Remediation Level is lower than the General Remediation Level, the exploitability subscore calculation for the environmental score is higher than the temporal exploitability subscore. Now consider the impact subscore of the environmental score. When the Collateral Damage Potential is 'None,' this metric does not modify the impact subscore in the environmental score calculation.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Misuse Scoring System (CMSS)_ Metrics for Software Feature Misuse Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 6.1 開始フェーズ according to NIST Application Container Security Guide According to Application Container Security Guide, 6.1 開始フェーズ: 組織は、他のセキュリティポリシーがコンテナによってどのような影響を受けるかを検討し、コンテナを考慮に入れ るために、必要に応じてこれらのポリシーを調整することが望ましい。例えば、インシデントレスポンス（特にフォ レンジック）や脆弱性管理のポリシーは、コンテナの特殊な要件を考慮するための調整が必要となる場合がある。 コンテナ技術の導入は、組織内の既存の文化とソフトウェア開発方法論を混乱させる可能性がある。コンテナが提供 するメリットを最大限に活用するためには、この新しいアプリの開発、実行、サポート方法をサポートするように組 織のプロセスを調整することが望ましい。従来の開発手法、パッチ適用技術、およびシステムのアップグレードプロ セスは、コンテナ化された環境に直接適用されない場合があり、組織内の従業員が新しいモデルに積極的に適応する ことが重要である。新しいプロセスでは、技術の変化によってもたらされる潜在的なカルチャーショックを考慮する ことができ、また、対処できる。ソフトウェア開発ライフサイクルに関わるすべての人に教育とトレーニングを提供 することによって、人々がアプリを構築、配布、実行するための新しい方法に慣れることができる。

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Application Container Security Guide.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain General Issues: according to NIST A Threat Analysis on UOCAVA Voting Systems According to A Threat Analysis on UOCAVA Voting Systems, General Issues:: Leaking sensitive personal information from voters. Available and integrity of voter registration database.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Threat Analysis on UOCAVA Voting Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Device Security_ Bring Your Own Device (BYOD) provide? (Section 115) --------------------------------| | | | DE.CM-5: Unauthorized mobile code is detected. | SC-18: Mobile Code SI-7: Software, Firmware, and Information Integrity | A.12.5.1: Installation of Software on Operational Systems A.12.6.2: Restrictions on Software Installation | CSC 7: Email and Web Browser Protections CSC 8: Malware Defenses | PR-CDA-001: Cyber Defense Analyst SP-DEV-002: Secure Software Assessor | | IBM MaaS360 Mobile Device Management (SaaS) Version 10.73 | Enforces organizational mobile endpoint security policy | ID.AM-1: Physical devices and systems within the organization are inventoried.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control EP-67 in Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)? (Part 51) Control EP-67: There are already academic conference series such as PQC and workshops have been established by ETSI/IQC [i.1] and NIST. The European Commission has recently granted funding to two QSC projects under the Horizon 2020 framework: SAFEcrypto [i.2] and PQCrypto [i.3] and [i.4]. The present document draws on all these research efforts. The present document will cover three main areas. Clauses 4 and 5 discuss the types of primitives being considered and describe an assessment framework; clauses 6 to 10 discuss some representative cryptographic primitives; and clause 11 gives a preliminary discussion of key sizes. | | | ETSIGR QSC 003 V1.1.1 (2017-02) | ETSI | Quantum Safe Cryptography; Case Studies and Deployment Scenarios The present document examines a number of real-world uses cases for the deployment of quantum-safe cryptography (QSC). Specifically, it examines some typical applications where cryptographic primitives are deployed today and discusses some points for consideration by developers, highlighting features that may need change to accommodate quantum-safe cryptography. The main focus of the document is on options for upgrading public-key primitives for key establishment and authentication, although several alternative, non-public-key options are also discussed. The present document gives an overview of different technology areas; identify where the security and cryptography currently resides; and indicate how things may have to evolve to support quantum-safe cryptographic primitives. Clauses five and six discuss network security protocols, using TLS and S/MIME as typical examples. These are contrasted in clauses seven and eight by an examination of security options for IoT and Satellite use cases, which have very different requirements and constraints than traditional Internet-type services. Some alternatives to public key protocols are reviewed in clause nine.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Validating the Integrity of Computing Devices say about 2.1.1.1.3 CentOS 7 Image Creation? (Part 2) According to Validating the Integrity of Computing Devices, 2.1.1.1.3 CentOS 7 Image Creation: ning the required vmlinuz and initrd0.img files. It will also create a directory named pxelinux.cfg which contains a file named default . default contains the kernel flags necessary to boot the image. Use these files in the PXE environment detailed in Section 2.1.1.3. ``` $ livecd-iso-to-pxeboot imagename.iso ```

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validating the Integrity of Computing Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Workshop on Security Procedures for the Interchange of Electronic Documents_ Selected Papers and Results provide? (Section 16) l to the internal systems will add to confidence in the authenticity of transmitted documents, and effective controlled access to sensitive databases will add to confidentiality when that is required. Commentary to 6 ; Irvin Chmielewski, in his paper, stresses "application systems that will utilize EDI" rather than just EDI. This leads him to consider overall security, not just data link security. He states, "... applications, both client/server and host-based, at the manufacturers and their trading partners, must provide full security of all information and resources." In the paper by Horton Sorkin, the security of the data interchange is related to the internal control structure as seen by an auditor of a client's system. Sorkin states that the standard audit objectives for each transaction do not change with EDI; the same concerns are translated to the new technology. "The loss of controlled and prenumbered paper stock is supplanted by concerns over counters, date-time mechanisms, and authorization and internal access controls. It does not appear to make much sense to be concerned about EDI transmission security if internal controls at the business application level are inadequate," Sorkin states. 7. There are non-cryptographic techniques that can be used to provide confidence in document integrity and originator authentication at a lower level than could be assured with cryptographic techniques. There are no non-cryptographic techniques that can provide high confidence of confidentiality in document interchange. Commentary to 7 ; Peter Weiss provides a list of computer security techniques applicable to EDI, presented in generally ascending order of security strength. The lower-level techniques presented are non-cryptographic. Weiss points out that the list of techniques is generally consistent with that contained in the American Bar Association's Model Payments Agreement and Commentary ("Model Agreement") . 32 Jurimetrics 601 (Summer, 1992) .

