You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy provide? (Section 288) nding on how security and privacy responsibilities are allocated organization-wide. Common control providers may be system owners when the common controls are resident within an organizational system. 119 A privacy program plan is a formal document that provides an overview of an agency's privacy program, including a description of the structure of the privacy program; the role of the senior agency official for privacy and other privacy officials and staff; the strategic goals and objectives of the privacy program; the resources dedicated to the privacy program; and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ has oversight responsibility for common controls in place or planned for meeting applicable privacy requirements and managing privacy risks and is responsible for assessing those controls. At the discretion of the organization, privacy controls that are designated as common controls may be assessed by an independent assessor. In all cases, however, the senior agency official for privacy retains responsibility and accountability for the organization's privacy program, including any privacy functions performed by independent assessors. Privacy plans and privacy control assessment reports are made available to systems owners whose systems inherit privacy controls that are designated as common controls.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: risk management framework, fips, security control. General security reference material without sensitive content. Source: Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Checklist according to Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements? Checklist: A document that contains instructions or procedures for configuring an IT product to an operational environment, for verifying that the product has been configured properly, and/or for identifying unauthorized configuration changes to the product. Also referred to as a security configuration checklist, lockdown guide, hardening guide, security guide, security technical implementation guide (STIG), or benchmark.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Related Controls according to NIST_SP_800-53r5_Security_Privacy_Controls? Related Controls: AC-3, AU-2, AU-6, AU-9, AU-12, PE-3.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Computer Security Training & Awareness Course Compendium provide? (Section 100) disaster recovery plan design using project teams, the selection of alternative procedures, and basic documentation standards. Class participation and team utilization of concepts will be emphasized. Upon completion of the course, participants will be able to apply improved project and time management skills for managing the planning project, use improved verbal and written communications skills and techniques to communicate with organization management and disaster recovery teams, develop the basic design of the disaster recovery plan, produce standardized documentation of the plan, and use improved management report presentation techniques and skills to assist in gaining plan approval. COURSE TITLE: Implementing and Testing the Disaster Recovery Plan COURSE LENGTH: 2.5 DAYS Disaster Recovery Institute 1810 Craig Road, Suite 213 St. Louis, MO 63146-4761 Bill Langendoerfer: (314) 434-2272 This course is designed for those who have limited experience in the area of disaster recovery planning. It was developed for prospective contingency planners, operations managers, data communications managers, disaster planning and recovery team members, and others who will be involved in the development or management of the contingency planning and recovery functions. The course will prepare participants to develop the detailed procedures within the disaster recovery plan and be prepared to teach those procedures when training other disaster recovery teams. Other topics to be explored include the development of a testing and assessment program, as well as periodic maintenance of the plan. Class participation and team utilization of concepts will be emphasized.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Computer Security Training & Awareness Course Compendium.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does A Report on the Privilege (Access) Management Workshop provide? (Section 13) report, work needs to be done to formalize any terminology beyond that being proposed by organized committees such as the Identity, Credential, and Access Management (ICAM) Subcommittee and the AASC. To have a clear notion of the meaning and scope of privilege management, we start by considering how access control works at a high level, as shown in Figure 1. Figure 1. High-Level View of Access Control <!-- image --> Figure 2 depicts the real-time framework for access control in more detail, introducing terminology that is used in this report. Figure 2. High-Level View of Real-Time Access Control <!-- image --> In Figure 2, the Access Controller of Figure 1 is split into two parts-Policy Enforcement Point and Policy Decision Point-and Attribute and Policy Information replaces Access Control Data. The meanings of the Policy Enforcement Point and Policy Decision Point (as described in Annex A: Authorization and Attributes Glossary) are as follows: -  Policy Decision Point (PDP): A system entity that makes authorization decisions for itself or for other system entities that request such decisions. -  Policy Enforcement Point (PEP): A system entity that requests and subsequently enforces authorization decisions . 'Attribute and policy information' is being used in a very general sense and is intended to have the same scope as access control data. Thus, it includes any form of information that can be used for access control. For example, it includes traditional access control lists (ACLs.) For an ACL, the attribute might be a group or user name while the policy 2 is implicit. In this context, 'policy' denotes digital policy-policy that can be processed by computer. The rationale for this scope of the terminology is to enable discussion without having to deal with the details of the many forms of access control data, while at the same time distinguishing the main categories of access control data-attributes and policies. A user is a person, process, or device.

Explanation: NIST publication on credential and access management. Topics: access control, authorization. Contains security framework guidance for authentication systems. Source: A Report on the Privilege (Access) Management Workshop.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control AU-16(3) in NIST_SP_800-53r5_Security_Privacy_Controls? Control AU-16(3): STORE ON COMPONENT WITH DIFFERENT OPERATING SYSTEM Non-repudiation ASSOCIATION OF IDENTITIES VALIDATE BINDING OF INFORMATION PRODUCER IDENTITY CHAIN OF CUSTODY VALIDATE BINDING OF INFORMATION REVIEWER IDENTITY DIGITAL SIGNATURES Audit Record Retention LONG-TERM RETRIEVAL CAPABILITY Audit Record Generation SYSTEM-WIDE AND TIME-CORRELATED AUDIT TRAIL STANDARDIZED FORMATS CHANGES BY AUTHORIZED INDIVIDUALS QUERY PARAMETER AUDITS OF PERSONALLY IDENTIFIABLE INFORMATION Monitoring for Information Disclosure USE OF AUTOMATED TOOLS REVIEW OF MONITORED SITES UNAUTHORIZED REPLICATION OF INFORMATION Session Audit SYSTEM START-UP CAPTURE AND RECORD CONTENT REMOTE VIEWING AND LISTENING Alternate Audit Logging Capability Cross-Organizational Audit Logging IDENTITY PRESERVATION SHARING OF AUDIT INFORMATION DISASSOCIABILITY √ √ √ √ √ √ √ √ √ √ √ √ √ O S S S O/S S W: Incorporated into SI-7. O O S S S S S O O/S O O/S S S W: Incorporated into AU-14. S W: Moved to AU-5(5). O O O O APPENDIX C PAGE 435 T h s i p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 I . NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________ TABLE C-4: ASSESSMENT, AUTHORIZATION, AND MONITORING FAMILY CONTROL NUMBER CONTROL NAME CONTROL ENHANCEMENT NAME IMPLEMENTED BY ASSURANCE

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CA-6 in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 3) Control CA-6: cess. The intra-organization joint authorization process is most relevant for connected systems, shared systems, and systems with multiple information owners. T h s i p u b Related Controls: AC-6. (2) AUTHORIZATION | JOINT AUTHORIZATION — INTER-ORGANIZATION l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . o r g / 1 0 . 6 0 2 8 / N S T S P . 8 0 0 - 5 3 r 5 . I Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization. Discussion: Assigning multiple authorizing officials, at least one of whom comes from an external organization, to serve as co-authorizing officials for the system increases the level of independence in the risk-based decision-making process. It implements the concepts of separation of duties and dual authorization as applied to the system authorization process. Employing authorizing officials from external organizations to supplement the authorizing official from the organization that owns or hosts the system may be necessary when the external organizations have a vested interest or equities in the outcome of the authorization decision. The inter-organization joint authorization process is relevant and appropriate for connected systems, shared systems or services, and systems with multiple information owners. The authorizing officials from the external organizations are key stakeholders of the system undergoing authorization. Related Controls: AC-6. References: [OMB A-130], [SP 800-37], [SP 800-137].


