You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Blockchain Networks_ Token Design and Management Overview say about Transaction Mixers :? According to Blockchain Networks_ Token Design and Management Overview, Transaction Mixers :: Transaction mixers are meant to provide transaction untraceability. A first approach consists of users sending equal amounts of a given token to an intermediary who, in return, sends the funds back to other addresses owned by the same users [76]. The intermediary can be a trusted custodian or a non-custodial smart contract vault. Another approach to transaction mixing aggregates transactions to obscure the linkage between senders and recipients, as in CoinJoin [77].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Report on the Privilege (Access) Management Workshop say about Definitions and Standards? (Part 1) According to A Report on the Privilege (Access) Management Workshop, Definitions and Standards: Definitions and Standards The ability to control access to sensitive data in accordance with policy is a fundamental security requirement. Definitions enable discourse and standards facilitate implementation in support of enterprise-level access management and privilege management in particular. Definitions generally in use, as in NISTIR-7298 Glossary of Key Information Security Terms and those explicitly referenced in Annex A: Authorization and Attributes Glossary, serve the purpose of effective discourse. However, no generally accepted definition of privilege management appears to be in use. The Identity, Credential, and Access Management (ICAM) Subcommittee of the Federal Information Security & Identity Management Committee is developing implementation guidance for access management, which includes a draft definition of privilege management, as follows: 'Privilege Management is the definition and management of policies and processes that define the ways in which the user is provided access rights to enterprise systems. It governs the management of the data that constitutes the user's privileges and other attributes, including the storage, organization and access to information in directories.' [FICAM-09] This definition is in accord with the view taken in this report; some architectural details in the referenced document relative to privilege management differ. Both this report and the referenced document view privilege management as one part of a larger access management capability. The eXtensible Access Control Markup Language (XACML 10 ), an OASIS 11 standard for managing access control policy, provides some of what is needed to support enterprise-level privilege management. It includes a policy language and a query language that results in a Permit, Deny, Intermediate (error in query), or Not Applicable response.

Explanation: NIST publication on credential and access management. Topics: access control, authorization, identity management. Contains security framework guidance for authentication systems. Source: A Report on the Privilege (Access) Management Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Security-Focused Configuration Management of Information Systems say about MEMBERSHIP? According to Guide for Security-Focused Configuration Management of Information Systems, MEMBERSHIP: <List the members of this CCB. The CCB typically includes representatives from program management, project management, software engineering, hardware engineering, testing, documentation, customer support, and marketing. One individual is designated as the CCB Chair. Keep the CCB as small as possible, to facilitate its ability to make rapid decisions, but make sure that the critical perspectives are represented.>

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Security-Focused Configuration Management of Information Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AM-12 in Engineering Trustworthy Secure Systems? (Part 104) Control AM-12: of the element. This approach forces the system designer to assume that things will not go right and to rigorously seek evidence that demonstrates the effectiveness of the design when things go wrong. Considerations for system element non-performance include: - -An expectation that elements will behave and produce outcomes that are inconsistent with their design intent - -The constraints, assumptions, and preconditions that are associated with achieving threshold performance - -Intentional and unintentional events and conditions, typically referred to by terms like fault, error, failure, and compromise ## References: [2] [21] [50] ## E.30. Trustworthy System Control Principle: The design for system control functions conforms to the properties of the generalized reference monitor. Note: The trustworthy system control principle reflects the generalization of the reference monitor concept to provide a uniform design assurance basis for trustworthy system control mechanisms or constraint-enforcing mechanisms that compose to provide system control functions. 84 Adapted from a statement made by John Rushby, SRI International, about the need for software to be treated as 'guilty until proven innocent' at a Layered Assurance Workshop (LAW). The reference monitor concept (Section D.4.2) is a foundational access control concept for secure system design. It is defined as a trustworthy abstract machine that mediates all accesses to objects by subjects [38]. As a concept for an abstract machine, the reference monitor does not address any specific implementation. A reference validation mechanism, which is a combination of hardware and software, realizes the reference monitor concept to provide the access mediation foundation for a secure system [37].

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Cryptochecksum according to Securing Wireless Infusion Pumps in Healthcare Delivery Organizations? Cryptochecksum: 9ffa4947d875e0c501e036c54e80ee93

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to Computer Security Division 2009 Annual Report? http: //csrc.nist.gov/groups/SMA/forum/

