You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography? (Part 50) Control HA-3: ession of the correct static private key from a trusted third party (trusted by the recipient) either before or during a key-agreement transaction that makes use of that static public key. The methods used by a third party trusted by the recipient to obtain that assurance are beyond the scope of this Recommendation (however, see the discussion in Section 5.6.2.2.3 above). ## 5.6.2.2.3.2 Recipient Obtains Assurance Directly from the Claimed Owner (i.e., the Other Party) When two parties engage in a key-agreement transaction, there is (at least) an implicit claim of ownership made whenever a static public key is provided on behalf of a given party. That party is considered to be a claimed owner of the corresponding static key pair - as opposed to being a true owner - until adequate assurance can be obtained that the party is actually the one authorized to use the static private key. The claimed owner can provide such assurance by demonstrating its knowledge of that private key. If all the following conditions are met during a key-agreement transaction that incorporates key confirmation as specified in this Recommendation, then while establishing keying material, the recipient of a static public key may be able to directly obtain (initial or renewed) assurance of the claimed owner's (i.e., the other party's) current possession of the corresponding static private key: 1. The recipient of the static public key contributes an ephemeral public key to the keyagreement process, one that is intended to be arithmetically combined with the claimed owner's (i.e., the other party's) static private key in computations performed by the claimed owner. (If an appropriate key-agreement scheme is employed, the claimed owner will be challenged to demonstrate current knowledge of his static private key by successfully performing those computations during the transaction.) 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings say about 9 Availability? According to 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings, 9 Availability: The component matching software is included in OpenLDAP release as a module and can be downloaded at openldap.org/software/download/ . The eSNACC ASN.1 compiler can be obtained from DigitalNet at com/knowledge/download.htm .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case say about Highlighted Performance Impacts? According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case, Highlighted Performance Impacts: No performance measurement experiments were performed for network segmentation and segregation due to it being implemented on the PCS before the Manufacturing Profile implementation was initiated.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-1 in 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings? (Part 233) Control HA-1: on, on the other hand, may be possible under either scheme through the use of signed authorization messages for access control. ## 6 REFERENCES [ANSI03] American National Standards Institute. Biometric Information Management and Security for the Financial Services Industry. ANSI X9.84-2003. 2003. [INCITS04] InterNational Committee for Information Technology Standards. Information Technology - Finger Pattern Based Interchange Format . January 2004. [IAB04] Interagency Advisory Board (IAB) Data Model Task Force. IAB Data Model Task Force Report v0.6 (Draft). October 2004. [ISO01] International Standards Organization. Identification cards - Contactless integrated circuit(s) cards - Proximity cards - Parts 1-4 . ISO/IEC 14443. 2000-2001. [ISO01b] International Standards Organization. Information technology - Open Systems Interconnection - The Directory: Public- key and attribute certificate frameworks. ISO/IEC 9594-8. August 2001. [ISO04] International Standards Organization. Information technology -- Biometric data interchange formats . ISO 19794. Under development, 2004. [MAM+99] M. Myers, R. Ankney, A. Malpani, S. Galperin, C. Adams. X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP . IETF RFC 2560. June 1999. [OASIS02] Organization for the Advancement of Structured Information Standards ## 4th Annual PKI R&D Workshop -- Proceedings (OASIS). Guidelines for using XML Signatures with the OASIS Security Assertion Markup Language (SAML). Draft 02. September 2002. - [PAIIWG04] Government Smart Card Interagency Advisory Board's Physical Security Interagency Interoperability Working Group, Technical Implementation Guidance: Smart Card Enabled Physical Access Control Systems, Version 2.2. July 2004. - [PDR+01] Fernando Podio, Jeffrey Dunn, Lawrence Reinert, Catherine Tilton, Lawrence O'Gorman, M. Paul Collier, Mark Jerde, - Brigitte Wirtz. CBEFF: Common Biometric Exchange File Format .

Explanation: NIST publication on credential and access management. Topics: access control, authorization, pki. Contains security framework guidance for authentication systems. Source: 4th Annual PKI R&D Workshop _Multiple Paths to Trust_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Computer Security Division 2009 Annual Report say about Automated Security Testing and Test Suite Development? (Part 2) According to Computer Security Division 2009 Annual Report, Automated Security Testing and Test Suite Development: multi-block mes- sages, which require the chaining of information from one block to the next. Other types of validation testing exist to satisfy other testing requirements of cryptographic algorithms. Automated security testing and test suite development are integral components of the Cryptographic Algorithm Validation Program (CAVP). The CAVP encompasses validation testing for FIPS-approved and NIST-recommended cryptographic algorithms. Cryptographic algorithm validation is a prerequisite to the Cryptographic Module Validation Program (CMVP). All of the tests under the CAVP are handled by the 18 third-party laboratories that are accredited as CMT laboratories by NVLAP . We develop and maintain a Cryptographic Algorithm Validation System (CAVS) tool that automates the validation testing.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management say about Appendix A-Acronyms? (Part 3) According to Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, Appendix A-Acronyms: KRI Key risk indicator NCCIC National Cybersecurity and Communications Integration Center NCP National Checklist Program NTCTF NSA/CSS Technical Cyber Threat Framework NVD National Vulnerability Database OLIR Online Informative References OT Operational technology OVAL Open Vulnerability Assessment Language POA&M Plan of Actions & Milestones RDR Risk Detail Record SCAP Security Content Automation Protocol SIEM Security Incident Event Monitoring SWOT Strength, Weakness, Opportunity, and Threat Analysis TTP Tactics, Techniques, and Procedures

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Attribute Based Access Control (ABAC) Definition and Considerations say about Executive Summary? (Part 4) According to Guide to Attribute Based Access Control (ABAC) Definition and Considerations, Executive Summary: Further, ABAC enables object owners or administrators to apply access control policy without prior knowledge of the specific subject and for an unlimited number of subjects that might require access. As new subjects join the organization, rules and objects do not need to be modified. As long as the subject is assigned the attributes necessary for access to the required objects (e.g., all Nurse Practitioners in the Cardiology Department are assigned those attributes), no modifications to existing rules or object attributes are required. This benefit is often referred to as accommodating the external (unanticipated) user and is one of the primary benefits of employing ABAC. When deployed across an enterprise for the purposes of increasing information sharing among diverse organizations, ABAC implementations can become complex-supported by the existence of an attribute management infrastructure, machine-enforceable policies, and an array of functions that support access decisions and policy enforcement. In addition to the basic policy, attribute, and access control mechanism requirements, the enterprise must support management functions for enterprise policy development and distribution, enterprise identity and subject attributes, subject attribute sharing, enterprise object attributes, authentication, and access control mechanism deployment and distribution. The development and deployment of these capabilities requires the careful consideration of a number of factors that will influence the design, security, and interoperability of an enterprise ABAC solution.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Guide to Attribute Based Access Control (ABAC) Definition and Considerations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Batch or Rising according to Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers? Batch or Rising: Batch indexes all of the table's data every time that it runs, whereas Rising uses a checkpoint to update the data that it collects from the table. We selected Rising.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality say about 2 Authority? According to Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality, 2 Authority: This document has been developed by the National Institute of Standards and Technology (NIST) in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347. NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III. This guideline has been prepared for use by federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright. (Attribution would be appreciated by NIST.) Nothing in this document should be taken to contradict standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. Conformance testing for implementations of the mode of operation that is specified in this Part of the Recommendation will be conducted within the framework of the Cryptographic Module Validation Program (CMVP), a joint effort of NIST and the Communications Security Establishment of the Government of Canada. An implementation of a mode of operation must adhere to the requirements in this Recommendation in order to be validated under the CMVP. The requirements of this Recommendation are indicated by the word 'shall.'

