You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-6 in Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy? (Part 48) Control AM-6: tion, and those objectives are assigned a relative priority among them. For example, human and environmental safety objectives may be the two most important objectives relevant to a Profile's context. In this example, when performing Task P-6, a system that relates to a human safety objective may be prioritized higher than a system that has the same impact levels but does not relate to the human safety objective. References: [FIPS 199]; [FIPS 200]; [SP 800-30]; [SP 800-39] (Organization and System Levels); [SP 80059]; [SP 800-60 v1]; [SP 800-60 v2]; [SP 800-160 v1] (System Requirements Definition Process); [IR 8179] (Criticality Analysis Process B); [CNSSI 1253]; [NIST CSF] (Core [Identify Function]; Profiles). ## CONTINUOUS MONITORING STRATEGY-ORGANIZATION TASK P-7 Develop and implement an organization-wide strategy for continuously monitoring control effectiveness. Potential Inputs: Risk management strategy; organization- and system-level risk assessment results; organizational security and privacy policies. Expected Outputs: An implemented organizational continuous monitoring strategy. Primary Responsibility: Senior Accountable Official for Risk Management or Risk Executive (Function). 62 Organizations operating National Security Systems follow the categorization guidance in [CNSSI 1253] which does not apply the high-water mark concept. 63 Organizations can also elect to use an alternative, organization-defined categorization approach to add additional granularity to the impact levels defined in [FIPS 199]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Supporting Roles: Chief Information Officer; Senior Agency Information Security Officer; Senior Agency Official for Privacy; Mission or Business Owner; System Owner; Authorizing Official or Authorizing Official Designated Representative.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: csf, risk management framework, fips. General security reference material without sensitive content. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) say about 2.1 Profile Topics and Requirements, Augmentations, and Features? (Part 2) According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS), 2.1 Profile Topics and Requirements, Augmentations, and Features: vice-using organizations could selectively require that their FCKMSs support some of the recommended augmentations or suggested features, but such requirements are beyond the scope of this document. In order to easily recognize Profile requirements, augmentations and features from the surrounding text, each type is presented in separate tables. For each table: -  Column one provides the PR, PA or PF number; -  Column two identifies any related security controls in [SP 800-53]; when column two is blank, no related security control has been identified; and -  Column three provides the text of the requirement, augmentation or feature. The first Framework requirement and the first Profile requirement, recommended augmentation and suggested feature are concerned with the overall conformance to the Framework and Profile. FR:1.1 A conformant CKMS design shall meet all 'shall' requirements of the Framework [SP 800-130] . | PR:2.1 | A Federal CKMS shall satisfy all Framework requirements ( FRs ) and Profile requirements ( PR s). | |----------|-----------------------------------------------------------------------------------------------------| | PA:2.1 | A Federal CKMS should support Profile augmentations ( PA s). | |----------|----------------------------------------------------------------| | PF:2.1 | A Federal CKMS could support Profile features ( PF s). |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Comments on this publication may be submitted to: according to NIST Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies According to Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies, Comments on this publication may be submitted to:: National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: SP800-175@nist.gov All comments are subject to release under the Freedom of Information Act (FOIA).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Domain Name System-Based Electronic Mail Security? (Part 34) Control AC-1: r each option. The orange arrows between the mail clients and the Postfix MTA reflect the fact that clients submitted email directly to the SMTP server for relay, while using Dovecot only to get mail. (The depiction in Figure 4.2 reflects that IMAP is not used to submit mail, only retrieve it, so the MUA sent mail directly to the Postfix server, but received the reply through the Dovecot server.) The project team demonstrated 30 different events using various combinations of MUA, MTA, and DNS Server components divided among five test sequences. In each sequence, signed and encrypted messages were sent from a sender to a recipient. Both Exchange and Postfix encrypted mail by default. Most of the exchanges employed either self-signed certificates or local CAs (see Appendix C). The BIND configuration was set up to obtain and validate certificates from the NIST Advanced Network Technologies Division's (ANTD's) DNS source (acting as a root CA). (See section 6 below for test sequence sets.) In one test sequence, fraudulently signed S/MIME email was sent from a malicious sender to recipients using Outlook and Thunderbird MUAs configured to use Exchange and Postfix as MTAs. The Outlook/Exchange configuration used Active Directory as its DNS server. The configurations employing Postfix/Dovecot MTAs were demonstrated with each of the other three contributed DNS services. In one event, the Thunderbird MUA employed an Apple Key Chain Utility tool that allows a host to obtain X.509 certificates via of DANE RRs. All events were conducted using well-known CA and Enterprise CAissued certificates for the impersonated sender. The fraudulent site attempted to spoof a valid sending domain belonging to a Secure64 site that was configured with DNS Authority/Cache/Signer DNS services, a Postfix/Dovecot MTA, and Thunderbird equipped with the Apple Key Chain utility. An Outlook/Exchange/ Active Directory set-up acted as the fraudulent site.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to NIST Test Personal Identity Verification (PIV) Cards Version 2? http: //smime2.nist.gov/PIVTest2/RSA2048IssuingCA.crl

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Test Personal Identity Verification (PIV) Cards Version 2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to Computer Security Division 2011 Annual Report? http: //csrc.nist.gov/groups/SNS/security-risk-analysis- enterprise-networks/

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2011 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 63) rational, environmental, and technical scenarios. The controls can be used to demonstrate compliance with a variety of governmental, organizational, or institutional security and privacy requirements. Organizations have the responsibility to select the appropriate security and privacy controls, to implement the controls correctly, and to demonstrate the effectiveness of the controls in satisfying security and privacy requirements.19 Security and privacy controls can also be used in developing specialized baselines or overlays for unique or specialized missions or business applications, information systems, threat concerns, operational environments, technologies, or communities of interest.20 15 [SP 800-30] provides guidance on the risk assessment process. 16 [IR 8062] introduces privacy risk concepts. 17 [SP 800-39] provides guidance on risk management processes and strategies. 18 [SP 800-37] provides a comprehensive risk management process. 19 [SP 800-53A] provides guidance on assessing the effectiveness of controls. 20 [SP 800-53B] provides guidance for tailoring security and privacy control baselines and for developing overlays to support the specific protection needs and requirements of stakeholders and their organizations. CHAPTER ONE PAGE 4 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ Organizational risk assessments are used, in part, to inform the security and privacy control selection process.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Special Factors Affecting Confidentiality Impact Determination according to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices? Special Factors Affecting Confidentiality Impact Determination: In cases where the consequences of unauthorized disclosure of labor relations information could seriously affect the agencies mission capability, protection of agency assets, and safety of individuals, the confidentiality impact level might be moderate