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain e. GUIDANCE FOR CALCUUATINQ SOFTWARE AND DATA REPLACEMENT COSTS: according to NIST U.S. Department of Energy Risk Assessment Methodology According to U.S. Department of Energy Risk Assessment Methodology, e. GUIDANCE FOR CALCUUATINQ SOFTWARE AND DATA REPLACEMENT COSTS:: - For "Off-the-shelf" Software Prices: - For Software and Data Development Costs: - -Consult computer catalogs and advertisements, as well as government price schedules and local vendor price lists available from your organization's computer support group or Procurement Office - Consult contract labor cost rates available from the Procurement Office or the contract's COTR OR - -Develop the total cost by multiplying approx, hours spent times average labor cost per hour. Accepted labor costs for your use are provided: - · Clerclal: $5-10/hr. - · Junior Professional or Programmer: .. Senior Professional or Programmer: - Approximate No. of work hours per: - (Holidays and weekends are not - Included) - 1 Year: 2,080 6 Months: 1,040 1 Month: 170 - . Personnel Management - . Manufacturing/Control - . Mathematics/Statistical - . Security - . Training $1 5-20/hr. $20-30/hr.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: U.S. Department of Energy Risk Assessment Methodology.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Card Technology Developments and Gap Analysis Interagency Report say about SESSION: SECURITY AND PRIVACY ISSUES? (Part 3) According to Card Technology Developments and Gap Analysis Interagency Report, SESSION: SECURITY AND PRIVACY ISSUES: ard technology with a second technology which is completely different to the chip-card technology. The idea is to combine diffractive optical technology with the state of the art chip card technology. Technology and Integration: The idea is to have a diffractive optical technology, a Kinegram®, and combine it with the state of the art chip card technology. The secret is to combine these two technologies, so that the optical technology enhances the chip-card technology. We want to impart physical security and additional logical security. Security: Physical security is important, while it allows you to say this chip card is real, this is not a copy of the chip card. Security and Integration: The problem is that the information on how to attack chip cards is very easily disseminated. We enhance the security measures for chip cards by adding a non-holographic diffraction technology. The Kinegram® itself allows quick and easy authentication as a first line feature and the machine-verifiable Kinechip® enhances the physical and logic security of the chip card. Security: We can classify three main threats against the components of chip card security: data manipulation, re-engineering of chip cards and stolen secret keys. Requirement : The Kinechip® is used to secure specific data in the chip card; this specified data will be constant over the lifetime of the card, e.g. fingerprint data or personal data. You take this constant data, apply an encryption algorithm to this data to get a digital certificate, which is then stored permanently in the diffractive linear code of the Kinechip®. This digital certificate which is in the diffractive linear code of the Kinechip® can be any length up to 1,000 bits. Typically 80 - 160 bits are used in the digital certificate of the Kinechip®. Security: We use an irreversible process, laser ablation, to write the data. You cannot change these data bits from a '1' to a '0' or from a '0' to a '1'; you can erase a data bit (e.g.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Card Technology Developments and Gap Analysis Interagency Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS) provide? (Section 34) | | | | 112 | | 11.1.1 Review of Third-Party Testing and Verification of Test | 11.1.1 Review of Third-Party Testing and Verification of Test | 11.1.1 Review of Third-Party Testing and Verification of Test | | | | Results......................................................................................113 | | 11.1.2 Architectural Review of System Design ....................................114 11.1.3 Functional and Security Testing................................................115 11.1.4 Penetration Testing...................................................................115 Periodic Security Review ............................................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Metrics and Methodology for Hardware Security Constructs provide? (Section 24) ig. 3. Resource mapping of CAPEC standard attack patterns <!-- image --> For example, white-box access is required to launch white-box reverse engineering attack 167 against an exploitable weakness. However, black-box access is needed to launch black-box reverse engineering attack 189. If there is a higher probability for an adversary to have blackbox access than white-box access, mitigation of 189 should be a higher priority than mitigation of 167. This work addresses the critical issue of threats that arise from hardware weaknesses by presenting a comprehensive methodology to quantify the vulnerabilities that these weaknesses introduce and the potential threats from various attacks that can exploit them. The methodology helps designers understand different hardware weaknesses and attack patterns in order to prioritize and plan effective mitigation efforts. Given the evolving nature of hardware security, new weaknesses and attack strategies will inevitably emerge. This work emphasizes the importance of continuously updating and expanding the analysis, and the methodology's robust design allows for seamless modifications. While this work focuses on hardware weaknesses, the methodology is applicable to all identified vulnerabilities, including those that may arise in the future. As such, the findings contribute to a growing body of knowledge to help mitigate existing vulnerabilities and guide the development of more secure hardware architectures. Ongoing research will be crucial in supporting decision-making and design considerations for security-resilient hardware. - [1] Kocher P, Horn J, Fogh A, Genkin D, Gruss D, Haas W, Hamburg M, Lipp M, Mangard S, Prescher T, Schwarz M, Yarom Y (2019) Spectre attacks: Exploiting speculative execution. 2019 IEEE Symposium on Security and Privacy (SP 2019) (IEEE, San Francisco, California), pp 1-19.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: exploit, adversary. Contains technical security guidance that could inform defensive posture. Source: Metrics and Methodology for Hardware Security Constructs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Recommended Confidentiality Impact Level according to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices? Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for formula grants information is low .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Framework Version 1.1 Manufacturing Profile provide? (Section 78) AC) | PR.AC-7 | Perform a risk assessment on manufacturing user transactions to document and implement the authentication mechanisms required (e.g. single- or multi-factor) for each transaction. | IA-1, IA-2, IA-4, IA-5, IA-8 | | PROTECT | Identity Management, Authentication and Access Control (PR.AC) | PR.AC-7 | Moderate Impact | | | PROTECT | | PR.AC-7 | Perform a risk assessment on manufacturing system transactions and the associated user, device, or other asset authentication mechanism to document and implement the authentication mechanisms required (e.g. single- or multi-factor) for each transaction. | IA-1, IA-2, IA-4, IA-5, IA-8 | | PROTECT | | PR.AC-7 | Implement multi-factor or certificate-based authentication for transactions within the manufacturing systems determined to be critical.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Cybersecurity Framework Version 1.1 Manufacturing Profile.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Module-Lattice-Based Digital Signature Standard say about 3.6.3 Intermediate Values? (Part 1) According to Module-Lattice-Based Digital Signature Standard, 3.6.3 Intermediate Values: 3.6.3 Intermediate Values The data used internally by the key generation and signing algorithms in intermediate computation steps could be used by an adversary to gain information about the private key and thereby compromise security. The data used internally by verification algorithms is similarly sensitive for some applications, including the verification of signatures that are used as bearer tokens (i.e., authentication secrets) or the verification of signatures on plaintext messages that are intended to be confidential. Intermediate values of the verification algorithm may reveal information about its inputs (i.e., the message, signature, and public key), and in some applications, security or privacy requires one or more of these inputs to be confidential. Therefore, implementations of ML-DSA shall ensure that any potentially sensitive intermediate data is destroyed as soon as it is no longer needed. Two particular cases in which implementations may refrain from destroying intermediate data are: 1. The seed 𝜉 generated in step 1 of ML-DSA . KeyGen can be stored for the purpose of later expansion 3 In addition, when signing is deterministic, there is leakage through timing side channels of information about the message but not the private key). If the signer does not want to reveal the message being signed, hedged signatures should be used (see Section 3.2 in [6]). using ML-DSA . KeyGen \_ internal . As the seed can be used to compute the private key, it is sensitive data and shall be treated with the same safeguards as a private key. 2. The matrix 𝐀 ̂ generated in step 3 of ML-DSA . KeyGen \_ internal can be stored so that it need not be recomputed in later operations. Likewise, the matrix 𝐀 ̂ generated in step 5 of the verification algorithm ML-DSA . Verify \_ internal can also be stored. In either case, the matrix 𝐀 ̂ is data that is easily computed from the public key and does not require any special protections.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Module-Lattice-Based Digital Signature Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does 2016 NIST_ITL Cybersecurity Program Annual Report say about F O R M O R E I N F O R M AT I O N , S E E :? According to 2016 NIST_ITL Cybersecurity Program Annual Report, F O R M O R E I N F O R M AT I O N , S E E :: BioCTS - Biometric Conformance Test Tools: https:/ /www.nist.gov/itl/csd/biometrics/biometricconformance-test-software-biocts BioCTS for ANSI/NIST-ITL User Guide: https:/ /csrc.nist.gov/Projects/Biometric-Conformance-TestSoftware/publications