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Workshop on Security Procedures for the Interchange of Electronic Documents_ Selected Papers and Results.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AN-2013 in Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet? (Part 104) Control AN-2013: | N o t e | Imp. Required | Imp. Support | Supporte d Range | Test Result | E n c . | |----------------------------------|----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------|----------------------------------| | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | Transaction-related Requirements | | XML | | an end tag of format </Name>. For all logical records - including Types 4, 7, and 8 that do not have field tags in the Traditional encoding -- data elements are tagged according to XMLrules. The format for each element shall consist of a start tag enclosed in angle brackets followed by data followed by an end tag.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.6.8 Example according to NIST A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications According to A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, 2.6.8 Example: (input) ε = 11001001000011111101101010100010001000010110100011 00001000110100110001001100011001100010100010111000 (input) n = 100 (processing) N1 = 46 (processing) N0 = 47.5 (processing) d = -1.376494 (output) P-value = 0.168669 (conclusion) Since P-value ≥ 0.01 , accept the sequence as random.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.5 Trusted Platform Module (TPM) Key Derivation Function according to NIST Recommendation for Existing Application-Specific Key Derivation Functions According to Recommendation for Existing Application-Specific Key Derivation Functions, 5.5 Trusted Platform Module (TPM) Key Derivation Function: Version 1.2 of the Trusted Platform Module is specified in the TPM Main Specification Parts 1, 2 and 3 ([TPM Principles], [TPM Structures] and [TPM Commands], respectively). It uses a SHA-1 HMAC-based Pseudorandom Function (PRF) in its KDF to generate keying material for transport sessions between the TPM and an application running on another processor. To protect the integrity of communications, a session key, SKEY , is derived from a secret authorization value, Auth , that is a secret key shared between the TPM and the application. An HMAC-PRF is used to produce the SKEY as follows: SKEY = HMAC ( Auth , Nonce\_even || Nonce\_odd ), where Nonce\_even and Nonce\_odd are non-secret values created by the random number generators on the TPM and the application, respectively. Additional technical details for the variables in the functions are provided in Part 3 of the TPM Main Specification. SKEY is used as an HMAC key to provide data integrity for communications during the session. Further keys may be derived from SKEY to provide encryption of parts of the session. The TPM KDF is approved when the following conditions are satisfied: - (1) The TPM KDF is performed in the context of a TPM session (i.e. performed between a TPM and an application with a shared authorization value.) - (2) HMAC and SHA-1 are used as specified in FIPS 198-1 and 180-3, respectively. Note that the KDF is a particular instance of the feedback mode as specified in Section 5.2 of SP 800-108, with an empty initial value (IV).

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Existing Application-Specific Key Derivation Functions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain n : 6610559687902485989519153080327710398284046829642812192846487\ 98304157774827374805208143723762179110965979867288366567526771 according to NIST Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters According to Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters, n : 6610559687902485989519153080327710398284046829642812192846487\ 98304157774827374805208143723762179110965979867288366567526771: ``` (= 0x1000000 00000000 00000000 00000000 00000000 00000000 000001e2 aad6a612 f33307be 5fa47c3c 9e052f83 8164cd37 d9a21173 ) tr : -6059503967182126918765909026644927652236777310526686418445029 (=(2 m + 1) h ⋅ n = -0x3c5 55ad4c25 e6660f7c bf48f879 3c0a5f07 02c99a6f b34422e5 ) a : 1 (= 0x0000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001 ) ```

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Acknowledgments according to NIST Computer Security Division 2013 Annual Report According to Computer Security Division 2013 Annual Report, Acknowledgments: The editor, Patrick O'Reilly of the Computer Security Division, wishes to thank his colleagues in the Computer Security Division, who provided write-ups on their 2013 project highlights and accomplishments for this annual report (their names are mentioned after each project write-up). The editor would also like to acknowledge Barbara Guttman, Kevin Stine, Jim Foti (ITL, NIST), Greg Witte, Chris Johnson and Doug Rike (G2) for reviewing and providing valuable feedback for this annual report. The Editor also would like to thank Lorie Richards (Facilities Services Division, Creative and Printing Service, NIST) for designing the cover and final layout of our division's annual report. Finally, the editor would like to thank Joshua Franklin and Michaela Iorga (Computer Security Division, ITL, NIST) for their input with the 2013 annual report cover design. Verification FIPS 140-2 Biometrics Policy Machine Validated Products List This page is intentionally left blank. Assets FIPS 140-2 iometrics Access Control licy Machine Validated Products List Guidelines Risk Management Framework Systems Assets Verification FISMA Cloud Computing Cybersecurity Framework Roadmap Authorization Evaluation Standards Security Controls Mobile Devices Supply chain risk management Continuous Monitoring Critical Infrastructure Security Practices <!-- image -->

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: Computer Security Division 2013 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain National Institute of Standards and Technology Interagency Report 7622 80 pages (October 2012) according to NIST Notional Supply Chain Risk Management Practices for Federal Information Systems According to Notional Supply Chain Risk Management Practices for Federal Information Systems, National Institute of Standards and Technology Interagency Report 7622 80 pages (October 2012): Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. All NIST publications, other than the ones noted above, are