Explanation: NIST publication discussing classified information handling. References: secret, national security. Contains guidance on protecting sensitive government information. Source: Recommendation for Block Cipher Modes of Operation_ the CCM Mode for Authentication and Confidentiality.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Computer Security Log Management provide? (Section 90) sible. The organization can then revise its policies so that the infrastructure implementation will be less resource-intensive, while ensuring that all legal and regulatory requirements are still met. Because of the complexities of log management, it may take a few cycles of policy modification, infrastructure design, and design assessment to finalize the policy and design. When designing a log management infrastructure, organizations should consider several factors related to the current and future needs of both the infrastructure and the individual log sources throughout the organization. Major factors include the following: - GLYPH<c=31,font=/APONEK+Webdings> The typical and peak volume of log data to be processed per hour and day. The typical volume of log data tends to increase over time for most log sources. The peak volume should include handling extreme situations, such as widespread malware incidents, vulnerability scanning, and penetration tests that may cause unusually large numbers of log entries to be generated in a short period of time. If the volume of log data is too high, a logging denial of service may result. Many logging products rate their capacity for processing log data by the volume of events they can process in a given time, most often in events per second (EPS). - GLYPH<c=31,font=/APONEK+Webdings> The typical and peak usage of network bandwidth. - GLYPH<c=31,font=/APONEK+Webdings> The typical and peak usage of online and offline (e.g., archival) data storage. This should include an analysis of the time and resources needed to perform backups and archival of log data, as well as disposing of the data once it is no longer needed. - GLYPH<c=31,font=/APONEK+Webdings> The security needs for the log data. For example, if log data needs to be encrypted when transmitted between systems, this could require more processing by the systems, as well as increased usage of network bandwidth.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware, penetration test. Contains technical security guidance that could inform defensive posture. Source: Guide to Computer Security Log Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-7 in Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance? (Part 76) Control CM-7: Enforce software usage and installation restrictions. | These Subcategory requirements can be met by implementing solutions that provide the Authentication and Authorization, System Use Monitoring, and Physical Access Monitoring technical capabilities. Potential solutions for meeting these Subcategory requirements include: Microsoft Active Directory, FreeIPA, Symantec Endpoint Protection, Native operating system/device capabilities, electronic access control systems, cameras, Sign in/out sheets Solutions that were implemented in use cases: Active Directory Symantec Endpoint Protection Native operating system/device capabilities Electronic access control system Sign in/out sheet | | DETECT | Security Continuous Monitoring (DE.CM) | DE.CM-4 | Low Deploy malicious code protection mechanisms throughout the manufacturing system where safe and feasible to detect and eradicate malicious code. Update malicious code protection mechanisms whenever new releases are available in accordance with the configuration management policy and procedures for the manufacturing system. | These Subcategory requirements can be met by implementing solutions that provide the Anti-virus/malware and Vulnerability Management technical capabilities.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware. Contains technical security guidance that could inform defensive posture. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs say about Table of Contents? (Part 1) According to Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs, Table of Contents: Table of Contents | | Introduction ..................................................................................................................... | Introduction ..................................................................................................................... | |------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | Background: NIST Cryptographic Standards and Testing/Validation Programs ... 1 Methodology.......................................................................................................... 2 | Background: NIST Cryptographic Standards and Testing/Validation Programs ... 1 Methodology..........................................................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Organizational Views of NIST Cryptographic Standards and Testing and Validation Programs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control HA-3 in Computer Security Division 2012 Annual Report? (Part 118) Control HA-3: ap:df00) GLYPH(cmap:df00)raft of FIPS 140-3. As a result, NIST requesteGLYPH(cmap:df00) additional public comments in August 2012 on several clearly iGLYPH(cmap:df00)entifieGLYPH(cmap:df00) sections. More GLYPH(cmap:df00)etails about the project anGLYPH(cmap:df00) a timetable can be founGLYPH(cmap:df00) at: nist.gov/groups/ST/FIPS140\_3/ . During FY2013, all receiveGLYPH(cmap:df00) comments on the iGLYPH(cmap:df00)entifieGLYPH(cmap:df00) issues will be aGLYPH(cmap:df00)GLYPH(cmap:df00)resseGLYPH(cmap:df00) anGLYPH(cmap:df00) the final FIPS 140-3 GLYPH(cmap:df00)ocument will be prepareGLYPH(cmap:df00) for a final internal review anGLYPH(cmap:df00) approval by the Secretary of Commerce. nist.gov/groups/ST/FIPS140\_3/ Contact: Dr. Michaela Iorga (301) 975-8431 michaela.iorga@nist.gov ## Personal IGLYPH(cmap:df00)entity Verification (PIV) T est CarGLYPH(cmap:df00)s Federal Information Processing Standard (FIPS) 201, Personal IGLYPH(cmap:df00)entity Verification (PIV) of FeGLYPH(cmap:df00)eral Employees and Contractors , was publisheGLYPH(cmap:df00) in February 2005 to satisfy policy GLYPH(cmap:df00)irectives specifieGLYPH(cmap:df00) in HomelanGLYPH(cmap:df00) Security PresiGLYPH(cmap:df00)ential Directive-12 (HSPD-12). The majority of feGLYPH(cmap:df00)eral workers now have Personal IGLYPH(cmap:df00)entity Verification (PIV) carGLYPH(cmap:df00)s; however , the PIV carGLYPH(cmap:df00) has not yet been embraced as a mechanism for logical access to IT resources. The unavailability of test PIV cards has been iGLYPH(cmap:df00)entifieGLYPH(cmap:df00) as an impeGLYPH(cmap:df00)iment to GLYPH(cmap:df00)eployment for this purpose. To facilitate the development of applications and miGLYPH(cmap:df00)GLYPH(cmap:df00)leware that support the PIV carGLYPH(cmap:df00), CSD GLYPH(cmap:df00)evelopeGLYPH(cmap:df00) a reference set of smart cards.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CS-3 in U.S. Department of Energy Risk Assessment Methodology? (Part 77) Control CS-3: ed for the Classified Program. How/ever, it should be noted that selected Orders apply to both programs and are marked with an ( * ). ** NOTE; See Cross Reference List for numerical listing of Orders. | ucrAK 1 Mcn 1 ur ADP SYSTEM RISK ASSESSMENT | ucrAK 1 Mcn 1 ur ADP SYSTEM RISK ASSESSMENT | CROSS REFERENCE NUMERIC LISTING OF DOE ORDERS USED TO DEVELOP SECURITY REQUIREMENTS | STEP 3 RESOURCE TABLE R3 (Page 3) | |-----------------------------------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|-------------------------------------| | OOe:;;::fi::::::.:::: OOCVMeNT NUMBER | DOE DOCMMBIT TITI^ (A» ^ | DOE DOCMMBIT TITI^ (A» ^ | BASELINE REQUIREMENT CODE | | 1000.38 | INTERNAL CONTROL SYSTEMS | INTERNAL CONTROL SYSTEMS | K, | | 1330.18 | MANAGEMENT OF AUTOMATED INFORMATION SYSTEMS AND DATA RESOURCES | MANAGEMENT OF AUTOMATED INFORMATION SYSTEMS AND DATA RESOURCES | C. | | 1360.1 A | ACQUISITON AND MANAGEMENT OF COMPUTING RESOURCES | ACQUISITON AND MANAGEMENT OF COMPUTING RESOURCES | D.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: U.S. Department of Energy Risk Assessment Methodology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-7 in Vetting the Security of Mobile Applications? (Part 6) Control CM-7: y the estimated risk as pass, warning or fail. While some standards exist for expressing risk assessment 15 and vulnerability reporting 16 the current adoption of these standards by test tools is low. To the extent possible, it is recommended that an organization use test tools that leverage vulnerability reporting and risk assessment standards. If this approach is not possible, it is recommended that the organization provide sufficient training to analysts on the interpretation of reports and risk assessments generated by test tools. ## 5.8 Compliance versus Certification For mobile application vetting, two terms are frequently used to demonstrate proof of successful implementation of mobile app security requirements. For a mobile application that has been developed to include security aimed at a particular requirement (e.g. National Information Assurance Partnership - Requirements for Vetting Mobile Apps from the Protection Profile for Application Software [7]) developers may choose to note that they are compliant or certified. The difference depends on the organization's need for compliance or certification. Compliance for mobile application security means either self-attestation or attestation from an unofficial third party that has validated the mobile app meets such security requirements. For example an enterprise may choose to use their own internally developed mobile application vetting process to validate the security and privacy of a mobile application. By going through their own internal process they approve the mobile application for use in their organization or on 15 An example standard, the Common Vulnerability Scoring System CVSS, is discussed in Section 4.2.3. 16 Examples are described in Section 2.1. their organization's mobile assets. On the other hand, certification means successful validation from the authorized validator. For example, for NIAP certification, a formal NIAP validation process must be followed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Vetting the Security of Mobile Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security and the Data Encryption Standard_ Proceedings of the Conference on Computer Security and the Data Encryption Standard provide? (Section 69) ime we will have to use more down to earth approaches. Human beings will be heavily involved in key management, and as in any security situation, careful steps must be taken to ensure their integrity. In practice it will be necessary to sacrifice extra complexity for the sake of smooth operation. In addition to careful planning, the chosen system should be thoroughly tested and particular attention paid to what would happen in abnormal situations such as loss of a key or recovery from a system crash. All possible eventualities should be considered and a comprehensive set of rules established. A tight discipline must then be enforced. A final reminder, if the key management scheme is not designed properly or adequately enforced, the result could not only be disastrous from a security viewpoint but the viability of the entire system may be jeopardized. Reference [1] Chambers R.P., Random Number Generation, I.E.E.E. Spectrum, February 1967. Design and Specification of Cryptographic Capabilities Interbank Card Association Carl M. Campbell, Jr. (Consultant) 8 09 Maiin Road, Newtown Square, Pa. 19073 Cryptography can be used to provide data secrecy, data authentication, and originator authentication. Non-reversible transformation techniques provide only the last. Cryptographic check digits provide both data and originator authentication, but no secrecy. Data secrecy, with or without data authentication, is provided by block encryption or data stream encryption techniques. Total systems security may be provided on a link-by-link, nodeby-node, or end-to-end basis, depending upon the nature of the application. Key words: Cryptography; data security; encryption. Up to the present, cryptography has been a relatively unknown science, used primarily to secure sensitive governmental communications.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Computer Security and the Data Encryption Standard_ Proceedings of the Conference on Computer Security and the Data Encryption Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does General Access Control Guidance for Cloud Systems say about 1.1 Purpose? According to General Access Control Guidance for Cloud Systems, 1.1 Purpose: Access control (AC) dictates how subjects (i.e., users and processes) can access objects based on defined AC policies to protect sensitive data and critical computing objects in the cloud systems. Considering the heterogeneity and remote nature of the cloud service models, AC and its general concepts should be revisited. In recent years, many works have focused on AC in cloud systems [23, 25, 26, 27]. However, these are primarily ad hoc solutions targeted at specific cloud applications and do not provide comprehensive views of cloud AC. This document presents a set of general AC guidance for cloud service models independent from its deployment models because it requires another layer of access control that depends on the security requirements of the business function for which the cloud system is used. As shown in Figure 3, different cloud service models require the management of access to different components of the offered service. Since such cloud service models can be considered hierarchical, the AC considerations of functional components in a lower-level (according to Figure 2) service model (e.g., networking and storage layers in the Infrastructure as a Service (IaaS) model) are also applicable to the same functional components in a higher-level service model (e.g., networking and storage in Platform as a Service (PaaS) and Software as a Service (SaaS) models). In general, AC considerations for IaaS are also applicable to PaaS and SaaS, and AC considerations for IaaS and PaaS are also applicable to SaaS. Thus, AC guidance for IaaS is applicable to PaaS and SaaS, and AC guidance for IaaS and PaaS is also applicable to SaaS. However, each service model has its own focus with regard to AC. For instance, an IaaS provider may put more effort into virtualization control, and in addition to the virtualization control, a SaaS provider needs to consider data security and the privacy of services it provides.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: General Access Control Guidance for Cloud Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders provide? (Section 12) work for this publication was done while at employer. The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register. Respondents with relevant capabilities or product components were invited to sign a Cooperative Research and Development Agreement (CRADA) with NIST, allowing them to participate in a consortium to build this example solution. We worked with: | Technology Partner/Collaborator | Build Involvement | |-----------------------------------|-----------------------------------------------------------------------------| | Ping Identity | Federation Server | | Motorola Solutions | Mobile Applications | | Yubico | External Authenticators | | Nok Nok Labs | Fast Identity Online (FIDO) Universal Authentication Framework (UAF) Server | | StrongKey | FIDO Universal Second Factor (U2F) Server | NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL.