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: 2016 NIST_ITL Cybersecurity Program Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters say about 3.2.2.1. Curve25519? According to Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters, 3.2.2.1. Curve25519: The elliptic curve Curve25519 is the Montgomery curve MA , B defined over the prime field GF( p ) with p = 2 255 -19 and parameters A = 486662 and B = 1 [RFC\_7748]. This curve has order h ⋅ n , where h = 8, and n is a prime number. For this curve, A 2 -4 is not a square in GF( p ), whereas A +2 is. The quadratic twist of this curve has order h 1 ⋅ n 1, where h 1 = 4, and n 1 is a prime number. This curve has domain parameters D = ( p , h , n , Type , A , B , G ), where the Type is 'Montgomery curve,' and the other parameters are defined as follows: ``` p : 2 255 -19 (= 0x7fffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffed ) h : 8 ``` ``` n : 72370055773322622139731865630429942408\ 57116359379907606001950938285454250989 (=2 252 + 0x14def9de a2f79cd6 5812631a 5cf5d3ed ) tr : -221938542218978828286815502327069187962 (=( p+ 1) h ⋅ n = -0xa6f7cef5 17bce6b2 c09318d2 e7ae9f7a ) A : 486662 B : 1 Gu : 9 (= 0x9 ) Gv : 43114425171068552920764898935933967039\ 370386198203806730763910166200978582548 (= 0x5f51e65e 475f794b 1fe122d3 88b72eb3 6dc2b281 92839e4d d6163a5d 81312c14 ) ``` Curve25519 is isomorphic to the curve W-25519 specified in Section 3.2.2.1 and is birationally equivalent to the curve Edwards25519. See Appendices B.1 and B.2 for more details.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control PE-09(02) in Assessing Security and Privacy Controls in Information Systems and Organizations? Control PE-09(02): automac voltage controls for <PE-09(02)_ODP crical system components> are employed. POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Biometric Specifications for Personal Identity Verification say about Table of Contents? (Part 28) According to Biometric Specifications for Personal Identity Verification, Table of Contents: Minimum accuracy specifications.........................................................................................................39 | | 10.1 | Scope...........................................................................................................................................................39 | Scope...........................................................................................................................................................39 | | 10.2 | Approach.....................................................................................................................................................39 | Approach.....................................................................................................................................................39 | | 10.3 | Operating threshold specification .............................................................................................................39 | Operating threshold specification .............................................................................................................39 | | 10.4 | Conformance to accuracy specifications...................................................................................................40 | Conformance to accuracy specifications...................................................................................................40 | | | 10.4.1 Use of multiple samples with fixed thresholds...........................................................................40 Agency consideration of false rejection performance..............................................................................40 | 10.4.1 Use of multiple samples with fixed thresholds...........................................................................40 Agency consideration of false rejection performance..............................................................................40 | | 11.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Biometric Specifications for Personal Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Derived PIV Application and Data Model Test Guidelines provide? (Section 255) | | Issuer Documentation | None. | |------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Precondition(s) | • A token with the Derived PIV Application is inserted into an appropriate token reader. • Suitable drivers have been loaded between the test system and an instance of the reader. • A Derived PIV Authentication certificate is present within the Derived PIV Application. | | Test Scenario | 1. Send the SELECT command with • AID == 'A0 00 00 03 08 00 00 20 00 01 00' 2. Send the GET DATA command with • Data field of the command containing the tag ('5FC105') of the X.509 Certificate for Derived PIV Authentication data object 3. Extract the the value of the authorityInfoAccess extension from the certificate. | | Expected Result(s) | 1. From Step 1, the command returns the application property template with the status word '90 00'. 2. From Step 2, the command the requested data object along with the returns status word '90 00'. 3. From Step 3, an accessMethod containing id-ad-ocsp (1.3.6.1.5.5.7.48.1) is present that contains an accessLocation of type uniformResourceIdentifier where the scheme is 'http' (not 'https').

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Securing Public Web Servers say about 9.4.2 Penetration Testing? According to Guidelines on Securing Public Web Servers, 9.4.2 Penetration Testing: 'Penetration testing is security testing in which evaluators attempt to circumvent the security features of a system based on their understanding of the system design and implementation' [NISS99]. The purpose of penetration testing is to exercise system protections (particularly human response to attack indications) by using common tools and techniques developed by attackers. This testing is highly recommended for complex or critical systems. Penetration testing can be an invaluable technique to any organization's information security program. However, it is a very labor-intensive activity and requires great expertise to minimize the risk to targeted systems. At a minimum, it may slow the organization's network response time because of network mapping and vulnerability scanning. Furthermore, the possibility exists that systems may be damaged or rendered inoperable in the course of penetration testing. Although this risk is mitigated by the use of experienced penetration testers, it can never be fully eliminated. Penetration testing does offer the following benefits [NIST02b]: - GLYPH<c=31,font=/IEIOAF+Webdings> Tests the network using the same methodologies and tools employed by attackers - GLYPH<c=31,font=/IEIOAF+Webdings> Verifies whether vulnerabilities exist - GLYPH<c=31,font=/IEIOAF+Webdings> Goes beyond surface vulnerabilities and demonstrates how these vulnerabilities can be exploited iteratively to gain greater access - GLYPH<c=31,font=/IEIOAF+Webdings> Demonstrates that vulnerabilities are not purely theoretical - GLYPH<c=31,font=/IEIOAF+Webdings> Provides the 'realism' necessary to address security issues - GLYPH<c=31,font=/IEIOAF+Webdings> Allows for testing of procedures and susceptibility of the human element to social engineering.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, penetration test. Contains technical security guidance that could inform defensive posture. Source: Guidelines on Securing Public Web Servers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification say about National Institute of Standards and Technology Interagency or Internal Report 7849 40 pages (March 2014)? According to A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification, National Institute of Standards and Technology Interagency or Internal Report 7849 40 pages (March 2014): Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. All NIST Computer Security Division publications, other than the ones noted above, are available at