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Notional Supply Chain Risk Management Practices for Federal Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Identity and Access Management for Electric Utilities provide? (Section 143) Universal to Door Controller ......................................................223 10.4.2 Enable TCP/IP to SQL 2008 R2 Server .......................................................................224 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . 11.2.1 System Environment .................................................................................................225 NIST SP 1800-2C: Identity and Access Management for Electric Utilities ix 11.2.2 ConsoleWorks Server Installation on the OT Network .............................................226 11.2.3 Post-Installation Configuration of ConsoleWorks on the OT Network .....................226 11.2.4 Configuring External Authentication for the OT Network ConsoleWorks Server .....227 T h i s p u b l i c a t i o n 12.2.1 Installing iSIM ............................................................................................................228 12.2.2 iEMS ..........................................................................................................................228 i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p : / / d o i . o r g / 1 0 . 6 0 2 8 / N I S T . S P 1 8 0 0 - 2 . . 15.1.1 Managing the Account ..............................................................................................267 15.1.2 What Is a Profile? / Profile Management .................................................................267 15.1.3 What Is a License?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Identity and Access Management for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Digital Identity Guidelines_ Federation and Assertions provide? (Section 203) ot require the server to authenticate the client. Authentication of the server is often accomplished through a certificate chain that leads to a trusted root rather than individually with each server. See protected session . The process by which a claimant proves possession and control of one or more authenticators bound to a subscriber account to demonstrate that they are the subscriber associated with that account. A category that describes the strength of the authentication process. A private or symmetric key used by an authenticator to generate the authenticator output. Something that the subscriber possesses and controls (e.g., a cryptographic module or password ) and that is used to authenticate a claimant's identity. See authenticator type and multi-factor authenticator . The establishment of an association between a specific authenticator and a subscriber account that allows the authenticator to authenticate the subscriber associated with the account, possibly in conjunction with other authenticators. A decision to grant access, typically automated by evaluating a subject 's attributes . 127 In federation , the organization, person, or entity that is responsible for making decisions regarding the release of information within the federation transaction , most notably subscriber attributes . This is often the subscriber (when runtime decisions are used) or the party operating the IdP (when allowlists are used). Communication between two systems that relies on a direct connection without using redirects through an intermediary, such as a browser. An assertion that can be presented on its own as proof of the identity of the presenter. A documented list of specific elements that are blocked, per policy decision. This concept has historically been known as a 'blacklist.' An authenticator verified by the RP in addition to an assertion at FAL3. The bound authenticator is bound to the RP subscriber account .