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain RISK MANAGEMENT according to NIST Fiscal Year 2023 Cybersecurity and Privacy Annual Report According to Fiscal Year 2023 Cybersecurity and Privacy Annual Report, RISK MANAGEMENT: Organizations must balance an evolving cybersecurity and privacy threat landscape with the need to fulfill mission and business requirements - an effort that increasingly calls for a collaborative approach to managing risks. Risk management is integrated into NIST standards and guidelines to help organizations understand, measure, manage, and reduce cybersecurity and privacy risks in a larger context.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Fiscal Year 2023 Cybersecurity and Privacy Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Common Biometric Exchange Formats Framework (CBEFF) say about Patron Format Specification? (Part 7) According to Common Biometric Exchange Formats Framework (CBEFF), Patron Format Specification: what specific CBEFF optional fields are present in the record/structure (see below). Use of this element facilitates the dynamic, automated interpretation or parsing of the information within the SBH. | Patron Format A Specific Field | Field Source | Length | Bit Location | Mandatory/ Optional | Notes | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|----------|---------------------------------------------------------------------------------------------------------------------------------|-----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Optional Fields Present Mask Subheader/Basic Structure Count PID Patron Format Identifier Index Biometric Creation Date Validity Period Biometric Type Biometric Subtype CBEFF Header Version Patron Header Version Biometric Purpose Biometric Data Type Biometric Data Quality Creator Challenge/Response Payload | Format A | 2 bytes | x'0001' x'0002' x'0004' x'0008' x'0010' x'0020' x'0040' x'0080' x'0100' x'0200' x'0400' x'0800' x'1000' x'2000' x'4000' x'8000' | Optional | Present only if 'Optional Fields Present' = 1.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Common Biometric Exchange Formats Framework (CBEFF).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet say about AN-2013 Annex G: Mapping to the NIEM IEPD? (Part 44) According to Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet, AN-2013 Annex G: Mapping to the NIEM IEPD: | | |-----------------------------------------------|-----------------------------------------------|-----------------------------------------------|-----------------------------------------------|----------------------------------------------------------|-----------------------------------------------|-----------------------------------------------|-----------------------------------------------|-----------------------------------------------|-----------------------------------------------|-----------------------------------------------|-----------------------------------------------| | Record Type-1: Transaction information record | Record Type-1: Transaction information record | Record Type-1: Transaction information record | Record Type-1: Transaction information record | Record Type-1: Transaction information record | Record Type-1: Transaction information record | Record Type-1: Transaction information record | Record Type-1: Transaction information record | Record Type-1: Transaction information record | Record Type-1: Transaction information record | Record Type-1: Transaction information record | Record Type-1: Transaction information record | | | | 1 | Type1- 1.005- Occurrences | EQ ( Count(FldsInRec(Rec(1), Int(5))), Int(1) ) | | M-Rec(1) | | | | T | | | | | 1 | Type1- 1.006- Occurrences | MO ( Count(FldsInRec(Rec(1), Int(6))), Set-Int([0,1]) ) | | M-Rec(1) | | | | T | | | | | 1 | Type1- 1.007- Occurrences | EQ ( Count(FldsInRec(Rec(1), Int(7))), Int(1) ) | | M-Rec(1) | | | | T | | | | | 1 | Type1- 1.008- Occurrences | EQ ( Count(FldsInRec(Rec(1), Int(8))), Int(1) ) | | M-Rec(1) | | | | T | | | | | 1 | Type1- 1.009- Occurrences | EQ ( Count(FldsInRec(Rec(1), Int(9))), Int(1) ) | | M-Rec(1) | | | | T |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Testing Methodology Framework for ANSI_NIST-ITL 1-2011 Update_ 2013, Data Format for the Interchange of Fingerprint, Facial & Other Biomet.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Source Controls according to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations? Source Controls: AC-02, AC-02(03), AC-02(05), AC-02(13)