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Methodology for Developing Authentication Assurance Level Taxonomy for Smart Card-based Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 646) , system components, and system services may deviate significantly from the functional and design specifications created during the requirements and design stages of the system development life cycle. Therefore, updates to threat modeling and vulnerability analyses of those systems, system components, and system services during development and prior to delivery are critical to the effective operation of those systems, components, and services. Threat modeling and vulnerability analyses at this stage of the system development life cycle ensure that design and implementation changes have been accounted for and that vulnerabilities created because of those changes have been reviewed and mitigated. Related controls: PM-15, RA-3, RA-5. (3) DEVELOPER TESTING AND EVALUATION | INDEPENDENT VERIFICATION OF ASSESSMENT PLANS AND EVIDENCE (a) Require an independent agent satisfying [Assignment: organization-defined independence criteria] to verify the correct implementation of the developer security and privacy assessment plans and the evidence produced during testing and evaluation; and CHAPTER THREE PAGE 277 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ (b) Verify that the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information. Discussion: Independent agents have the qualifications—including the expertise, skills, training, certifications, and experience—to verify the correct implementation of developer security and privacy assessment plans.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Secure Web Services provide? (Section 91) particular attribute. The relying party uses the information supplied by the asserting party to make decisions, including, but not limited to, whether or not to trust the asserting party's assertion. By trusting the asserting party's information, the relying party can provide services without requiring the principal to authenticate again. SAML assertions contain a number of required elements (except where otherwise noted): - ID . Uniquely identifies this assertion - IssueInstant . Timestamp indicating when the SAML assertion was created - Issuer . Information about the entity that created the assertion - Signature . Digital signature of the SAML assertion (optional) - Subject . Information about the entity to which this assertion applies (optional) - Conditions . Information used to determine the validity of the assertion, such as a validity period (optional) - Advice . Information that may be useful in processing the assertion (optional) - Statements . SAML statements can provide information about subject authentication, authorization decision or attributes. Additional types of statements can be defined by an extension. (optional) Figure 3-8 shows a SAML assertion containing a single authentication statement. This assertion indicates that John Doe was authenticated on January 15, 2007 at 14:15:07 UTC via X.509 certificate and that this assertion is valid for one hour from the initial time of authentication. ``` <saml:Assertion xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion' Version="2.0" IssueInstant="2007-01-15T14:15:07Z"> <saml:Issuer Format=urn:oasis:names:SAML:2.0:nameid-format:entity> </saml:Issuer> <saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:x509SubjectName"> CN=Doe.John, OU=NIST, O=U.S.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.21.1.6 Categorization File according to NIST Situational Awareness for Electric Utilities According to Situational Awareness for Electric Utilities, 2.21.1.6 Categorization File: - Create a .csv file containing the text below, and copy this file to /opt/arcsight/<connector directory>/current/user/agent/acp/categorizer/current/<deviceproduct>/deviceproduct.csv | event. | set.event. | set.event. | set.event. | set.event. | set.event. | set.event. | |----------|--------------|--------------|--------------|--------------|--------------|--------------| | device | category | category | category | category | category | category | | Product | Object | Behavior | Technique | DeviceGroup | Significance | Outcome | CyberLens /Host /Found /Traffic Anomaly /IDS/Network /Informational /attempt

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Situational Awareness for Electric Utilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security Labels for Open Systems_ an Invitational Workshop provide? (Section 64) associations. While a CIPSO, labeling individual IP datagrams, is an important element in supporting rule-based security policies, it is not the only element and its use will not always be obligatory. The primary need for CIPSO per-datagram labeling arises in cases when an entity needing to make an RBAC authorization decision is unable to determine the access class of a datagram based on state information available to the determinin g entity; clear examples include: - connectionless communications - connection-oriented communications in which data of varying access classes may be carried on a single connection - mediation of RBAC policies by intermediate systems (e.g., routers) Many entities and channels will have fixed access class designations, allowing implicit labeling. In some other cases, implicit labeling can be achieved on a per-association basis, based on bindings established in the course of association initiation procedures. Further, it is important to remember that customer requirements for security do not always imply requirements for rule-based security policies. Identity-based policies, at the granularity of hosts and/or users, can satisfy many customer needs in and of themselves, in a decentralized fashion without need for the centralized infrastructure needed to support RBAC. Many customer requirements will be best addressed with hybrid approaches employing both rule-based and identity-based policies. In the commercial environment, labeling authorities correspond to customer organizations, organizational subunits, or established consortia thereof (e.g., the set of corporate participants in a joint venture). Labeling authorities define and coordinate the infrastructure (assignment of clearances to entities and of access class designations to data) which underlies RBAC. Related observations: - The number of labeling authorities is large and unpredictable.

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Security Labels for Open Systems_ an Invitational Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Managing Information Security Risk_ Organization, Mission, and Information System View say about D.12 INFORMATION SYSTEM SECURITY ENGINEER? According to Managing Information Security Risk_ Organization, Mission, and Information System View, D.12 INFORMATION SYSTEM SECURITY ENGINEER: The information system security engineer is an individual, group, or organization responsible for conducting information system security engineering activities. Information system security engineering is a process that captures and refines information security requirements and ensures that the requirements are effectively integrated into information technology component products and information systems through purposeful security architecting, design, development, and configuration. Information system security engineers are an integral part of the development team (e.g., integrated project team) designing and developing organizational information systems or upgrading legacy systems. Information system security engineers employ best practices when implementing security controls within an information system including software engineering methodologies, system/security engineering principles, secure design, secure architecture, and secure coding techniques. System security engineers coordinate their security-related activities with information security architects, senior information security officers, information system owners, common control providers, and information system security officers.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Managing Information Security Risk_ Organization, Mission, and Information System View.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain system development life cycle according to NIST Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, system development life cycle: The scope of activities associated with a system, encompassing the system's initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal. [SP80034r1, adapted]

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Derived Personal Identity Verification (PIV) Credentials? (Part 30) Control AC-1: ng mechanisms, remote wipe, and other mobile device security best practices to mitigate risk of a stolen device. Further- more, multifactor authentication prevents unauthorized use of the private key. | \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ | Authenticator Threats/Attacks | Examples | Applicability to DPC | |---------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Duplication | A software PKI authenticator (pri- vate key) is copied. | A DPC stored in a software-based container on a mobile device could be copied from the device. Use device sandboxing mecha- nisms, cryptographic techniques, and mal- ware detection mechanisms as mitigation. | | Eavesdropping | Memorized secrets are obtained by watching keyboard entry.

