You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does NIST_SP_800-53r5_Security_Privacy_Controls provide? (Section 430) s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ Discussion: Organizations can document the media downgrading process by providing information, such as the downgrading technique employed, the identification number of the downgraded media, and the identity of the individual that authorized and/or performed the downgrading action. Related Controls: None. (2) MEDIA DOWNGRADING | EQUIPMENT TESTING Test downgrading equipment and procedures [Assignment: organization-defined frequency] to ensure that downgrading actions are being achieved. Discussion: None. Related Controls: None. (3) MEDIA DOWNGRADING | CONTROLLED UNCLASSIFIED INFORMATION Downgrade system media containing controlled unclassified information prior to public release. Discussion: The downgrading of controlled unclassified information uses approved sanitization tools, techniques, and procedures. Related Controls: None. (4) MEDIA DOWNGRADING | CLASSIFIED INFORMATION Downgrade system media containing classified information prior to release to individuals without required access authorizations. Discussion: Downgrading of classified information uses approved sanitization tools, techniques, and procedures to transfer information confirmed to be unclassified from classified systems to unclassified media. Related Controls: None. References: [32 CFR 2002], [NSA MEDIA]. CHAPTER THREE PAGE 178 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I NIST SP 800-53, REV.

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cell Phone Forensic Tools_ an Overview and Analysis provide? (Section 138) ls translate data to a format and structure that is understandable by the examiner and can be effectively used to identify and recover evidence. However, tools may contain some degree of inaccuracies. For example, the tool's implementation may contain a programming error; a specification used by the tool to translate encoded bits into data comprehensible by the examiner may be inaccurate or out of date; or the protocol structure generated by the cellular device as input may be incorrect, causing the tool to function improperly. In addition, a knowledgeable suspect may tamper with device information to foil the workings of a tool or apply a wiping tool to remove or eliminate data. Over time, experience with a tool provides an understanding of its limitations, allowing an examiner to compensate where possible for any shortcomings or to turn to other means of recovery. While the tools discussed in this paper generally performed well and have adequate functionality, new versions are expected to improve and better meet investigative requirements. For instance, during the course of preparing this report, a new version for nearly every tool was issued, which included support for additional phones and enhanced functionality. The following criteria highlight some items to consider when choosing among available tools: - Usability - the ability to present data in a form that is useful to an investigator. - Comprehensive - the ability to present all data to an investigator so that evidence pertaining to an investigation can be identified. - Accuracy - the quality that the output of the tool has been verified and a margin of error ascertained. - Deterministic - the ability for the tool to produce the same output when given the same set of instructions and input data. - Verifiable - the ability to ensure accuracy of the output by having access to intermediate translation and presentation results.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control BA-123 in Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio? (Part 14) Control BA-123: ponsibility, and accountability that enables managers to acceptably manage risk. In this regard, there can be multiple participants in the governance process, depending on context and enterprise type. Larger entities might implement risk governance mechanisms across the enterprise with more specific governance mechanisms at the organization (e.g., division, portfolio, or bureau) and apply that strategy to systems or programs. Table 2 illustrates some notional roles and responsibilities at each level. Table 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AC-1 in Domain Name System-Based Electronic Mail Security? (Part 110) Control AC-1: Table 2.3 Test Sequence 3 | Sequence 3 | NCCoE Lab | NCCoE Lab | NCCoE Lab | Remote Sites | Certificate on Receiver Side | |--------------|-------------|-------------|------------------|----------------------------------------------------------------------------------------------|--------------------------------| | Event | MUA | MTA | DNS Service | Secure64 and NLnet Labs | Certificate on Receiver Side | | 13 | Outlook | Exchange | Active Directory | Thunderbird on MacBook, Postfix/ Dovecot, DNS Authority/ Cache/Signer Local CA issued (CU=2) | Local CA (CU=1) | | Sequence 3 | NCCoE Lab | NCCoE Lab | NCCoE Lab | Remote Sites | Certificate on Receiver Side | |--------------|------------------------|------------------|-----------------------------|-------------------------|--------------------------------| | Event | MUA | MTA | DNS Service | Secure64 and NLnet Labs | Certificate on Receiver Side | | 14 | Thunderbird | Postfix/ Dovecot | NSD4/Unbound/ Open DNSSEC | Same as 13 | Local CA issued (CU=1) | | 15 | Thunderbird on MacBook | Postfix/ Dovecot | DNS Authority/ Cache/Signer | Same as 13 | Local CA issued (CU=1) | | 16 | Outlook | Exchange | Active Directory | Same as 13 | Self-signed Cert (CU=3) | | 17 | Thunderbird | Postfix/ Dovecot | NSD4/Unbound/ Open DNSSEC | Same as 13 | Self-signed Cert (CU=3) | | 18

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Developing Trust Frameworks to Support Identity Federations say about What are Compliance Marks?? According to Developing Trust Frameworks to Support Identity Federations, What are Compliance Marks?: Often used to augment a registry listing to make marketing and discovery of compliant services more effective, a compliance mark is a visually recognizable mark that can be placed on the web properties and communication materials of compliant framework participants. These can-and in most cases should-be further supported by electronic verification capabilities.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Developing Trust Frameworks to Support Identity Federations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is http according to Guidelines for Smart Grid Cybersecurity? http: //www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/privruletxt.txt [accessed 8/11/2014]. There may also be