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Property Management Systems provide? (Section 86) | | CM-8, PM-5 | Technical Sup- port Specialist | | NIST Cybersecurity Framework | NIST Cybersecurity Framework | NIST Cybersecurity Framework | Standards and Best Practices | Standards and Best Practices | Standards and Best Practices | |--------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------|-----------------------------------------------------| | Func- tion | Category | Subcategory | PCI DSS v3.2.1 | NIST SP 800- 53r5 Security and Privacy Con- trols [9] | NICE Framework 2017 Work Roles [11] | | PROTECT (PR) | objectives and the organiza- tion's risk strat- egy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Securing Property Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 902) The set of hardware, software, and/or firmware that implements Approved security functions (including cryptographic algorithms and key generation) and is contained within the cryptographic boundary. Prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. The interdependent network of information technology infrastructures that includes the Internet, telecommunications networks, computer systems, and embedded processors and controllers in critical industries. A system operation that processes personally identifiable information. An analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. General term for any process of removing the association between a set of identifying data and the data subject. A planned, systematic set of multidisciplinary activities that seek to identify, manage, and reduce risk of exploitable vulnerabilities at every stage of the system, network, or subcomponent life cycle, including system, network, or product design and development; manufacturing; packaging; assembly; system integration; distribution; operations; maintenance; and retirement. An information security strategy that integrates people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization. An attribute associated with an assessment method that addresses the rigor and level of detail associated with the application of the method. A general term that includes developers or manufacturers of systems, system components, or system services; systems integrators; vendors; and product resellers.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Workforce Framework for Cybersecurity (NICE Framework) say about 3.1 Using Existing Task, Knowledge, and Skill (TKS) Statements? According to Workforce Framework for Cybersecurity (NICE Framework), 3.1 Using Existing Task, Knowledge, and Skill (TKS) Statements: Users of the NICE Framework reference one or more Task, Knowledge, and Skill statements (TKS statements), as described in Section 2, to describe both work and learners. Task statements are used to describe the work. Task statements have associated K&S statements. Although a Task statement may have a recommended set of associated K&S statements, users may include other existing K&S statements to tailor Tasks for their unique context. K&S statements are used to describe learners. K&S statements can be used in many ways to manage the cybersecurity workforce. They can be used in part, all together, or not at all, depending on the implementing organization's unique context. The notional examples of use below demonstrate areas where TKS statements might be implemented: - Employee Skill tracking program to determine promotion qualifications - Required Knowledge for completion of a course - Weekly Task list for completion at an organization TKS statements and examples can be found in the NICE Framework Resource Center and will be updated, as needed, to keep pace with changes resulting from evolving business missions, risks, or emerging technologies. [1]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Workforce Framework for Cybersecurity (NICE Framework).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control TF-8 in Common Platform Enumeration_ Naming Specification Version 2.3? (Part 45) Control TF-8: sions are roundtrip safe , meaning that taking one of the two bound forms, converting it to the other form, then converting that back to the original binding form, will result in the original binding. ## 7.1 Converting a URI to a Formatted String Given a URI u which conforms to the CPE v2.2 specification, the procedure for converting it to a formatted string fs has two steps: ``` function convert_uri_to_fs(u) w := unbind_uri(u). fs := bind_to_fs(w). return fs. end. ``` ## 7.2 Converting a Formatted String to a URI Given a formatted string fs which conforms to the description in Section 6.2.2, the procedure for converting it to a URI has two steps: ``` function convert_fs_to_uri(fs) w := unbind_fs(fs). uri := bind_to_uri(w). return uri. end. ``` ## Appendix A-References The following documents are indispensable references for understanding the application of this specification. ## A.1 Normative References [CPE22] Buttner, A. and N. Ziring, Common Platform Enumeration (CPE)-Specification, Version 2.2, March 11, 2009. See [RFC2119] Bradner, S. (1997). Key words for use in RFCs to Indicate Requirement Levels . March 1997. See [RFC2234] Crocker, D. and P. Overell. (1997). Augmented BNF for Syntax Specifications: ABNF . Internet RFC 2234, November 1997. See [RFC3629] Yergeau, F. (2003). UTF-8, a transformation format of ISO 10646. Internet RFC 3629, November 2003. See [RFC3986] Berners-Lee, T., Fielding, R. and L. Masinger. (2005). Uniform Resource Identifier (URI): Generic Syntax. Internet RFC 3986, January 2005. See [RFC5646] Phillips, A. and M. Davis. (2009). Tags for Identifying Languages. RFC 5646, September 2009. See ## A.2 Informative References [ISO19770-2] ISO/IEC 19770-2. (2009).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Platform Enumeration_ Naming Specification Version 2.3.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for the Creation of Interoperable Software Identification (SWID) Tags provide? (Section 4) rpreted as RFC 2119 key words. Some of the requirements and conventions used in this report reference Extensible Markup Language (XML) content. These references come in two forms, inline and indented. An example of an inline reference is: A patch tag is differentiated by the fact that the value of the @patch attribute within the < SoftwareIdentity > element is ' true '. In this example, the notation < SoftwareIdentity > can be replaced by the more verbose equivalent 'the XML element whose qualified name is SoftwareIdentity '. The general convention used when describing XML attributes within this report is to reference the attribute as well as its associated element, employing the general form ' @attributeName for the < prefix:localName >'. Attribute values are indicated in quotations, such as the example ' true ' above. In cases where any valid value may be provided for an XML attribute, this report specifies ' <any> ' as the attribute value. This report defines a number of new XML attributes that are extensions to the SWID specification. These extension attributes are defined in a new XML namespace, These new attributes will be assigned the prefix 'n8060' mapped to this namespace. In guidelines and examples, extension attributes will be provided in the form ' @n8060:attributeName '. The schema for these extensions can be downloaded at Indented references are intended to represent the form of actual XML content. Indented references represent literal content by the use of a fixed-length font, and parametric (freely replaceable) content by the use of an italic font. Square brackets '[]' are used to designate optional content. Both inline and indented forms use qualified names to refer to specific XML elements. A qualified name associates a named element with a namespace.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Creation of Interoperable Software Identification (SWID) Tags.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders provide? (Section 141) ct the list. Your screen should look like Figure 2-10. Figure 2-10 PSX Cockpit User Interface <!-- image --> - On the Cockpit screen, you can trigger an emergency (triangle icon in the upper right). Set your status (drop-down menu under your name); or reselect roles and groups, see configuration, and sign off (hamburger menu to the left of your name, and then tap username ). - If you pull down your notifications, you should see icons and text indicating Reporting interval: 120 seconds, Signed In: <date> <time>, Connected, and Registered. - Open the Mapping application. You should see the screen shown in Figure 2-11. - Select the Layers icon in the lower-right corner. Group names should appear under Layers. - Select a group. Your screen should look like Figure 2-12. Figure 2-11 PSX Mapping User Interface <!-- image --> Figure 2-12 PSX Mapping Group Member Information <!-- image --> - The locations of the devices that are members of that group should appear as dots on the map. - Select a device. A pop-up will show the user of the device and icons for phoning and messaging that user. - Selecting the Messenger icon for the selected user will take you to the Messenger application, where you can send a message to the user. - Open the Messenger application. Your screen should look like Figure 2-13. - Your screen should show People and Groups. Select one of them. - A list of people or groups to which you can send a message should appear. Select one of them. Your screen should look like Figure 2-14. Figure 2-13 PSX Messenger User Interface <!-- image --> Figure 2-14 PSX Messenger Messages <!-- image --> - You are now viewing the messaging window. You can type text for a message and attach a picture, video, voice recording, or map. - Tap the Send icon. The message should appear on your screen. - Tap the Pivot icon in the upper-right corner of the message window.