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls provide? (Section 122) with security violations. The data administration area is responsible for the successful management and control of the data files and data bases necessary to support the information processing system. This area is supported by data management systems (which are intended to permit access to and retrieval from existing files, usually in response to single applications, reports generation, or simple information retrieval requirements) and/or data base management systems (which are intended to integrate and manage data in a nonredundant structure for [Processing by multiple applications). The data administrator should set policies to ensure that only properly authorized users have access to the various data and programs in the computer system. The following three definitions are important for the controls considered here: Identification is the process that enables, generally by the use of unique machine-readable names, recognition of users or resources as identical to those previously described to an ADP system. Authorization is the granting to a user, a program, or a process the right of access. Authentication is a measure designed to increase protection against fraudulent transmissions by establishing the validity of a transmission, message, station, or originator. 1. It is important that identification, authorization, and authentication are all carried out (either by the data administration area or by other components of the computer system or both) 2. Since it is possible for authorized or unauthorized users to circumvent data administration controls provided by the data base management system and thereby access data and programs either through the underlying operating system or directly, the data administration area must also be cognizant of operating system access controls and flaws and consider compensatory administrative and procedural controls. 3.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Audit and Evaluation of Computer Security II_ System Vulnerabilities and Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Dramatically Reducing Software Vulnerabilities_ Report to the White House Office of Science and Technology Policy provide? (Section 91) lysis,' is a means of assessing risks or threats [Fundamental08]. Through threat analysis, software can be designed to avoid the introduction of some vulnerabilities and reduce the severity of others. For instance, one form of threat analysis is documenting attack surfaces to understand how adversaries might use interfaces to elevate privilege. Without performing threat analysis, preferably at both the architectural and design levels, software can contain vulnerabilities that might otherwise be avoided [Shostack14]. Architectural threat analysis can significantly increase the security robustness and resilience of the architecture of software and its high-level designs to dramatically reduce the number and severity of vulnerabilities [Diamant11]. The call for a dramatic reduction in software vulnerability is heard from multiple sources, including the 2016 Cybersecurity National Action Plan. This report has identified five approaches for achieving this goal. Each approach meets three criteria: 1) have a potential for dramatic improvement in software quality, 2) could make a difference in a three to seven-year time frame and 3) are technical activities. The identified approaches use multiple strategies: - Stopping vulnerabilities before they occur, including improved methods for specifying and building software; - Finding vulnerabilities, including better testing techniques and more efficient use of multiple testing methods and - Reducing the impact of vulnerabilities by building architectures that are more resilient, so that vulnerabilities cannot be meaningfully exploited. Formal Methods. Formal methods include multiple techniques based on mathematics and logic, ranging from parsing to type checking to correctness proofs to model-based development to correct-by-construction.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Dramatically Reducing Software Vulnerabilities_ Report to the White House Office of Science and Technology Policy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Blockchain Networks_ Token Design and Management Overview provide? (Section 28) This can lead to massive data leaks and abusive data collection for users and businesses. Blockchain technology has enabled a new software paradigm for managing digital ownership in partial- or zero-trust environments. It uses tokens to conduct transactions, exchange verifiable data, and achieve coordination across organizations and on the web. Fundamental to this representation is that users can independently control token custody in digital wallets through public-key cryptography and interact with one another in a peer-to-peer manner. Blockchain networks provide secure transaction reconciliation, linkage, and storage in consolidated, integrity-protected distributed ledgers. They form mutually operated record-keeping execution environments or virtual machines. Combined with off-chain resources, blockchain-based tokens can allow for faster and cheaper transaction settlement while bolstering user-centric ownership models and interoperable data representations. Blockchain networks and the tokens that they form or support are also interchangeably referred to as cryptonetworks . Bitcoin and Ethereum introduced the technologies of blockchains and smart contracts as well as new types of global, web-native social constructs with decentralized governance. Anyone with an internet connection can view the blockchain, operate a publishing node, and submit transactions. Blockchain addresses are derived from public keys generated directly by the users who control the associated private keys' custody. Transactions are signed using these private keys before being validated and reconciled by the blockchain nodes, providing data integrity and public verifiability. More generally, the domain of permissionless blockchains brought about protocol-native tokens, or cryptocurrencies .