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Securing Public Web Servers say about Appendix B-Glossary? (Part 3) According to Guidelines on Securing Public Web Servers, Appendix B-Glossary: ded to manage and track the installation of patches. PharmingUsing technical means to redirect users into accessing a fake Web site masquerading as a legitimate one and divulging personal information. PhishingUsing social engineering techniques to trick users into accessing a fake Web site and divulging personal information. ProxyA proxy is an application that 'breaks' the connection between client and server. The proxy accepts certain types of traffic entering or leaving a network, processes it, and forwards it. This effectively closes the straight path between the internal and external networks, making it more difficult for an attacker to obtain internal addresses and other details of the organization's internal network. Proxy servers are available for common Internet services; for example, a Hypertext Transfer Protocol (HTTP) proxy used for Web access and a Simple Mail Transfer Protocol (SMTP) proxy used for e-mail. Service PackMicrosoft's term for a collection of patches integrated into a single large update. SOCKS Protocol -An Internet protocol to allow client applications to form a circuit-level gateway to a network firewall via a proxy service. System AdministratorA person who manages a computer system, including its operating system and applications. A system administrator's responsibilities are similar to that of a network administrator. VirtualizationThe use of an abstraction layer to simulate computing hardware so that multiple operating systems can run on a single computer. VulnerabilityA security exposure in an operating system or other system software or application software component. A variety of organizations maintain publicly accessible databases of vulnerabilities based on the version numbers of software. Each vulnerability can potentially compromise the system or network if exploited. Web ServerA computer that provides World Wide Web (WWW) services on the Internet.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: Guidelines on Securing Public Web Servers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Software Asset Management say about Defect Check Rationale Table? According to Automation Support for Security Control Assessments_ Software Asset Management, Defect Check Rationale Table: A failure in effectiveness of this control item results in a defect in one or more of the following defect checks: | Determination Statement ID | Defect Check ID | Defect Check Name | Rationale If an [organization-defined measure] for this defect check is above [the organization- defined threshold], then defects in maintaining an adequate number of prior software baseline versions to support rollback related to this control item might be the cause of the defect, i.e.,… | |------------------------------|-------------------|-----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | CM-2(3){1} | SWAM- L05 | Number of prior versions of installed software inadequate | lack of prior versions of installed software to enable rollback and recovery. |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Securing Telehealth Remote Patient Monitoring Ecosystem say about Appendix D Problematic Data Actions and Risks? According to Securing Telehealth Remote Patient Monitoring Ecosystem, Appendix D Problematic Data Actions and Risks: While the project team was writing this practice guide, the National Institute of Standards and Technology (NIST) published the NIST Privacy Framework, Version 1.0 [5]. Privacy concerns should be addressed particularly in healthcare environments. The project team examined the NIST Privacy Framework and included approaches that lead toward better understanding and managing the privacy risks that may be present in remote patient monitoring (RPM) deployments. Structurally, the NIST Privacy Framework is like the NIST Cybersecurity Framework. Both frameworks should be applied when evaluating enterprise programs and developing mitigation strategies. Applying the Privacy Framework does not supersede the NIST Cybersecurity Framework. Rather, the Privacy Framework provides organizations with information to understand privacy-specific risks. For more information about the NIST Privacy Framework , healthcare delivery organizations (HDOs) should review NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0 [5].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Securing Telehealth Remote Patient Monitoring Ecosystem.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 5.2 Message Authentication Code (MAC) Algorithm according to NIST Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, 5.2 Message Authentication Code (MAC) Algorithm: A Message Authentication Code (MAC) algorithm defines a family of cryptographic functions that is parameterized by a symmetric key. It is computationally infeasible to determine the MAC of a (newly formed) MacData value without knowledge of the MacKey value (even if one has seen the MACs corresponding to other MacData values that were computed using that same MacKey value). The input to a MAC algorithm includes a symmetric key, called MacKey and a binary data string called MacData that serves as the 'message.' That is, a MAC computation is represented as MAC( MacKey , MacData ). In this Recommendation, a MAC algorithm is used if key confirmation is performed during key establishment (see Section 5.9); a (possibly different) MAC algorithm may be used for the required key-derivation process (see Section 5.8 and SP 800-56C). Key confirmation requires the use of an approved MAC algorithm, i.e., HMAC, AESCMAC or KMAC. HMAC is specified in FIPS 198 and requires the use of an approved hash function. AES-CMAC is specified in SP 800-38B for the AES block cipher algorithm specified in FIPS 197. KMAC is specified in SP 800-185. When used for key confirmation, an entity is required to compute a MAC tag on received or derived data using a MAC algorithm with a MacKey that is derived from a shared secret. The MAC tag is sent to the other entity participating in the key-establishment scheme in order to provide assurance that the shared secret or derived keying material was correctly computed. MAC-tag computation and verification are defined in Sections 5.2.1 and 5.2.2. If a MAC algorithm is employed in key derivation, an approved MAC algorithm shall be selected and used in accordance with SP 800-56C.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE) provide? (Section 124) the Security of Mobile Applications [50] -  NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations [60] -  NIST SP 800-181, National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework [7] -  Center for Internet Security [46] -  Executive Office of the President, Bring Your Own Device Toolkit [68] -  Federal Chief Information Officers (CIO) Council and Department of Homeland Security (DHS) Mobile Security Reference Architecture, Version 1.0 [69] -  Digital Services Advisory Group and Federal Chief Information Officers Council, Government Use of Mobile Technology Barriers, Opportunities, and Gap Analysis [70] -  International Organization for Standardization (ISO), International Electrotechnical Commission (IEC) 27001:2013, Information technology-Security techniques-Information security management systems-Requirements [45] -  Mobile Computing Decision Example Case Study [71] -  Mobile Services Category Team (MSCT) Advanced Technology Academic Research Center (ATARC), Mobility Strategy Development Guidelines Working Group Document [72] -  MSCT ATARC, Mobile Threat Protection App Vetting and App Security Working Group Document [73] -  MSCT, Device Procurement and Management Guidance [74] -  MSCT, Mobile Device Management (MDM), MDM Working Group Document [75] -  MSCT, Mobile Services Roadmap, MSCT Strategic Approach [76] - 

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Study of OSI Key Management provide? (Section 204) . Here are some suggestions on diagnostic information. It is up to the local security policy to decide whether it can be sent. The concern is that to much information would be provided to an intruder. | Type | Reason | |--------|---------------------------------------------------| | 0 | Proposed Confidentiality Algorithms not supported | | 1 | r*roposed Integrity Algorithms not supported | | 2 | Proposed Key Exchange Methods not supported | The diagnostic parameters are defined in the algorithm dependent section. Type Reason 0 PDU could not be correctly decrypted There are algorithm dependent diagnostic parameters, these parameters begin with the value 100. There are also security protocol dependent diagnostic parameters, they begin with the value 200. One problem encountered in the service specification was whether some specific parameters should be provided or not For example, should the certification path be included in the New Key service primitive? The motive for not including the certification path is that it might be desirable to have the certification path cached in its transfer syntax form, thereby avoiding unnecessary retranslations. Encryption and decryption procedures are performed on the transfer syntax representation of the data, therefore the Diffie-Hellman public key provided in the New Key request cannot be sent signed. The service primitives issued, as previously described, can been seen as issued from the part of the key management application process that resides outside the key management application entity. Where should the "intelligence" be built in? In the part of the application process that is outside the application entity or in the application entity? For example, should the authentication procedure be employed in the application process or application entity?