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-14 in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? (Part 47) Control SI-14: conditions listed above. • Compliance controls (e.g., those checking to ensure that all patches are up to date) Cyber resiliency focuses primarily on evolving and adapting rather than on compliance. Thus, unless a control is explicitly focused on ensuring that some specific (already established) cyber resiliency capability is implemented correctly and operating as intended, compliance controls are generally not considered part of cyber resiliency. • Vulnerability assessment controls While adversaries take advantage of vulnerabilities, identifying such vulnerabilities is not the focus of cyber resiliency. Some control families are more likely to support cyber resiliency than others. The Contingency Planning (CP), Incident Response (IR), System and Communications Protection (SC), and System and Information Integrity (SI) families have a high percentage of controls that are cyber resiliency oriented. However, controls that support cyber resiliency are not confined to these families nor are all controls in these families automatically controls supporting cyber resiliency. After the above criteria are applied, there may still be some ambiguity for some controls as to whether or not they are cyber resiliency in their focus. This is due in part to the overlap between aspects of cybersecurity and cyber resiliency. Delineation between the two is not easy to discern. To illustrate the distinction, it is useful to reference first principles. Cyber resiliency is essentially about ensuring continued mission operations despite the fact that an adversary has established a foothold in the organization’s systems and cyber infrastructure. • Controls that are largely focused on keeping the adversary out of systems and infrastructure are generally not resiliency controls. For example, identification and authentication controls such as IA-4 (Identifier Management) are generally not focused on combating an adversary after they have achieved a foothold in an organizational system.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, adversary, incident response. Contains technical security guidance that could inform defensive posture. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 886) Segmented Integer Counter (SIC) mode. Common Vulnerabilities and Exposures Common Weakness Enumeration Distribution Automation Defense Advanced Research Projects Agency Distributed Control System. A computer-based control system where several sections within the plants have their own processors, linked together to provide both information dissemination and manufacturing coordination. Distributed Denial of Service A form of anonymization that does not attempt to control the data once it has had PII identifiers removed, so it is at risk of re-identification. Distributed Energy Resources Data Encryption Standard Domain Expert Working Group Digital Fault Recorder Distribution Grid Management Department of Homeland Security Diffie-Hellman A cryptographic key exchange protocol first published by Whitfield Diffie and Martin Hellman in 1976. It allows two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure communications channel. Distinguished names String representations that uniquely identify users, systems, and organizations. DMS DN DNP DNS DoD DOE DoS DR Distribution Management System Distinguished Name Distributed Network Protocol Domain Name Service Department of Defense Department of Energy Denial of Service Demand Response DRBG Deterministic Random Bit Generators 156 DRM DRMS DSL DSPF DSS EAP EAX mode EAX’ ECC ECDH ECDSA ECPA EEO Digital Rights Management. A generic term for access control technologies used by standards providers, publishers, copyright holders, manufacturers, etc. to impose limitations on the usage of digital content and devices. The term is used to describe any technology that inhibits the use of digital content in a manner not desired or intended by the content provider.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-256 in Fiscal Year 2021 Cybersecurity and Privacy Annual Report? (Part 14) Control HA-256: publishes access control characteristics and general access control guidelines for various cloud service models. NIST also performs research and development regarding access control rules and methods. ## Personal Identity Verification (PIV) As required by Homeland Security Presidential Directive 12, NIST developed and maintains FIPS 201 for the personal identity verification (PIV) of federal employees and contractors. In FY 2019, NIST initiated a revision of FIPS 201 to incorporate the changing business requirements of federal departments and agencies and to adapt to an evolving technology environment. Revision activities began in FY 2019 with a business requirement meeting to engage with federal stakeholders about the revision goals. In FY 2020, the PIV team updated the draft standard based on the revision goals and published a public draft of FIPS 201. Comments received were adjudicated in FY 2021 and subsequently reflected in the final FIPS 201. The standard expands the set of PIV authenticators beyond the current practices (including the current smart card form factor) while addressing the interagency use of new types of PIV authenticators (i.e., derived PIV credentials) via federation. The revision also aims to facilitate the issuance of PIV cards by enabling remote identity proofing. These changes closely align with Office of Management and Budget (OMB) Policy Memorandum M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access . For FY 2022, the PIV team will actively work on Special Publications associated with FIPS 201 to further specify the standard's technical details while continuing outreach to federal stakeholders. ## Digital Identity Guidelines The four-volume set of Digital Identity Guidelines (NIST SP 800-63-3) was published in June 2017.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Fiscal Year 2021 Cybersecurity and Privacy Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Information Security Handbook_ A Guide for Managers say about 6.3.1 Emergency Disconnection? According to Information Security Handbook_ A Guide for Managers, 6.3.1 Emergency Disconnection: If one or both organizations detect an attack, intrusion attempt, or other contingency that exploits or jeopardizes the connected systems or their data, it might be necessary to abruptly terminate the interconnection without providing written notice to the other party. This extraordinary measure should be taken only in extreme circumstances and only after consultation with appropriate technical staff and senior management. The decision to make the emergency disconnection should be made by the system owner (or a designated staff member) and implemented by technical staff. The system owner or designee should immediately notify the other party verbally and receive confirmation of the notification. Both parties should work together to isolate and investigate the incident, in accordance with incident response procedures. If necessary, law enforcement authorities should be notified, and evidence should be preserved. The initiating party should provide a written notification to the other party in a timely manner (e.g., within five days). The notification should describe the nature of the incident, explain why and how the interconnection was terminated, and identify actions taken to isolate and investigate the incident. The notification should also specify when and under what conditions the interconnection may be restored, if appropriate.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, incident response. Contains technical security guidance that could inform defensive posture. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines for Securing Radio Frequency Identification (RFID) Systems? (Part 89) Control ES-1: dditional step takes time. When considering security controls, organizations need to balance the business impact of each security control's effect on transaction speed with the protection it provides. ## 3.3.3 Network Connectivity and Data Storage Whether or not an RFID system's readers are networked with database applications has major implications for the architecture of the RFID system and its security. When an application needs to link data with tags, the data needs to be stored somewhere. If the readers are networked with databases, then the data can be stored in the databases. Otherwise, the data must be stored on the tags. When data is stored centrally on database servers, the tag only needs to contain an identifier, which links the tag to its associated information. In this architecture, the vast majority of the data processing occurs on the supporting systems to which the reader is connected. On the other hand, when data is stored on tags, the tags must have some form of memory and support both write and read transactions. Regardless of where data is stored, the data's integrity must be protected. If the data is sensitive, its confidentiality must also be protected. The methods for achieving this include authentication, access control, encryption, and physical security. However, database servers and tags implement these methods in different ways. Nearly all commercial database servers support a wide variety of configurable security controls, but most tags do not. In general, RFID systems that use networked readers to access database servers are preferable to those that store data on tags, both in terms of cost and security. However, a system may require local storage of data on tags for several reasons, including: - GLYPH<c=31,font=/MCAMJE+Webdings> Extending the network to a remote RFID reader is not feasible or is more expensive than using tags that support the required functionality.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, sso. Contains security framework guidance for authentication systems. Source: Guidelines for Securing Radio Frequency Identification (RFID) Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Note according to Usability and Security Considerations for Public Safety Mobile Authentication? Note: Embedded cryptographic tokens are commonly used in MFA situations alongside a PIN, password, or biometric, and in this situation, would inherit the usability considerations and technical considerations from using the PIN or password, or any other second factor that is implemented. The use of a PIN, password, or biometric to unlock a mobile device could be considered the first factor in an MFA scenario.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa, token. Contains security framework guidance for authentication systems. Source: Usability and Security Considerations for Public Safety Mobile Authentication.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings say about 6th Annual PKI R&D Workshop - Proceedings? According to 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings, 6th Annual PKI R&D Workshop - Proceedings: Directory browsers, to automatically trust Argonne's administrative web servers. The key to a seamless portal experience is single sign-on (SSO). Although not required, s ingle sign-on allows users to jump from resource to resource and application to application within the portal without having to log in to each component individually. If a user had to provid e credentials to each application he accessed, even if those credentials were identical, the experience would be severely diminished.

