Search CSRC

Validation Number: 126 Vendor: Tripwire Product Name: Tripwire Enterprise Product Major Version: 8 Product Version Tested: 8.3.2 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor Provided SCAP Information Dates Tested: 4/1/2013 - 11/4/2013...

Although cryptography is an essential component of modern computing, implementing cryptography correctly is a non-trivial undertaking, often resulting in developers making errors and introducing vulnerabilities into their cryptographic products. Our cryptographic research is concerned with creating a baseline understanding of the practices and challenges of organizations that are developing products that use cryptography. This new understanding can help improve the assurance of cryptographic tools and the usability of cryptographic resources, such as standards and libraries. Pursuant to...

Understanding user perceptions and behavior is critical to achieving security objectives. People are repeatedly bombarded with messages about the dangers lurking on the Internet and are encouraged (or forced) to take numerous security-related actions, often without a clear understanding of why and to what end. We conduct research to discover people’s security and privacy perceptions, attitudes, and behaviors with a goal of developing cybersecurity guidance that: 1) takes into account user needs, skills, and limitations and 2) helps people make sound security decisions. Recent projects include...

NIST welcomes feedback on the NIST Security and Privacy Control Overlay Repository (SCOR). If you have any questions about submitting overlays to the NIST SCOR, participation agreements, or any suggestions, comments, or questions regarding the repository, send an e-mail to sec-cert@nist.gov. Return to Control Overlay Repository Overview

Call for Proposals Each submitted algorithm, together with each submitted reference implementation and optimized implementation, must be made freely available for public review and evaluation purposes worldwide during the period of the post-quantum algorithm search and evaluation. The following signed statements will be required for a submission to be considered complete: 1) statement by the submitter, 2) statement by patent (and patent application) owner(s) (if applicable), and 3) statement by reference/optimized implementations' owner(s). Note that for the last two statements, separate...

Call for Proposals 4.C Algorithm and Implementation Characteristics 4.C.1 Flexibility Assuming good overall security and performance, schemes with greater flexibility will meet the needs of more users than less flexible schemes, and therefore, are preferable. Some examples of “flexibility” may include (but are not limited to) the following: The scheme can be modified to provide additional functionalities that extend beyond the minimum requirements of public-key encryption, KEM, or digital signature (e.g., asynchronous or implicitly authenticated key exchange, etc.). It is...

XCCDF Benchmark: XCCDF Sample for Cisco IOS XCCDF Sample for Cisco IOS Status: draft (as of 2004-10-07) Version: 0.12.1 Applies to: Cisco IOS Routers version 11.x Cisco IOS Routers version 12+ Contents 1. Introduction 2. Tailoring Values 2.1. IOS - line exec timeout value 2.2. Logging level for buffered logging 3. Rules 3.1. Management Plane Rules 3.1.1. IOS 11 - no IP finger service 3.1.2. IOS 12 - no IP finger service 3.1.3. Require exec session timeout on admin sessions 3.2. Control Plane Rules 3.2.1. Disable tcp-small-servers 3.2.2. Disable udp-small-servers...

CCE is industry-endorsed through the CCE Working Group, which includes members from industry, academia, and government. IMPORTANT: Activity on the CCE effort has been suspended Send comments or concerns to cce@nist.gov. Participants American International Group, Inc. Application Security Inc. ArcSight, Inc. Belarc, Inc. Bentley College BlackStratus, Inc. Booz Allen Hamilton Center for Internet Security CERIAS/Purdue University Cisco Systems, Inc. Critical Watch Defense Information Systems Agency (DISA) Department of Homeland...

These are current NIST research to identify meaningful metrics and measures in context to understand the effectiveness and resource needs of different cybersecurity technical measures. Measuring Security Risk in Enterprise Networks Methodology to measure the overall system risk by combining the attack graph structure with the Common Vulnerability Scoring System (CVSS). Cyber Risk Analytics and Measurement Research and prototype methods and tools to enable predictive risk analytics and identify cyber risk trends. Develop guidelines to improve the assessment and measurement of...

FIPS 140-2 (ending Sept-22-2021) Security Requirements for Cryptographic Modules NVLAP accredited Cryptographic and Security Testing (CST) Laboratories perform conformance testing of cryptographic modules. Cryptographic modules are tested against requirements found in FIPS 140-2, Security Requirements for Cryptographic Modules [ PDF ]. Security requirements cover 11 areas related to the design and implementation of a cryptographic module. For each area, a cryptographic module receives a security level rating (1-4, from lowest to highest) depending on what requirements are met. An overall...

If you would like to participate in the Online Informative Reference (OLIR) Program please consult NISTIR 8278A Rev. 1 National Online Informative References (OLIR) Program: Submission Guidance for OLIR Developers document and become familiar with the requirements and all procedures involved during the life cycle. Developers of Informative References considering a submission are welcome to contact NIST with questions before completing the entire Informative Reference submission package. Questions and draft Informative Reference documents may be directed to olir@nist.gov. Submitting parties can...

The NIST NCCoE has launched a new project, Software Supply Chain and DevOps Security Practices. In early 2023, the project team will be publishing a Federal Register Notice based on the final project description to solicit collaborators to work with the NCCoE on the project. NIST held a virtual workshop in January 2021 on improving the security of DevOps practices; you can access the workshop recording and materials here. A second virtual workshop was held in September 2022 on the planned NCCoE DevSecOps project; the workshop recording and presentations are posted. NIST will leverage existing...