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: A Study of OSI Key Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.5.3.2 SAML Statements according to NIST Guide to Secure Web Services According to Guide to Secure Web Services, 3.5.3.2 SAML Statements: SAML defines three types of statements-authentication, attribute, and authorization-allowing SAML assertions to provide a wealth of information about individual subjects. SAML authentication statements indicate that a subject was authenticated and provide specific details, such as what authentication method was used, when the authentication occurred, and who the authenticating entity was. Different techniques for establishing identity are supported, ranging from use of a password to use of hardware tokens and personal physical attributes (biometrics). SAML allows assertions to specify any type of authentication mechanism used and provides a vocabulary for a number of commonly used mechanisms. Figure 3-8 shows a sample authentication statement. A SAML authorization decision statement may be used to assert that a request by a subject to access a specified resource has resulted in the specified decision and may optionally include evidence to support the decision. SAML attribute statements provide information about a particular subject that may be useful or necessary for determining whether or not access should be granted. In an RBAC environment, a SAML attribute statement can provide information about the subject's roles; similarly, in an ABAC environment, a SAML attribute statement can provide the attributes required by the policy.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization, token. Contains security framework guidance for authentication systems. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management say about 3.2 HWAM Sub-Capabilities and Defect Check Tables and Templates? (Part 1) According to Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management, 3.2 HWAM Sub-Capabilities and Defect Check Tables and Templates: 3.2 HWAM Sub-Capabilities and Defect Check Tables and Templates This section documents the specific test templates that are proposed and considered adequate to assess the control items that support HWAM. See Section 5 of Volume 1 of this NISTIR for an overview of defect checks, and see Section 4.1 of Volume 1 for an overview of the actual state and desired state specifications discussed in the Assessment Criteria Notes for each defect check. Sections 3.2.1 and 3.2.2 of this document describe the foundational and local defect checks, respectively. The Supporting Control Item(s) data in sections 3.2.1 and 3.2.2 document which controls might cause any of the checks to fail, i.e., documenting why the check (test) might be needed. Refer to Section 3.1 on how to adapt the defect checks (and roles specified therein) to the organization. Data found in Section 3.2 can be used in both defect check selection and root cause analysis, as described there. Section 3.2.3 documents how each sub-capability (tested by a defect check) serves to support the overall capability by addressing certain example attack steps and/or data quality issues. The Defect Check Templates are organized around four-part tables, as follows: - (1) Part 1 of the table is preceded by the text, 'The purpose of this sub-capability is defined as follows:' and contains the following columns: - a. Sub-Capability Name . - b. Sub-Capability Purpose . This is a description of the sub-capability purpose. Note that how sub-capabilities block or delay attack steps is described in Section 3.2.3.) - (2) Part 2 of the table is preceded by the text, 'The defect check to assess whether this subcapability is operating effectively is defined as follows:' and contains the following columns: - a. Defect Check ID . Defect check identifier. - b. Defect Check Name . - c. Assessment Criteria Summary . Short description of what is checked. - d. Assessment Criteria Notes .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Volume 2_ Hardware Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Review of the Advanced Encryption Standard provide? (Section 12) depends on the algorithmic description of the AES algorithm but also on the way the algorithm is implemented and on how its inputs (plaintexts/ciphertexts, and keys) are generated by the application. When a cryptographic application is vulnerable to a practical attack, this approach allows for the identification of the underlying cause and an evaluation of the vulnerability's impact.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Review of the Advanced Encryption Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Automation Support for Security Control Assessments_ Volume 1_ Overview say about 7.2.2 Root Cause Analysis How-to: Defect Types? (Part 1) According to Automation Support for Security Control Assessments_ Volume 1_ Overview, 7.2.2 Root Cause Analysis How-to: Defect Types: 7.2.2 Root Cause Analysis How-to: Defect Types Three levels of root cause analysis are needed for defect check failures: - (1) Determine case-specific causes. - (2) Determine which control failed. - (3) Determine systemic causes. LEVEL 1: Determine the case-specific causes . This typically involves affirming whether the desired specification or the actual state is in error. - a. Was the desired state specification wrong? - b. Was the actual state wrong? In coordination with the system owner (SO) and SSO, designated operational staff looks at each specific case to decide whether option (a) or (b) applies to the defect. It is equally important to consider what caused (a) or (b) to be the defect. Example 1: Perhaps a system administrator has connected multiple devices to the production network without first adding them to the authorized inventory, configuring them correctly, and patching them. Determining that this is the root cause indicates that option (b), actual state error, is the issue because the actual state (unpatched, misconfigured devices on the network and not in the inventory) is the defect. In this case, the solution is not just to get the devices authorized, configured, and patched, but also to make sure the system administrator understands the importance of following operational procedures. For Example 1, note that the failure includes one or more of the controls/control items related to managing the actual state. Example 2: Perhaps a system administrator has connected multiple devices to the production network after getting them authorized and correctly configuring and patching them. However, the administrator forgot to put them in the authorized system component inventory first. Determining that this is the root cause indicates that option (a), desired state specification error, is the issue because the desired state specification (failure to include a correctly authorized device in the inventory) is the defect.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Volume 1_ Overview.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Validating the Integrity of Computing Devices say about 4.2.1.1 IBM QRadar? According to Validating the Integrity of Computing Devices, 4.2.1.1 IBM QRadar: We demonstrate the capabilities described above with IBM QRadar -a SIEM platform which supports the collection of security events and automated processing of events by way of rules that align with an organization's risk posture. We leverage two of its core capabilities, the log manager and the SIEM. The log manager is the component that collects, analyzes, stores, and reports on security event logs from Dell and HP Inc. laptop endpoints. The SIEM consolidates data gathered by the log manager and executes our custom ruleset which detects potential platform integrity events. This results in identifying offenses, events that security operations personnel may need to take remediation action on, which can be consumed by other enterprise systems (such as Dashboards) via the QRadar Representational State Transfer (REST) application programming interface (API).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Validating the Integrity of Computing Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 1 – General say about 9.2.1 Key Inventories? (Part 1) According to Recommendation for Key Management_ Part 1 – General, 9.2.1 Key Inventories: 9.2.1 Key Inventories A key inventory shall include information about each key (e.g., all or part of the metadata associated with the key); unless the inventory is also used for key backup or archiving, the inventory shall not include secret or private keys but shall include a reference to the key (e.g., a key identifier or pointer to the location of the key). The information in the inventory should indicate who/what owns or shares the key, the key type, the algorithm with which the key is to be used, the key length, how it is used (e.g., the application), and its expiration date. Key inventories should be maintained in a central repository or network of mutually trusted repositories and operated in accordance with a Key-Inventory Policy. See SP 800-57, Part 2 for additional information. If a key is compromised, the owners or sponsors associated with the compromised key need to be notified so that remedial actions can be taken, including revoking the key, performing an analysis of the effects of the compromise, and replacing the key when appropriate. The information in the inventory can be used to identify who is to be notified and how to contact them. If an owner is no longer authorized to use a key (e.g., the owner is a human who left the organization or a device that is removed from the system), other entities need to be notified so that further interaction using that key is terminated. If the key is a symmetric key, the information in the inventory can be used to identify other entities that need to be notified and how to contact them. If the key is an asymmetric key and PKI certificates are used, notification is usually accomplished using CRLs. If the cryptoperiod for a key expires or is about to expire, the key needs to be replaced if interactions between the entities using that key are to continue (i.e., using a replacement key).

Explanation: NIST publication on credential and access management. Topics: pki, key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 1 – General.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Report_ Authentication Diary Study provide? (Section 102) r nine hours or however many hours you're doing and then you think of something of home, it definitely is less likely that you're going to get online to actually do that thing that you're thinking of. You're just going to wait until the next day.' (P11) Study participants reported avoiding entering authentication elements in two key situations: time-outs on systems or networks, and when they perceived authenticating as more of a 'hassle' than it was worth for the task they needed to do. One common reason for having to re-authenticate was because the desktop or laptop computer the person was using had locked after 15 minutes of inactivity (as described in Sec. 2.7 ). Participants addressed this inconvenience by doing something to prevent the computer from timing out, such as jiggling the mouse, or carrying their laptop with them - although as the participant quoted at the end of Sec. 6.2.1 pointed out, this solution was far from ideal and did little to reduce the friction and disruption caused by timed lockouts. One participant also mentioned (in jest) that software that makes the computer think the mouse is moving often enough to prevent the screen from locking or a 'drinking bird' could be employed to periodically tap a key on the computer and prevent timeouts. Another participant said that despite the appeal of 'cheating' the lockout, he/she did not plan to do so: 'Well you have two choices. Either you can beat the system - I mean there are little devices that you can buy that you plug into USB that imitates the mouse being moved every so often, right? […] And they're very cheap. They're like five dollars or something. But I prefer not to try and beat the system, although that's tempting.' (P23) In certain situations, participants elected to perform long tasks without the computer because doing so was more efficient than logging in, being locked out, having to log in again, and so on.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Report_ Authentication Diary Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Available at https according to Digital Identity Guidelines? Available at https: //www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE-