Explanation: NIST publication on credential and access management. Topics: pki, single sign-on, sso. Contains security framework guidance for authentication systems. Source: 6th Annual PKI R&D Workshop _Applications-Driven PKI_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-17(06) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control AC-17(06): informaon about remote access mechanisms is protected from unauthorized use and disclosure. POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CP-9(8) in Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach? Control CP-9(8): SYSTEM BACKUP | CRYPTOGRAPHIC PROTECTION

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Remote Electronic UOCAVA Voting say about Notes:? According to Security Considerations for Remote Electronic UOCAVA Voting, Notes:: Individuals with privileged access to the voting system should be uniquely identified by the voting system. That is, system administrators, election officials, and other with access to voting system should not share accounts or login credentials. This allows for greater accountability of administrative actions performed on the voting system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Remote Electronic UOCAVA Voting.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PM-8200 in Cell Phone Forensic Tools_ an Overview and Analysis? (Part 101) Control PM-8200: MIS provides examiners with a user interface containing a set of tabs providing examiners with the ability to create report notes, import archived reports, search acquired data and PIN administration. SIMIS allows the following data types to be acquired from SIM cards: Abbreviated Dial Numbers (ADN), Fixed Dial Numbers (FDN), International Mobile Subscriber Identity (IMSI), Last Numbers Dialed (LND), Mobile Subscriber Integrated Services Digital Network Number (MSISDN), Short Message Server Parameters (SMSP), SMS Short Messages, Deleted Messages, Public Land Mobile Networks (PLMNS), Forbidden Public Land Mobile Networks (FPLMNS), Location Information, Broadcast Control Channel (BCCH), Cell Broadcast Message Identifier for Data Download (CBMID), Voicemail Number, Integrated Circuit Card Identification (ICCID), Phase ID, Service Provider, Administration Data, Service Dialing Number (SDN) and Capability Configuration Parameters. The tool can also perform a full dump of the card contents for analysis. ## Acquisition Stage The acquisition stage begins by prompting the examiner to select the interface to be used as illustrated below. Figure 66: Interface Selection <!-- image --> If the SIM is password protected, the screen below appears. If the examiner does not have the PIN for the SIM, only unprotected data can be acquired from the SIM. Figure 67: SIM PIN Wizard <!-- image --> If the correct PIN is known, it can be entered into the input window shown in Figure 68 below. 19 Additional information about SIMIS can be found at: Figure 68: SIM PIN Input <!-- image --> After the correct PIN number has been entered, the examiner can Change, Unlock, Activate, or Deactivate the PIN from the user interface, as illustrated in Figure 69 below.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2012 Annual Report? (Part 199) Control HA-3: knows how to engage successfully with the White House; civilian, defense and intelligence agencies; and industry on cybersecurity, keeping these constituencies focused on the issues. She is heavily invested in initiatives to secure cloud and mobile computing, the Smart Grid, and supply chain. Kevin Stine 2012 WEDI Award of Merit <!-- image --> Kevin Stine was GLYPH(cmap:df00)esignateGLYPH(cmap:df00) by the Workgroup for Electronic Data Interchange (WEDI) BoarGLYPH(cmap:df00) of Directors as a recipient of the 2012 WEDI AwarGLYPH(cmap:df00) of Merit. WEDI, established in 1991 in response to a challenge from then Secretary of Health anGLYPH(cmap:df00) Human Services, Louis Sullivan, MD, brings together a consortium of leaGLYPH(cmap:df00)ers within the healthcare industry to identify practical strategies for reducing administrative costs in healthcare through the implementation of electronic data interchange. This awarGLYPH(cmap:df00) recognizes inGLYPH(cmap:df00)iviGLYPH(cmap:df00)uals who have contributeGLYPH(cmap:df00) in a meaningful way to the success of WEDI and/or WEDI Strategic National Implementation Process (SNIP) programs and activities through their volunteer commitment and talents. Dr. Ron Ross Distinguished Practitioner Award 28th Annual Computer Security Applications Conference Dr. Ross received the Distinguished Practitioner AwarGLYPH(cmap:df00) at the 28 th Annual Computer Security Applications Conference. <!-- image --> This awarGLYPH(cmap:df00) is presenteGLYPH(cmap:df00) to an inGLYPH(cmap:df00)iviGLYPH(cmap:df00)ual who has GLYPH(cmap:df00)emonstrateGLYPH(cmap:df00) a continuing, vital, anGLYPH(cmap:df00) influential contribution to the fielGLYPH(cmap:df00) of information security . SC Magazine's Influential IT Security MinGLYPH(cmap:df00)s in 2012 Dr. Ross was also recognizeGLYPH(cmap:df00) by SC Magazine as one of the Influential IT Security MinGLYPH(cmap:df00)s in 2012.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms say about 2.3.4 International Organization for Standardization (ISO) 37? (Part 1) According to Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms, 2.3.4 International Organization for Standardization (ISO) 37: 2.3.4 International Organization for Standardization (ISO) 37 ISO is a non-governmental, worldwide federation of national standards bodies. Its mission is to develop international standards that help make industry more efficient and effective. ISO standards cover almost all aspects of technology and business, from food safety to computers, and from agriculture to healthcare. Experts from all over the world develop the standards that are required by the nation or liaison organization they represent using a consensus process. ISO/IEC JTC 1 is a joint technical committee of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). ISO/IEC JTC 1 SC 27 is the subcommittee for IT security. Working group 2 (WG2) is the group developing standards for cryptography and security mechanisms. It usually has more than 20 active projects to develop either a revision of an existing standard or a new standard. Each standard consists of multiple parts, and each part includes multiple algorithms and/or mechanisms. The cryptographic algorithms and schemes in FIPS and SPs are usually included in ISO/IEC standards, along with many other algorithms submitted by other countries. The following is a list of ISO/IEC standards that include cryptographic algorithms and schemes specified in NIST standards. 1. ISO/IEC 9797-1, Information technology -Security techniques -Message Authentication Codes (MACs) - Part 1: Mechanisms using a block cipher . 2. ISO/IEC 9797-2, Information technology -Security techniques -Message Authentication Codes (MACs) - Part 2: Mechanisms using a dedicated hashfunction . 3. ISO/IEC 10116, Information technology -Security techniques -Modes of operation for an n-bit block cipher . 4. ISO/IEC 10118-3, Information technology -Security techniques -Hash-functions - Part 3: Dedicated hash-functions . 5.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 256) of the systems that are the targets of the penetration testing. CA-2(1) provides additional information on independent assessments that can be applied to penetration testing. Related Controls: CA-2. (2) PENETRATION TESTING | RED TEAM EXERCISES Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]. Discussion: Red team exercises extend the objectives of penetration testing by examining the security and privacy posture of organizations and the capability to implement effective cyber defenses. Red team exercises simulate attempts by adversaries to compromise mission and business functions and provide a comprehensive assessment of the security and CHAPTER THREE PAGE 93 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ privacy posture of systems and organizations. Such attempts may include technology-based attacks and social engineering-based attacks. Technology-based attacks include interactions with hardware, software, or firmware components and/or mission and business processes. Social engineering-based attacks include interactions via email, telephone, shoulder surfing, or personal conversations. Red team exercises are most effective when conducted by penetration testing agents and teams with knowledge of and experience with current adversarial tactics, techniques, procedures, and tools.