Explanation: NIST publication on credential and access management. Topics: authentication, multi-factor, sso. Contains security framework guidance for authentication systems. Source: Digital Identity Guidelines_ Federation and Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Standard Security Label for GOSIP_ an Invitational Workshop say about Table of Contents? (Part 5) According to Standard Security Label for GOSIP_ an Invitational Workshop, Table of Contents: | , "Security Labels at the Transport Layer" (Presentation Slides) , Wayne A. Jansen (NIST) - | 95 | | Comments on the draft FIPS "Standard Security Label for the Government Open Systems Interconnection Profile" (Position Paper) , Russell Housley, Sammy Migues (Xerox Special Information Systems) "The Multipolicy Machine - A New Paradigm for Multilevel Security Systems" (Position Paper) , Hilary Hosmer (Data Security, Inc.) | Comments on the draft FIPS "Standard Security Label for the Government Open Systems Interconnection Profile" (Position Paper) , Russell Housley, Sammy Migues (Xerox Special Information Systems) "The Multipolicy Machine - A New Paradigm for Multilevel Security Systems" (Position Paper) , Hilary Hosmer (Data Security, Inc.) | 105 | | "Modelling Security Policy and Labelling Unclassified but Sensitive Information - A Canadian (Position Paper) , D.S. Crawford (Canadian Department National | "Modelling Security Policy and Labelling Unclassified but Sensitive Information - A Canadian (Position Paper) , D.S.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Standard Security Label for GOSIP_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain DHCP Server Insertion Attack according to NIST Security Considerations for Voice Over IP Systems According to Security Considerations for Voice Over IP Systems, DHCP Server Insertion Attack: It is often possible to change the configuration of a target phone by exploiting the DHCP response race when the IP phone boots. As soon as the IP phone requests a DHCP response, a rogue DHCP server can initiate a response with data fields containing false information. This attack allows for possible man in the middle attacks on the IP-media gateway, and IP Phones. Many methods exist with the potential to reboot the \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ phone remotely, e.g. 'social engineering', ping flood, MAC spoofing (probably SNMP hooks, etc.). If possible, use static IP addresses for the IP Phones. This will remove the necessity of using a DHCP server. Further, using a state based intrusion detection system can filter out DHCP server packets from IP Phone ports, allowing this traffic only from the legitimate server.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, intrusion detection. Contains technical security guidance that could inform defensive posture. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does PBX Administrator’s Security Standards say about Illegally Obtaining Authorization Codes? (Part 1) According to PBX Administrator’s Security Standards, Illegally Obtaining Authorization Codes: Illegally Obtaining Authorization Codes Observation Social Engineering Schemes Operator Direct Dial Scheme easier ways to steal services. Hackmg a 14 digit code is more difficult than hackmg a PBX that is not securely administered. - Long distance providers are no longer tolerating toll fraud. They have successfully prosecuted and jailed hackers caught breaking into their systems and stealing their services. There are a variety of ways in which a hacker may illegally obtain someone's long distance authorization code. For example, hackers have been known to sit on balconies in busy aiiports or train stations overlooking telephone banks. Using telescopes or field glasses, they watch a traveler make a long distance call, and through careful observation, obtain the authorization code. Social engineering refers to a person's ability to use personality, knowledge of human namre, and social skills to steal toll calls. In one scheme, a hacker calls a long distance subscriber and claims to represent his/her long distance carrier. The hacker might claim to be doing maintenance or validating long distance access codes (PINs). He reads the first ten digits of the access code (which is the phone number of the person he is talking to) and makes up the last four digits. Human nature being what it is, the victim automatically corrects the hacker, giving him the correct PIN. The hacker thanks the subscriber and hangs up in full possession of a valid authorization code for placing long distance calls. In this scheme, a thief employs his social engineering skills to convince a switchboard operator to assist him in placing a long distance caU. Commonly, the thief dials your 800 number and asks for a particular department, such as Marketing. Once connected to that department, he says he has been connected to the wrong d^artment and asks to be transferred back to the operator.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PBX Administrator’s Security Standards.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 7.10.3. Procedure according to NIST Secure Data Network Systems (SDNS) Key Management Documents According to Secure Data Network Systems (SDNS) Key Management Documents, 7.10.3. Procedure: When the responder KMAP issues a response primitive with a failure result, the KMASE generates an Estat. The parameter estatus contains the result value, and the value represents a failure when it is greater than zero. The following codes represent the various failure responses: (16) (17) (18) (19) ``` service-not-available (8), - No further details service-not-available-CRL (9), service-not-available-Interactive-rekey (10), service-not-available-Staged-rekey (11), service-not-available-at-this-time (15), - Specify doNotTryBefore incorrect-value-in-protected-field incorrect-value-PDU-type incorrect-value-old-resp-kid incorrect-value-crl-ver incorrect-value-add-info incorrect-value-univ-id incorrect-value-ref-num incorrect-value-proposed-options rekey-not-complete delete-this-TEK negotiation-failure failure , - No further details , , , (20) , (21), ( 22), (23) , (24) , (126) , - Locally definable (127) , - No further details (255) ``` When the KMASE receives an Estat KPDU, it delivers a confirm primitive with estatus, and optionally doNotTryBefore, as the result parameter. The KMASE includes the doNotTryBefore parameter in the Estat when the failure is service-not-available-at-this-time. The parameter doNotTryBefore is UTC Time and is the earliest time the initiator KMAP should attempt the request again.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Secure Data Network Systems (SDNS) Key Management Documents.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Telehealth Remote Patient Monitoring Ecosystem say about C-4 Threats? (Part 5) According to Securing Telehealth Remote Patient Monitoring Ecosystem, C-4 Threats: veat in these assumptions is that HDOs that engage with telehealth platform providers should be provided assurance that third parties that they engage deploy mature privacy and cybersecurity programs. Table C-4 Threats Applied to the Telehealth Platform Provider | C, I, A | Threat Event | Description | Likelihood | |-----------|------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------| | C | phishing | Telehealth platform provider workforce with privileged access may be susceptible to spear phishing attacks. | high | | I, A | malicious software | Telehealth platform provider workforce with privileged access to permitting allows malicious software to be introduced into the telehealth platform environment. | moderate | | I, A | command and control | Telehealth platform provider workforce with privileged access to permitting allows threat actors to execute arbitrary code and perform privileged functions. | low | | A | ransomware | Ransomware may be introduced into the telehealth platform provider environment either as links or attachments found in phishing emails or may be introduced through local media. | moderate | | C | credential escalation | Malware may be introduced to the telehealth platform provider environment that allows threat actors to execute arbitrary code and perform privileged functions. | moderate | | I, A | OS or application disruption | Malware may be introduced into the telehealth platform provider environment that disrupts the operating system or applications.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: threat actor, malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2017 NIST_ITL Cybersecurity Program Annual Report say about NIST Cybersecurity for IoT Program? (Part 2) According to 2017 NIST_ITL Cybersecurity Program Annual Report, NIST Cybersecurity for IoT Program: ional IoT cybersecurity standards. The Task Group has 54 federal employee participants representing 13 agencies and will convene in early FY 2018 to determine the next steps for its draft report. If approved, NIST is prepared to take this document through the NISTIR process in FY 2018 to collect industry input on specific areas, such as market adoption and challenges associated with the adoption of existing standards. In FY 2018, the Cybersecurity for IoT Program will continue collaborating with stakeholders as NIST begins drafting guidance for IoT security and privacy. As part of the drafting process, the team will hold town-hall meetings for input on discussion drafts. The document is intended to educate federal agencies on common high-level security and privacy risks for IoT, and to introduce practical risk management considerations for IoT product selection, deployment, protection, and operation. Additional information regarding the broad portfolio of NIST activities for supporting secure IoT can be found on our program website.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2017 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Status Report on the Second Round of the NIST Lightweight Cryptography Standardization Process provide? (Section 86) During the final round, NIST is planning to host the fifth workshop to support the standardization process. NIST encourages further analysis of the candidates that did not advance to the final round. The candidates that proposed new modes of operation instantiated with AES might still be beneficial for general-purpose applications. The modes of operations of these candidates may be considered later under NIST's mode development project [277]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ - [1] S¨ onmez Turan M, McKay KA, C ¸ alık C ¸ , Chang D, Bassham I Lawrence E (2019) Status Report on the First Round of the NIST Lightweight Cryptography Standardization Process (National Institute of Standards and Technology), Report. https://doi.org/10.6028/NIST.IR.8268 - [2] Aagaard M, AlTawy R, Gong G, Mandal K, Rohit R (2020) Updates on ACE, Update to the NIST Lightweight Cryptography Standardization Process. documents/] round-2/status-update-sep2020/ace update.pdf. - [3] Dobraunig C, Eichlseder M, Mendel F, Schl¨ affer M (2020) Status Update on Ascon v1.2, Update to the NIST Lightweight Cryptography Standardization Process. documents/round-2/status-update-sep2020/ascon update.pdf. - [4] Gueron S, Jha A, Nandi M (2020) Updates on COMET, Update to the NIST Lightweight Cryptography Standardization Process. https: //csrc.nist.gov/CSRC/media/Projects/lightweight-cryptography/documents/ round-2/status-update-sep2020/comet update.pdf. - [5] Riou S (2020) DryGASCON Status Update, Update to the NIST Lightweight Cryptography Standardization Process.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Status Report on the Second Round of the NIST Lightweight Cryptography Standardization Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Guidelines for Smart Grid Cybersecurity? (Part 86) Control SI-11: at assets may be present to target for theft; introduce a virus or other attack to collect personal information. 33 As seen in the table, such data might be used in ways that raise privacy concerns. For example, granular smart grid data may allow numerous assumptions about the health of a dwelling’s resident in which some insurance companies, employers, the press, civil litigants, and others could be interested. Most directly, specific medical devices may be uniquely identified through serial numbers or MAC addresses, or may have unique electrical signatures; if associated with data that identifies an individual resident, either could indicate that the resident suffers from a particular disease or condition that requires the device.82 More generally, inferences might be used to determine health patterns and risk. For example, the amount of time the computer or television is on could be compared to the amount of time the treadmill is used.83 Electricity usage data could also reveal how much the resident sleeps and whether he gets up in the middle of the night.84 Similarly, appliance usage data could indicate how often meals are cooked with the microwave, the stove, or not cooked at all, as well as implying the frequency of meals.85 Many of the parties listed in the “Potential Privacy Impacts” table (Table 5-3) will not be interested in the health of the resident and will wish to use the data for purposes such as efficiency monitoring, but some parties may be interested in the behavioral assumptions that could be made with such data.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain VENDOR: according to NIST Computer Security Training & Awareness Course Compendium According to Computer Security Training & Awareness Course Compendium, VENDOR:: Computer Security Institute 600 Harrison Street San Francisco CA 94107 (415) 905-2626 This workshop is for data processing managers, security officers, and auditors who have little or no knowledge in the communications area. Because communications systems are so complex and vulnerable, the data processing operation is a substantial risk. You will learn about the basic concepts and the terminology needed to communicate effectively with technicians. The emphasis, however , is on vulnerabilities and the practical security safeguards you can implement Because the largest communications risk faced by most organizations is unauthorized access to their computers, considerable emphasis will be placed on how mainframe access control mechanisms interface with other communication security techniques. In particular, you will learn to address the three major risks -loss of network service, unauthorized access to your network and data center resources, and surveillance of your network traffic. "Special Note" You are encouraged to prepare, in advance of the Workshop, a description of specific communications security problems being faced within your own organization. Cases will be discussed as time permits and as issues arise during the Workshop. NOTE: Ask about available discount for government hosted classes. COURSE TITLE: Managing Computer Security-Mergs, Acq, and Divestitures COURSE LENGTH: 2 DAY