NEW: Combinatorial Coverage Difference Measurement for assurance of autonomous systems and other critical software. Combinatorial coverage is a way of finding the rare cases that may lead to security vulnerabilities or system failures, with application to both testing and assured autonomy. Achieving sound testing or assured autonomy in any environment requires methods for measuring the input space, to show that the test environment adequately covers real-world conditions that may be encountered. NIST is developing new combinatorial measurement methods and tools for input space coverage,...

About: The Federal Cybersecurity Supply Chain Risk Management (C-SCRM) Forum fosters collaboration and the exchange of C-SCRM information among federal organizations to improve the security of federal supply chains. Through periodic meetings and informal exchanges, the Forum offers all agencies that depend upon or guide C-SCRM an opportunity to discuss issues of interest with – and to inform – many of those leading C-SCRM efforts in the federal ecosystem, including the Office of Management and Budget (OMB), the Department of Defense (DOD), the Cybersecurity and Infrastructure Security...

The NIST Cybersecurity & Privacy Professionals Forum is co-chaired by representatives of NIST's Information Technology Laboratory Computer Security Division (CSD) and the Department of Commerce Office of Privacy and Open Government (OPOG). The Forum Secretariat provides the necessary administrative and logistical support for operations. The Forum serves as an important mechanism for NIST to: exchange information directly with cybersecurity and privacy professionals in U.S. federal, state, and local government, and higher education organizations handling federal information in...

The SSDF uses these established secure development practice documents as references. Note that these references were current at the time SSDF version 1.1 was published, and may no longer be current. NIST Publications General Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1 National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (SP 800-181) Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5) Software Development Cybersecurity Supply Chain Risk Management Practices for Systems and...

ATTENTION: The Project Lead is no longer at NIST. Inquiry responses may be delayed. ISO/IEC 29147 International Organization for Standardization/International Electrotechnical Commission (2018) ISO/IEC 29147:2018 – Information technology – Security techniques – Vulnerability disclosure (ISO, Geneva, Switzerland). Available at https://www.iso.org/standard/72311.html ISO/IEC 30111 International Organization for Standardization/International Electrotechnical Commission (2019) ISO/IEC 30111:2019 – Information technology – Security techniques – Vulnerability handling processes (ISO,...

At A Glance Purpose: Provide accountability by requiring a senior official to determine if the security and privacy risk based on the operation of a system or the use of common controls, is acceptable. Outcomes: authorization package (executive summary, system security and privacy plan, assessment report(s), plan of action and milestones) risk determination rendered risk responses provided authorization for the system or common controls is approved or denied Resources for Implementers RMF Introductory Online Course RMF Quick Start Guide (QSG): Authorize Step...

NIST Testing Process DOs and DON'Ts of Testing

Many security research efforts have focused on adults' perceptions and practices, leaving gaps in our understanding of youth perceptions and practices. To help fill this gap, our team explores the online security and privacy perceptions and practices of youth and influencing social factors from three perspectives: youth themselves, parents/guardians, and teachers/educators. Pursuant to September 29, 2026, Executive Order 14434: Inaugurating the Era of Super Intelligence. AI has been changed to SI except when referring to previously completed work and historical documents per Executive Order...

The mc-forum@list.nist.gov mailing list is used for announcements and questions about the "Masked Circuits" project (formerly known as the single-device track of the threshold cryptography project). To subscribe: send an mail to mc-forum+subscribe@list.nist.gov. Upon receiving an automatic response message, click the "Join" link inside that email to confirm your subscription request. If having difficulty, send a request instead to "masked-circuits (at) nist (dot) gov". We will then manually add your email address. To unsubscribe: send an email to: mc-forum+unsubscribe@list.nist.gov. The...

Subscribing to the PEC-Forum The pec-forum@list.nist.gov mailing list was created to share announcements and questions about the "Privacy-Enhancing Cryptography" (PEC) project. Only subscribed members can send email to the mailing list. Please note that this mailing list should not be used for direct promotion of commercial products. To subscribe, please send an mail to pec-forum+subscribe@list.nist.gov. You will receive a response message. Click the "Join" link inside that email to confirm your subscription request. To unsubscribe, please send an email to:...

MPTC-forum for publicly accessible messages: The mptc-forum@list.nist.gov mailing list was created for public announcements and public conversation about the NIST Multi-Party Threshold Cryptography project. Messages: The MPTC-forum is an unmoderated mailing list; messages sent to this list are immediately distributed to all the addresses on the list, and are by default made publicly available via the email archive. Only members are allowed to post messages to the list, by sending an email to mptc-forum@list.nist.gov, but anyone can subscribe to become a member of the list. Email archive:...

/CSRC/media/Projects/olir/documents/submissions/WIP_Framework_v_1_1_to_800_53_Rev5.xlsx /CSRC/media/Projects/olir/documents/submissions/WIP_Framework_v_1_1_to_800_53_Rev5.xlsx /CSRC/media/Projects/olir/documents/submissions/SP800-82-Rev-2-to-SP800-53-Rev-4.xlsx /CSRC/media/Projects/olir/documents/submissions/WIP_Framework_v_1_1_to_800_53_Rev5.xlsx /CSRC/media/Projects/olir/documents/submissions/SP800-177-Rev-1-to-SP800-53-Rev-4.xlsx...

Fireside Chat: Complexity is the new Cyber Adversary The cascading risk that made Lehman Brothers infamous for accelerating the global financial crisis or the Northeast Power Outage that disabled parts of US and Canada in 2003 exemplify how counterparty risk could turn a single breach into a disastrous systemic failure. Cyber risks face similar consequences. They are not enabled simply by individual cyber vulnerabilities, but by the Complex Systems-of-Systems they inhabit. Composed of legacy and new HW, SW and IoT elements connected by myriad channels, haphazardly integrated over many years,...