Search CSRC

Abstract: Recommendations are provided to promote accuracy, integrity, and security in computerized vote-tallying, and to improve confidence in the results produced. The recommendations respond to identified problems, and concern software, hardware, operational procedures, and institutional changes. It is pro...

Abstract: The National Bureau of Standards Message Authentication Code (MAC) Validation System (MVS) tests message authentication devices for conformance to two data authentication standards: Federal Information Processing Standard Publication (FIPS PUB) 113, "Computer Data Authentication," and American Natio...

Abstract: This guide addresses auditing the system development life cycle (SDLC) process for an automated information system (AIS), to ensure that controls and security are designed and built into the system. The guide also presents a process for deciding which system to audit among an organization's universe...

Abstract: This publication describes a set of solutions to the problem of intrusion into government and private computers via dial-up telephone lines, the so-called "hacker problem". There are a number of minimum protection techniques against these people and more nefarious intruders that should be used in al...

Abstract: This publication addresses the issue of selecting ADP backup processing support in advance of events that cause the loss of data processing capability. The document emphasizes the need for managers at all levels of the organization to support the planning, funding, and testing of an alternate proces...

Abstract: This technology assessment constitutes a summary and assessment of methods for measuring the level of computer security in computer applications, systems, and installations. The initial draft report for this document was produced in June 1981 for the National Bureau of Standards (NBS) by the System...

Abstract: The use of personal computer systems (often called desktop or professional computers) in the office and home environment has placed increasingly powerful information system technology in the hands of growing numbers of users. While providing many benefits, the use of such small computer systems may...

Abstract: This overview is intended to provide ADP policy managers, information resource managers, ADP technical managers, and ADP staff with a comprehensive summary of and guide to FIPS PUB 102, "Guideline to Computer Security Certification and Accreditation," September 27, 1983. FIPS PUB 102 presents in det...

Abstract: This document provides, in the form of questions and answers, the background and basic essential information required to understand the developmental process for Automatic Data Processing (ADP) contingency plans. The primary intended audience consists of executives and managers who depend on ADP res...

Abstract: This publication describes the design and operation of the NBS testbed that is used for the validation of hardware implementations of the Federal Information Processing Data Encryption Standard (DES). A particular implementation is verified if it correctly performs a set of 291 test cases that have...

Abstract: This publication describes the design of four maintenance tests for the Federal Information Processing Data Encryption Standard (DES) . The tests consist of an iterative procedure that tests the operation of DES devices by using a small program and minimum data. The tests are designed to be independ...

Abstract: The National Bureau of Standards, with the support of the U.S. General Accounting Office, sponsored a second invitational workshop on computer security audit, entitled "Audit and Evaluation of Computer Security II: System Vulnerabilities and Controls," In Miami Beach, Florida, on November 28-30, 197...

Abstract: A cryptographic, Key Notarization System is proposed for computer networks to protect personal (nonshared) files, to communicate securely both on and off-line with local and remote users, to protect against key substitution, to authenticate system users, to authenticate data, and to provide a digita...

Abstract: This report describes remote monitoring in the application areas of performance evaluation, diagnostic testing, performance assurance and system security testing. The evolution of remote monitoring is briefly reviewed and, then, remote monitors are categorized into seven classes. Several example sys...

Abstract: The results of a systems analysis and evaluation conducted on the role of automatic digital processing in vote-tallying are presented. Included in the report are descriptions of hardware, software, and administrative problems encountered in fourteen elections in which electronic computing technology...

Abstract: These proceedings include papers or summaries of presentations of the fifteen speakers who participated in the Conference on Computer Security and the Data Encryption Standard held at the National Bureau of Standards on February 15, 1977. Representatives from Federal agencies and private industry pr...

Abstract: Stanford Research Institute (SRI) has an extensive file of actual computer misuse cases. The National Bureau of Standards asked SRI to use these cases as a foundation to develop ranked lists of computer safeguards that would have prevented or detected the recorded intentional misuses. This report p...

Abstract: This report identifies the approaches and techniques now practiced for detecting, and when possible, correcting malperformance as it occurs in computer information systems. This report is addressed to two audiences: to the systems designer using stock commercial hardware and software who is creating...

Abstract: This report describes a unique approach to the solution of computer network security problems, and provides guidance in the areas of network security architectural issues and implementation options. The approach is based on a network resource, called a Network Security Center (NSC), which performs t...

Abstract: The security problems associated with a network of computers are an extension of those of stand-alone computer systems, but require additional security controls due to the distributed and autonomous nature of the network components. The purpose of this investigation was to generate a pre-development...

Abstract: This publication describes the design and operation of the NBS testbed that is used for the validation of hardware implementations of the Federal Information Processing Data Encryption Standard (DES). A particular implementation is verified if it correctly performs a set of 291 test cases that have...

Abstract: The National Bureau of Standards, with the support of the U.S. General Accounting Office, sponsored an invitational workshop on "Audit and Evaluation of Computer Security," held in Miami Beach, Florida on March 22-24, 1977. Its purpose was to explore the state-of-the-art in this area and define appr...

Abstract: This report considers the generation of passwords and their effective application to the problem of controlling access to computer resources. After describing the need for and uses of passwords, password schemes are categorized according to selection technique, lifetime, physical characteristics, an...

Abstract: This publication summarizes and contains the proceedings of a conference held at the National Bureau of Standards on March 4-5, 1974 to continue the dialog in search of ways to protect confidential information in computer systems. Proposals are presented for meeting governmental needs in safeguardin...

NIST cybersecurity reference materials include data, models, software, and tools.