Explanation: NIST publication on credential and access management. Topics: token, sso. Contains security framework guidance for authentication systems. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Validating the Correctness of Hardware Implementations of the NBS Data Encryption Standard say about PLAIN? According to Validating the Correctness of Hardware Implementations of the NBS Data Encryption Standard, PLAIN: 01A1D6D039776742 5CD54CA83DEF57DA 0248D43806F67172 51454B582DDF440A 42FD443059577FA2 059B5E0851CF143A 0756D8E0774761D2 7625].4B829BF486A 3BDD119049372802 26955F6835AF609A 164D5E404F275232 6B056E18759F5CCA 004BD6EF09176062 480D39006EE762F2 437540C8698F3CFA 072D43A077075292 02FE55778117F12A 1D9D5C5018F728C2 305532286D6F295A CIPHER 690F5B0D9A26939B 7A389D10354BD271 868EBB51CAB4599A 7178876E01F19B2A AF37FB421F8C4095 86A560F10EC6D85B 0CD3DA020021DC09 EA676B2CB7DB2B7A DFD64A815CAF1A0F 5C513C9C4886C088 0A2AEEAE3FF4AB77 EF1BF03E5DFA575A 88BF0DB6D70DEE56 A1F9915541020B56 6FBF1CAFCFFD0556 2F22E49BAB^CA1AC 5A6B612CC26CCE4A 5F4C038ED12B2E41 63FAC0D034D9F793

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validating the Correctness of Hardware Implementations of the NBS Data Encryption Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Guidelines for Smart Grid Cybersecurity? (Part 378) Control SI-11: individuals are characterized by multi- decade experience and history in their companies. Examples include distribution operations departments, field operations, and distribution engineering/planning. In terms of personnel security, it may be worthwhile considering “two-person integrity,” or “TPI,” a security measure to prevent single-person access to key management mechanisms. This practice comes from national security environments but may have some applicability to the smart grid where TPI security measures might be thought of as somewhat similar to the safety precaution of having at least two people working in hazardous environments. Another area of concern related to personnel issues has to do with not having a backup to someone having a critical function; in other words, a person (actor) as a single point of failure (SPOF). 7.3.4 Security Levels A security model should be built with different security levels that depend on the design of the network/system architecture, security infrastructure, and how trusted the overall system and its elements are. This model can help put the choice of technologies and architectures within a security context and guide the choice of security solutions. 7.3.5 Distributed vs. Centralized Model of Management There are unique issues associated with how to manage a system as distributed as the smart grid, yet maintain efficiency and reliability factors that imply centralization. Many grid systems are highly distributed, geographically isolated, and require local autonomy—as commonly found in modern substations. Yet these systems need to have a measure of centralized security management in terms of event logging/analysis, authentication, etc. There should be a series of standards in this area that can strike the right balance and provide for the “hybrid” approach necessary for the smart grid.

Explanation: NIST publication on credential and access management. Topics: authentication, key management, sso. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS) say about 2.1 Demonstration of Invariant Properties? (Part 1) According to Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS), 2.1 Demonstration of Invariant Properties: 2.1 Demonstration of Invariant Properties The first step in the process is to postulate a set of properties, or invariants, that the system must exhibit: things that happen with suitably small (approximating "never") or large (approximating "always") probability. The desirability of these properties is seldom in dispute when they are discussed in general terms (e.g., "safety," "security," or "integrity"). An example is the midair failure of a commercial airliner's structure (an instance of "safety") . The specified probability of this occurrence is so small that it should "never" happen within the service life of a given aircraft. Once a property is selected and a definition established (e.g., the actual allowed probability of structural failure) then the system to be constructed is modelled in some suitable mathematical notation, and a mathematical argument is presented that the model exhibits the properties. Continuing our commercial aircraft analogy, this first step is the stress analysis of the structure, which is based on an abstract representation of the aircraft. The step in no sense guarantees a safe airplane because people do not fly in abstract representations. Weaknesses can be introduced in later development steps through errors in detailed design, poor materials, or shoddy workmanship. The level of assurance at this point is that the aircraft is not inherently unsafe in a way that no amount of skill in detail design or construction can overcome. The output of this step is a specification for the entity to be constructed which is consistent in the sense that it does not contradict itself and is relevant in the sense that it describes a useful and feasible system. The importance of this first step should not be underestimated. Without this step, the project runs the risk of building an inappropriate system that is entirely correct (in the sense that the implementation meets the specifications) , but does not perform any useful function.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report of the Invitational Workshop on Integrity Policy in Computer Information Systems (WIPCIS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Workshop on Enhancing Security of Devices and Components Across the Supply Chain say about 2.2.1. Speaker Viewpoints? (Part 2) According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain, 2.2.1. Speaker Viewpoints: ives), there need to be different tiers of metrics based on the audience or user. For example, the CWE structure could be used to define security requirements that lead to associated security metrics. Jason noted that CWEs for hardware are relatively new, starting around 2020, compared to CWEs' long track record for software, which started around 2006. Since CWEs point out common root cause weaknesses that lead to vulnerabilities, they foster a more proactive approach by allowing security issues to be discovered and mitigated earlier in the hardware development life cycle, thus lowering the financial impact. Having good metrics that can be used to inform design and business decisions would be helpful to the semiconductor community. Finally, Mark Tehranipoor from the University of Florida emphasized the importance of thinking about security and associated metrics in the early stages of the hardware development life cycle. Specifically, this involves conducting a security and risk assessment and developing a security architecture during the specification and planning phases. The dynamic nature of the IC development process may impact the metrics that need to be developed, and a security metric that is suitable for the register-transfer level (RTL) may not be appropriate at the gate or physical level. He noted that time-to-market constraints still run on an approximately six- to nine-month cycle, but complexity has increased, leading to the need for automation in security, reliability, and testing. This increased complexity also increases the number of assets to protect and the number of potential vulnerabilities to mitigate. Regardless of what security techniques and associated security metrics are used early in the development life cycle (i.e., pre-silicon), verification is still needed during the physical layout and post-silicon stages.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Workshop on Enhancing Security of Devices and Components Across the Supply Chain.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Trustworthy Email provide? (Section 219) validity of information transmitted. Authenticity protection includes, for example, protecting against man-in-themiddle attacks/session hijacking and the insertion of false information into sessions. The information system only allows the use of [ Assignment: organization-defined certificate authorities ] for verification of the establishment of protected sessions. Supplemental Guidance: Reliance on certificate authorities (CAs) for the establishment of secure sessions includes, for example, the use of Secure Socket Layer (SSL) and/or Transport Layer Security (TLS) certificates. These certificates, after verification by their respective CAs, facilitate the establishment of protected sessions between web clients and web servers. Justification : Prior to establishing a TLS connection for SMTP transmission of email, a sending MTA should authenticate the certificate provided by the receiving MTA. This authentication could be PKIX, or an alternative method ( e.g., DANE, SMTP-STS, etc.). See Section 5.2 for details. Control: The organization employs a detonation chamber capability within [ Assignment: organization-defined system, system component, or location ]. Supplemental Guidance: De tonation chambers, also known as dynamic execution environments, allow organizations to open email attachments, execute untrusted or suspicious applications, and execute Universal Resource Locator (URL) requests in the safety of an isolated environment or a virtualized sandbox. These protected and isolated execution environments provide a means of determining whether the associated attachments or applications contain malicious code. While related to the concept of deception nets, this control is not intended to maintain a long-term environment in which adversaries can operate and their actions can be observed.