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Digital Identity Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Module-Lattice-Based Key-Encapsulation Mechanism Standard provide? (Section 61) indication if random bit generation failed 4: end if 5: 6: (𝐾,𝑐) ← ML-KEM . Encaps _ internal ( ek , 𝑚) return (𝐾,𝑐) ▷ run internal encapsulation algorithm ``` The decapsulation algorithm ML-KEM . Decaps of ML-KEM (Algorithm 21) accepts a decapsulation key and an ML-KEM ciphertext as input, does not use any randomness, and outputs a shared secret. This algorithm requires input checking, as specified below. Decapsulation input check. To check a candidate decapsulation key dk and ciphertext 𝑐 , perform the following checks: 1. (Ciphertext type check) If 𝑐 is not a byte array of length 32(𝑑 𝑢 𝑘 + 𝑑 𝑣 ) for the values of 𝑑 𝑢 , 𝑑 𝑣 , and 𝑘 specified by the relevant parameter set, then input checking has failed. 2. (Decapsulation key type check) If dk is not a byte array of length 768𝑘 + 96 for the value of 𝑘 specified by the relevant parameter set, then input checking has failed. 3. (Hash check) Perform the computation <!-- formula-not-decoded --> If test ≠ dk [768𝑘 + 32 ∶ 768𝑘 + 64] , then input checking has failed. If all of the above checks pass, then ML-KEM . Decaps can be run with inputs dk ∶= dk and 𝑐 ∶= 𝑐 . It is important to note that this checking process does not guarantee that dk is a properly produced output of ML-KEM . KeyGen , nor that 𝑐 is a properly produced output of ML-KEM . Encaps . ML-KEM . Decaps shall not be run with a decapsulation key or a ciphertext unless both have been checked. However, checking of the decapsulation key need not be performed by the decapsulating party, nor with every execution of ML-KEM . Decaps . Instead, assurance that this check has been performed can be acquired through other means (see SP 800-227 [1]). Ciphertext checking shall be performed with every execution of ML-KEM . Decaps . Uses the decapsulation key to produce a shared secret key from a ciphertext. Checked input : decapsulation key dk ∈ 𝔹 768𝑘+96 . Checked input : ciphertext 𝑐 ∈ 𝔹 32(𝑑 𝑢 𝑘+𝑑 𝑣 ) . Output : shared secret key 𝐾 ∈ 𝔹 32 . 1: 𝐾 ′ ← ML-KEM .

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Module-Lattice-Based Key-Encapsulation Mechanism Standard.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Interview according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Interview: [SELECT FROM: personnel with identifier management responsibilities; personnel with information security responsibilities; system developers; system administrators]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines on Active Content and Mobile Code say about 2.2 Server Anatomy? (Part 3) According to Guidelines on Active Content and Mobile Code, 2.2 Server Anatomy: application executes as an integral part of the Web server within the same address space as the server code and can remain in memory or be removed from memory dynamically to conserve system resources. Server-side processing methods also have been developed that take advantage of these more efficient interfaces and are easier to program; for example, Microsoft ASP.NET for use with Internet Information Services (IIS) servers, Java Server Pages supported by Sun and Netscape, and the freeware PHP Hypertext Preprocessor (PHP) supported by most major Web platforms, including Apache and IIS. In general, the techniques for dynamically generating content and improving Web server capabilities tend to be proprietary and used by software manufacturers to differentiate their product from others in the marketplace. Further details of common content generating technologies, including Server Side Includes (SSI), Active Server Pages (ASP), Java Server Pages (JSP), and PHP, are discussed in Section 4. Web Scripting - Client vs. Server: It is important to distinguish scripts run by the browser (i.e., client-side scripting) from those run by the Web server (i.e., server-side scripting). Clientside scripting and server-side scripting are distinct concepts that serve different purposes. For example, since a server does not interact directly with a user, server-side scripting requires no human-to-computer interface capability. Furthermore, the Web browser and server each supply their own unique environment for executing scripts. Client-side scripting is used to make Web pages more interactive and functional after they have been sent to the browser. For example, client-side scripts might involve validating data entry fields on an HTML form so the user gets immediate feedback when a mistake occurs, or integrating an ActiveX control or Java applet with another component on the page so that they interact.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Active Content and Mobile Code.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography say about 6.2.1.5 Incorporating Key Confirmation into a C(1e, 2s) Scheme? According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, 6.2.1.5 Incorporating Key Confirmation into a C(1e, 2s) Scheme: The subsections that follow illustrate how to incorporate key confirmation (as described in Section 5.9) into the C(1e, 2s) key-agreement schemes described above. Note that party V cannot act as a key-confirmation recipient unless a nonce ( NonceV ) is provided by party V to party U and is used (in addition to the shared secret Z ) as input to the key-derivation method employed by the scheme. This would be accomplished by including (a copy of) NonceV in the OtherInput provided to the KDM, as part of the FixedInfo (see Section 5.8), in addition to using (a copy of) NonceV as the EphemDataV employed in the MacTag computations for key confirmation. The flow depictions separate the key-establishment flow from the key-confirmation flow. The depictions and accompanying discussions presume that the assumptions of the scheme have been satisfied, that the key-agreement transaction has proceeded successfully through key derivation, and that the received MacTags are successfully verified as specified in Section 5.2.2.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Examine according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Examine: [SELECT FROM: system and information integrity policy and procedures; configuration management policy and procedures; procedures for malicious code protection; records of malicious code protection updates; system design documentation; system configuration settings; scan results from malicious code protection mechanisms; record of actions initiated by malicious code protection mechanisms in response to malicious code detection; system audit records; system security plan; other relevant documents or records]


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Category according to Guidelines for Smart Grid Cybersecurity? Category: Common Governance, Risk, and Compliance (GRC) Requirements

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain C.2.8.1 Central Fiscal Operations Information Type according to NIST Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices, C.2.8.1 Central Fiscal Operations Information Type: Central Fiscal Operations includes the fiscal operations that the Department of Treasury performs on behalf of the Government. 14 [Note: Tax-related functions are associated with the Taxation Management information type.] Impacts to some information and information systems associated with central fiscal operations may affect the security of the critical banking and finance infrastructure. In most cases, the effect on public welfare of a loss of central fiscal operations functionality can be expected to be delayed rather than immediate. The potential for consequent loss of human life or of major national assets is low. . The provisional security categorization recommended for the central fiscal operations information type is as follows: Security Category = {(confidentiality, Moderate), (integrity, Low), (availability, Low)}

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements say about Appendix D-References? (Part 4) According to Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements, Appendix D-References: anagement and Budget (OMB) Memorandum M-08-22, Guidance on the Federal Desktop Core Configuration (FDCC) , August 11, 2008. | | [RFC 2119] | Internet Engineering Task Force (IETF) Request for Comment (RFC) 2119, Key words for use in RFCs to Indicate Requirement Levels , March 1997. https://doi.org/10.17487/RFC2119 | | [SWID] | ISO/IEC 19770-2:2015, Information technology - Software asset management - Part 2: Software identification tag , October 2015 (corrected March 2017). http://www.iso.org/iso/catalogue_detail.htm?csnumber=65666. | | [XMLS] | World Wide Web Consortium (W3C) Recommendation, XML Schema [XML Schema 1.1], October 28, 2004. http://www.w3.org/XML/Schema.html. |