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Information Security Handbook_ A Guide for Managers say about Acknowledgements? According to Information Security Handbook_ A Guide for Managers, Acknowledgements: NIST would like to thank the many people who assisted with the development of this handbook. NIST management officials who supported this effort include: Joan Hash, William C. Barker, Elizabeth Chew, and Matthew Scholl. The authors would like to thank Elizabeth Lennon, Alicia Clay, Elizabeth Chew, Richard Kissel, Carol Schmidt, Matthew Scholl, and Patricia Toth who assisted with reviewing this Handbook and provided comments and suggestions for improvement. Additional drafters of Handbook chapters include: Ron Ross, Tim Grance, and Marianne Swanson, NIST. Nadya Bartol, Joe Nusbaum, Laura Prause, Will Robinson, Karen Kent, and Randy Ewell, BAH, In addition, special thanks are due those contractors who helped craft the Handbook, prepare drafts, and review materials: Nadya Bartol of Booz, Allen, Hamiliton (BAH), served as Project Manager for BAH on this project. In addition, many BAH employees contributed to the Handbook, including: Anthony Brown, Linda Duncan, Gina Jamaldinian, Sedar Labarre, Ines Murphy, Steven Peck, Mike Kapetanovic, Michael Rohde, Jacob Tsizis, Aderonke Adeniji, and Marge Spanninger. The authors also gratefully acknowledge and appreciate the many contributions from individuals in the public and private sectors whose thoughtful and constructive comments improved the quality and usefulness of this publication.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Information Security Handbook_ A Guide for Managers.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Report_ Authentication Diary Study say about IV. Coping mechanisms? (Part 17) According to Report_ Authentication Diary Study, IV. Coping mechanisms: my RSA token, I am likely to just scribble a note on a piece of paper and remember it the next day, hopefully. So, it definitely changes my behavior. That's a good question. I had not thought of that. Same thing, like it makes me less likely to, if I'm at the airport and I close my laptop to go to the restroom or whatever, and I have 15 minutes before the plane's going to board or 10 minutes or something like that, if I have to re-authenticate and dig out that RSA token, again, then it'll make me less likely to take advantage of just a few minutes because it's that, again that kind of level of effort. […] I mean if there's something I have to get done, then of course, I will do it. But, as far as, "Oh, let me just taking advantage of every last second," you're less likely to do that because there's a cost associated with taking advantage of that time. […] We know people are sensitive to small, local costs and when I hear myself describing the fact that, oh, well me going upstairs to get the thing is going to prevent me from doing one e-mail, it sounds kind of silly, but that's what happens.' (P11) - 'Well, let's say I'm working on a Word document and I have to refer to somebody's e-mail just to see one of their comments or an attachment of something I sent myself or somebody sent me. I'd have to really stop my work for five minutes. And if I'm on a roll with something, it's… […] Yeah. It just breaks everything. So instead of having to stop, go do this and then come back, and then try and get back in the flow of things, I'll just keep going. I'll just skip it and maybe come back later. [...] Every time I do that and wait for incentives here to check my e-mail, I'll get like five or six e-mails that probably people would have preferred a more immediate response.' (P19) - B. Authentication's unintended effects on work habits > Doing things less frequently 1.

Explanation: NIST publication on credential and access management. Topics: authentication, token, sso. Contains security framework guidance for authentication systems. Source: Report_ Authentication Diary Study.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Managing Information Security Risk_ Organization, Mission, and Information System View say about DEVELOPING COMMON INFORMATION SECURITY FOUNDATIONS? According to Managing Information Security Risk_ Organization, Mission, and Information System View, DEVELOPING COMMON INFORMATION SECURITY FOUNDATIONS: COLLABORATION AMONG PUBLIC AND PRIVATE SECTOR ENTITIES In developing standards and guidelines required by FISMA, NIST consults with other federal agencies and offices as well as the private sector to improve information security, avoid unnecessary and costly duplication of effort, and ensure that NIST publications are complementary with the standards and guidelines employed for the protection of national security systems. In addition to its comprehensive public review and vetting process, NIST is collaborating with the Office of the Director of National Intelligence (ODNI), the Department of Defense (DoD), and the Committee on National Security Systems (CNSS) to establish a common foundation for information security across the federal government. A common foundation for information security will provide the Intelligence, Defense, and Civil sectors of the federal government and their contractors, more uniform and consistent ways to manage the risk to organizational operations and assets, individuals, other organizations, and the Nation that results from the operation and use of information systems. A common foundation for information security will also provide a strong basis for reciprocal acceptance of security assessment results and facilitate information sharing. NIST is also working with public and private sector entities to establish mappings and relationships between the security standards and guidelines developed by NIST and the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC). \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Managing Information Security Risk_ Organization, Mission, and Information System View.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Examine according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Examine: [SELECT FROM: system and communications protection policy and procedures; procedures for network disconnect; system design documentation; system configuration settings; system audit records; system security plan; other relevant documents or records]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Derived PIV Application and Data Model Test Guidelines say about 1.1 Background? According to Derived PIV Application and Data Model Test Guidelines, 1.1 Background: Federal Information Processing Standard (FIPS) 201, Personal Identity Verification (PIV) for Federal Employees and Contractors [FIPS201], specified a common set of identity credentials for the purpose of Homeland Security Presidential Directive 12 [HSPD12] in a smart card form factor, known as the PIV Card. [FIPS201] originally required that all PIV credentials and associated keys be stored on the PIV Card, and although the use of the PIV Card for electronic authentication works well with traditional desktop and laptop computers, it is not optimized for mobile devices. 1 In response to the growing use of mobile devices within the Federal Government, [FIPS201] was revised to permit the issuance of an additional credential specifically for mobile devices. This PIV credential is called a Derived PIV Credential, for which the corresponding private key is stored in a cryptographic module within a mobile device. The use of this Derived PIV Credential is restricted to provide PIV-enabled authentication services on mobile devices in order to authenticate the credential holder to remote systems.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Derived PIV Application and Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST provide? (Section 51) k or subnotebook computer may be a better choice as the host for the ERN. This portability must be weighed against the negative factor of limited connection capabilities to a network or other devices. In any case, an operating system that supports user-friendly Graphical User Interface (GUI) is essential for the ERN. The Macintosh and the PC, whether a desktop or a light-weight portable model, running in an environment with windows offer a compelling combination of affordability and software availability. If a multimedia capability is also a requirement for the ERN, these computers are the most desirable for the development and delivery of multimedia capabilities. This will be the model configuration, but not the required configuration, for the NIST ERN as illustrated in Figure 1. As an option, a scanner with associated OCR software may be added to this configuration to provide an alternative for making ERN entries in cases where software tools for ERN entries cannot adequately meet the users' needs. Figure 1. A System Configuration for the NIST ERN <!-- image --> This section presents the functional specifications of the basic ERN as described in Section 2.3.1. The specifications are provided in three subsections starting with the ERN input capability, followed by storage and retrieval considerations, and concluding with a discussion on security aspects of the ERN. The ERN should utilize a user-friendly interface. The acceptance of the ERN depends to a great extent on the tools that are provided for users to make notebook entries that include text, graphics, images, equations, etc. Not only must the appropriate tools be provided and easy to use, but they need to be integrated as a package. Due to the multiple input possibilities and different forms of storage, this integration of tools will not be a trivial task. Since word processors are so common, textual input is easily supported.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Preliminary Functional Specifications of a Prototype Electronic Research Notebook for NIST.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Building Secure Microservices-based Applications Using Service-Mesh Architecture say about 4.4 Configuration for Identity and Access Management? (Part 3) According to Building Secure Microservices-based Applications Using Service-Mesh Architecture, 4.4 Configuration for Identity and Access Management: n identity certificate. In many systems, this can be achieved by attesting the instance against the system's orchestration engine, and by using other local proofs (e.g. secrets retrieved from an HSM). The same care should be taken in provisioning the signing certificate for the Service Mesh control plane's certificate management system. That signing certificate should be retrievable only by the Service Mesh control plane and only after some form of attestation has been done against it. Recommendation for Secure Naming Service (SM-DR17): If the certificate used for mTLS carries server identity, then the Service Mesh should provide a secure naming service that maps the server identity to the microservice name that is provided by the secure discovery service or DNS. This requirement is needed to ensure that the server is the authorized location for the microservices and to protect against network hijacking. If the certificate used for mTLS carries the service identity, no additional secure naming service is required. This also ensures that when the microservice is ported to a different network domain (different cluster or different cloud location), the identity and associated access control policies need not be defined again for the new location. Setting up certificates for microservices based on service identity enables two communicating services to establish a secure communication channel but does not specify whether they are allowed to communicate at all in the place. To specify this, a feature to define policies for allowed inbound and outbound traffic for each microservice node is required. Recommendation for Granular Identity (SM-DR18): Each microservice should have its own identity, and all instances of this service should present the same identity at runtime. This allows for access policy at the level of microservice in a given namespace.