Explanation: NIST publication on credential and access management. Topics: authentication, pki, sso. Contains security framework guidance for authentication systems. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control UI-64 in Guidelines for the Secure Deployment of IPv6? (Part 291) Control UI-64: peration of a dual stack or mixed IPv6/IPv4 environment. One of the most difficult challenges facing the operations staff in a mixed IPv6/IPv4 environment is keeping the two environments synchronized. When operations makes changes to security controls such as firewall rule sets, access control lists, and IDS signatures, they must ensure the change occurs on both the IPv4 and IPv6 networks. Rules and signatures must be translated between IPv4 and IPv6 syntax and deployed as a single coordinated process. If strict change control is not followed, the two environments will have non-overlapping protections. In a dual stack environment, the physical topologies of the equipment are the same, but the logical topologies can be very different. Configuration changes can have unpredictable or unforeseen consequences. Configuration management controls should be structured to prevent configuration changes on IPv4 or IPv6 networks that affect the other network. Organizations should manage and monitor their IPv4, IPv6, and dual stack environment as a single environment. ## 6.9.5 Disposition Phase A migration from IPv4 to IPv6 results in displacement or retirement of equipment. Some equipment does not support IPv6 and is retired, while other equipment is transferred to IPv4 islands or to other organizations. Organizations must plan for the secure disposition of this obsolete equipment, ensuring that no confidential data is released. Organizations place themselves at great risk for exposing confidential information when disposing of obsolete equipment. A key decision concerning sanitization is whether the equipment is planned for reuse or retirement. Often, equipment is reused to conserve an organization's resources. Equipment should be sanitized before it is reused or retired. Most organizations have policies, regulations or standards that require the proper disposition of obsolete equipment. It is important that these processes be followed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Peripheral Memory Cards according to Cell Phone Forensic Tools_ an Overview and Analysis Update? Peripheral Memory Cards: N.A. - The Motorola V300 does not allow for removable media. (NA)

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis Update.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Smart Grid Cybersecurity provide? (Section 902) ephen Florida Power and Light Cox Software Architects Jennic LTD Tennessee Valley Authority State of Michigan LC RISQ & Associates Microchip Technology Czaplewski, John Northrup Grumman Corp. Dagle, Jeff Dalva, Dave Danahy, Jack Pacific Northwest National Laboratory Stroz Friedberg Bochman & Danahy Research Danezis, George Microsoft Dangler, Jack Das, Subir Davis, Scott Davison, Brian De Petrillo, Nick Delenela, Ann DeLoach, Tim DePeppe, Doug di Sabato, Mark Dieffenbach, Dillon Dienhart, Mary Dierking, Tim Dillon, Terry Dinges, Sharon Dion, Thomas Do, Tam Dodd, David Dodson, Greg Don-Arthur, George Doreswamy, Rangan Doring, Ernest Dorn, John Dougherty, Steven Downum, Wesley Dransfield, Michael Applied Communication Sciences Sensus Public Utility Commission of Texas Industrial Defender Ercot IBM Global Business Services i2IS Cyberspace Solutions Ernst & Young Xcel Energy Aclara Power-Line Systems, Inc. APS Trane Dept of Homeland Security Southwest Research Institute pbnetworks Dominion Resources Services, Inc. Alterium LLC Verisign, Inc. Pacific Gas & Electric Accenture IBM Telcordia National Security Agency 170 Drgon, Michele Drozinski, Timothy Drummond, Rik Dubrawsky, Ido Duffy, Paul Duggan, Pat Dulaney, Mike Dunfee, Rhonda Dunphy, Mary Dunton, Benjamin Dupper, Jeff Duren, Michael Dutta, Prosenjit Earl, Frank Eastham, Bryant Edgar, Tom Eggers, Matthew Eigenhuis, Scott M Ellison, Mark Emelko, Glenn Engels, Mark Ennis, Greg Enstrom, Mark Eraker, Liz Erickson, Dave Ersue, Mehmet Estefania, Maria Eswarahally, Shrinath Evans, Bob Ewing, Chris Fabela, Ronnie Fabian, Michael Faith, Doug Faith, Nathan Famolari, David DataProbity Florida Power & Light Company Drummond Group Itron Cisco Systems ConEd Arxan Technologies, Inc.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Data Integrity_ Recovering from Ransomware and Other Destructive Events provide? (Section 35) rs need to be defined and developed within the capability that look for specific events. For example, it may be very normal for end users to have encrypted files they develop during operational hours. But if every file on the end user's workstation begins to be encrypted, or an encryption begins to happen on the end user machine at hours outside of normal operational hours, these could be identifiable actions noted in the log files indicating a ransomware attack. For an enterprise, these triggers need to be defined appropriately and thoroughly to have a successful Corruption Testing capability. The Backup Capability component supports the ability to back up each component within the enterprise as well as perform a restore that uses backup data. The configuration of this component needs to align with the tempo of the enterprise. For example, if an enterprise is performing thousands of transactions per hour per day, then a backup solution that only performs a backup once a day may not provide adequate recovery capability for the enterprise. This type of configuration would allow for a potentially large data loss. If backups occur every morning and a loss of DI happened at the end of the day, then a full day's worth of transactions would be lost. The decision on what the correct configuration is determined by an organization's risk tolerance. More information pertaining to this decision can be found in Section 5.1.1.3. The Virtual Infrastructure component straddles the line between being part of the enterprise and part of the DI architecture. It provides virtual capabilities to the enterprise as well as backup and restoration capabilities to support the DI architecture. The backup and restoration capabilities are for the virtual infrastructure itself. For data that is produced on individual virtual machines (VMs), either the VM infrastructure can provide the file-level restoration or the backup component can provide this capability.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cell Phone Forensic Tools_ an Overview and Analysis provide? (Section 102) Table 11: Results Matrix | | Device | Device | Device | Device | Device | |-----------------------------|---------------|---------------|--------------|------------|-------------| | Scenario | Ericsson T68i | Motorola C333 | Motorola V66 | Nokia 3390 | Nokia 6610i | | Connectivity and Retrieval | Meet | Meet | Meet | Meet | Meet | | PIM Applications | Below | Meet | Below | Below | Below | | Dialed/Received Phone Calls | Below | Below | Below | Below | Below | | SMS/MMS Messaging | Below | Meet | Meet | Below | Below | | Internet Messaging | Miss | NA | NA | NA | NA | | Web Applications | Miss | NA | NA | Miss | Below | | Text File Formats | NA | NA | NA | NA | Below | | Graphics File Formats | Miss | NA | NA | NA | Below | Figure 27: Text-Based Report Excerpt | | Device | Device | Device | Device | Device | |---------------------------------|---------------|---------------|--------------|------------|-------------| | Scenario | Ericsson T68i | Motorola C333 | Motorola V66 | Nokia 3390 | Nokia 6610i | | Compressed Archive File Formats | NA | NA | NA | NA

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control GG-23 in Security Labels for Open Systems_ an Invitational Workshop? (Part 42) Control GG-23: 1038) was deemed acceptable to BLACKER designers (NSA). - Thus, BLACKER and DoD hosts that interface to BLACKER are built to support these internet Protocol Security Option (IPSO) labeling standards. ## MITRE ## DoD IP DATAGRAM TRANSITING PHASE I BFE MITRE <!-- image --> ## Format of Basic Security Option <!-- image --> ## MITRE ## DDN-BLAC K E R Access Control MITRE | MAC Communities | CENSER | SIOP-ESI | SCI | NSA | |-------------------|---------------------|-----------------------|------------------|------------------| | Top Secret | Top Secret CENSER | Top Secret SIOP-ESI | Top Secret SCI | Top Secret NSA | | Secret | Secret GENSER | Secret SIOP-ESI | Secret SCI | Secret NSA | | Confidential | Confidential GENSER | Confidential SIOP-ESI | Confidential SCI | Confidential NSA | | Unclassified | Unclassified GENSER | Unclassified SIOP-ESI | Unclassified SCI | Unclassified NSA | | IP THE AD PROCESSES | AND THE AD'S CRITERIA CLASS D | AND THE AD'S SECURITY OPERATING MODE D | THEN THE DAC GROUP D | AND EMERGENCY MODE ENTRY D | |-----------------------|-------------------------------------|------------------------------------------|-------------------------------|------------------------------| | CENSER lsfonnatios | Minimtm of Cl (DDN EaeLroameat) | System High or Msltilevel | Trosted/Opea or DAA-depeadeal | DAA Discretioa | | CENSER lsfonnatios | Not Miilmia of Cl (DDN Eaeifoameat) | Dedicated | DAA-depeadeat | Prohibited | DoD/GOSIP/X.25 UNITS TRANSITING PHASE III BFE MTTRE <!-- image --> ## Summary of BLACKER Labeling Functionality - Labeling functionality used to identify security level of packet to BLACKER System.