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: penetration test, red team. Contains technical security guidance that could inform defensive posture. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives provide? (Section 49) manufacturing supply chains requires: 1. An information sharing approach that transcends the typical business-to-business (B2B) bilateral exchanges of information that is exchanged in supply chains. The existing bi-lateral exchanges are well-supported by existing IT, legal, contractual, and liability methods and means. In contrast, blockchain and related technologies have potential to share information in a wider yet trusted scope, but are not yet widely supported in IT, legal, contractual, and liability methods and means. 2. Agreement and cooperation to share traceability information across relevant stakeholders, sufficient to correlate traceability with each relevant stakeholders' internal enterprise systems. The tradeoff is between minimal information shared with potentially redundant information in enterprise systems, or more information shared but with increased requirement for fine grained and rules-based access control. The analysis of tradeoff alternatives must include time, effort, and resilience to future changes. 3. Linking physical objects to cyber records. Validation of authenticity of a physical part, requires that the part is inspected (independent of its packaging and labeling) to detect a unique characteristic or signature which can be linked to electronic records. This can occur at 2 layers. The first is an actual physical marking (see Section 4.2, Cyber-Physical Anchors) and the second is a trusted data layer or hardware root of trust. For example, the operator of a nuclear power plant can verify the authenticity of an ICT/OT microelectronic component by comparing the traceability signature on the component with the matching traceability data record in the trusted data layer, before using that component during routine maintenance. 4. Cooperation across the supply chain to write and read traceability records, and adoption of technology, methods, and means to mark and inspect goods and services for linkage with electronic records. 5.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain and Related Technologies to Support Manufacturing Supply Chain Traceability_ Needs and Industry Perspectives.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-06(05) in Assessing Security Requirements for Controlled Unclassified Information? (Part 8) Control AC-06(05): n accordance with applicable access control policies. A.03.01.02[02]: approved authorizations for logical access to system resources are enforced in accordance with applicable access control policies. ## ASSESSMENT METHODS AND OBJECTS ## Examine [SELECT FROM: access control policy and procedures; procedures for access enforcement; system design documentation; system configuration settings; list of approved authorizations (i.e., user privileges); system audit records; system security plan; other relevant documents or records] ## Interview [SELECT FROM: personnel with access enforcement responsibilities; system administrators; personnel with information security responsibilities; system developers] ## Test [SELECT FROM: mechanisms for implementing the access control policy] ## REFERENCES Source Assessment Procedure: AC-03 ## 03.01.03 Information Flow Enforcement ## ASSESSMENT OBJECTIVE Determine if: A.03.01.03[01]: approved authorizations are enforced for controlling the flow of CUI within the system. A.03.01.03[02]: approved authorizations are enforced for controlling the flow of CUI between connected systems.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified, cui. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Protocol Control and Liability : according to NIST Blockchain Networks_ Token Design and Management Overview According to Blockchain Networks_ Token Design and Management Overview, Protocol Control and Liability :: The distributed and cryptographic nature of blockchain technology provides resilience and verifiability but does not eliminate the notions of control and liability. Permissions, roles, and backstops may be placed at the base layer and the smart contract layer, potentially giving some degree of protocol control to privileged entities that could be held accountable for their actions. This entails making policy decisions that can have wide-ranging implications, especially if nodes span across jurisdictions. Isolated legal actions from a small subset of those jurisdictions may, by design, not be able to affect a blockchain's global state. Note that data may also be isolated and kept within certain region(s) via the use of separate blockchain networks, states for subsets of participants, or off-chain schemes. International regulation, survey, and standardization efforts have been developed to help address adverse outcomes and rethink oversight approaches in such distributed and digital environments [122][123].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control VE-20131763 in CVSS Implementation Guidance? (Part 49) Control VE-20131763: [Web page] [accessed 3/26/14]. | | [2] | D. Waltemire, S. Quinn, K. Scarfone, and A. Halbardier, The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2 , NIST SP 800-126 Revision 2, National Institute of Standards and Technology, U.S. Department of Commerce, Gaithersburg, MD, September 2011. [Web page] [accessed 3/26/14]. | | [3] | D. Kaminsky, It's The End Of The Cache As We Know It , Presented at Black Ops 2008, Japan, 2008. [Web page] Kaminsky/BlackHat-Japan-08-Kaminsky-DNS08-BlackOps.pdf [accessed 3/26/14]. | | [4] | Gallagher, Sean, 'New JavaScript hacking tool can intercept PayPal, other secure sessions,' ArsTechnica , September 21, 2011. [Web page] http://arstechnica.com/business/2011/09/new-javascript-hacking-tool-can-intercept- paypal-other-secure-sessions/ [accessed 3/26/14]. | | [5] | IBM, Security Bulletin: Multiple security vulnerabilities in the IBM InfoSphere Information Server Suite . [Web page] 01.ibm.com/support/docview.wss?uid=swg21623501 [accessed 3/26/14]. | | [6] | IBM Internet Security Systems, Apple QuickTime Clear() code execution . [Web page] [accessed 3/26/14]. | | [7] | IBM Internet Security Systems, OpenStack Dashboard session hijacking . [Web page] [accessed 3/26/14]. | | [8] | Industrial Control Systems Cyber Emergency Response Team, Post Oak Bluetooth Traffic Systems Insufficient Entropy Vulnerability , Advisory (ICSA-12-335-01), November 30, 2012. [Web page] [accessed 3/26/14].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: CVSS Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE) say about 3.4.2.8 Threat Event 8-Compromise of Device Integrity via Observed, Inferred, or Brute-Forced Device Unlock Code? According to Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE), 3.4.2.8 Threat Event 8-Compromise of Device Integrity via Observed, Inferred, or Brute-Forced Device Unlock Code: Summary: A malicious actor may be able to obtain a user's device unlock code by direct observation, side-channel attacks, or brute-force attacks. Both the first and second can be attempted with at least proximity to the device; only the third technique requires physical access. However, side-channel attacks that infer the unlock code by detecting taps and swipes to the screen can be attempted by applications with access to any peripherals that detect sound or motion (microphone, gyroscope, or accelerometer). Once the device unlock code has been obtained, a malicious actor with physical access to the device will gain immediate access to any data or functionality not already protected by additional access control mechanisms. Additionally, if the user employs the device unlock code as a credential to any other systems, the attacker may further gain unauthorized access to those systems.