Explanation: NIST publication on credential and access management. Topics: access control, sso. Contains security framework guidance for authentication systems. Source: Building Secure Microservices-based Applications Using Service-Mesh Architecture.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders provide? (Section 160) installed in several ways on CentOS 7 using yum . Yum is a package manager on the CentOS 7 platform that automates software processes, such as installation, upgrade, and removal, in a consistent way. - Download the Java Development Kit (JDK) in the appropriate format for your environment, from Oracle's website; for CentOS, the Red Hat Package Manager (RPM) download can be used: - As root, install the RPM by using the following command, substituting the actual version of the downloaded file: - Alternatively, the JDK can be downloaded in .tar.gz format and unzipped in the appropriate location (i.e., /usr/share on CentOS 7). ``` rpm -ivh jdk-8u151-linux-x64.rpm ``` The alternatives command maintains symbolic links determining default commands. This command can be used to select the default Java command. This is helpful even in cases where there are multiple installations of Java on the system. - Use the following command to select the default Java command: ``` alternatives --config java ``` There are three programs that provide 'java.' - *+ 2 java-1.8.0-openjdk.x86\_64 (/usr/lib/jvm/java-1.8.0-openjdk- ``` Selection Command -----------------------------------------------1 /usr/java/jre1.8.0_111/bin/java 1.8.0.131-3.b12.el7_3.x86_64/jre/bin/java) 3 /usr/java/jdk1.8.0_131/jre/bin/java ``` Enter to keep the current selection[+], or type selection number: This presents the user with a configuration menu for choosing a Java instance. Once a selection is made, the link becomes the default command systemwide. - To make Java available to all users, the JAVA\_HOME environment variable is set by using the following command: - For cryptographic functions, download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 8 from -

Explanation: NIST publication on credential and access management. Topics: authentication, single sign-on. Contains security framework guidance for authentication systems. Source: Mobile Application Single Sign-On_ Improving Authentication for Public Safety First Responders.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Trustworthy Email provide? (Section 48) fashion, across networks via Mail Transfer Agents (MTAs). MTAs communicate using the Simple Mail Transfer Protocol (SMTP) described below and act as both client and server, depending on the situation. For example, an MTA can act as a server when accepting an email message from an end user's MUA, then act as a client in connecting to and transferring the message to the recipient domain's MTA for final delivery . MTAs can be described with more specialized language that denotes specific functions: - Mail Submission Agents (MSA): An MTA that accepts mail from MUAs (usually after authenticating the sender) and begins the transmission process by sending it to a MTA for further processing. Often the MSA and first -hop MTA is the same process, just fulfilling both roles. - Mail Delivery Agent (MDA): An MTA that receives mail from an organization's inbound MTA and ultimately places the message in a specific mailbox. Like the MSA, the MDA could be a combined in-bound MTA and MDA component. Mail servers may also perform various security functions to prevent malicious email from being delivered or include authentication credentials such as digital signatures (see Sender Policy Framework Section 4.3 and DomainKeys Identified Mail (DKIM) Section 4.5). �ese security functions may be provided by other components that act as lightweight MTAs or these functions may be added to MTAs via filters or patches. An email message may pass through multiple MTAs before reaching the final recipient. Each MTA in the chain may have its own security policy (which may be uniform within an organization but may not be uniform) and there is currently no way for a sender to request a particular level of security for the email message. However, there is work in progress 1 for specifying how a client can request the use of TLS for message transmission. In addition to MUAs and MTAs, an organization may use one or more special purpose components for a particular task.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Trustworthy Email.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Government Smart Card Interoperability Specification, Version 2.1 say about Appendix C-GSC Data Model? (Part 6) According to Government Smart Card Interoperability Specification, Version 2.1, Appendix C-GSC Data Model: Login Information File / Buffer | | EF 4000 | Verify CHV | |-----------------------------------|-----|-----------|--------------| | Data Element (TLV) | Tag | Type | Max. Bytes | | User ID | 40 | Variable | 60 | | Domain | 41 | Variable | 60 | | Password | 42 | Variable | 20 | | Error Detection Code | FE | LRC | 1 | | Card Information File / Buffer | | EF 5000 | Always Read | Always Read | |----------------------------------|-----|-----------------|---------------|---------------| | Data Element (TLV) | Tag | Type | | Max. Bytes | | Issuer ID | 50 | Variable | | 32 | | Issuance Counter | 51 | Variable | | 4 | | Issue Date | 52 | Date (YYYYMMDD) | | 8 | | Expiration Date | 53 | Date (YYYYMMDD) | | 8 | | Card Type | 54 | Variable | | 32 | | Demographic Data Load Date | 55 | Date (YYYYMMDD) | | 8 | | Demographic Data Expiration Date | 56 | Date (YYYYMMDD) | | 8 | | Card Security Code | 57 | Fixed Text | | 32 | | Card ID AID | 58 | Variable | | 32 | <!-- image --> | Card Information File / Buffer | | EF 5000 | Always Read | |----------------------------------|-----|-----------|---------------| | Data Element (TLV) | Tag | Type | Max.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Domain Name System-Based Electronic Mail Security provide? (Section 43) ure of communications and confidentiality protection by encrypting communications. The project's demonstration of DNSSEC and DANE protocols also supports communications and control network integrity. It does this by demonstrating operationally feasible mechanisms for refusing connections to or message delivery from sources that do not implement a specified set of DNS security extensions. Rigorous adherence to a minimum security configuration can be used to enforce isolation of networks from entities that do not conform to the network's security requirements. The Detect Function develops and implements the appropriate activities needed to identify in a timely manner the occurrence of a cybersecurity event. Examples of outcome categories within this function addressed by the project include Security Continuous Monitoring and Detection Processes. The Security Continuous Monitoring Category supports an outcome in which information systems and assets are monitored at discrete intervals to identify cybersecurity events and to verify the effectiveness of protective measures. While not a classic example of continuous monitoring, the project's platform has the ability to automatically check all DNS responses for correct digital signatures. The DE.CM-1 subcategory under Security Continuous Monitoring supports monitoring of networks to detect potential cybersecurity events. While not a classic example of continuous monitoring, the demonstrated capability of the project's platform to automatically check all inbound DNS responses for valid digital signatures permits identification of attempts to spoof systems using bogus DNS data. Automatic signing and signature validation for email permits continuous checking for false sender identities and modification of message content. NIST SP 800-53, referred to by this subcategory, requires monitoring of inbound and outbound communications traffic for unauthorized conditions (SI-4 [4]).