Explanation: NIST publication on credential and access management. Topics: authentication, pki. Contains security framework guidance for authentication systems. Source: Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Security and Privacy Controls for Information Systems and Organizations provide? (Section 660) within developer organizations. Vulnerability information is available from a variety of public and private sector sources, including the NIST National Vulnerability Database. Related Controls: None. (9) DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | USE OF LIVE DATA [Withdrawn: Incorporated into SA-3(2).] (10) DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | INCIDENT RESPONSE PLAN Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan. Discussion: The incident response plan provided by developers may provide information not readily available to organizations and be incorporated into organizational incident response plans. Developer information may also be extremely helpful, such as when organizations respond to vulnerabilities in commercial off-the-shelf products. Related Controls: IR-8. (11) DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | ARCHIVE SYSTEM OR COMPONENT Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review. CHAPTER THREE PAGE 283 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ Discussion: Archiving system or system components requires the developer to retain key development artifacts, including hardware specifications, source code, object code, and relevant documentation from the development process that can provide a readily available configuration baseline for system and component upgrades or modifications.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, incident response. Contains technical security guidance that could inform defensive posture. Source: Security and Privacy Controls for Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2 say about 3.5 Common Platform Enumeration (CPE)? (Part 1) According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2, 3.5 Common Platform Enumeration (CPE): 3.5 Common Platform Enumeration (CPE) This section lists requirements and recommendations for using Common Platform Enumeration (CPE) to express a CPE component of an SCAP source data stream (see Table 12). The Official CPE Dictionary data feed 15 MAY be used by SCAP components to reference CPE names. If use of the Official CPE Dictionary is impractical, a subset of the dictionary MAY be used instead. Creating the reduced official dictionary involves first identifying every CPE in <xccdf:platform> and <cpe2:fact-ref> elements contained within referenced <cpe2:platformspecification> elements in every benchmark in the data stream. Then these CPEs MUST be matched against every entry in the Official CPE Dictionary using the CPE name matching algorithm [CPE-M]. All CPEs matched in the official dictionary with a result of EQUAL or SUPERSET MUST be included in the reduced official dictionary. One or more third-party dictionaries MAY be included in a data stream as well. All such third-party dictionaries SHOULD follow the requirements of the CPE Dictionary specification [CPE-D]. If including an entire third-party dictionary is impractical, a subset of the dictionary MAY be used instead. The reduced dictionary MUST be created using the same procedure outlined for creating a subset of the official dictionary. In all cases, a dictionary component MAY be remote to the data stream collection. Each CPE name [CPE-N] in an <xccdf:platform> or <cpe2:fact-ref> element within an XCCDF document SHALL match at least one CPE entry in a dictionary referenced by the data stream. A match is considered an EQUAL or SUPERSET result when matching the CPE name to a dictionary entry, 15 The Official CPE Dictionary is located at http://nvd.nist.gov/cpe.cfm. as defined in the CPE Name Matching specification [CPE-M]. Only non-deprecated names SHOULD be used.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2005 Annual Report provide? (Section 28) of NIST Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems , was completed in July 2005 with the final publication expected in March 2006. The guideline will help achieve more secure information systems within the federal government by- - Enabling more consistent, comparable, and repeatable assessments of security controls - Facilitating more cost-effective assessments of security control effectiveness - Promoting a better understanding of the risks to organizational operations, organizational assets, or individuals resulting from the operation of information systems, and - Creating more complete, reliable, and trustworthy information for organizational officials-to support security accreditation decisions and the annual FISMA reporting requirements. Contacts: Dr. Ron Ross (301) 975-5390 ron.ross@nist.gov Mr. Arnold Johnson (301) 975-3247 arnold.johnson@nist.gov P hase II of the FISMA Implementation Project will focus on the development of a program for accrediting public and private sector organizations to provide security certification services for federal agencies. The term 'accreditation' is used in two different contexts in the FISMA Implementation Project. 'Security accreditation' is the official management decision to authorize operation of an information system. 'Organizational accreditation' involves comprehensive proficiency testing and the demonstration of specialized skills in a particular area of interest. A security certification is a comprehensive assessment of the management, operational and technical security controls in an information system, made in support of security accreditation, to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting the security requirements for the system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2005 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide to Operational Technology (OT) Security provide? (Section 230) ing execution details may help organizations during the post-incident review process to determine whether any gaps or potential opportunities for improvement in the recovery plan should be considered. Due to the time sensitivity of recovery efforts, organizations may want to consider other techniques (e.g., reviewing logs, reviewing video footage captured during the recovery activities, or interviewing recovery personnel) if capturing execution details impacts safety or increases the time to complete the recovery plan. Supplemental guidance for recovery planning can be found in the following documents: • NIST SP 800-184, Guide for Cybersecurity Event Recovery • NIST SP 800-209, Security Guidelines for Storage Infrastructure 6.5.2. Recovery Improvements (RC.IM) As a recovery effort is ongoing, the recovery steps taken should be documented to identify lessons learned. These lessons can be used to improve recovery plans and processes. Supplemental guidance for recovery improvements can be found in the following document: • NIST SP 800-184, Guide for Cybersecurity Event Recovery 137 NIST SP 800-82r3 September 2023 Guide to Operational Technology (OT) Security 6.5.3. Recovery Communications (RC.CO) Restoration activities are coordinated with internal and external parties. In addition to operational recovery, an organization may need to manage public relations and repair its reputation. Supplemental guidance for recovery communications can be found in the following document: • NIST SP 800-184, Guide for Cybersecurity Event Recovery OT-Specific Recommendations and Guidance A list of internal and external resources for recovery activities should be developed as part of the recovery planning effort. During an event, this list should be used to get all necessary personnel on-site, as required, to recover within the RTO and RPO.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Guide to Operational Technology (OT) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services say about 4.2.4. Information Protection Processes and Procedures Category? (Part 10) According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services, 4.2.4. Information Protection Processes and Procedures Category: 5 CP-1, CP-2, CP-7, CP-10, CP-12, CP13, IR-1, IR-7, IR-8, IR-9, PE-17 NIST SP 800-160 Rev.1 Appendix F.2.6 RTCA 356 5.6.6 USG FRP 1.7.3, 6 | | Protect Information Protection Processes and Procedures | Applicability to PNT | References (PNT-Specific) | |-----------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------| | Subcategory | fault mode, identify detection and compensation strategies, effects on the computed PNT data, and effects on the applications dependent on the data to determine whether the response and recovery plans are adequate to meet business continuity objectives.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, cybersecurity framework, fips. General security reference material without sensitive content. Source: Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for Derived Personal Identity Verification (PIV) Credentials say about 1.1 Background? (Part 1) According to Guidelines for Derived Personal Identity Verification (PIV) Credentials, 1.1 Background: 1.1 Background FIPS 201 originally required that all PIV credentials and associated keys be stored in a PIV Card. While the use of the PIV Card for electronic authentication works well with traditional desktop and laptop computers, it is not optimized for mobile devices. In response to the growing use of mobile devices within the Federal government, FIPS 201 was revised to permit the issuance of an additional credential, a Derived PIV Credential, for which the corresponding private key is stored in a cryptographic module with an alternative form factor to the PIV Card. Derived PIV Credentials leverage the current investment in the PIV infrastructure for electronic authentication and build upon the solid foundation of well-vetted and trusted identity of the PIV cardholder - achieving substantial cost savings by leveraging the identityproofing results that were already performed to issue PIV cards. This document provides the technical guidelines for the implementation of Derived PIV Credentials. The use of a Derived PIV Credential is one possible way to PIV-enable a mobile device. In other cases it may be practical to use the PIV Card itself with the mobile device, using either the PIV Card's contact or contactless interface, rather than issuing a Derived PIV Credential. Mobile devices are generally too small to integrate smart card readers into the device itself, requiring alternative approaches for communicating between the PIV Card and the mobile device. Some of these approaches are possible by today's set of available products. Other, newer technologies are addressed by new guidelines in the existing set of PIV Special Publications. The current solution for PIV enablement directly uses PIV Cards with mobile devices through smart card readers. This has the advantage of avoiding the additional time and expense required to issue and manage Derived PIV Credentials.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Guidelines for Derived Personal Identity Verification (PIV) Credentials.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to IPsec VPNs say about 10.6 Post Quantum Key Exchange? (Part 9) According to Guide to IPsec VPNs, 10.6 Post Quantum Key Exchange: ask Force (IETF) Network Working Group), IETF Request for Comments (RFC) 2104. https://doi.org/10.17487/RFC2104 - [48] Frankel S, Herbert H (2003) The AES-XCBC-MAC-96 Algorithm and Its Use With IPsec. (Internet Engineering Task Force (IETF) Network Working Group), IETF Request for Comments (RFC) 3566. https://doi.org/10.17487/RFC3566 - [49] Black D, McGrew D (2008) Using Authenticated Encryption Algorithms with the Encrypted Payload of the Internet Key Exchange version 2 (IKEv2) Protocol. (Internet Engineering Task Force (IETF) Network Working Group), IETF Request for Comments (RFC) 5282. https://doi.org/10.17487/RFC5282 - [50] Viega J, McGrew D (2005) The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP). (Internet Engineering Task Force (IETF) Network Working Group), IETF Request for Comments (RFC) 4106. https://doi.org/10.17487/RFC4106 - [51] Frankel S, Glenn R, Kelly S (2003) The AES-CBC Cipher Algorithm and Its Use with IPsec. (Internet Engineering Task Force (IETF) Network Working Group), IETF Request for Comments (RFC) 3602. https://doi.org/10.17487/RFC3602 - [52] Kent S (2005) Extended Sequence Number (ESN) Addendum to IPsec Domain of Interpretation (DOI) for Internet Security Association and Key Management Protocol (ISAKMP). (Internet Engineering Task Force (IETF)), IETF Request for Comments (RFC) 4304. https://doi.org/10.17487/RFC4304 - [53] Pauly T, Touati S, Mantha R (2017) TCP Encapsulation of IKE and IPsec Packets. (Internet Engineering Task Force (IETF)), IETF Request for Comments (RFC) 8229. https://doi.org/10.17487/RFC8229 - [54] McDonald D, Metz C, Phan B (1998) PF\_KEY Key Management API, Version 2. (Internet Engineering Task Force (IETF) Network Working Group), IETF Request for Comments (RFC) 2367. https://doi.org/10.17487/RFC2367 - [55] Salim J, Khosravi H, Kleen A, Kuznetsov A (2003) Linux Netlink as an IP Services Protocol.