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guidelines for the Secure Deployment of IPv6 say about Table of Contents? (Part 11) According to Guidelines for the Secure Deployment of IPv6, Table of Contents: | Comparing IPv6 and IPv4 Addressing...................................................... | 3-11 | | 3.2 | IPv6 Address Allocations......................................................................................3-12 | IPv6 Address Allocations......................................................................................3-12 | | | | 3.2.1 IPv6 Address Assignments ...................................................................... | 3.2.1 IPv6 Address Assignments ...................................................................... | 3-12 | | | 3.2.2 Obtaining Globally Routable IPv6 Address Space.................................... | 3.2.2 Obtaining Globally Routable IPv6 Address Space....................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines for the Secure Deployment of IPv6.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE) say about iii. In the Address dialogue:? According to Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE), iii. In the Address dialogue:: - 1) For the Name field, enter a unique name to identify this address. - 2) For the Description field, enter a meaningful description of the purpose of this address. - 3) In the unnamed field following the Type drop-down menu, enter the IPv4 address that this interface will use in Classless Inter-Domain Routing notation. This example uses 10.6.1.2/24 for the WAN interface in our lab environment. - 4) Click OK. Figure 2-38 WAN Interface IP Address Configuration <!-- image --> - e. The address should now appear as an item in the IP list box; select OK; the Address dialogue closes. 4. Click OK. 5. Repeat Steps 2 and 3 for each of the additional Ethernet/Layer3 interfaces. Figure 2-39 Completed WAN Interface Configuration <!-- image -->

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Mobile Device Security_ Corporate-Owned Personally-Enabled (COPE).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Framework Profile for Liquefied Natural Gas provide? (Section 17) | Category........................................................................................................................................23 | | Table 22. CSF Subcategory Priorities for the Identify Function's Business Environment (ID.BE) Category........................................................................................................................................23 | | | Table 23. CSF Subcategory Priorities for the Identify Function's Governance (ID.GV) Category. .......................................................................................................................................................24 | | | Table 24. CSF Subcategory Priorities for the Identify Function's Risk Assessment (ID.RA) Category........................................................................................................................................24 | | | Table 25. CSF Subcategory Priorities for the Identify Function's Risk Management Strategy (ID.RM) | Category..........................................................................................................................25 | | Table 26. CSF Subcategory Priorities for the Identify Function's Supply Chain Management (ID.SC) Category.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, csf, fips. General security reference material without sensitive content. Source: Cybersecurity Framework Profile for Liquefied Natural Gas.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Threat Analysis on UOCAVA Voting Systems say about 7 Security Controls? (Part 1) According to A Threat Analysis on UOCAVA Voting Systems, 7 Security Controls: 7 Security Controls The threat analysis conducted and documented in Section 6 includes references to security controls. These controls provide procedural and technical countermeasures to protect the confidentiality, integrity and availability of systems from threats. Whenever possible, specific controls are referenced for each threat identified in the analysis. These controls fully or partially mitigate the associated threat. In some cases the controls are preventative. That is, the controls prevent a security violation from taking place. In other cases the controls are reactive, in that they help recover from an attack or other security violation without further loss of confidentiality, integrity or availability. Preventative controls are preferable, but not always possible or realistic. This section summarizes the security controls identified to mitigate threats to each transmission option. These controls point to specific controls listed in NIST SP 800-53, Recommended Security Controls for Federal Information Systems [3] . NIST SP 800-53 is a catalog of highlevel security controls, written primarily for federal computer systems. This report references the controls documented in NIST SP 800-53 by the Control Number. As the controls are highlevel, and not geared for election systems, this report includes discussion on how these controls could be implemented in UOCAVA election systems. The particular security controls referenced in this report mitigate specific threats identified to each transmission option. Furthermore, threats are identified for the high-level characterizations of election systems outlined in Section 4. Most jurisdictions will use a variation of one or more of the systems identified in this paper. As such, specific voting systems may be vulnerable to different threats, requiring a different set of security controls. This report does not suggest that the following controls adequately mitigate the threats faced by each system.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: A Threat Analysis on UOCAVA Voting Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities provide? (Section 33) em files that the system cannot operate without. Another example is disabling a service that is needed to boot the system. | The threat posed by a security configuration issue may change over time. The base metrics are limited to the characteristics of a security configuration issue that are constant over time and across user environments. To incorporate the time-variant aspect of threats, the temporal metrics produce a scaling factor that is applied to the Exploitability components of the base metric. Temporal metrics describe the characteristics of security configuration issues that can change over time but remain constant across user environments. The two components of CMSS temporal metrics are the General Exploit Level and the General Remediation Level. Since temporal metrics are optional, each includes a default metric value that has no effect on the score. This value is used when the scoring analyst wishes to ignore a particular metric because it does not apply or the analyst does not have sufficient data to determine the appropriate metric value. The General Exploit Level metric measures the prevalence of attacks against a security configuration issue-how often any vulnerable system is likely to come under attack. If a security configuration issue could be exploited more widely with the use of exploit code, the prevalence of attacks may be related to the current state of exploit techniques or exploit code availability. Public availability of easy-to-use exploit code increases the number of potential attackers by including those who are unskilled, thereby increasing the severity of the vulnerability. The availability of automated exploit code also increases the number of attacks each attacker can launch. However, note that attacks may not require exploit code. For example, consider a security configuration issue that can be attacked by sending a user an email with instructions to perform actions that result in an exploit.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit. Contains technical security guidance that could inform defensive posture. Source: The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IA-3 in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 1) Control IA-3: DEVICE IDENTIFICATION AND AUTHENTICATION Control: Uniquely identify and authenticate [Assignment: organization-defined devices and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection. Discussion: Devices that require unique device-to-device identification and authentication are defined by type, device, or a combination of type and device. Organization-defined device types include devices that are not owned by the organization. Systems use shared known information (e.g., Media Access Control [MAC], Transmission Control Protocol/Internet Protocol [TCP/IP] addresses) for device identification or organizational authentication solutions (e.g., Institute of Electrical and Electronics Engineers (IEEE) 802.1x and Extensible Authentication Protocol [EAP], RADIUS server with EAP-Transport Layer Security [TLS] authentication, Kerberos) to identify and authenticate devices on local and wide area networks. Organizations determine the required strength of authentication mechanisms based on the security categories of systems and mission or business requirements. Because of the challenges of implementing device authentication on a large scale, organizations can restrict the application of the control to a limited number/type of devices based on mission or business needs. Related Controls: AC-17, AC-18, AC-19, AU-6, CA-3, CA-9, IA-4, IA-5, IA-9, IA-11, SI-4. Control Enhancements: (1) DEVICE IDENTIFICATION AND AUTHENTICATION | CRYPTOGRAPHIC BIDIRECTIONAL AUTHENTICATION Authenticate [Assignment: organization-defined devices and/or types of devices] before establishing [Selection (one or more): local; remote; network] connection using bidirectional authentication that is cryptographically based. Discussion: A local connection is a connection with a device that communicates without the use of a network. A network connection is a connection with a device that communicates through a network.