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Security-Focused Configuration Management of Information Systems say about 2.1 OVERVIEW? According to Guide for Security-Focused Configuration Management of Information Systems, 2.1 OVERVIEW: This section provides an overview of SecCM including its importance in managing organizational risks from systems, the basic terms associated with configuration management, and characterization of SecCM within the configuration management discipline.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Digital Identity Guidelines_ Authentication and Authenticator Management provide? (Section 128) (FIPS) 140-3. NIST.FIPS.140-3 [FIPS201] National Institute of Standards and Technology (2022) Personal Identity Verification (PIV) of Federal Employees and Contractors. (U.S. Department of Commerce, Washington, DC), Federal Information Processing Standards Publication (FIPS) 201-3. NIST.FIPS.201-3 81 NIST SP 800-63B-4 July 2025 Digital Identity Guidelines Authentication and Authenticator Management [FISMA] Federal Information Security Modernization Act of 2014, Pub. L. 113-283, 128 Stat. 3073. Available at https://www.govinfo.gov/app/details/PLAW-113publ283 [IC3] Federal Bureau of Investigation (2024) Annual Reports - Internet Crime Complaint Center (IC3). Available at https://www.ic3.gov/AnnualReport/Reports/ [ISO/IEC2382-37] International Standards Organization (2022) Information technology — Vocabulary — Part 37: Biometrics (ISO, Geneva, Switzerland). Available at https: //www.iso.org/standard/73514.html [ISO/IEC9241-11] International Standards Organization (2018) ISO/IEC 9241-11 Ergonomics of human-system interaction – Part 11: Usability: Definitions and concepts (ISO, Geneva, Switzerland). Available at https://www.iso.org/standard/63500.html [ISO/IEC10646] International Standards Organization (2020) Information technology — Universal coded character set (UCS) (ISO, Geneva, Switzerland). Available at https: //www.iso.org/standard/76835.html [ISO/IEC19792] International Standards Organization (2009) Information technology — Security techniques — Security evaluation of biometrics (ISO, Geneva, Switzerland). Available at https://www.iso.org/standard/51521.html [ISO/IEC19795-1] International Standards Organization (2021) Information technology - Biometric performance testing and reporting Part 1: Principles and framework (ISO, Geneva, Switzerland).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Digital Identity Guidelines_ Authentication and Authenticator Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT) say about Table 16 - Software Assurance Standards? (Part 13) According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT), Table 16 - Software Assurance Standards: Product Management: The product shall be designed and implemented such that it is possible to perform an update of the product's software, and to roll back an update Page 11, Section 11 | Approved Standard Guidance Available | Software Assurance: Standards that describe requirements and guidance for significantly decreasing the likelihood of software having vulnerabilities, either intentionally designed into the software or accidentally inserted at any time during its life cycle, and that the software functions in the intended manner. | Documents | SDO | Description | Maturity Level (Table 6) | |-------------|-------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------| | UL 2900-2-1 | UL | Security evaluation standard applies to the testing of network connected components of healthcare systems. It applies to, but is not limited to, the following key components: a) Medical devices; b) Accessories to medical devices; c) Medical device data systems; d) In vitro diagnostic devices; e) Health information technology; and f) Wellness devices.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Users according to NIST Foundations of a Security Policy for Use of the National Research and Educational Network According to Foundations of a Security Policy for Use of the National Research and Educational Network, Users: - U2.1. Handle accounts in a responsible manner. - U2.2. Follow site procedures for security of personal data as well as for the computer system. Use file protection mechanisms to maintain appropriate file access control. - U2.3. Select and maintain good passwords. Do not share accounts. - U3.1. Help to protect the property of other individuals. Notify them of resources (e.g. files, accounts) left unprotected. - U3.2. Notify the System Administrator of a suspected or observed violation. - U5.1. Do not intentionally modify, destroy, read, or transfer information in an unauthorized manner; do not intentionally deny others authorized access to or use of network resources and information. - U5.2. Provide the correct identity and authentication information when requested and not attempt to assume any other party's identity.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Foundations of a Security Policy for Use of the National Research and Educational Network.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Configure Mediator Server according to NIST Securing Telehealth Remote Patient Monitoring Ecosystem According to Securing Telehealth Remote Patient Monitoring Ecosystem, Configure Mediator Server: 1. Open File Explorer and navigate to C:\Program Files\LogRhythm. 2. Navigate to Mediator Server. 3. Double-click lrconfig application file. 4. In the LogRhythm Data Processor Local Configuration Manager window, provide the following information and leave the remaining fields as their default values: - a. Server: - 192.168.45.20 - b. Password: ********** 5. Click Test Connection, then follow the instruction of the alert window to complete the test connection. 6. Click Apply and then click OK. <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.1.7 Applying Destination Group to End Points according to NIST Securing Property Management Systems According to Securing Property Management Systems, 2.1.7 Applying Destination Group to End Points: The following instructions detail how to apply a previously created destination group to a registered end point. 1. In the Cryptonite Policy tab, click Enable Editing: 2. Locate the box titled Endpoints on the right hand of the screen. Right-click on any of the end points. 3. Select Assign Endpoints to Destination Groups: <!-- image --> <!-- image --> 4. Locate and select the desired end point(s) under All Endpoints: <!-- image --> 5. Select the desired destination group(s) under Available Destination Groups: 6. Click >>: <!-- image --> <!-- image --> 7. Click Save.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Property Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Discussion: Do not let the adversary