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Domain Name System-Based Electronic Mail Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control BE-4 in IT Asset Management? (Part 118) Control BE-4: cvss_base = stripped(str(row[12])) risk_factor = stripped(str(row[13])) if int(id) > int(last_id): #print "Greater!" last_id = id openvas_state.seek(0,0) openvas_state.write(str(last_id)) new_record_count = new_record_count + 1 csv_writer.writerow([id, task, subnet, host, port, nvt, type, results_description, report, nvts_name, nvts_description, cve, cvss_base, risk_factor]) ``` ``` json_dict = {'id': id, 'task': task, 'subnet': subnet, 'host': host, 'port': port, 'nvt': nvt, 'type': type, 'results_description': results_description, 'report': report, 'nvts_name': nvts_name, 'nvts_description': nvts_description, 'cve': cve, 'cvss_base': cvss_base, 'risk_factor': risk_factor} json.dump(json_dict, jsonfile, sort_keys = True, indent = 4, ensure_ascii = False) #print "ID: %s LAST: %s" % (id, last_id), print "\n" db_conn.close() csvfile.close() jsonfile.close() print "Wrote %s new records." % new_record_count ``` ## /opt/splunkforwarder/etc/system/local/server.conf ``` [sslConfig] sslKeysfilePassword = $1$JnofjmZL66ZH [lmpool:auto_generated_pool_forwarder] description = auto_generated_pool_forwarder quota = MAX slaves = * stack_id = forwarder [lmpool:auto_generated_pool_free] description = auto_generated_pool_free quota = MAX slaves = * stack_id = free [general] pass4SymmKey = $1$cTZL0iMNoPRH serverName = openvas ``` ## /opt/splunkforwarder/etc/system/local/outputs.conf ``` [tcpout] defaultGroup = splunkssl [tcpout:splunkssl] compressed = true server = loghost:9997 sslCertPath = $SPLUNK_HOME/etc/certs/openvas.lab5.nccoe.gov.pem sslPassword = $1$JnofjmZL66ZH sslRootCAPath = $SPLUNK_HOME/etc/certs/CAServerCert.pem sslVerifyServerCert = true ``` ## /opt/splunkforwarder/etc/system/local/inputs.conf ``` [default] host = openvas index = openvas sourcetype = openvas [monitor:///home/mike/openvas_results.csv] ``` ## 3.7 Puppet Enterprise Puppet Enterprise enforces a configuration baseline on servers and workstations.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: IT Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control RA-1 in Securing Wireless Infusion Pumps in Healthcare Delivery Organizations? (Part 58) Control RA-1: edical devices with wireless LAN ▪ remote access for external vendor support The NCCoE build uses Cisco Adaptive Security Appliances (ASA) as virtual router and firewall devices within the network. Each defined zone in the hospital network that we built has its own ASA, with two interfaces to protect each zone. As we considered how many ASAs to use, we opted for a tradeoff between the complexity of the configuration and the number of interfaces on a single ASA. 2.1.1 Cisco ASA Baseline Configuration In our environment, all ASAs are virtualized and are based on Cisco’s Adaptive Security Virtual Appliance (ASAv) product. In your environment, the responsible person would complete installation by following the Cisco Adaptive Security Virtual Appliance (ASAv) Quick Start Guide, 9.6 [2]. We imported the virtual appliance called asav-vi.ovf, assigning the first interface to the management network, the second interface to the wide area network (WAN), and the third interface to the local area network (LAN). For an unknown reason, the show version command did not work in the console; as a workaround, we configured Secure Shell (SSH) [3] access and ran the command via SSH instead. NIST SP 1800-8C: Securing Wireless Infusion Pumps 4 T h i s p u b l i c a t i o n i s a v a i l l a b e f r e e o f c h a r g e f r o m : h t t p s : / / d o i . . o r g / 1 0 6 0 2 8 / N I S T . S P 1 8 0 0 - 8 . . Next, we configured the ASA with a baseline-configuration template that allows all outbound traffic, as well as only related inbound traffic as allowed by the stateful firewall. Internet Control Message Protocol (ICMP) [4] enables troubleshooting with ping and traceroute tools. Authenticated OSPF automated routing tables as we added or removed ASAs in the network. In your production environment, you may wish to make different decisions in your baseline configuration. All ASAs have an additional management interface on 192.168.29.0/24.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: Securing Wireless Infusion Pumps in Healthcare Delivery Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security say about 2.2.3 Remote Desktop Access? (Part 1) According to Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security, 2.2.3 Remote Desktop Access: 2.2.3 Remote Desktop Access A remote desktop access solution gives a teleworker the ability to remotely control a particular PC at the organization, most often the user's own computer at the organization's office, from a telework client device. The teleworker has keyboard and mouse control over the remote computer and sees that computer's screen on the local telework client device's screen. Remote desktop access allows the user to access all of the applications, data, and other resources that are normally available from their PC in the office. Figure 2-3 shows the basic remote desktop access architecture. A remote desktop access client program or web browser plug-in is installed on each telework client device, and it connects directly with the teleworker's corresponding internal workstation on the organization's internal network. Figure 2-3. Remote Desktop Access Architecture <!-- image --> There are two major styles of remote desktop access: direct between the telework client and the internal workstation, and indirect through a trusted intermediate system. However, direct access is often not possible because it is prevented by many firewalls. For example, if the internal workstation is behind a firewall performing network address translation (NAT), the telework client device cannot initiate contact with the internal workstation unless either the NAT allows such contact 14 or the internal workstation initiates communications with the external telework client device (e.g., periodically checking with the client device to see if it wants to connect). Indirect remote desktop access is performed through an intermediate server. This server is sometimes part of the organization's firewall, but is more often run by a trusted commercial or free third-party service outside the organization's network perimeter.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Vetting the Security of Mobile Applications say about Table of Contents? (Part 9) According to Vetting the Security of Mobile Applications, Table of Contents: | Managed and Unmanaged Apps .................................................................. | 21 | | | 5.2 | App Whitelisting and App Blacklisting...........................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Vetting the Security of Mobile Applications.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 2.9 SWAM Actual State and Desired State Specification according to NIST Automation Support for Security Control Assessments_ Software Asset Management According to Automation Support for Security Control Assessments_ Software Asset Management, 2.9 SWAM Actual State and Desired State Specification: For information on the actual state and the desired state specification for SWAM, see the assessment criteria notes section of the defect check tables in Section 3.2. Note that many controls in SWAM refer to developing and updating an inventory of software on devices (or other inventories). Note also, that per the SP 800-53A 22 definition of test , testing of the SWAM controls implies the need for specification of both an actual state inventory and a desired state inventory, so that the test can compare the two inventories. The details of the comparison are described in the defect check tables in Section 3.2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Asset Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Assessing Security Requirements for Controlled Unclassified Information say about Test? According to Assessing Security Requirements for Controlled Unclassified Information, Test: [SELECT FROM: processes for security at alternate work sites; mechanisms for supporting alternate work sites; security requirements employed at alternate work sites; means of communication between personnel at alternate work sites and security personnel]