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach provide? (Section 529) 1 DEVELOPING CYBER-RESILIENT SYSTEMS _________________________________________________________________________________________________ ATT&CK Technique Mitigation or Candidate Mitigation Cyber Resiliency Implementation Approaches Potential Effects Cyber Resiliency Controls Scheduled Transfer (T1029) Network Intrusion Prevention (M1031) Monitoring and Damage Assessment Detect SI-4(4) Covert Signaling (CM1112) Tainting Detect, Reveal SI-20 Present Decoy Data (CM1113) Disinformation, Misdirection Tainting Deceive, Degrade Detect, Scrutinize SC-30(4), SC-26 SI-20 Fragment Information (CM1114) Fragmentation Delay, Exert SI-23 Modulate Information Flows (CM1153) Design Diversity, Replication Negate, Exert Process Monitoring (CM2015) Monitoring and Orchestration Analyze Outgoing Traffic Patterns (CM2042) Damage Assessment, Behavior Validation Monitoring and Damage Assessment, Behavior Validation Exert Detect Detect AC-4(27), AC- 4(30) AC-4(29) AU-6, IR-4(13) SI-4(18), IR- 4(13) Transfer Data to Cloud Account (T1537) Covert Signaling (CM1112) Tainting Detect, Reveal SI-20 Present Decoy Data (CM1113) Disinformation, Misdirection Tainting Deceive, Degrade Detect, Scrutinize SC-30(4), SC-26 SI-20 Fragment Information (CM1114) Cloud Account Monitoring (CM2016) Fragmentation Delay, Exert SI-23 Monitoring and Damage Assessment, Behavior Validation Detect AC-2(12) TABLE F-16: POTENTIAL EFFECTS OF CYBER RESILIENCY ON IMPACT ATT&CK Technique Mitigation or Candidate Mitigation Account Access Removal (T1531) Use Alternate Communications (CM1140) Dynamic Account Management (CM1117) Cyber Resiliency Implementation Approaches Potential Effects Cyber Resiliency Controls Path Diversity Shorten, Reduce AC-7(4), SC-47 Dynamic Privilege, Dynamic Reconfiguration Dynamic Reconfiguration Shorten, Reduce AC-2(6)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Device Security_ Cloud and Hybrid Builds provide? (Section 1) Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C) Joshua Franklin Kevin Bowler Christopher Brown Spike E. Dog Sallie Edwards Neil McNab Matthew Steele This publication is available free of charge from: The original draft of this publication is available free of charge from: <!-- image --> Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C) Joshua Franklin National Institute of Standards and Technology Information Technology Laboratory Kevin Bowler Christopher Brown Spike E. Dog Sallie Edwards Neil McNab Matthew Steele The MITRE Corporation McLean, VA February 2019 <!-- image --> U.S. Department of Commerce Wilbur Ross, Secretary National Institute of Standards and Technology Walter G. Copan, Undersecretary of Commerce for Standards and Technology and Director Executive Summary National Institute of Standards and Technology Information Technology Laboratory Kevin Bowler Christopher Brown Spike E. Dog Sallie Edwards Neil McNab Matthew Steele The MITRE Corporation McLean, VA This publication is available free of charge from: The original draft of this publication is available free of charge from: <!-- image --> - ◼ Adopting mobile devices without the necessary policies and management infrastructure in place increases the opportunities for attackers to breach sensitive enterprise data. - ◼ The National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) developed example mobile device and enterprise mobility management solutions that organizations can use to reduce the likelihood of a data breach.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Cloud and Hybrid Builds.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AN-2013 in Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet? (Part 92) Control AN-2013: It also specifies the order in which the remaining records shall appear in the file. | | REC-IDC- Matches Records | ForEach (Record in Recs) ( Present(Subfield in 1.003 ST AND ( EQ({InfoI(1.003.REC) in Subfield}, RecType(Record)), EQ({InfoI(1.003.IDC) in Subfield}, {Record.002}) ) ) Note: The record types must appear in the same order that they are listed in Fld(1.003) ) | | | | | | | | | | | 2 | NIEM- Transaction REC-CNT- IDC- Matches Records | Complex ( ForEach (Record in Recs) ( Present(XElm(1.003.biom:ContentRecordSummar y) ST AND ( EQ({XElm(1.003.biomRecordCategoryCode) in XElm(1.003.biom:ContentRecordSummary)}, RecType(Record)), EQ({XElm(1.003.ImageReferenceIdentification) in XElm(1.003.biom:ContentRecordSummary)}, {Record.002}) ) ) Note: The record types must appear in the same order that they are listed in Fld(1.003) ) | | M- Transaction | | | | B | | TX.14 - Tra nsaction: SRN Sequential | 7.3.2.1 | The value of the SRN shall be a sequentially assigned positive integer starting from one and incremented by one, not to exceed 255.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.1.3 Globally Unique Identifiers according to NIST The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2 According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2, 3.1.3 Globally Unique Identifiers: The elements listed in Table 13 have special conventions around the format of their identifiers ( @id attribute). Authors MUST follow these conventions because they preserve the global uniqueness of the resulting identifiers. In Table 13, namespace contains a valid reverse-DNS style string (limited to letters, numbers, periods, and the hyphen character) that is associated with the content author. Examples include "com.acme.finance" and "gov.tla". These namespace strings MAY have any number of parts, and SCAP content consumers processing them SHALL treat them as case-insensitive (e.g., com.ABC is considered identical to com.abc). The name in the format conventions MUST be an NCName-compliant string [XMLS]. Table 13 - Element Identifier Format Convention | Element | Identifier Format Convention | |-----------------------------|-----------------------------------| | <ds:data-stream-collection> | scap_ namespace _collection_ name | | <ds:data-stream> | scap_ namespace _datastream_ name | | <ds:component-ref> | scap_ namespace _cref_ name | | <ds:component> | scap_ namespace _comp_ name | | <ds:extended-component> | scap_ namespace _ecomp_ name |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Voice Over IP Systems say about 8.1 IPsec? (Part 2) According to Security Considerations for Voice Over IP Systems, 8.1 IPsec: d. The IPsec header and the new IP Header for this encapsulating packet are the only information left in the clear. Usually each 'tunnel' is between two network elements such as a router or a gateway. In some cases, such as for mobile users, the tunnel could be between a router/gateway on one end and a client on the other end. The IP addresses of these nodes are used as the unencrypted IP address at each hop. Hence, at no point is a plain IP header sent out containing both the source and destination IP. Thus if an attacker were to intercept such packets, they would be unable to discern the packet contents or the origin and destination. Note that some traffic analysis is possible even in tunnel mode, because gateway addresses are readable. If a gateway is used exclusively by a particular organization, an attacker can determine the identity of one or both communicating organizations from the gateway addresses. IPsec allows nodes in the network to negotiate not only a security policy, which defines the security protocol and transport mode as described previously, but also a security association defining the encryption algorithm and algorithm key to be used Figure 11. IPsec Tunnel and Transport Modes <!-- image --> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Voice Over IP Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 7.3. LEV Recall of KEV Lists according to NIST Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability According to Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability, 7.3. LEV Recall of KEV Lists: The statistical measurement of 'recall', applied to LEV, measures the coverage of KEV lists by LEV lists of differing threshold values. As discussed previously in Sec. 3.3, an LEV list can be created by choosing a threshold probability and then including all vulnerabilities with an LEV probability greater than the threshold. Fig. 4 provides the recall measurements for an LEV list relative to its coverage of a KEV list. Fig. 4. Recall measurements for LEV and CISA KEV <!-- image --> Even at a threshold of 0.1, the LEV list does not provide more than 60 % coverage. This indicates that LEV lists should not be used as a replacement for KEV lists. It does not necessarily show a deficiency in LEV. It demonstrates that there are a large number of low probability vulnerabilities, and given the large number, many of them will actually be exploited despite their low probability.