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2012 Annual Report say about Hash Algorithm Standards and Security Guidelines? (Part 3) According to Computer Security Division 2012 Annual Report, Hash Algorithm Standards and Security Guidelines: action-then-Expansion , and to discuss different approved hash-based key derivation functions. The revision was completeGLYPH(cmap:df00) anGLYPH(cmap:df00) publisheGLYPH(cmap:df00) in August 2012. In 2013, work will begin on a new revision of the stanGLYPH(cmap:df00)arGLYPH(cmap:df00) (FIPS 180-5), which will contain the new hash algorithm resulting from the SHA-3 competition discussed in the Hash Algorithms and the Secure Hash Algorithm (SHA)-3 Competition section of this report.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Summary according to NIST Picture Password_ A Visual Login Technique for Mobile Devices According to Picture Password_ A Visual Login Technique for Mobile Devices, Summary: Picture Password is a visual login technique that matches the capabilities and limitations of most handheld devices and provides a simple and intuitive way for users to authenticate. Besides user authentication, Picture Password may also be used in other security applications where conventional passwords have been used traditionally. For example, password-based encryption, whereby a password value is transformed into a cryptographic key suitable for encrypting files or other information could rely on keys derived by the image selection technique of Picture Password. The mechanism is relatively straightforward and flexible, and one that is suitable for many users, organizations, and types of devices. The approach provides a simple and hopefully entertaining way for users to authenticate to a device, which should remove much of the burden associated with employing an authentication mechanism. Moreover, with style dependent image selection, password reuse, and embedded salting, the mechanism is superior to using traditional ASCII passwords of comparable length. While the solution is particularly well suited for handheld devices, Picture Password can also be used in a wide range of platforms, from appliances having single embedded processors, to large-scale multi-processor computers.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Picture Password_ A Visual Login Technique for Mobile Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2016 NIST_ITL Cybersecurity Program Annual Report say about https:/ /doi.org/10.1109/QRS.2016.29? (Part 2) According to 2016 NIST_ITL Cybersecurity Program Annual Report, https:/ /doi.org/10.1109/QRS.2016.29: led to a collaboration with NIST to provide replacements. Test Suites 45 and 46 are analyzed, discussed, and updated to improve accuracy, consistency, reciseness, and automation. Empirical results show metrics such as recall, precision, and F-Measure are all impacted by invalid base assumptions regarding the test suites. B. Stivalet and E. N. Fong, Large Scale Generation of Complex and Faulty PHP Test Cases , 2016 IEEE International Conference on Software Testing, Verification and Validation (ICST), Chicago, IL, April 2016, https:/ /doi.org/10.1109/ICST.2016.43 Developing good test cases is an intellectually demanding and critical task, and it has a strong impact on the effectiveness and efficiency of the whole testing process. This paper presents an automated generator of test cases, which are designed to evaluate source code security analyzers. The generator produces PHP: Hypertext Preprocessor (PHP) programs with most common vulnerabilities embedded in various code complexities. It also produces programs without vulnerabilities to test for false positives. The generator is modular and extensible. We describe its internal design and how it works. The generated PHP test cases were added to the Software Assurance Reference Dataset (SARD) and will be used to assess the effectiveness of static analyzers. We conclude with the current state of the tool, its benefits and future work. F. E. Boland and C. D. De Oliveira, A Real World Software Assurance Test Suite , The 27th Annual IEEE Software Technology Conference, Long Beach, CA, October 2015. The design of a test suite to test and measure software assurance using automated tools must have the following characteristics: relevance, statistical significance, and inclusion ground truth.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Telehealth Remote Patient Monitoring Ecosystem say about 3 Approach? According to Securing Telehealth Remote Patient Monitoring Ecosystem, 3 Approach: RPM is a telehealth use case wherein healthcare providers can use internet-based technologies to track biometric data from the patient's home. Patients may have chronic or recurring health conditions that require regular clinical monitoring; however, in-person visitation may be impractical or undesirable. Technology enables capturing biometric and patient-generated data, having those data relayed to systems that clinicians may use to evaluate a patient, and bidirectional communication of the data between the patient and clinician. RPM may be an appropriate means for performing healthcare in pandemic scenarios or to address patients who may live in parts of the country where healthcare settings or practitioners are scarce. The NCCoE collaborated with a healthcare Community of Interest (COI) that included technology and cybersecurity vendors, healthcare cybersecurity subject matter experts, and healthcare systems to identify RPM use cases, data workflows, ecosystem actor, and general deployment architecture. Further, with the assistance of the COI and external cybersecurity subject matter experts, a risk assessment was performed and reviewed, thereby confirming the measures and outcomes that were determined from the risk assessment activity. Additionally, this project reviewed NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organization s [1], as well as NIST SP 800-181 Rev. 1, Workforce Framework for Cybersecurity (NICE Framework) [2], for further guidance. These documents serve as . background for this project, with primary emphasis on the NIST Cybersecurity Framework [3], the NIST Risk Management Framework [4], and the NIST Privacy Framework [5].