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cell Phone Forensic Tools_ an Overview and Analysis provide? (Section 149) t) The following scenarios were conducted on a Cingular GSM Motorola MPx220 running Microsoft Windows Mobile 2004 for Pocket PC Phone Edition. PDA Seizure version 3.0.3.89 was used for acquisition. Connectivity and Retrieval: The data contents of the device were successfully acquired with or without the SIM present. If internal memory authentication mechanisms are applied, the proper pass-phrase must be provided in order for the ActiveSync connection to take place. Basic subscriber and service provider information (e.g., IMEI, ICCID, MSISDN) were not found. Network carrier and the phone number was found in the \Windows directory and reported. The reported memory size is consistent with the total memory size of the device. (Meet) PIM Applications: PIM data was not found (i.e., Address Book, Calendar, Tasks, Memos). (Miss) Dialed/Received Phone Calls: Dialed/received phone calls were not found. (Miss) SMS/MMS Messaging: SMS messages were not found. Textual content of all active incoming MMS messages were found and reported. MMS attachments were not found. Deleted MMS messages were not found. (Below) Internet Messaging: All data content associated with sent and received email messages was found and reported. Deleted messages were not found. (Below) Web Applications: Visited URLs and search engine queries were found and reported. Textual Web content pertaining to visited URLs was not found. No graphical images of visited sites were found. (Below) Text File Formats: Data content associated with text files (i.e., . txt , . doc , . pdf ) was found and reported. Deleted text files were not found. (Below) Graphics File Formats: Graphics file (i.e., . bmp , . jpg , . gif , . png , . tif ) data content was found and reported. . png files were found but not displayed in the graphics library. Deleted graphics files were not found. (Below) Compressed File Archive Formats: Compressed data file (i.e., . zip , . rar , . exe , . tgz ) content was found and reported.

Explanation: NIST publication on credential and access management. Topics: authentication, sso. Contains security framework guidance for authentication systems. Source: Cell Phone Forensic Tools_ an Overview and Analysis.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is Note according to Engineering Trustworthy Secure Systems? Note: Scope includes the system, system elements, information items, or artifacts that will be verified against applicable requirements, security characteristics, or other security properties. Each verification action description includes what will be verified (e.g., actual system, model,

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Engineering Trustworthy Secure Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings provide? (Section 107) es (EECs) [16] and proxy certificates [42]. In brief, these certificates allow a user to assert a globally unique identifier (i.e., a distinguished name from the X.509 identity certificate). We note that in Grid scenarios there is often an organizational separation between the certificate authorities (CAs), which are the authorities of identity (authentication) and the authorities of attributes (authorization). For example, in the case of the Department of Energy (DOE) SciDAC program [36], a single CA, the DOE Grids CA [6], serves a broad community of users, while the attributes and rights for those users are determined by their individual projects (e.g., National Fusion Grid, Earth Systems Grid, or Particle Physics Data Grid). Authorization in the Globus Toolkit is by default based on access control lists (ACLs) located at each resource. The ACLs specify the identifiers of the users allowed to access the resource. Also, higher-level services (such as CAS [32]) that provide richer authorization policies exist as optional configurations. As is discussed later, the GridShib project enhances the authorization options of the Globus Toolkit by adding standards-based attribute exchange for both authorization policies and service customization. Shibboleth[37] provides cross-domain single sign-on and attribute-based authorization while preserving user privacy. Developed by Internet2/MACE [19], Shibboleth is based in large part on the OASIS Security Assertion Markup Language (SAML). The SAML 1.1 browser profiles [17,21,34] define two functional components, an Identity Provider and a Service Provider 2 . The Identity Provider (IdP) creates, maintains, and manages user identity, while the Service Provider (SP) controls access to services and resources. An IdP produces and issues SAML assertions to SPs upon request.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: 5th Annual PKI R&D Workshop _Making PKI Easy to Use_ Proceedings.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Usability of PIV Smartcards for Logical Access provide? (Section 2) Gallagher, Under Secretary of Commerce for Standards and Technology and Director | INTRODUCTION............................................................................................................................................3 | INTRODUCTION............................................................................................................................................3 | INTRODUCTION............................................................................................................................................3 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------| | PREVIOUS PIV STUDIES.............................................................................................................................4 | PREVIOUS PIV STUDIES.............................................................................................................................4 | PREVIOUS PIV STUDIES.............................................................................................................................4 | | 3.1 | PARTICIPANTS ..........................................................................................................................................5 | | | 3.2 | INSTRUCTIONAL MATERIALS ...................................................................................................................7 | | | 3.3 | EQUIPMENT..............................................................................................................................................7 | | | 3.3.1 | Card .................................................................................................................................................7 | | | 3.3.2 | Card Readers....................................................................................................................................9 | | | 3.4 SETTING .................................................................................................................................................10 | 3.4 SETTING .................................................................................................................................................10 | | | 3.5 | TASKS ....................................................................................................................................................10 | | | 3.6 | TIMELINE OF ACTIVITIES........................................................................................................................10 | | | 3.6.1 | Smartcard Installation Phase..........................................................................................................11 | | | 3.6.2 | Smartcard Use Phase .....................................................................................................................11 | | | 3.6.3 | Study Wrap-Up Phase....................................................................................................................12 | | | 3.7 DATA COLLECTION METHODS ..............................................................

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Usability of PIV Smartcards for Logical Access.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Comments on this publication may be submitted to: according to NIST A Framework for Designing Cryptographic Key Management Systems According to A Framework for Designing Cryptographic Key Management Systems, Comments on this publication may be submitted to:: National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: ckmsdesignframework@nist.gov SP 800-130 August 2013

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: A Framework for Designing Cryptographic Key Management Systems.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms provide? (Section 81) rganizations having special security needs and desiring to augment the base security and key-management services, and suggests additional features that may be desirable to implement and use. 74 SP 800-130, A Framework for Designing Cryptographic Key Management Systems . 75 SP 800-152, A Profile for U. S. Federal Cryptographic Key Management Systems (CKMS) . In addition to providing design requirements to be incorporated into a CKMS design, SP 800-152 provides requirements for a Federal CKMS (FCKMS) to be operated by a service provider that may be a federal agency or a third party operating an FCKMS under contract for one or more federal agencies and their contractors. This Profile is intended to - Assist CKMS designers and implementers in supporting appropriate cryptographic algorithms and keys, selecting the metadata associated with the keys, and selecting protocols for protecting sensitive U.S. federal computing applications and data; - Establish requirements for testing, procurement, installation, configuration, administration, operation, maintenance, and usage of the FCKMS; - Facilitate an easy comparison of one CKMS with another by analyzing their designs and implementations in order to understand how each meets the Framework (i.e., SP 800-130) and Profile (e.g., SP 800-152) requirements; and - Assist in understanding what is needed to evaluate, procure, install, configure, administer, operate, and use an FCKMS that manages the key information that is used to protect sensitive and valuable data obtained, processed, stored, and used by U.S. federal organizations and their contractors. A PKI is a security infrastructure that creates and manages public-key certificates to facilitate the use of public-key (i.e., asymmetric-key) cryptography. To achieve this goal, a PKI needs to perform two basic tasks: 1.