Explanation: NIST publication on credential and access management. Topics: access control, authentication. Contains security framework guidance for authentication systems. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Symmetric Key Injection onto Smart Cards provide? (Section 11) d holder connects to the PACS over a two-way authenticated Transport Layer Security (TLS) session [6] in which client authentication is performed using the PIV Authentication key from the PIV Card. 2. The PACS uses information provided by the card holder in addition to information available from the Backend Attribute Exchange [1] to determine whether to provision the PIV Card with a symmetric physical access key. The PACS also uses the Backend Attribute Exchange to find the Universal Resource Identifier (URI) for the PIV Card's CMS. 3. If the PACS wishes to provision the PIV Card with a symmetric physical access key then the PACS directs the card holder to the PIV Card's CMS by providing the card holder with a URI that points to the card holder's CMS. The URI includes an identifier for the PACS (e.g., ). 4. The card holder follows the URI, which results in the establishment of a two-way authenticated TLS session with the PIV Card's CMS. Client authentication is performed using the PIV Authentication key from the PIV Card. 5. The CMS makes a decision as to whether to load the PACS's key onto the PIV Card, and proceeds with the remainder of the protocol only if the key is to be loaded. The decision process must include verifying that the identifier specified in the URI corresponds to a legitimate PACS. If the identified PACS is legitimate, but no empty slots remain on the PIV Card, then the CMS may ask the card holder to determine which, if any, PACS's key should be deleted in order to allow the new key to be loaded. 6. The CMS uses the Backend Attribute Exchange to obtain the symmetric physical access key for the PIV Card, KPHYS , from the PACS. The communication between the CMS and the PACS is performed over a two-way authenticated TLS session using a cipher suite that provides both confidentiality and integrity protection for the data transmitted between the CMS and the PACS.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Symmetric Key Injection onto Smart Cards.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Security Considerations for Code Signing say about Feedback? According to Security Considerations for Code Signing, Feedback: Feedback on this publication is welcome, and can be sent to: code-signing@nist.gov.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Considerations for Code Signing.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications say about Block Size? According to A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, Block Size: Block sizes are dependent on the individual statistical test. In the case of Maurer's Universal Statistical test, block sizes range from 1 to 16. However, for each specific block size, a minimum sequence length should be used. If the block size were fixed at 16, a sequence of more than a billion bits would be required. For some users, that may not be feasible. Intuitively, it would seem that the larger the block size, the more information could be gained from the parsing of a sequence, such as in the Approximate Entropy test. However, a block size that is too large should not be selected either, for otherwise the empirical results may be misleading and incorrect because the test statistic is better approximated by a distinct probability distribution. In practice, NIST advises selecting a block size no larger than  log 2 n  , where n is the sequence length. However, certain exceptions hold, and thus NIST suggests choosing a smaller block size.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Mobile Device Security_ Bring Your Own Device (BYOD) say about Appendix C References? (Part 2) According to Mobile Device Security_ Bring Your Own Device (BYOD), Appendix C References: s://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final. - [9] NIST. NIST Privacy Risk Assessment Methodology. Jan. 16, 2020. [Online]. Available: - [10] Joint Task Force, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, NIST SP 800-37 Revision 2, NIST, Gaithersburg, Md., Dec. 2018. Available: - [11] Open Web Application Security Project (OWASP). ' OWASP Mobile Top 10, ' [Online]. Available: https://owasp.org/www-project-mobile-top-10/. - [12] NIST. Privacy Engineering Program: Privacy Risk Assessment Methodology, Catalog of Problematic Data Actions and Problems. [Online]. Available: - [13] Qualcomm. 'Mobile Security Solutions.' [Online] . Available: https://www.qualcomm.com/products/features/mobile-security-solutions. - [14] National Information Assurance Partnership (NIAP). U.S. Government Approved Protection Profile -Extended Package for Mobile Device Management Agents Version 3.0. Nov. 21, 2016. [Online]. Available: https://www.niap-ccevs.org/MMO/PP/ep\_mdm\_agent\_v3.0.pdf. - [15] International Business Machines (IBM). About enterprise app wrapping. Aug. 09, 2022 last updated. [Online]. Available: https://www.ibm.com/docs/en/maas360?topic=overview-aboutenterprise-app-wrapping. - [16] NIAP. U.S. Government Approved Protection Profile -Module for Virtual Private Network (VPN) Gateways 1.1. July 01, 2020. [Online]. Available: - [17] NIAP. U.S. Government Approved Protection Profile -collaborative Protection Profile for Network Devices Version 2.2e. Mar. 27, 2020. Available: - [18] NIAP. Approved Protection Profiles. [Online].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, risk management framework, fips. General security reference material without sensitive content. Source: Mobile Device Security_ Bring Your Own Device (BYOD).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does BIOS Protection Guidelines for Servers say about 2.4 Threats to the System BIOS? According to BIOS Protection Guidelines for Servers, 2.4 Threats to the System BIOS: A server is susceptible to the same forms of attack that threaten a client system. Execution of operating system-level malware on servers could precede a BIOS attack. Server BIOS updates that are executed without being authenticated as coming from a trusted source are vulnerable to attacks. Since servers may have multiple BIOS update mechanisms, each mechanism has a risk of vulnerability. The interaction between update mechanisms potentially can also introduce vulnerabilities. The Service Processor in servers has elevated privileges to perform system management, which may include modifying BIOS. While the Service Processor might be controlled through an isolated communication channel, unauthorized access to this channel exposes great risk to the server. While many security practices focus on the data network, the management network might be less vetted and less protected without special efforts. If insufficiently protected, BIOS image backups on servers (often maintained for recovery features) are vulnerable to rewrite attacks even while the primary BIOS is protected from modification. Subsequent to successful subversion of a BIOS backup, an adversary could employ other means to cause the server to reboot with the infected backup image.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, malware, adversary. Contains technical security guidance that could inform defensive posture. Source: BIOS Protection Guidelines for Servers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AN-2011 in ANSI_NIST-ITL 1-2011 Requirements and Conformance Test Assertions? (Part 143) Control AN-2011: 7, Table 66, 7.4.4 Table 66 See section 7.4.4 for details. Reserved for future useonly by ANSI/NIST-ITL. Table 66, Table 6, 8.13.19 The first information item shall be the friction ridge code/ FRC. See Section 7.7.7 for a description of the remaining three information items. - 13.018, 13.019- Reserved O 13.020- COM Value - 13.021, 13.023- Reserved O 13.024- LQM Value <See Requirement ID: “Field: Type13- CondCode>. <See Requirement ID: “Field: Comment>. <See Requirement ID: “Field: Type13- CondCode>. <See Requirement IDs: “Field: Sample Quality Subfield 1”, “Field: Sample Quality Subfield 2”, “Field: Sample Quality Subfield 3”, “Field: Sample Quality Additional Subfield”>. Table 66 Reserved for future useonly by ANSI/NIST-ITL. Table 66 User Defined Fields Table 66 Reserved for future useonly by ANSI/NIST-ITL. - - - 13.025, 13.199- Reserved 13.200 to 13.900- User Defined 13.901- Reserved <See Requirement ID: “Field: Type13- CondCode>. TRUE <See Requirement ID: “Field: Type13- CondCode>. 