Explanation: NIST publication on credential and access management. Topics: key management, sso. Contains security framework guidance for authentication systems. Source: Guide to IPsec VPNs.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RC-20 in Blockchain Networks_ Token Design and Management Overview? (Part 44) Control RC-20: attribute-based access control, or hybrid/finegrained access control (e.g., a list of authorized users that enables token transfers with different identity verification tiers and transfer limits). For fungible tokens, those restrictions may apply to a user's entire account balance or a portion of it [7]. Sending an unauthorized transaction means that the transaction will fail to execute and the state of the blockchain will remain at its starting point. Note that some publications categorize tokens in two types-'token-based' and 'accountbased'-depending on whether transfers are subject to controls or the representation type used (as discussed in Section 2.1.1) [64]. ## Role-Based Access Control : In role-based access control (see NIST definition [65]), role assignation follows either a top-down approach, where privileged entities act as system owners and directly manage the roles, or a bottom-up approach, where roles are self-assigned by users with predefined conditions and time delays during which system owners may be allowed to cancel new role assignations. Roles are implemented through role manager smart contracts that are integrated with token factory contracts. Smart contract libraries that offer role-based access control have been developed, such as the Open-Zeppelin library [66]. It is also possible to implement roles in blockchains that follow the UTXO model by modifying the input and output parameters in the transaction format [67]. ## Attribute-Based Access Control : In attribute-based access control , an identity management system provides users with token-based attributes or credentials generated either on-chain or off-chain, which they can then use to authenticate themselves and be authorized to call certain account-level operations.

Explanation: NIST publication on credential and access management. Topics: access control, identity management, token. Contains security framework guidance for authentication systems. Source: Blockchain Networks_ Token Design and Management Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out provide? (Section 70) ll develop a clearinghouse for <organization name> to locate pertinent information about previous incidents, known viruses and worms, known vulnerabilities of systems, and key people to contact. This clearinghouse shall include information about security clearances needed by key computer security and technical personnel at each site. The team shall develop an automated tracking system to track incidents. The Contracting Officer's Technical Representative (COTR) will review the Automated Tracking System and Clearinghouse. At the organizations's discretion, the team shall form cooperative procedures between <organization name> and other federal organizations. Part of the team's task shall be to develop procedures for incident reporting. These procedures define who is contacted during an incident, what kind of information is shared, who performs a particular task, and how subtasks are divided under different types of incidents and conditions. The team shall develop cooperative relationships with vendors to learn of security holes and fixes. The team shall also work with vendors to ensure problems are fixed. The Contractor shall document these cooperative procedures which will be included in the Incident Handling Guidelines, described in Task 5 below. The Contractor shall deliver the Cooperative Procedures Report to the COTR. The team shall develop guidelines for incident handling that both the team and technical personnel at the <organization name> sites can follow. These guidelines shall include managerial as well as technical guidance for event handling and the Cooperative Procedures Report developed in Task 4, The team shall define what an incident is and conditions under which the team becomes involved, These guidelines shall be consistent with the <organization name> policy.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Discussion according to NIST_SP_800-53r5_Security_Privacy_Controls? Discussion: The plan of action and milestones is a key organizational document and is subject to