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Non-Fungible Token Security provide? (Section 26) their rightful owner. 6. If a smart contract enables the contract manager to restore stolen tokens, this feature could be used by the manager to confiscate, freeze, or unilaterally transfer tokens. 7. A smart contract may not allow a manager to restore stolen tokens, but the smart contract may have a manager-controlled update mechanism whereby this feature could be added in the future (enabling the previously mentioned security concern). 8. Coding errors in the smart contract could enable attackers to steal tokens and transfer them to their accounts. 9. Fractional ownership increases the NFT attack surface by involving an additional thirdparty smart contract that handles the fractional ownership. 10. Owners of fractional shares may not be aware that they could lose their shares through a forced buyout. 11. Inaccurately stored metadata (either done maliciously or accidentally) can delink an NFT from the asset it represents and make it worthless. 12. Server errors that make a digital asset unavailable (e.g., corrupted file, server failure, or storage service discontinuation) could effectively delink an NFT from the asset it represents and make it worthless. 13. If the off-blockchain table linking NFT identifiers to URLs is compromised, an attacker could delink NFTs from their assets and/or change which NFTs represent which assets. 14. If off-blockchain tables are used to link NFT identifiers to URLs, the owner of the table could use their access to delink NFTs and/or change which NFTs represent which assets. 15. An NFT owner may not realize that their account and information on the NFTs that their account owns are public information on the associated blockchain. 16. While blockchain accounts are anonymous, they can be de-anonymized through account owner purchases that include personally identifying information (e.g., name and address). 17. A blockchain could undergo an attack enabling changes to blockchain history (this is unlikely with established blockchains). 18.

Explanation: NIST publication on credential and access management. Topics: token, sso. Contains security framework guidance for authentication systems. Source: Non-Fungible Token Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about Examine? According to Assessing Security Requirements for Controlled Unclassified Information, Examine: [SELECT FROM: security assessment and monitoring policy and procedures; procedures for plans of action and milestones; security assessment plan; security assessment report; security assessment evidence; plan of action and milestones; system security plan; other relevant documents or records]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Information Security Handbook_ A Guide for Managers say about 4.2 Components: Awareness, Training, Education, and Certification? According to Information Security Handbook_ A Guide for Managers, 4.2 Components: Awareness, Training, Education, and Certification: An agency's information security program policy should contain a clear and distinct section devoted to agency-wide requirements for the awareness and training program. Although security awareness and training is generally referred to as 'a' program, many organizations consider awareness and training to be two distinct functions, each with separate purposes, goals, and approaches. Proper implementation of these components (with consideration of options like education and professional certification) promotes professional development, which leads to a high-performance workforce. Requirements for the security awareness and training program should be documented in the enterprise-level policy and should include: - Definition of security roles and responsibilities; - Implementation of the program plan; and - Development of program strategy and a program plan; - Maintenance of the security awareness and training program. 32

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2007 Annual Report say about Developing a Unified Framework for Information Security? According to Computer Security Division 2007 Annual Report, Developing a Unified Framework for Information Security: The Computer Security Division provided technical support to the Chief Information Officer, Director of National Intelligence (DNI), in a major Intelligence Community initiative to transform the certification and accreditation process for information systems and to build a common framework for information security across the federal government. The division worked with the DNI to assist the Intelligence Community in reengineering the security standards and guidelines for national security systems, building on a common foundation established by NIST in its FISMA Implementation Project. The project is using as starting points the NIST Risk Management Framework, the security controls from NIST SP 800-53, and the security categorization paradigm from FIPS 199. The DNI hopes to adopt a common foundation for information security based on NIST security standards and guidelines and build unique national security system requirements on top of that foundation, when necessary. When completed, the project will result in greater standardization of information security standards and guidelines across the federal government which will lead to more cost-effective and consistent security for federal information systems, both for national security-related systems and non national security-related systems. Contact: Dr. Ron Ross (301) 975-5390 ron.ross@nist.gov