Explanation: NIST publication discussing classified information handling. References: classified, secret, top secret. Contains guidance on protecting sensitive government information. Source: Security Labels for Open Systems_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-1 in Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers? (Part 99) Control CM-1: mmerce) security; internet shopping security; multifactor authentication (MFA) ## ACKNOWLEDGMENTS We are grateful to the following individuals for their generous contributions of expertise and time. | Name | Organization | |------------------|-----------------------| | Greg Dicovitsky | RSA | | Leonardo Andrade | RSA | | Adam Cohn | Splunk | | Arshad Noor | StrongKey | | Kamil Kreiser | TokenOne | | Derek Hanson | Yubico | | David Coley | Dominion Tea | | Brian Abe | The MITRE Corporation | | Lorrayne Auld | The MITRE Corporation | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Name | Organization | |--------------------|-----------------------| | Lura Danley | The MITRE Corporation | | Sallie Edwards | The MITRE Corporation | | Charles Jones, Jr. | The MITRE Corporation | | Joshua Klosterman | The MITRE Corporation | | Jay Vora | The MITRE Corporation | | Mary Yang | The MITRE Corporation | The Technology Partners/Collaborators who participated in this build submitted their capabilities in response to a notice in the Federal Register. Respondents with relevant capabilities or product components were invited to sign a Cooperative Research and Development Agreement (CRADA) with NIST, allowing them to participate in a consortium to build these example implementations.

Explanation: NIST publication on credential and access management. Topics: authentication, mfa, token. Contains security framework guidance for authentication systems. Source: Multifactor Authentication for E-Commerce_ Risk-Based, FIDO Universal Second Factor Implementations for Purchasers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Data Integrity_ Recovering from Ransomware and Other Destructive Events provide? (Section 74) (CR 2.b) Backup Capability | | Description | Show that the DI solution can recover from a DI attack that destroys data via a malware attack. | | Associated test cases | N/A | | Associated CSF Subcategories | PR.DS-1, PR.IP-4, PR-DS-6, PR.PT1 | | Preconditions | User downloads a malicious executable that modifies critical data. | Procedure 1. Open the Tripwire Enterprise interface. 2. Click on the Tasks Section, enable the associated rule box, and click Run. 3. Open HPE ArcSight ESM. 4. Under Events, select Active Channels , then select Audit Events. 5. Find the Tripwire event logs associated with the event. Select Fields in the Customize dropdown and enable the following fields: - a. End Time - b. Attacker Address - c. File Name - d. Device Action - e. Source User Name - f. Device Custom String 6. Open IBM Spectrum Protect. 7. Click on Restore. 8. Select missing files and click Restore to original location. | Expected Results (pass) | Provide file integrity monitor (CR 2.a). | |---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | Modified files are correctly identified. | | | Recovery complete (CR 2.b). | | | System was restored to pre-DI event version. | | Actual Results | Details of the event were understood and the moment of last known good was identified for the file in question. All the files affected within that timeframe were correctly identified, and a full and successful restore was executed.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Recovering from Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Trust Model for Security Automation Data 1.0 (TMSAD) say about 6.2.4 References? (Part 1) According to Trust Model for Security Automation Data 1.0 (TMSAD), 6.2.4 References: 6.2.4 References References are an essential part of an XML digital signature. This section contains requirements specific to the construction of references. These requirements apply to a <dsig:Reference> that is a child of either <dsig:SignedInfo> or <dsig:Manifest> . If the document that contains the signature is referenced, it SHOULD be referenced by setting the @URI attribute on <dsig:Reference> to the empty string (i.e., @URI =''). When referencing items in the signature that have an attribute of type xs:ID such as <dsig:Object> , <dsig:Manifest> , or <dsig:SignatureProperties> , they SHOULD be referenced using a URI fragment (e.g., @URI='#referenceIdentifier' ). ``` When referencing a <dsig:Object> , <dsig:Manifest> , or <dsig:SignatureProperties> from a <dsig:Reference> , the @Type attribute MUST be specified, and it MUST contain http://www.w3.org/2000/09/xmldsig#Object , http://www.w3.org/2000/09/xmldsig#Manifest , or http://www.w3.org/2000/09/xmldsig#SignatureProperties , respectively. ``` When specifying XPath transforms, content authors SHOULD use only XPath Filter 2.0 [XPath Filter-2], which is consistent with XML Digital Signature best practices [XMLDSIG-BEST]. Due to the more limited support of XPath 2.0, XPath transforms SHOULD use only XPath 1.0 [XPath] expressions. When referencing the root node of an XML document, if an ID exists on the root node that is not of type xs:ID , then the reference SHOULD specify an [XPath Filter-2] transform targeting the root node by ID. For example, if the root node of a document is <root-node id='root123'> , then the [XPath Filter-2] expression would be ' root-node[@id = 'root123'] ' with a @Filter attribute value of ' intersect '. This approach is preferable because if the signed document is later included as a child node within another XML document, the signature can still be valid (unless there is an ID conflict). Unnamed XSLT transforms SHOULD be avoided.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trust Model for Security Automation Data 1.0 (TMSAD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Security and Privacy in Public Cloud Computing say about 7. References? (Part 22) According to Guidelines on Security and Privacy in Public Cloud Computing, 7. References: ees of Multi-tenancy, ZDNET News and Blogs, June 16, 2008, <URL: - [Wal10] Hannah Wald, Cloud Computing for the Federal Community, IAnewsletter, Vol. 13, No. 2, Information Assurance Technology Analysis Center, Spring 2010. - [Wei09] Jinpeng Wei, Xiaolan Zhang, Glenn Ammons, Vasanth Bala, Peng Ning, Managing Security of Virtual Machine Images in a Cloud Environment, ACM Cloud Computing Security Workshop (CCSW'09) , Chicago, Illinois, November 13, 2009. - [Wei11] Thilo Weichert, Cloud Computing and Data Privacy, The Sedona Conference, Working Group on International Electronic Information Management, Discovery & Disclosure, February 2011, <URL: - [Whi09] Lance Whitney, Amazon EC2 Cloud Service Hit by Botnet, Outage, December 11, 2009, CNET News, <URL: - [Wil10] Matt Williams, All Eyes are on Los Angeles as City Deploys Cloud-Based E-Mail, Government Technology, February 10, 2010, <URL: - [Xen08] Xen Architecture Overview, Version 1.2, Xen Wiki Whitepaper, February 13, 2008, <URL: et=Xen+Architecture\_Q1+2008.pdf>. - [You07] Greg Young, Neil MacDonald, John Pescatore, Limited Choices are Available for Network Firewalls in Virtualized Servers, Gartner, Inc., ID Number: G00154065, December 20, 2007, <URL: - [You08] Lamia Youseff, Maria Butrico, Dilma Da Silva, Toward a Unified Ontology of Cloud Computing, Grid Computing Environments Workshop (GCE08), held in conjunction with SC08, November 2008, <URL:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Security and Privacy in Public Cloud Computing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Publication History according to NIST Building a Cybersecurity and Privacy Learning Program According to Building a Cybersecurity and Privacy Learning Program, Publication History: Approved by the NIST Editorial Review Board on 2024-08-09 Supersedes NIST SP 800-50 (October 2003) https://doi.org/10.6028/NIST.SP.800-50 ; Supersedes NIST SP 800-16 (April 1998) https://doi.org/10.6028/NIST.SP.800-16