8.13.21, This is an optional field, listing the O 13.902- <See Requirement ID: “Field: xx.902-ANN” >. 111 t-2 t-2 t-2 t-2 t-2 t-2 t-2 t-2 t-2 B 13.902- Annotated Information Value Field: 13.903- Device Unique Identifier Value Field: 13.904- Make/Mode l/Serial Number Value Field: 13.905, 13.994- Reserved Field: 13.995- Associated Context Value Field: 13.996- Hash Value Field: 13.997- Source Representati on Value Field: 13.998- Geographic Sample Acquisition Location Value Field: 13.999- Image Data Valid Table 66 8.13.22, Table 66 operations performed on the original source in order to prepare it for inclusion in a biometric record type. See Section 7.4.1. This is an optional field. See Section 7.7.1.1. ANN-Value O 13.903-DUI <See Requirement ID: “Field: Device ID” >. t-2 Value 8.13.23, Table 66 This is an optional field. See Section 7.7.1.2. O 13.904- MMS Value <See Requirement ID: “Field: Make Model” >.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: ANSI_NIST-ITL 1-2011 Requirements and Conformance Test Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Division 2009 Annual Report provide? (Section 70) s and innovative voting system architectures. NIST will be holding an end-to-end (E2E) voting system workshop to investigate the viability of using these novel voting systems for largescale elections. In addition, we will support the NIST National Voluntary Laboratory Accreditation Program (NVLAP) efforts to accredit voting system test laboratories and host the TGDC plenary meetings. We plan to engage voting system manufacturers, voting system test laboratories, state election officials, and the academic community in exploring ways to increase voting system security and transparency. http://vote.nist.gov/ Contacts: Dr. Nelson Hastings (301) 975-5237 nelson.hastings@nist.gov Mr. Andrew Regenscheid (301) 975-5155 andrew.regenscheid@nist.gov FIPS 140-3 (draft), Security Requirements for Cryptographic Modules , provides four increasing qualitative levels of security that are in- tended to cover a wide range of potential applications and environments. The security requirements cover areas related to the secure design and implementation of a cryptographic module. These areas include cryptographic module specification; cryptographic module physical ports and logical interfaces; roles, authentication, and services; software security; operational environment; physical security; physical security - non-invasive attacks; sensitive security parameter management; self-tests; life-cycle assurance; and mitigation of other attacks. The standard provides users with a specification of security features that are required at each of four security levels, flexibility in choosing security requirements, a guide to ensuring that the cryptographic modules incorporate necessary security features, and the assurance that the modules are compliant with cryptography-based standards. The FIPS 140-3 draft is a result of the reexamination and reaffirmation of the current standard, FIPS 140-2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Computer Security Division 2009 Annual Report.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Domain Name System-Based Electronic Mail Security say about 3.1.2.1 Configuration of OpenSSL to act as a Local Certificate Authority (CA)? According to Domain Name System-Based Electronic Mail Security, 3.1.2.1 Configuration of OpenSSL to act as a Local Certificate Authority (CA): OpenSSL can be used to generate certificates and act as a local enterprise Certificate Authority (CA). This is not always advisable as it is very basic set of tools. Enterprises using OpenSSL as their CA must take great care to ensure that the root certificate (i.e. the CA certificate that signs all the end-entity certificates) is adequately protected. Compromise of the root certificate private key would allow an attacker to generate arbitrary certificates for spoofed hosts and services. How this root certificate private key is protected is beyond the scope of this document but should include adequate physical, access, and logical controls. OpenSSL can be used via the openssl command line tool to generate key pairs, and certificates for those key pairs. This certificate generation can be done by adding the certificate data on the command line, or using a configuration file for (organizational) default values. For example, if the organizational policy is for all certificates to have a lifetime of one year (365 days), that value can be set in a configuration file and does not need to be set using command line options unless there is a need to override the default for a specially generated certificate. The general order in setting up OpenSSL to operate an enterprise local CA (or to generate self-signed certificates) is to: Generate and set up configuration files, generate the root certificate, and finally, generate and sign end entity certificates.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition provide? (Section 138) ps://www.cosic.esat.kuleuven.be/ecrypt/courses/tenerife09/index.shtml - [21] ECRYPT II Hash Workshop, Tallinn, Estonia, May 19-20, 2011, - [22] Quo Vadis Cryptology? SHA-3 Contest - 7 th International Workshop on the State of the Art in Cryptology and New Challenges Ahead, Warsaw, Poland, May 23-24, 2011, http://cryptography.gmu.edu/quovadis/ - [23] Hash Workshop on SHA3 Finalists, Kolkata, India, December 9-10, 2011, - [24] ECRYPT SHA-3 Zoo, - [25] D. Bernstein and T. Lange (editors), eBASH: ECRYPT Benchmarking of All Submitted Hashes, http://bench.cr.yp.to/ebash.html - [26] External Benchmarking Extension (XBX), http://xbx.das-labor.org/trac - [27] C. Rechberger, T. Bjørstad, J. Daemen, C. De Cannière, P. Gauravaram, D. Khovratovich, W. Meier, T. Nad, I. Nikolić, M. Robshaw, M. Schläffer, S. Thomsen, E. Tischhauser, D. Toz, G. Van Assche, K. Varıcı, ' ECRYPT II SHA-3 Design and Cryptanalysis Report ,' August 2010, - [28] P. Gauravaram, F. Mendel, M. Naya-Plasencia, V. Rijmen, D.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Third-Round Report of the SHA-3 Cryptographic Hash Algorithm Competition.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007 say about Record-Level Requirements and Assertions? (Part 120) According to Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007, Record-Level Requirements and Assertions: } | | | | | frequency (pixel density). | 2 | M | 13.008-JP2L-SLC | No Implementation | 4 | | | | | 2 | M | 13.008-PNG-SLC | IF Present(PHYS Chunk) THEN IF {13.008} EQ 1 OR 2 THEN {Sampling Units} EQ 1, ELSE IF {13.008} EQ 0 THEN {Sampling Units} EQ 0 | 3 | | 13.009-HPS | 18.1.9 | Field 13.010 shall specify the integer pixel density used in the horizontal direction of the transmitted image if the SLC field contains a 1 or 2. Otherwise, it | 2 | M | 13.009-JPEGL-HPS | IF {13.008} EQ '1' OR '2', THEN IF Present(JFIF Header) THEN {13.009} EQ {Horizontal Density} | 3 | | | | | 2 | M | 13.009-JP2L-HPS | No Implementation | 4 | | | | indicates the horizontal component of the pixel aspect ratio.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Conformance Test Architecture and Test Suite for ANSI_NIST-ITL 1-2007.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Secure Web Services say about F.8 Online Documents? (Part 5) According to Guide to Secure Web Services, F.8 Online Documents: s/nwesp2005 federated-security.pdf | | Neal Leavitt: 'Are Web Services Finally Ready to Deliver?' ( IEEE Computer, Nov. 2004) | To purchase from IEEE Computer Society: 004.199 | | Takeshi Imamura, Michiaki Tatsubori, and Yuichi Nakamura, IBM/Tokyo Research Lab., and Christopher Giblin, IBM/Zurich Research Lab.: 'Web Services Security Configuration in a Service-Oriented Architecture' ( Proceedings of WWW2005 ) | | | Academic Theses | | | Thomas Schepers, University of Tilburg (Netherlands): A View on Web Service Security: Can Current Security Standards Adequately Secure Web Services?