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guidelines for Evaluating Differential Privacy Guarantees provide? (Section 6) | 3.4.4. | Min/Max Queries . . . . . . . . . . . . . . . . . | 44 | | 3.5. | Machine Learning | . . . . . . . . . . . . . . . . . . . . . | 44 | | 3.6. | . . . . . . | Synthetic Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 46 | |----------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|------| | | 3.7. . . . | Unstructured Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 50 | | 4. Deploying Differential Privacy . . . . . . . . . . . . . . . . . | 4. Deploying Differential Privacy . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . | 51 | | 4.1. | Query . . . . . . | Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 51 | | 4.2. | Trust . . . . . . . | Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 53 | | | 4.2.1. . . | Central Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 55 | | | 4.2.2. . . . | Local Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 56 | | | 4.2.3. | Future Directions: Shuffle and Secure Computation Models . . . | 57 | | 4.3. | Mechanism Challenges | Implementation . . . . . . . . . . . . . . . . . . . . | 58 | | 4.4.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Evaluating Differential Privacy Guarantees.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2012 Annual Report provide? (Section 182) YPH(cmap:df00) strategic CSIRT s, as well as inGLYPH(cmap:df00)ustry knowleGLYPH(cmap:df00)ge repositories. This may incluGLYPH(cmap:df00)e selective use of security automation where applicable. In FY2013, this work will GLYPH(cmap:df00)evelop GLYPH(cmap:df00)raft SP 800-150, Coordinated Computer Security Incident Handling Guidance . Contacts: Mr. Lee BaGLYPH(cmap:df00)ger (301) 975-3176 lee.baGLYPH(cmap:df00)ger@nist.gov Mr. DaviGLYPH(cmap:df00) Waltermire (301) 975-3390 GLYPH(cmap:df00)aviGLYPH(cmap:df00).waltermire@nist.gov The UniteGLYPH(cmap:df00) States Government Configuration Baseline (USGCB) initiative creates security configuration baselines for information technology (IT) products wiGLYPH(cmap:df00)ely GLYPH(cmap:df00)eployeGLYPH(cmap:df00) across the feGLYPH(cmap:df00)eral agencies. The project evolveGLYPH(cmap:df00) from the FeGLYPH(cmap:df00)eral Desktop Core Configuration (FDCC) manGLYPH(cmap:df00)ate originally GLYPH(cmap:df00)escribeGLYPH(cmap:df00) in a March 2007 memoranGLYPH(cmap:df00)um from the U.S. White House Office of Management anGLYPH(cmap:df00) BuGLYPH(cmap:df00)get (MemoranGLYPH(cmap:df00)um M-0711). USGCB helps to improve information security and reduce overall IT operating costs by providing commonly accepteGLYPH(cmap:df00) security configurations for major operating systems. Through the National Checklist Program described in Special Publication (SP) 800-70, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers , a baseline submitter may express interest in submitting a canGLYPH(cmap:df00)iGLYPH(cmap:df00)ate for use in the USGCB program. CSD works with the FeGLYPH(cmap:df00)eral CIO Council's Technology Infrastructure Subcommittee (TIS) to consider the candidate, recommend any changes to the baseline, and coordinate implementation at federal agencies.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2012 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices provide? (Section 468) Grants involves the allocation of money to States or their subdivisions in accordance with distribution formulas prescribed by law or administrative regulation, for activities of a continuing nature. The recommended provisional security categorization for the formula grants information type is as follows: Security Category = {(confidentiality, Low), (integrity, Low), (availability, Low)} The confidentiality impact level is the effect of unauthorized disclosure of formula grants information on the ability of responsible agencies to allocate money to States or their subdivisions in accordance with distribution formulas prescribed by law or administrative regulation, for activities of a continuing nature. Typically, unauthorized disclosure of most formula grants information will have only a limited adverse effect on agency operations, assets, or individuals. In most cases, information associated with formula grants is public knowledge. Special Factors Affecting Confidentiality Impact Determination : In a few cases, details of programs for which formula grants are awarded may be sensitive (e.g., some Federal/State cooperative programs intended to support Homeland Security operations). This can result in assignment of a moderate or high impact level to such information. Some formula grants information might be classified (hence outside the scope of this guideline). Recommended Confidentiality Impact Level : The provisional confidentiality impact level recommended for formula grants information is low . The integrity impact level is based on the specific mission and the data supporting that mission, not on the time required to detect the modification or destruction of information. Formula grants activities are not generally time-critical and multiple individuals in multiple organizations are usually involved in the grants process. Therefore, the information maintained by all the individuals/agencies is probably necessary to alter a grants decision.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Technology Assessment_ Methods for Measuring the Level of Computer Security provide? (Section 91) y built their own evaluation matrices in the process and have incorporated the methodology into their system development method. The study was published by the Institute for Internal Auditors [SMI80]. - 4.1.1.4 Major Strengths And Weaknesses -The methodology's primary strengths are its thoroughness and structure. It conveys an insightful awareness of the complexity and limitations associated with evaluation. It forces and structures thought, providing a focal point for controlled analysis and documentation. No final "score" is produced. In fact, major misunderstandings have resulted from the limited quantitative ratings that exist (e.g. via the assumption that a high score means an area is more secure than one with a low score). As a result , in the future the authors will be removing the use of numbers entirely and replacing them with letters to help avoid numeric oversimplification Peat Marwiok Mitchell & Co. has developed a Data Processing Security Evaluation Guideline (DPSE, pronounced Dipsey) . Its development began in 1973 and the firm has used it for "hundreds" of clients. It is a proprietary methodology. The firm is considering licensing it to users. DPSE is a partially quantitative, comprehensive, systematic methodology for evaluating security in a data processing environment It consists of an embedded installation profile and a series of questionnaires formatted so as to accommodate a scoring scheme for the answers to each question. These scores are then consolidated into a score for each major security area reviewed. The DPSE "guidelines and program are intended to aid professional data processing audit and consultant representatives in planning, reviewing, and evaluating (in-depth), the security of data processing installations" [p. IB-1] . "Although the review is designed for medium to large-scale data processing environments, the comprehensive topics of data processing security are appropriate to all computer installations" [p. IB-1].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Technology Assessment_ Methods for Measuring the Level of Computer Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Recommended Confidentiality Impact Level according to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices? Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for travel information is low .