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Building a Cybersecurity and Privacy Learning Program.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events say about 2.18.2 Import the CSV File to Symantec ICA? According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events, 2.18.2 Import the CSV File to Symantec ICA: 1. On the Symantec ICA web console, navigate to Gear Icon > Integration. 2. Click the Data Sources tab. 3. Select User Defined for Choose Data Source. 4. Click Create Data Source. 5. Select File System IW for the Data Source Type. 6. Enter a name for the data source for Data Source Label. 7. Enter the hostname of the Symantec ICA server for Server Name. 8. Select Windows/Active Directory for the Authentication Mode. 9. Enter the location for the downloaded CSV file for Download Directory (relative to the Symantec ICA server). 10. Enter the location for the CSV file to be downloaded from for Source Folder (relative to the Symantec ICA server). <!-- image --> <!-- image --> 11. Click Save. 12. Right-click the newly created data source and select Create Query. 13. Enter a Query Name and Query Description. <!-- image --> <!-- image --> 14. If you specified the Source Folder correctly, you will see the CSV file listed. 15. Check the box next to any CSVs to import. 16. Click Save. <!-- image --> <!-- image --> 17. Click OK. 18. If desired, set a schedule for this import. 19. Click Save. <!-- image --> <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities provide? (Section 43) higher the vulnerability score. Each organization must determine for itself the precise meaning of 'slight,' 'moderate,' 'significant,' and 'catastrophic' in the organization's environment. Table 12. Collateral Damage Potential Scoring Evaluation | Metric Value | Description | |------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | None (N) | There is no potential for loss of life, physical assets, productivity or revenue. | | Low (L) | Successful exploitation of this vulnerability may result in slight physical or property damage or loss. Or, there may be a slight loss of revenue or productivity. | | Low-Medium (LM) | Successful exploitation of this vulnerability may result in moderate physical or property damage or loss. Or, there may be a moderate loss of revenue or productivity. | | Medium-High (MH) | Successful exploitation of this vulnerability may result in significant physical or property damage or loss. Or, there may be a significant loss of revenue or productivity. | | High (H) | Successful exploitation of this vulnerability may result in catastrophic physical or property damage or loss. Or, there may be a catastrophic loss of revenue or productivity. | | Not Defined (ND) | Assigning this value to the metric will not influence the score. It is a signal to the equation to skip this metric. The default value is None. | The Confidentiality Requirement, Integrity Requirement, and Availability Requirement metrics enable the analyst to customize the environmental score depending on the importance of the affected IT asset to an organization, measured in terms of confidentiality, integrity, and availability.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Module-Lattice-Based Key-Encapsulation Mechanism Standard provide? (Section 2) ess a quantum computer. This standard specifies three parameter sets for ML-KEM. In order of increasing security strength and decreasing performance, these are ML-KEM-512, ML-KEM-768, and ML-KEM-1024. Keywords: computer security; cryptography; encryption; Federal Information Processing Standards; key-encapsulation mechanism; lattice-based cryptography; post-quantum; public-key cryptography. Published: August 13, 2024 Effective: August 13, 2024 Federal Information Processing Standards (FIPS) publications are developed by the National Institute of Standards and Technology (NIST) under 15 U.S.C. 278g-3 and issued by the Secretary of Commerce under 40 U.S.C. 11331. 1. Name of Standard. Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203). 2. Category of Standard. Computer Security. Subcategory. Cryptography. 3. Explanation. A cryptographic key (or simply 'key') is represented in a computer as a string of bits. A shared secret key is a cryptographic key that is computed jointly by two parties (e.g., Alice and Bob) using a set of algorithms. Under certain conditions, these algorithms ensure that both parties will produce the same key and that this key is secret from adversaries. Such a shared secret key can then be used with symmetric-key cryptographic algorithms (specified in other NIST standards) to perform tasks such as encryption and authentication of digital information. This standard specifies a set of algorithms for establishing a shared secret key. While there are many methods for establishing a shared secret key, the particular method described in this standard is a key-encapsulation mechanism (KEM). In a KEM, the computation of the shared secret key begins with Alice generating a decapsulation key and an encapsulation key . Alice keeps the decapsulation key private and makes the encapsulation key available to Bob. Bob then uses Alice's encapsulation key to generate one copy of a shared secret key along with an associated ciphertext .

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Module-Lattice-Based Key-Encapsulation Mechanism Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PM-8200 in Cell Phone Forensic Tools_ an Overview and Analysis? (Part 40) Control PM-8200: Table 5: SIMs | SIM | Phase | Network | Services | |-------|-------------------------------|-----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1604 | 2 - profile download required | AT&T | Abbreviated Dialing Numbers (ADN) Fixed Dialing Numbers (FDN) Short Message Storage (SMS) Last Numbers Dialed (LND) Group Identifier Level 1 (GID1) Group Identifier Level 2 (GID2) Service Dialing Numbers (SDN) General Packet Radio Service (GPRS) | | 1144 | 2 - profile download required | AT&T | Abbreviated Dialing Numbers (ADN) Fixed Dialing Numbers (FDN) Short Message Storage (SMS) Last Numbers Dialed (LND) General Packet Radio Service (GPRS) | | 8778 | 2- profile download required | Cingular | Abbreviated Dialing Numbers (ADN) Fixed Dialing Numbers (FDN) Short Message Storage (SMS) Last Numbers Dialed (LND) Group Identifier Level 1 (GID1) Group Identifier Level 2 (GID2) Service Dialing Numbers (SDN) General Packet Radio Service (GPRS) | | SIM | Phase | Network | Services | |-------|-------------------------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 7202 | 2 - profile download required | T-Mobile | Abbreviated Dialing Numbers (ADN) Fixed Dialing Numbers (FDN) Short Message Storage (SMS) Last Numbers Dialed (LND) Group Identifier Level 1 (GID1) General Packet Radio Service (GPRS) | | 5343 | 2 - profile download required | T-Mobile | Abbreviated Dialing


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Security-Focused Configuration Management of Information Systems say about GLOSSARY? (Part 19) According to Guide for Security-Focused Configuration Management of Information Systems, GLOSSARY: ser [SP 800-37] | An individual or (system) process acting on behalf of an individual that is authorized to access information and information systems to perform assigned duties. Note: With respect to SecCM, an information system user is an individual who uses the information system functions, initiates change requests, and assists with functional testing. | | threat [SP 800-30] | Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the Nation through a system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. | | threat source [FIPS 200] | The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally trigger a vulnerability. Synonymous with threat agent. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | United States government configuration baseline (USGCB) 33 | The United States Government Configuration Baseline (USGCB) provides security configuration baselines for Information Technology products widely deployed across the federal agencies. The USGCB baseline evolved from the federal Desktop Core Configuration mandate. The USGCB is a Federal government-wide initiative that provides guidance to agencies on what should be done to improve and maintain effective configuration settings focusing primarily on security.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Guide for Security-Focused Configuration Management of Information Systems.