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Likely Exploited Vulnerabilities_ A Proposed Metric for Vulnerability Exploitation Probability.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-06(05) in Assessing Security Requirements for Controlled Unclassified Information? (Part 23) Control AC-06(05): ned. A.03.02.01.ODP[03]: the frequency at which to update security literacy training content is defined. A.03.02.01.ODP[04]: events that require security literacy training content updates are defined. A.03.02.01.a.01[01]: security literacy training is provided to system users as part of initial training for new users. security literacy training is provided to system users A.03.02.01.a.01[02]: <A.03.02.01.ODP[01]: frequency> after initial training. A.03.02.01.a.02: security literacy training is provided to system users when required by system changes or following <A.03.02.01.ODP[02]: events> . A.03.02.01.a.03[01]: security literacy training is provided to system users on recognizing indicators of insider threat. A.03.02.01.a.03[02]: security literacy training is provided to system users on reporting indicators of insider threat. A.03.02.01.a.03[03]: security literacy training is provided to system users on recognizing indicators of social engineering. A.03.02.01.a.03[04]: security literacy training is provided to system users on reporting indicators of social engineering. A.03.02.01.a.03[05]: security literacy training is provided to system users on recognizing indicators of social mining. A.03.02.01.a.03[06]: security literacy training is provided to system users on reporting indicators of social mining. ## A.03.02.01.b[01]: security literacy training content is updated <A.03.02.01.ODP[03]: frequency> . A.03.02.01.b[02]: security literacy training content is updated following <A.03.02.01.ODP[04]: events> .

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Secure Web Services say about A.7.3 Logic Bombs, Trapdoors, and Backdoors? According to Guide to Secure Web Services, A.7.3 Logic Bombs, Trapdoors, and Backdoors: A logic bomb is malicious code that is left dormant until the Web service reaches a certain state, at which point the malicious code is executed. A trapdoor or backdoor is malicious code that has the specific objective of enabling the attacker (or the Web service that acts as a proxy service on the attacker's behalf) to bypass the targeted Web service's (or its host's) authentication mechanisms to gain access to sensitive data or resources, without being detected. Logic bombs, trapdoors, and backdoors are usually delivered as Trojan horses via another attack vector such as a virus or worm payload or planted by an attacker who has gained the necessary level of write-access to the Web service host. Note that many logic bombs, backdoors, and trapdoors are planted by the developer of the Web service that contains them. Unlike external attackers, developers can exploit their deep knowledge of how a particular Web service's host will be configured in deployment, and how its system-, middleware-, and application-level components will interact.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, attack vector. Contains technical security guidance that could inform defensive posture. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Bluetooth Security say about 3.2.1 Low Energy Security Modes and Levels? (Part 1) According to Guide to Bluetooth Security, 3.2.1 Low Energy Security Modes and Levels: 3.2.1 Low Energy Security Modes and Levels Low energy security modes are similar to BR/EDR service-level security modes (i.e., Security Modes 2 and 4) in that each service can have its own security requirements. However, Bluetooth low energy also specifies that each service request can have its own security requirements as well. A device enforces the service-related security requirements by following the appropriate security mode and level. - Low energy Security Mode 1 has multiple levels associated with encryption. Level 1 specifies no security, meaning no authentication and no encryption will be initiated. Level 2 requires unauthenticated pairing with encryption. Level 3 requires authenticated pairing with encryption. 4.2 added Level 4 which requires authenticated low energy Secure Connections pairing with encryption. - Low energy Security Mode 2 has multiple levels associated with data signing. Data signing provides strong data integrity but not confidentiality. Level 1 requires unauthenticated pairing with data signing. Level 2 requires authenticated pairing with data signing. If a particular service request and the associated service have different security modes and/or levels, the stronger security requirements prevail. For example, if either requires Security Mode 1 Level 3, then the requirements for Security Mode 1 Level 3 are enforced. Because Security Mode 1 Level 4 requires low energy Secure Connections authenticated pairing and Encryption, using AES-CMAC and P-256 elliptic curve for pairing and AES-CCM for encryption, NIST considers this the most secure of these modes/levels and strongly recommends its use for all low energy connections in 4.2. For 4.0 and 4.1 low energy connections, NIST strongly recommends using Security Mode 1 Level 3 as it requires authenticated pairing and encryption although not as strong (not using P-256 elliptical curve) encryption as Level 4. Security Mode 1 Level 1 is the least secure and should never be used.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Guide to Bluetooth Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) provide? (Section 219) g an architectural review, the assessment team for a Federal CKMS shall have access to all CKMS design information, third-party-validation information, and the available results of FCKMS/CKMS testing. | |-----------|------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | PA:11.4 | | When penetration testing is to be performed on a Federal CKMS, the penetration-testing scenarios should be determined by the architectural review team. | | PA:11.5 | SA-4 | A Federal CKMS using-organization should analyze the results of the architectural review before procuring an FCKMS. | Functional and security testing of an FCKMS should be performed prior to initial deployment, during subsequent periodic security reviews, and during incremental security assessments. Functional and security tests could be performed by the CKMS developer, CKMS implementer, the FCKMS service provider, or a trusted third-party. These tests could also be performed, or the results reviewed, by an FCKMS-using organization. Functional testing should include usability tests for users whose knowledge and experience with an FCKMS range from novice to expert. An FCKMS is considered to be 'user-friendly' when it can be easily used by novice users, or when the services are automatically provided and controlled by an FCKMS that is 'transparent' to the user. FR:11.7 The CKMS design shall specify all required functional and security testing of the CKMS. FR:11.8 The CKMS design shall report the results of all functional and security tests performed to date. | PR:11.6 | SA-11 | AFederal CKMS shall undergo functional and security testing, including ease-of-use tests before initial operation.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Abstract according to NIST Building Secure Microservices-based Applications Using Service-Mesh Architecture According to Building Secure Microservices-based Applications Using Service-Mesh Architecture, Abstract: The increasing trend in building microservices-based applications calls for addressing security in all aspects of service-to-service interactions due to their unique characteristics. The distributed cross-domain nature of microservices needs secure token service (STS), key management and encryption services for authentication and authorization, and secure communication protocols. The ephemeral nature of clustered containers (by which microservices are implemented) calls for secure service discovery. The availability requirement calls for: (a) resiliency techniques, such as load balancing, circuit breaking, and throttling, and (b) continuous monitoring (for the health of the service). The service mesh is the best-known approach that can facilitate specification of these requirements at a level of abstraction such that it can be uniformly and consistently defined while also being effectively implemented without making changes to individual microservice code. The purpose of this document is to provide deployment guidance for proxy-based Service Mesh components that collectively form a robust security infrastructure for supporting microservices-based applications.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, key management. Contains security framework guidance for authentication systems. Source: Building Secure Microservices-based Applications Using Service-Mesh Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Labels for Open Systems_ an Invitational Workshop say about End System Label Requirements? According to Security Labels for Open Systems_ an Invitational Workshop, End System Label Requirements: - Between two ESs, confidentiality and integrity requirements must be exchanged with data - Multilevel ESs on multilevel networks require security labels in order to perform trusted demultiplexing - ESs usually translate network security labels to a local format Xerox Special Information Systems A V