Explanation: NIST publication on credential and access management. Topics: pki, key management, sso. Contains security framework guidance for authentication systems. Source: Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case provide? (Section 189) PN users and add those users requiring remote access to this group. For instance, a group called VPN-users was created in our AD server and a user vpnuser01 was added to this group. <!-- image --> 3. Launch the Network Policy Server console. Create a new Radius client for your firewall device by clicking on Radius Clients > New . 4. Enter the IP address of the Interface on the ASA. This is typically the Default Gateway of the subnet where the AD/Radius server is in. Enter a strong passphrase for Shared secret. The image below shows a Radius client created for our Cisco-ASA firewall. <!-- image --> 5. Click on Network Policies under Polices . Create a Network Policy here corresponding to the Radius client setup earlier. The image below shows network policy created for the Cisco-ASA client. Ensure the policy is enabled. 6. Click ADD under Conditions tab to add the following two conditions at a minimum. Add more conditions as per your requirement. - VPN-Users security group created earlier. - Client IPv4 Address: IP address of the Radius client created earlier. <!-- image --> <!-- image --> 7. Select the authentication methods under Constraints as shown below. This is as per Cisco documentation. 82 <!-- image --> 8. Click Standard under Radius Attributes under Settings tab. Set the following attributes - Framed Protocol= PPP - Service-Type= Framed - Class = < Name of group policy >. This policy is configured in the Firewall for VPN <!-- image --> Below are the high-level steps for configuring Secure Remote Access in the FMC (Firepower Management Console). 1. Login to the FMC Web interface. Click on Licenses > Smart Licenses > Verify if either AnyConnect Plus or AnyConnect VPN license has been enabled (if not already). 2.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: cybersecurity framework, fips, security control. General security reference material without sensitive content. Source: Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does PIV Data Model Test Guidelines provide? (Section 220) Note: - Since the ECDSA keys do not have any size res rictions based on dates, this test case does not apply | | Expected Result(s) | The key sizes used adhere to the time period for use requirement. | | Purpose | Confirms that the digital signature certificate asserts the appropriate purpose of the key contained in the certificate. | |--------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Reference(s) | 1. FIPS201, Section 5.4.2.1 2. AS07.02.05 | | Precondition | 1. A valid PIV card is inserted into the contact reader. 2. A valid PC/SC connection exists between the test application and the contact reader. 3. The test application is currently connected to the card application which is accessible through card handle. 4. A digital signature key and corresponding certificate are present on the PIV card. | | Test Steps | 1. Set cardHandle := <<valid card handle>> cate from 2. Set OID := <<Digital Signature Certifi (2.16.840.1.101.3.7.2.1.0)>> 3. Call pivGetData w/ • (IN) cardHandle • (IN) OID • (OUT) data 4.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: PIV Data Model Test Guidelines.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide to Storage Encryption Technologies for End User Devices say about 3.2 Protection Provided by Storage Encryption Technologies? (Part 5) According to Guide to Storage Encryption Technologies for End User Devices, 3.2 Protection Provided by Storage Encryption Technologies: e and the user has been authenticated to the storage encryption solution, malware could access decrypted files and transfer copies of them to external hosts or extract sensitive information from them. Other examples are an attacker disabling or reconfiguring storage encryption, malware installing a keylogger that captures passwords used for storage encryption authentication, or malware acquiring a copy of a storage encryption key from the device's memory (for software-based storage encryption solutions). Organizations should also be aware that they should not rely on storage encryption technologies to protect data without regularly maintaining the encryption solution. For example, if an attacker acquires a lost, stolen, or retired device protected by storage encryption technology, and a vulnerability in the storage encryption technology is discovered in the future, the attacker may be able to exploit it to access the protected data.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: vulnerability, exploit, malware. Contains technical security guidance that could inform defensive posture. Source: Guide to Storage Encryption Technologies for End User Devices.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Assessing Security and Privacy Controls in Information Systems and Organizations provide? (Section 613) informaon security and privacy responsibilies]. PE-02 PHYSICAL ACCESS AUTHORIZATIONS ASSESSMENT OBJECTIVE: Determine if: PE-02_ODP PE-02a.[01] PE-02a.[02] PE-02a.[03] PE-02b. PE-02c. PE-02d. frequency at which to review the access list detailing authorized facility access by individuals is deﬁned; a list of individuals with authorized access to the facility where the system resides has been developed; the list of individuals with authorized access to the facility where the system resides has been approved; the list of individuals with authorized access to the facility where the system resides has been maintained; authorizaon credenals are issued for facility access; the access list detailing authorized facility access by individuals is reviewed <PE-02_ODP frequency>; individuals are removed from the facility access list when access is no longer required. CHAPTER FOUR PAGE 331 Reference produced from open data hps://github.com/usnistgov/oscal-content NIST SP 800-53A, REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS PE-02 PHYSICAL ACCESS AUTHORIZATIONS POTENTIAL ASSESSMENT METHODS AND OBJECTS: PE-02-Examine [SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access authorizaons; authorized personnel access list; authorizaon credenals; physical access list reviews; physical access terminaon records and associated documentaon; system security plan; other relevant documents or records]. PE-02-Interview [SELECT FROM: Organizaonal personnel with physical access authorizaon responsibilies; organizaonal personnel with physical access to system facility; organizaonal personnel with informaon security responsibilies]. PE-02-Test [SELECT FROM: Organizaonal processes for physical access authorizaons; mechanisms supporng and/or implemenng physical access authorizaons].

Explanation: NIST publication on credential and access management. Topics: authorization, sso. Contains security framework guidance for authentication systems. Source: Assessing Security and Privacy Controls in Information Systems and Organizations.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control SI-11 in Guidelines for Smart Grid Cybersecurity? (Part 363) Control SI-11: sues that arise in the design, deployment, and use of smart grid systems and that should be considered by system designers, implementers, purchasers, integrators, and users of smart grid technologies. In discussing the relative merits of different technologies or solutions to problems, these design considerations do not recommend specific solutions or requirements. The intention is to highlight important issues that can serve as a means of identifying and formulating requirements and high-level designs for key protocols and interfaces that are missing and need to be developed. 7.2 EVIDENT AND SPECIFIC CYBERSECURITY PROBLEMS This section documents specific cybersecurity problems in the smart grid by describing field cases that explain the operational, system, and device issues. The problems listed are intentionally not ordered or categorized in any particular way. 7.2.1 Authenticating and Authorizing Utility Users This section identifies three examples of authenticating and authorizing users that is unique for the smart grid. The three examples include authenticating and authorizing utility users to substation intelligent electronic devices (IEDs), to outdoor field equipment, and to meters. In each of these examples, role-based, rather than unique user-based access control is commonly used and passwords are shared among organizational users with the same role. Also common across all of the examples is the volume of devices, leading to the same password often being used across all devices and seldom changed. Control of authentication and authorization can be centrally managed for substation IEDs, outdoor field equipment, and to meters across the utility, and is updated promptly to ensure that only intended users can authenticate to intended devices and perform authorized functions. 34 In the case of substation IEDs, passwords are often stored locally on the device, with different passwords allowing different authorization levels.