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Secure Web Services.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Cryptographic Algorithms and Key Sizes for Personal Identity Verification say about Keywords? According to Cryptographic Algorithms and Key Sizes for Personal Identity Verification, Keywords: cryptographic algorithm; FIPS 201; identity credential; Personal Identity Verification (PIV); smart cards.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Cryptographic Algorithms and Key Sizes for Personal Identity Verification.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Usability and Security Considerations for Public Safety Mobile Authentication provide? (Section 17) | 5.10 Proximity Token............................................................................................ | 24 | | 5.11 | Fingerprints................................................................................................... | 24 | | 5.12 | Facial Recognition ........................................................................................ | 25 | | 5.13 | Iris Recognition ............................................................................................. | 26 | | | 5.14 Speaker Recognition.....................................................................................

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: Usability and Security Considerations for Public Safety Mobile Authentication.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Common Biometric Exchange Formats Framework (CBEFF) provide? (Section 14) Podio 1 , Jeffrey S. Dunn 2 , Lawrence Reinert 2 , Catherine Tilton 3 , Bruno Struif 4 , Fred Herr 5, Jim Russell 6 , M. Paul Collier 5 , Mark Jerde 7 , Lawrence O'Gorman 6 , Brigitte Wirtz 9 The Common Biometric Exchange Formats Framework (CBEFF) describes a set of data elements necessary to support biometric technologies in a common way. These data elements can be placed in a single file used to exchange biometric information between different system components or between systems. The result promotes interoperability of biometric-based application programs and systems developed by different vendors by allowing biometric data interchange. This specification is a revised (and augmented) version of the original CBEFF, the Common Biometric Exchange File Format, published as NISTIR 6529. In addition to the name change, which reflects more accurately the scope of the specification, NISTIR 6529-A incorporates new features such as a CBEFF nested structure in order to support multiple biometric data types (e.g., finger, face and voice) and/or multiple biometric data blocks of the same biometric type (e.g., finger biometric data blocks from more than one finger) within a CBEFF data structure, a Biometric Feature to further define the type of biometric data being placed in the file, a Validity Period for that data, an expanded definition of the Creator field which now specifies a Product Identifier, and Index Field associated with a specific instance of biometric reference data, a Challenge-Response field and a Payload field. NISTIR 6529-A also defines two new CBEFF Formats, biometric data objects for use within smart cards and other tokens and a simple root header for use in domains where more than one Patron Format, simple or nested, may be encountered. CBEFF provides forward compatibility accommodating for technology improvements and allows for new formats to be created. CBEFF implementations simplify integration of software and hardware provided by different vendors.

Explanation: NIST publication on credential and access management. Topics: token, sso. Contains security framework guidance for authentication systems. Source: Common Biometric Exchange Formats Framework (CBEFF).


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations say about 5 CKMS Security Policy? (Part 1) According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations, 5 CKMS Security Policy: 5 CKMS Security Policy An organization often creates and supports layered security policies, with high-level policies addressing the management of its information and lower-level policies specifying the rules for protecting the information. - An organization's Information Management Policy governs the collection, processing, and use of an organization's information and should specify, at a high level, what information is to be collected or created, and how it is to be managed. - The organization's Information Security Policy is created to support and enforce portions of the organization's Information Management Policy by specifying in more detail what information is to be protected from anticipated threats. and how that protection is to be attained. A Federal organization may have different Information Security Policies covering different applications of categories of information. A CKMS Security Policy 84 (SP) is a high-level document that describes the authorization and protection objectives and constraints that apply to the generation, establishment, accounting, storage, use, and destruction of cryptographic keying material. It is intended to support an Information Security Policy by protecting the cryptographic keys and metadata used by a CKMS and to enforce restrictions associated with their use. A CKMS SP includes an identification of all cryptographic mechanisms and cryptographic protocols that can be used by the CKMS. A CKMS SP 85 also includes a set of rules that are established to describe the goals, responsibilities, and overall requirements for the management of cryptographic keying material throughout the entire key lifecycle, including when they are operational, stored, transported and used.

Explanation: NIST publication on credential and access management. Topics: authorization, key management, sso. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control ES-1 in Guidelines on Electronic Mail Security? (Part 135) Control ES-1: s (e.g., Windows, Linux, Unix). This arrangement introduces an added layer of complexity because that general-purpose operating system must also be secured in addition to the firewall software itself. Application layer firewalls are increasingly being deployed as appliance-based devices, which may use specialized operating systems. Routers and stateful inspection firewalls also typically run on specialized operating systems. To successfully protect a mail server using a firewall, ensure that the firewall is patched to the latest or most secure level (application and underlying operating system) and is both capable of and configured to support the following items: - GLYPH<c=31,font=/HABHKN+Webdings> Control all traffic between the Internet and the mail server - GLYPH<c=31,font=/HABHKN+Webdings> Block all inbound traffic to the mail server except that traffic which is required, such as TCP port 25 (SMTP).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guidelines on Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways say about 3.5.2 Security Control Map? (Part 8) According to Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways, 3.5.2 Security Control Map: orts. Table 3-2 lists the Cybersecurity Framework Subcategories and SP 800-53 Revision 5 security controls that are needed to support the example solution-to mitigate the risks of the solution itself. Table 3-2: Mapping Security Characteristics of the Example Solution for Scenario 6 | Cybersecurity Framework Category | Cybersecurity Framework Subcategory | SP 800-53 Revision 5 Controls | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Identity Management, Authentication and Access Control (PR.AC): Access to physical and logical assets and associated facilities is limited to authorized users, processes, and devices, and is managed consistent with the assessed risk of unauthorized access to authorized activities and transactions.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, identity management. Contains security framework guidance for authentication systems. Source: Improving Enterprise Patching for General IT Systems_ Utilizing Existing Tools and Performing Processes in Better Ways.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications provide? (Section 69) equence to produce the next bit (the 5 th bit). The examination proceeded as follows: 5 Defined in The Handbook of Applied Cryptography ; A. Menezes, P. Van Oorschot and S. Vanstone; CRC Press, 1997. | | Bit 1 | Bit 2 | Bit 3 | Bit 4 | Bit 5 | |---------------------------------------------|---------|---------|---------|---------|---------| | The first 4 bits and the resulting 5 th bit | 1 | 1 | 0 | 1 | 0 | | Bits 2-5 and the resulting 6 th bit | 1 | 0 | 1 | 0 | 1 | | Bits 3-6 and the resulting 7 th bit | 0 | 1 | 0 | 1 | 1 | | Bits 4-7 and the resulting 8 th bit | 1 | 0 | 1 | 1 | 1 | | Bits 5-8 and the resulting 9 th bit | 0 | 1 | 1 | 1 | 1 | | Bits 6-9 and the resulting 10 th bit | 1 | 1 | 1 | 1 | 0 | | Bits 7-10 and the resulting 11 th bit | 1 | 1 | 1 | 0 | 0 | | Bits 8-11 and the resulting 12 th bit | 1 | 1 | 0 | 0 | 0 | | Bits 9-12 and the resulting 13 th bit | 1 | 0 | 0 | 0 | 1 | For this block, the trial feedback algorithm works. If this were not the case, other feedback algorithms would be attempted for the block (e.g., adding bits 1 and 3 to produce bit 5, or adding bits 1, 2 and 3 to produce bit 6, etc.). - (1) Under an assumption of randomness, calculate the theoretical mean µ : <!-- formula-not-decoded --> + 13 ( 9 + ( -1 ) 13 + 1 ) ( 13 3 2 9 ) For the example in this section, µ = + -2 13 = 6.777222. 2 36 - (4) M For each substring, calculate a value of Ti , where T = ( -1 ) · ( L -µ )+ 2 9 .