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Labels for Open Systems_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Recommendation for Key Management_ Part 1 – General? (Part 178) Control HA-3: ld be maintained in a central repository or network of mutually trusted repositories and operated in accordance with a Key-Inventory Policy. See SP 800-57, Part 2 for additional information. If a key is compromised, the owners or sponsors associated with the compromised key need to be notified so that remedial actions can be taken, including revoking the key, performing an analysis of the effects of the compromise, and replacing the key when appropriate. The information in the inventory can be used to identify who is to be notified and how to contact them. If an owner is no longer authorized to use a key (e.g., the owner is a human who left the organization or a device that is removed from the system), other entities need to be notified so that further interaction using that key is terminated. If the key is a symmetric key, the information in the inventory can be used to identify other entities that need to be notified and how to contact them. If the key is an asymmetric key and PKI certificates are used, notification is usually accomplished using CRLs. If the cryptoperiod for a key expires or is about to expire, the key needs to be replaced if interactions between the entities using that key are to continue (i.e., using a replacement key). A key-inventory management system can be used to monitor cryptoperiods and alert the key owners or sponsors that keys are about to expire. The inventory management system can also be used to find keys for algorithms and key lengths that are no longer considered to be secure in order to arrange for algorithm and/or key replacement.

Explanation: NIST publication on credential and access management. Topics: pki, key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information say about B.2. Challenges in Using Federation Technologies for Message Switch Use Cases? (Part 3) According to Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information, B.2. Challenges in Using Federation Technologies for Message Switch Use Cases: e CAD/RMS system. This can limit the damage an attacker could do by intercepting and using that assertion. They would be unable to forward it on to gain access to other agency systems or applications. Applying federation technologies to the message switch scenario is challenging because it is not a traditional identity federation scenario, but rather delegated authorization. The CAD/RMS system initiates a transaction with the message switch on the user's behalf. The user is not directly involved in this transaction; they are one step removed from it. Authorization protocols like Kerberos and the OAuth 2.0 Authorization Framework are designed for these types of transactions. However, Kerberos is not typically deployed across organizational boundaries, and OAuth 2.0 is not yet widely deployed in the public safety environment. Therefore, this document presents two options for implementing this scenario with the widely used SAML 2.0 standards: - Proxy IdP -A Proxy IdP accepts an assertion from an IdP and uses it to create its own assertion to provide to another RP, effectively acting as an IdP to that other RP. In the above example, the CAD/RMS system could use the identity information received in the assertion from the IdP to craft its own assertion, sign it with its own private key, and pass it on to the message switch, adjusting the audience parameter and other fields to reflect the intended use of this new assertion. Refer to Appendix A.3.1 of [8] for more details on the Proxy IdP concept. - WS-Trust -WS-Trust is another federation standard that the CAD/RMS system can use to request a new assertion from the IdP that is intended to be presented to the message switch.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, multi-factor. Contains security framework guidance for authentication systems. Source: Multi-Factor Authentication for Criminal Justice Information Systems_ Implementation Considerations for Protecting Criminal Justice Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.3.8.3 Vulnerability Scan Targets according to NIST Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case, 3.3.8.3 Vulnerability Scan Targets: All devices connected to the Plant and Supervisory network segments are scanned. The IT Staff will configure a scan for all network segments of Westman. A new scan can be established, or a modification can be made to an existing scan, by submitting a request to the IT Manager. Note: If an individual identifies that a scan is impacting the manufacturing process, they must report the situation immediately to the IT Manager to request stopping the scan and report the situation to the Director of Operations.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Random Bit Generator (RBG) Constructions say about 2.8.1.2. DRBG Generation Request? (Part 1) According to Recommendation for Random Bit Generator (RBG) Constructions, 2.8.1.2. DRBG Generation Request: 2.8.1.2. DRBG Generation Request Pseudorandom bits are generated after DRBG instantiation using the following function: ( status, returned\_bits ) = DRBG\_Generate ( state\_handle, requested\_number\_of\_bits, requested\_security\_strength, additional\_input ) . Fig. 6. DRBG\_Generate function <!-- image --> The DRBG\_Generate function (shown in Fig. 6) is used to generate a specified number of bits. If a suitable state\_handle is provided during instantiation, it is included as input to indicate the DRBG instance to be used. The number of bits to be returned and the security strength that the DRBG needs to support for generating the bitstring are provided with (optional) additional input. As stated in Sec. 2.4.1, the ability to accept additional input is recommended. The DRBG\_Generate function returns status information - either an indication of success or an error. If the returned status code indicates a success, the generated bits are returned. - If requested\_number\_of\_bits is equal to or greater than the instantiated security strength, the security strength that the returned\_bits can support (if used as a key) is: ss\_key = the instantiated security strength, where ss\_key is the security strength of the key. - If the requested\_number of bits is less than the instantiated security strength, and the returned\_bits are to be used as a key, the key is capable of supporting a security strength of: <!-- formula-not-decoded --> - If the output is used to form multiple keys, the security strength that can be supported by each key is: ss\_of\_each\_key = min ( key\_length , instantiated\_security\_strength ) . If the status code indicates an error, the returned\_bits consists of a Null bitstring. An example of a condition in which an error indication may be returned is a request for a security strength that exceeds the instantiated security strength for the DRBG. Details about the DRBG\_Generate function are provided in [SP\_800-90A].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Random Bit Generator (RBG) Constructions.