Explanation: NIST publication on credential and access management. Topics: access control, authentication, authorization. Contains security framework guidance for authentication systems. Source: Guidelines for Smart Grid Cybersecurity.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Guide for Conducting Risk Assessments say about 2.3.2 Assessment Approaches? (Part 3) According to Guide for Conducting Risk Assessments, 2.3.2 Assessment Approaches: y insignificant, while the difference between risks scored 36 and 70 is relatively significant). The role of expert judgment in assigning values is more evident than in a purely quantitative approach. Moreover, if the scales or sets of bins provide sufficient granularity, relative prioritization among results is better supported than in a purely qualitative approach. As in a quantitative approach, rigor is significantly lessened when subjective determinations are buried within assessments, or when significant uncertainty surrounds a determination of value. As with the nonnumeric categories or levels used in a well-founded qualitative approach, each bin or range of values needs to be clearly defined and/or characterized by meaningful examples. Independent of the type of value scale selected, assessments make explicit the temporal element of risk factors. For example, organizations can associate a specific time period with assessments of likelihood of occurrence and assessments of impact severity. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Guide for Conducting Risk Assessments.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Required Test Procedures: according to NIST Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements According to Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements, Required Test Procedures:: SCAP.T.3800.1: The tester SHALL manually inspect the vendor-identified machine-readable output and ensure that CPE naming data is correct according to the CPE specification. The tester will do this by choosing a minimum of 30 vendor and product names in the product output that are also included in the official CPE Dictionary. SCAP.R.3900: The product SHALL allow users to locate configuration issue items using CCE IDs. SCAP Capability:  ACS

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 4. Define a Specific Plan and Process according to NIST NIST Cryptographic Standards and Guidelines Development Process According to NIST Cryptographic Standards and Guidelines Development Process, 4. Define a Specific Plan and Process: NIST has several approaches that it may use to meet the needs for cryptographic standards or guidelines. These include adopting or adapting existing SDO-produced standards, encouraging and participating in the development of new standards by SDOs, or developing NIST standards - which, in some cases, may involve holding a competition. NIST will solicit input from stakeholders in determining the most appropriate approach for a particular standard or guideline. After making a decision, NIST will publicly state and explain the reason for this determination. Options include:

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: NIST Cryptographic Standards and Guidelines Development Process.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control DS-3 in Data Confidentiality_ Identifying and Protecting Assets Against Data Breaches? (Part 102) Control DS-3: Click Next . <!-- image --> 12. Copy the API Hostname into the labeled field. 13. Click Next. 14. Copy in the Integration and Secret Keys into the relevant fields and click Next . 15. Click Next. 16. Configure Duo's integration options according to the needs of your organization. Note that Bypass Duo authentication when offline will allow users to skip the two-factor authentication when offline, which increases the availability of their files but may increase risk. <!-- image --> <!-- image --> <!-- image --> 17. Click Next . 18. Leave Enable Smart Card support unchecked. 19. Click Next . <!-- image --> 20. Leave Enable UAC Elevation Protection unchecked. <!-- image --> ## 21. Click Next . <!-- image --> 22. Click Install . <!-- image --> 23. Click Finish . 24. Installation should now be complete. Users registered on the Duo Dashboard with a linked phone will be allowed access to the system. ## 2.7.2 Registering a Duo User 1. Login to the Duo Admin Dashboard. 2. Click Add New > User from the drop-down menu on the right. 3. Enter a username for the user. <!-- image --> <!-- image --> 4. Click Add User. 5. This will lead you to that user's information page, where additional information (full name, email, phone number) and Duo authenticators (phone numbers, 2 Factor Authentication (2FA) hardware tokens, WebAuthn, etc.) can be associated with that username. Note: A user will not be able to log into a Duo protected system unless the user is registered and has an authentication device associated with their username. ## 2.8 Dispel Dispel is a network protection and user access tool that we used to provide a Virtual Desktop Infrastructure (VDI) capability. A typical deployment of Dispel is done in a largely managed fashion, with a specific deployment being tailored to a network setup. The deployment in the NCCoE laboratory may not be the best setup for any given network.

Explanation: NIST publication on credential and access management. Topics: authentication, token, sso. Contains security framework guidance for authentication systems. Source: Data Confidentiality_ Identifying and Protecting Assets Against Data Breaches.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What information does Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance provide? (Section 91) uthoritiative server installers shall use an approved random bit generator (as discussed in [SP 800-90A]) to create and configure an initial, random secret string for use with TSIG in transactions. 3. Authoritative servers shall be configured to generate and sign zone data with a key pair that is consistent with the key size recommendations for digital signatures as specified in Part 1. 4. Authoritative servers shall be configured to generate and sign the key set with a key pair that is consistent with the key sizes recommended for digital signatures, as specified in Part 1. 5. Authoritative servers shall be configured to generate and use a random secret string for zone transfer-message authentication (via TSIG) between primary and secondary servers. The security strength of the random bit generator process shall support the security strength required by the servers. 6. Authoritative servers shall be configured to generate and use a separate shared secret string for dynamic update-message authentication (via TSIG). The security strength of the random bit generator process shall support the security strength required by the servers. 1. Recursive caching server installers shall configure DNS servers to be DNSSECaware. 2. Recursive caching server installers shall install at least one public key used for DNSSEC validation. The key(s) shall be kept up-to-date to insure successful validations. 1. Client systems shall be configured to send DNS queries to a DNSSEC-enabled caching recursive server. 2. Client systems should be configured to use DNSSEC-enabled applications, if they are available. The System Administrator is the individual who runs the DNS application on a day-today basis and interacts with the end user. 1. The organization security policy regarding the Authoritative servers shall be enforced. 2. Cryptographic keys shall be protected as specified in Part 1. 3.

Explanation: NIST publication on credential and access management. Topics: authentication, key management. Contains security framework guidance for authentication systems. Source: Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control CM-8(5) in Automation Support for Security Control Assessments_ Software Vulnerability Management? (Part 16) Control CM-8(5): | The defect check to assess whether this sub-capability is operating effectively is defined as follows: | Defect Check ID | Defect Check Name | Assessment Criteria Notes | Selected | |-------------------|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------| | VUL-Q03 | Low completeness- metric | The completeness metric is not a device - level defect but is applied to any collection of devices such as those in an authorization boundary.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control, assessment. General security reference material without sensitive content. Source: Automation Support for Security Control Assessments_ Software Vulnerability Management.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Message Authentication Code (MAC) Validation System_ Requirements and Procedures say about 5.1 Validate Suboption? (Part 3) According to Message Authentication Code (MAC) Validation System_ Requirements and Procedures, 5.1 Validate Suboption: rt the status of the validation testing to the DUT by sending a completion message. Tests involving the following types of key and data combinations are performed in the Binary Validate Suboption: I. - (1) Selected key and data combinations (without a MAC) which are related to those given in Appendix B of NBS Special Publication 500-20, Validating the Correctness of Hardware Implementations of the NBS Data Encryption Standard [9], except that the data consists of the given data with one to eight ASCII hexadecimal ones appended. 235 tests of this type are performed. - (2) Selected key and data combinations (without a MAC) which are related to those generated by the DES Maintenance Test as specified in NBS Special Publication 500-61, Maintenance Testing for the Data Encryption Standard [10], except that the data consists of the generated data with one to eight ASCII hexadecimal ones appended. 192 tests of this type are performed. - (3) Key and data combinations (without a MAC) which are randomly generated. At least 100 tests of this type are performed. Some of these combinations consist of data whose length is not a multiple of 64 bits so that the DUT must correctly pad the data in the MAC computation. - (4) Key and data combinations (with a MAC) which are randomly generated. At least 100 tests of this type are performed. Approximately half of the MACs are randomly chosen to be incorrect.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Message Authentication Code (MAC) Validation System_ Requirements and Procedures.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Examine according to NIST Assessing Security Requirements for Controlled Unclassified Information According to Assessing Security Requirements for Controlled Unclassified Information, Examine: [SELECT FROM: system media protection policy and procedures; system use policy; procedures for media usage restrictions; rules of behavior; system audit records; system design documentation; system configuration settings; system security plan; other relevant documents or records]