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, risk management framework, fips. General security reference material without sensitive content. Source: Computer Security Division 2007 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Minimum Security Requirements for Multi-User Operating Systems say about GLOSSARY? (Part 1) According to Minimum Security Requirements for Multi-User Operating Systems, GLOSSARY: GLOSSARY password schemes, biometrics devices, cryptographic methods, and onetime passwords (usually implemented with token based cards.) Authentication Information. Information used to establish the validity of a claimed identity. [ISO] Authorized. Entitled to a specific mode of access. Channel. An information transfer path within a system. May also refer to the mechanism by which the path is effected. [TCSEC] Clear-text. Intelligible data, the semantic content of which is available. [ISO] Configuration. The selection of one of the sets of possible combinations of features of a system. [ITSEC] Customer-Specifiable. The features of a MSR-compliant system that are set with a default value by the manufacturer, but can be reset after delivery by the customer to reflect the customer's security policy. These features are usually reset at the time of installation by an administrator or other customer authorized person and cannot be changed without the appropriate privilege at other times. Group. A named collection of userlDs. Identification. A unique, auditable representation of identity within the system usually in the form of a simple character string for each individual user, machine, software component or any other entity. Integrity. The property that data has not been altered or destroyed in an unauthorized manner. [ISO] The prevention of the unauthorized modification of information. [ITSEC] The state that exists when computerized data is the same as that in the source documents and has not been exposed to accidental or malicious alteration or destruction. [TCSEC] Mechanism. An operating system entry point or separate operating system support program that performs a specific action or related group of actions. Normal Operation. The process of using a system. [ITSEC] Owner. A user who can modify the contents of an access control list. Password. Confidential authentication information, usually composed of a string of characters. [ISO] Privilege.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, token. Contains security framework guidance for authentication systems. Source: Minimum Security Requirements for Multi-User Operating Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i? (Part 105) Control ES-1: ir products so that these conditions are configurable via policy. ## 5.3.3 Distinguishing RSN and Pre-RSN WLANs The outcome of the discovery phase is very important to the security posture of a WLAN. In an RSN, APs do not allow associations from pre-RSN STAs-those STAs that do not support data confidentiality and integrity mechanisms beyond WEP and that cannot create PMK security associations. For example, an ESS might contain several IEEE 802.11 STAs and three APs. Suppose that all STAs within this ESS use pre-shared keying (as opposed to the IEEE 802.1X technique) and the CCMP security method for both unicast and broadcast traffic. These parameters are negotiated through the discovery phase's security parameter negotiation. Because the three APs have allowed only RSNAs with the seven STAs, they provide an RSN. In contrast, suppose that the STAs in the ESS do not all operate with CCMP; two are using pre-RSN capabilities. These stations, forming a Transition Security Network, are using WEP and shared key authentication. As a result, this WLAN is not an RSN, even though five of its STAs are operating with CCMP. The two STAs using pre-RSN capabilities create significant security holes that can negatively impact the security of the other components of the WLAN. Not only are the communications between the STA and AP not protected strongly, but also the AP must be configured to permit the use of pre-RSN capabilities. This could allow an attacker within range of the AP to establish unauthorized connections to it, potentially gaining access to other resources. ## 5.4 Authentication Phase Upon successful completion of the discovery phase, the STA and AP enter the second phase in the establishment of an RSNA: the authentication phase. This phase provides the means for a STA to prove its identity to the WLAN. This security service is critical for preventing unauthorized access to network resources.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key-Derivation Methods in Key-Establishment Schemes say about 8.3 MAC Algorithms used for Extraction and Expansion? (Part 2) According to Recommendation for Key-Derivation Methods in Key-Establishment Schemes, 8.3 MAC Algorithms used for Extraction and Expansion: C algorithm selected for the implementation of a two-step key-derivation method shall be capable of supporting the targeted security strength as determined by consulting Tables 4 and 5 in Section 5.2. (This limits the use of AES-CMAC to cases where the targeted security strength is no more than 128 bits.) The imposed restrictions are intended to reduce the overall complexity of the resulting implementations, promote interoperability, and simplify the negotiation of the parameters and auxiliary functions affecting the security strength supported by the key-derivation procedure. Note: At this time, KMAC has not been specified for use in the implementation of a two-step keyderivation procedure. This restriction may be reconsidered once a KMAC-based KDF has been approved for use as a PRF-based KDF in a revision of [SP 800-108].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Key-Derivation Methods in Key-Establishment Schemes.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Information Security Handbook_ A Guide for Managers provide? (Section 271) blishing a successful incident response program. One of the first planning tasks should be to develop an organization-specific definition of the term 'incident' so that the scope of the term is clear. Additional tasks that should be performed during the preparation phase include the following: - Create an Incident Response Policy. The policy should define what events are considered incidents, establish the organizational structure for incident response, define roles and responsibilities, and list the organization's incident reporting requirements. - Develop Incident Response and Reporting Procedures. Based on the incident response policy, standard operating procedures (SOPs) are a delineation of the specific technical processes, techniques, checklists, and forms used by the incident response team. SOPs should be comprehensive and detailed to ensure that the organization's priorities are properly reflected in response operations. In addition, following standardized response procedures is also an effective way to minimize errors, particularly those that might be caused by incident handling pace and stress. Prior to implementation, the organization should test incident response SOPs in order to validate their accuracy and usefulness. Once validated, the SOPs must be widely disseminated throughout the organization. Incidents can occur in countless and unpredictable ways; therefore, it is impractical to develop comprehensive procedures with step-by-step instructions for handling every incident. The best that the organization can do is prepare to handle any type of incident, and more specifically, to handle common types of incidents. - Establish Guidelines for Communicating with External Parties. During the incident response process, the organization may need to communicate with outside parties, including other incident response teams, law enforcement, the media, vendors, and external victims.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-4009 in NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3? (Part 120) Control SI-4009: | 3176 | INCITS | International Committee for Information Technology Standards | | 3177 free | IoT | Internet of Things | | 3178 | ISO | International Organization for Standardization | | 3179 of | ISSEA | International Systems Security Engineering Association | | 3180 charge | IT | Information Technology | | 3181 | ITL | Information Technology Laboratory at NIST | | 3182 | KMS | Key Management Systems | | 3183 from: | M2M | Machine to Machine | | 3184 | MAC | Media Access Control | | 3185 https://doi.org/10.6028/NIST.SP.1500-4r2 | MBSE | Model-based Systems Engineering | | 3186 | MIFE | Multi-input Functional Encryption | | | ModSim | Modeling and Simulation | | 3187 3188 | MPC | Multi-party Computations | | 3190 | NBD-PWG | NIST Big Data Public Working Group | | 3191 | NBDRA | NIST Big Data Reference | | | | Architecture | | 3192 | NBD-SPSL | NIST Big Data Security and Privacy Safety Levels | | 3193 | NSTIC | National Strategy for Trusted Identities in Cyberspace | | 3194 3195 | OASIS OECD | Organization for the Advancement of Structured Information Organisation for Economic Co-Operation

Explanation: NIST publication on credential and access management. Topics: access control, key management, sso. Contains security framework guidance for authentication systems. Source: NIST Big Data Interoperability Framework_ Volume 4, Security and Privacy Version 3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain A.3.6. Data Protection 1 according to NIST Recommended Cybersecurity Requirements for Consumer-Grade Router Products According to Recommended Cybersecurity Requirements for Consumer-Grade Router Products, A.3.6. Data Protection 1: Each consumer-grade router product component protects data it stores via secure means, such as strong encryption (e.g., FIPS-approved algorithms). All stored data, including data used for authentication (e.g., salting and hashing stored passwords or passphrases) must be protected. Critical data (including firmware images) can be securely backed up and recovered. Related Standards Requirements: ``` BBF SEC.FIRMWARE.2 CL DRP-001, KEY-001, KEY-002, KEY-003, HR-003, HR-004, SB-005, OOB-002 BSI (4.1.1) IMDA 4.5 SP 800-193 4.1.1(1-4, 7), 4.1.4(1-2), 4.2.2, 4.2.3(1-2), 4.2.4(5), 4.4.1 (1, 2a, 7, 12), 4.4.2(1-2, 4, 6-8, 10) ```

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommended Cybersecurity Requirements for Consumer-Grade Router Products.