Search CSRC

Abstract: A significant portion of National Security and Emergency Preparedness (NS/EP) telecommunications relies on the Public Switched Network (PSN). Therefore, NS/EP telecommunications is concerned with the protection of the PSN to ensure that telecommunications services are available and reliable. Service...

Abstract: This document provides an overview of the Internet and security-related problems. It then provides an overview of firewall components and the general reasoning behind firewall usage. Several types of network access policies are described, as well as technical implementations of those policies. Lastl...

Abstract: The Public Switched Network (PSN) provides National Security and Emergency Preparedness (NS/EP) telecommunications. Service vendors, equipment manufacturers, and the federal government are concerned that vulnerabilities in the PSN could be exploited and result in disruptions or degradation of servic...

Abstract: This standard specifies an encryption/decryption algorithm and a Law Enforcement Access Field (LEAF) creation method which may be implemented in electronic devices and used for protecting government telecommunications when such protection is desired. The algorithm and the LEAF creation method are cl...

Abstract: Electronic commerce (EC) is the use of documents in electronic form, rather than paper, for carrying out functions of business or government that require interchange of information, obligations, or monetary value between organizations. Electronic data interchange (EDI) is the computer-to-computer tr...

Abstract: The Database Language SQL (SQL) is a standard interface for accessing and manipulating relational databases. An SQL-compliant database management system (DBMS) will include a minimum level of functionality in a variety of areas. However, many additional areas are left unspecified by the SQL standard...

Abstract: This standard specifies a Secure Hash Algorithm (SHA) which can be used to generate a condensed representation of a message called a message digest. The SHA is required for use with the Digital Signature Algorithm (DSA) as specified in the Digital Signature Standard (DSS) and whenever a secure hash...

Abstract: Computer viruses continue to pose a threat to the integrity and availability of computer systems. This is especially true for users of personal computers. A variety of anti-virus tools are now available to help manage this threat. These tools use a wide range of techniques to detect, identify, and r...

Abstract: Computer security "incidents" occur with alarming frequency. The incidents range from direct attacks by both hackers and insiders to automated attacks such as network worms. Weak system controls are frequently cited as the cause, but many of these incidents are the result of improper use of existing...

Abstract: This standard specifies a particular selection of options for the automated distribution of keying material by the Federal Government when using ANSI X9.17-1985. ANSI X9.17 defines procedures for the manual and automated management of keying materials and contains a number of options. Systems which...

Abstract: The Validated Products List (formerly called the Validated Processor List) is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the orga...

Abstract: Government agencies and other organizations have begun to augment their computer security efforts because of increased threats to computer security. Incidents involving these threats, including computer viruses, malicious user activity, and vulnerabilities associated with high technology, require a...

Abstract: The Integrated Services Digital Network (ISDN) standards will provide worldwide digital communications service and will play a key role in the transition to electronic documents and business transactions. ISDN has been developed with little thought to security. ISDN security will become a pressing c...

Abstract: This publication presents a state-of-the-art survey of public-key cryptography, circa 1988-1990, and covers the following topics: 1) the theory of public-key cryptography; 2) comparisons to conventional (secret-key) cryptography; 3) a largely self-contained summary of relevant mathematics; 4) a surv...

Abstract: This bibliography cites selected books and articles on computer security published from January 1980 through October 1989. To have been selected, an article had to be substantial in content and have been published in professional or technical journals, magazines, or conference proceedings. Only very...

Abstract: NISTIR 90-4262 includes four documents dealing with key management which were developed by the National Security Agency (NSA) as output from the Secure Data Network System (SDNS) project. SDN.601, Communication Protocol Requirements for Support of the SDNS Key Management Protocol, supplies a profile...

Abstract: NISTIR 90-4259 consists of three documents developed by the National Security Agency (NSA) as output from the Secure Data Network System (SDNS) project. The Access Control Concept Document, SDN.801, describes the principles and functions underlying the SDNS access control and authentication security...

Abstract: This guideline provides a framework for determining the training needs of employees involved with computer systems. It describes the learning objectives of agency computer security training programs. A focus on learning objectives--what the employee should know and be able to direct or actually perf...

Abstract: This document recommends a process for selecting automated risk analysis tools. It is primarily intended for managers and those responsible for managing risks in computer and telecommunications systems. The document describes important considerations for developing selection criteria for acquiring r...

Abstract: This guide is designed to help the policy maker address a host of questions regarding the protection and safety of computer systems and data processed within your agency. It introduces information systems security concerns, outlines the management issues that must be addressed by agency policies and...

Abstract: This guide introduces information systems security concerns and outlines the issues that must be addressed by all agency managers in meeting their responsibilities to protect information systems within their organizations. It describes essential components of an effective information resource protec...

Abstract: While excellent progress has been made in computer technology, very little has been done to inform users of the vulnerability of data and information to such threats as unauthorized modification, disclosure, and destruction, either deliberate or accidental. This guide will make users aware of some o...

Abstract: This document provides guidance for technical managers for the reduction of risk to their computer systems and networks from attack by computer viruses, unauthorized users, and related threats. The guidance discusses the combined use of policies, procedures, and controls to address security vulnerab...

Abstract: This is the Report of the Invitational Workshop on Integrity Policy in Computer Information Systems which was sponsored by the IEEE Computer Society's Technical Committee on Security and Privacy, the Special Interest Group on Security, Audit, and Control (SIGSAC) of the Association for Computing Mac...

Abstract: A smart card is a credit-card-sized device containing one or more integrated circuit chips, which perform the functions of a microprocessor, memory, and an input/output interface. Smart cards, and other related devices, may be used to provide an increased level of security in applications requiring...