Explanation: NIST publication discussing classified information handling. References: classified, controlled unclassified. Contains guidance on protecting sensitive government information. Source: Assessing Security Requirements for Controlled Unclassified Information.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does Digital Identity Guidelines_ Federation and Assertions say about 5.5. Discovery and Registration? (Part 2) According to Digital Identity Guidelines_ Federation and Assertions, 5.5. Discovery and Registration: anaging discovery and registration. When an RP joins the ecosystem, it registers itself with the trusted service, downloads the CSP's verification keys, and receives an identifier to use with wallets. When the CSP issues attribute bundles to the subscriber-controlled wallet, the subscriber-controlled wallet is informed where it can find the list of valid RP identifiers within the ecosystem. When the RP connects to the wallet, the wallet can verify the RP's identifier without the RP having to register itself directly with the wallet. Likewise, the RP can trust the wallet's verification keys by verifying the CSP's signature over the wallet's verification keys or identifier. - 5.6. Authentication and Attribute Disclosure The decision of whether a federation transaction proceeds and, therefore, an assertion is issued and attributes are released to the RP SHALL be determined by the subscriber acting in the role of the authorized party. The decision MAY be augmented by the use of allowlists and blocklists to allow the wallet to help the subscriber make a decision based on configured policies and trust agreements. The subscriber-controlled wallet MAY remember the subscriber's decision to allow for future actions at the same RP without separate authorization from the subscriber. The use of a stored authorization decision does not supersede the requirement for wallet activation, as discussed in Sec. 5.4. The subscriber-controlled wallet MAY provide a mechanism to remember a disclosure decision by the authorized party (i.e., the subscriber) to apply to future requests from the same RP. If such a mechanism is provided, the subscriber-controlled wallet SHALL disclose to the authorized party that the storage mechanism is in use and SHALL allow the authorized party to revoke such remembered access at a future time. The subscriber-controlled wallet SHOULD provide a means to selectively disclose a subset of the attributes in the attribute bundle from the CSP.

Explanation: NIST publication on credential and access management. Topics: authentication, authorization. Contains security framework guidance for authentication systems. Source: Digital Identity Guidelines_ Federation and Assertions.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What does NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0 say about Monitoring Change? According to NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0, Monitoring Change: Privacy risk management is not a static process. An organization monitors how changes in its business environment-including new laws and regulations and emerging technologies-and corresponding changes to its systems, products, and services may be affecting privacy risk, and iteratively uses the practices in this appendix to adjust accordingly. (GV.MT-P1) 23 The NIST PRAM uses organizational costs such as non-compliance costs, direct business costs, reputational costs, and internal culture costs as drivers for considering how to assess individual impact. Id. at Worksheet 3, Impact Tab. 24 See NIST SP 800-30, Rev. 1, Guide for Conducting Risk Assessments at [12] p. 14. 25 The NIST PRAM uses a semi-quantitative approach based on a scale of 1-10. 26 The NIST PRAM provides various prioritization representations, including a heat map. See [3] Worksheet 3. 27 The NIST PRAM provides a process for responding to prioritized privacy risks. Id. at Worksheet 4. 28 See NIST SP 800-37, Rev. 2 [7]. 29 See NIST SP 800-53 as updated [10].

Explanation: NIST cybersecurity documentation and standards guidance. Topics: nist sp, fips, security control. General security reference material without sensitive content. Source: NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. What is control IA-5 in NIST_SP_800-53r5_Security_Privacy_Controls? (Part 8) Control IA-5: owing rules: [Assignment: organization-defined binding rules]. Discussion: Authentication requires some form of binding between an identity and the authenticator that is used to confirm the identity. In conventional approaches, binding is established by pre-provisioning both the identity and the authenticator to the system. For example, the binding between a username (i.e., identity) and a password (i.e., authenticator) is accomplished by provisioning the identity and authenticator as a pair in the system. New authentication techniques allow the binding between the identity and the authenticator to be implemented external to a system. For example, with smartcard credentials, the identity and authenticator are bound together on the smartcard. Using these credentials, systems can authenticate identities that have not been pre-provisioned, dynamically provisioning the identity after authentication. In these situations, organizations can anticipate the dynamic provisioning of identities. Pre-established trust relationships and mechanisms with appropriate authorities to validate identities and related credentials are essential. Related Controls: AU-16, IA-5. (11) AUTHENTICATOR MANAGEMENT | HARDWARE TOKEN-BASED AUTHENTICATION [Withdrawn: Incorporated into IA-2(1) and IA-2(2).] (12) AUTHENTICATOR MANAGEMENT | BIOMETRIC AUTHENTICATION PERFORMANCE For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements [Assignment: organization-defined biometric quality requirements]. Discussion: Unlike password-based authentication, which provides exact matches of user- input passwords to stored passwords, biometric authentication does not provide exact matches. Depending on the type of biometric and the type of collection mechanism, there is likely to be some divergence from the presented biometric and the stored biometric that serves as the basis for comparison.

Explanation: NIST publication on credential and access management. Topics: authentication, token. Contains security framework guidance for authentication systems. Source: NIST_SP_800-53r5_Security_Privacy_Controls.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain Data Field returned in the Response Message according to NIST Government Smart Card Interoperability Specification, Version 2.1 According to Government Smart Card Interoperability Specification, Version 2.1, Data Field returned in the Response Message: If the immediately preceding APDU has indicated that additional data is available, the data field of an immediately following Get Response APDU will contain this data.

Explanation: NIST cybersecurity documentation and standards guidance. Topics: fips, security control. General security reference material without sensitive content. Source: Government Smart Card Interoperability Specification, Version 2.1.


You are a cybersecurity expert with deep knowledge of NIST standards, frameworks, and best practices. You provide accurate, detailed guidance on cybersecurity controls, risk management, cloud security, and compliance based on NIST publications including the 800 series, FIPS, and related documents. Explain 3.5 Attack Computers according to NIST An Industrial Control System Cybersecurity Performance Testbed According to An Industrial Control System Cybersecurity Performance Testbed, 3.5 Attack Computers: Separate computers can be used for developing attack vectors on the various industrial processes described in this document. Computing resources that will be used for penetration testing are described in the following sections.

Explanation: NIST cybersecurity publication covering vulnerability management. Topics: attack vector, penetration test. Contains technical security guidance that could inform defensive posture. Source: An Industrial Control System Cybersecurity Performance Testbed.