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Cryptography may be used to provide or support several basic security services according to Recommendation for Key Management_ Part 1 – General? Cryptography may be used to provide or support several basic security services: confidentiality, identity authentication, integrity authentication, source authentication, authorization, and nonrepudiation. These services may also be required to protect a key and other key information related to that key. In addition, there are other cryptographic and non-cryptographic mechanisms that are used to support these security services. In general, a single cryptographic mechanism may provide more than one service (e.g., the use of digital signatures can provide integrity authentication and source authentication) but not all services.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Executive Summary according to NIST Guidelines on Active Content and Mobile Code According to Guidelines on Active Content and Mobile Code, Executive Summary: The private and public sectors depend heavily upon information technology (IT) systems to perform essential, mission-critical functions. As existing technology evolves and new technologies are introduced to provide improved capabilities and advanced features in systems, new technology-related vulnerabilities often arise. Organizations implementing and using advanced technologies must be increasingly on guard. One such category of technologies is active content. Broadly speaking, active content refers to electronic documents that can carry out or trigger actions automatically without an individual directly or knowingly invoking the actions. Exploits based on vulnerabilities in active content technologies can be insidious. The following key guidelines are recommended to organizations for dealing with active content.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Active Content and Mobile Code.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Smart Card Technology_ New Methods for Computer Access Control say about 4.3.2 Cost Factors of the Smart Card? (Part 1) According to Smart Card Technology_ New Methods for Computer Access Control, 4.3.2 Cost Factors of the Smart Card: 4.3.2 Cost Factors of the Smart Card In addition to increasing the risks and costs associated with possible smart card chip breakage, including a magnetic stripe and embossing may increase the cost of the smart card in two other ways. First, it may raise the price of the card itself since more components must be added. Secondly, extra cost due to fraud may be encountered since a merchant may have the option to bill a card-holder by using the embossing, the magnetic stripe, or both, in addition to, or instead of, the smart card IC transaction. For these reasons, including embossing and/or a magnetic stripe on a smart card may be undesirable. On the other hand, businesses currently using extensive embossing and magnetic stripe systems may be reluctant to make an overnight conversion to systems which use only the smart card's IC chip. Unless they are spread out over a period of time, the costs of replacing millions of embossed magnetic stripe cards and their corresponding readers may be prohibitive. Large-scale conversion to smart card systems with advanced security capabilities may be limited by "the enormous cost of gathering additional cardholder data not currently in the issuer's file, formatting it, encoding it in the [smart] card, and maintaining [such a] widely distributed database." [LNDN 86, p. 4] Many foreign countries have succeeded in developing fairly wide-spread smart card systems for banking, telephone services, and other applications. In some cases (such as in France, for example, where smart cards are used in a telephone payment system), no card systems had been previously established; the smart card systems were set up "from scratch" without the need to replace existing technologies. In the U.S., the application of smart cards has been more limited, due in part to large corporate investments in embossed magnetic stripe cards. U.S.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Smart Card Technology_ New Methods for Computer Access Control.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events say about 3.5 Technologies? (Part 5) According to Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events, 3.5 Technologies: | | . | Component | Product | Function | Cybersecurity Frame- work Subcategories | |----------------------------|---------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------| | Mitigation and Containment | Cisco Identity Services Engine (ISE) v2.4 Glasswall FileTrust ATP for Email v6.90.2.5 Semperis DSP v2.7 | • Provides ability to sandbox files locally. • Provides ability to enforce policy across the enterprise. • Provides ability to quarantine devices across the enter- prise. • Provides ability to sanitize files through file reconstruc- tion. • Provides ability to revert changes to domain services. | DE.CM-5, RS.RP-1, RS.MI-1, RS.MI-2 | | Reporting | Micro Focus ArcSight ESM v7.0 Patch 2 | • Provides ability to send security alerts based on organi- zational policy. • Provides ability to provide reports of enterprise health. • Provides ability to provide reports of malware detection across the enterprise.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: malware, ransomware. Contains technical security guidance that could inform defensive posture. Source: Data Integrity_ Detecting and Responding to Ransomware and Other Destructive Events.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations say about Considerations in Determining Assessment and Monitoring Frequencies? (Part 1) According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, Considerations in Determining Assessment and Monitoring Frequencies: Considerations in Determining Assessment and Monitoring Frequencies . Organizations take the following criteria into consideration when establishing monitoring frequencies for metrics or assessment frequencies for security controls: - Security control volatility . Volatile security controls are assessed more frequently, whether the objective is establishing security control effectiveness or supporting calculation of a metric. 33 Controls in the NIST SP 800-53 Configuration Management (CM) family are a good example of volatile controls. Information system configurations typically experience high rates of change. Unauthorized or unanalyzed changes in the system configuration often render the system vulnerable to exploits. Therefore, corresponding controls such as CM -6, 33 Security control volatility is a measure of how frequently a control is likely to change over time subsequent to its implementation. Configuration Settings, and CM-8, Information System Component Inventory, may require more frequent assessment and monitoring, preferably using automated, SCAP -validated tools that provide alerts and status on demand. Conversely, controls such as PS -2, Position Categorization, or PS-3, Personnel Screening, (from the NIST SP 800 -53 Personnel Security family of controls) are not volatile in most organizational settings. They tend to remain static over long periods and would therefore typically require less frequent assessment. - System categorizations/impact levels . In general, security controls implemented on systems that are categorized as high-impact are monitored more frequently than controls implemented on moderate-impact systems, which are in turn monitored more frequently than controls implemented on low-impact systems. 34 - Security controls or specific assessment objects providing critical functions .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-37r2_Risk_Management_Framework provide? (Section 213) Management or Risk Executive (Function); Senior Agency Information Security Officer; Senior Agency Official for Privacy. System Development Life Cycle Phase: New - Not Applicable. Existing - Disposal. Discussion: When a system is removed from operation, several risk management actions are required. Organizations ensure that controls addressing system disposal are implemented. Examples include media sanitization; configuration management and control; component authenticity; and record retention. Organizational tracking and management systems (including inventory systems) are updated to indicate the system that is being removed from service. Security and privacy posture reports reflect the security and privacy status of the system. Users and application owners hosted on the disposed system are notified as appropriate, and any control inheritance relationships are reviewed and assessed for impact. This task also applies to system elements that are removed from operation. Organizations removing a system from operation update the inventory of information systems to reflect the removal. System owners and security personnel ensure that disposed systems comply with relevant federal laws, regulations, directives, policies, and standards. References: [SP 800-30]; [SP 800-88]; [IR 8062]. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ LAWS, POLICIES, DIRECTIVES, REGULATIONS, STANDARDS, AND GUIDELINES | [32 CFR 2002.4] | Title 32 Code of Federal Regulations, Sec. 2002.4, Definitions . 2018 ed.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-37r2_Risk_Management_Framework.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD) provide? (Section 84) P TLV must be enabled on both the Cisco switch and the IoT device. A policy-map configuration and a corresponding template are used to cause media access control (MAC) authentication bypass to happen. This will trigger an access-session attribute that will cause LLDP TLVs (including the MUD URL) to be forwarded in an accounting message to the RADIUS server. Some manual preconfiguration of VLANs on the switch is required. The Cisco MUD manager supports a default policy for IPv4. It implements a static mapping between domain names and IP addresses inside a configuration file. The version of the Cisco MUD manager used in this project is a proof-of-concept implementation that is intended to introduce advanced users and engineers to the MUD concept. It is not a fully automated MUD manager implementation, and some protocol features are not present. These are described in Section 10.1, Findings. 6.2.2 MUD File Server In the absence of a commercial MUD file server for this project, the NCCoE implemented its own MUD file server by using an Apache web server. This file server signs and stores the MUD files along with their corresponding signature files for the IoT devices used in the project. Upon receiving a GET request for the MUD files and signatures, it serves the request to the MUD manager by using https. NIST SP 1800-15B: Securing Small-Business and Home Internet of Things Devices 39 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-15 This publication is available freeof charge from:https://doi.org/10.6028/NIST.SP.1800-15

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: Securing Small-Business and Home Internet of Things (IoT) Devices_ Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD).