Search CSRC

Journal: Computer (IEEE Computer) Abstract: Many practical applications benefit from Machine Learning (ML) and Artificial Intelligence (AI) technologies, but their security needs to be studied in more depth before the methods and algorithms are actually deployed in critical settings. In this article, we discuss the risk of poisoning attacks w...

Conference: 2022 IEEE 29th Annual Software Technology Conference (STC) Abstract: Artificial intelligence (AI) systems are increasingly seen in many public facing applications such as self-driving land vehicles, autonomous aircraft, medical systems and financial systems. AI systems should equal or surpass human performance, but given the consequences of failure or erroneous or un...

Abstract: This publication documents the consumer profile of NIST’s IoT core baseline and identifies cybersecurity capabilities commonly needed for the consumer IoT sector (i.e., IoT products for home or personal use). It can also be a starting point for small businesses to consider in the purchase of IoT pro...

Abstract: This document is the third in a series that supplements NIST Interagency/Internal Report (NISTIR) 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM). This series provides additional details regarding the enterprise application of cybersecurity risk information; the previous documen...

Conference: The 7th International Workshop on Boolean Functions and their Applications (BFA) Abstract: Multiplicative Complexity (MC) is defined as the minimum number of AND gates required to implement a function with a circuit over the basis {AND, XOR, NOT}. This complexity measure is relevant for many advanced cryptographic protocols such as fully homomorphic encryption, multi-party computation, an...

Journal: Journal of Computer Security Abstract: Network attacks have become a major security concern for organizations worldwide. A category of network attacks that exploit the logic (security) flaws of a few widely-deployed authentication protocols has been commonly observed in recent years. Such logic-flaw-exploiting network attacks often do no...

Conference: 18th Symposium on Usable Privacy and Security (SOUPS 2022) Abstract: An important factor for investigating youth’s online safety, security, and privacy is to understand how and from where they learn their online behaviors and knowledge. Although research has shown that people within youths’ environments (e.g., parents) and the environments themselves (e.g., schools)...

Conference: 18th Symposium on Usable Privacy and Security (SOUPS 2022) Abstract: This paper overviews a dyadic study of youth knowledge and understandings of online privacy and risk, and then highlights challenges that the study reveals about youth online risk taking and privacy protective measures from a family perspective. A full overview of the qualitative, dyadic study of 40...

Abstract: Public safety officials utilizing public safety broadband networks will have access to devices, such as mobile devices, tablets, and wearables. These devices offer new ways for first responders to complete their missions but may also introduce new security vulnerabilities to their work environment....

Abstract: The rapid development and wide application of distributed network systems have made network security – especially access control and data privacy – ever more important. Blockchain technology offers features such as decentralization, high confidence, and tamper-resistance, which are advantages to sol...

Journal: Publicationes Mathematicae Debrecen Abstract: A Heron triangle is one in which the side lengths and area are integers. An integral right triangle is an example of a Heron triangle. In this paper, we show that there are infinitely many pairs of integral right triangles and Heron triangles with a common area and common perimeter, continuing a lin...

Abstract: This document describes a data structure, referred to as a data block matrix, that supports the ongoing addition of hash-linked records while also allowing for the deletion of arbitrary records, thereby preserving hash-based integrity assurance that other blocks are unchanged. The block matrix data...

Journal: The Ramanujan Journal Abstract: In this article, we consider the quadratic twists of the Mordell curve \(𝐸\) : 𝑦2=𝑥3−1. For a square-free integer k, the quadratic twist of \(𝐸\) is given by \(𝐸\)𝑘 : 𝑦2=𝑥3−𝑘3. We prove that there exist infinitely many k for which the rank of \(𝐸\)𝑘 is 0, by modifyin...

Conference: Lightweight Cryptography Workshop 2022 Abstract: Ascon is one of the finalists of the National Institute of Standards and Technology (NIST) lightweight cryptography standardization process. In 2019, Ascon was also selected as the primary choice for lightweight authenticated encryption in the final portfolio of the CAESAR competition. The Ascon fam...

Abstract: The President’s Executive Order (EO) on “Improving the Nation’s Cybersecurity (14028)” issued on May 12, 2021, charges multiple agencies – including NIST – with enhancing cybersecurity through a variety of initiatives related to the security and integrity of the software supply chain. The EO acknowl...

Abstract: In today’s cloud data centers and edge computing, attack surfaces have shifted and, in some cases, significantly increased. At the same time, hacking has become industrialized, and most security control implementations are not coherent or consistent. The foundation of any data center or edge computi...

Conference: The 12th ACM Conference on Data and Application Security and Privacy Abstract: We describe a formalized systems theoretic method for creating cyber-physical system (CPS) risk overlays that augment existing tree-based models used in CPS risk and threat analysis processes. This top-down approach objectively scopes the system's threat surface for some risk scenario consequence by...

Abstract: In today’s cloud data centers and edge computing, attack surfaces have significantly increased, cyber attacks are industrialized, and most security control implementations are not coherent or consistent. The foundation of any data center or edge computing security strategy should be securing the pla...

Abstract: Organizations employ a growing volume of machine identities, often numbering in the thousands or millions per organization. Machine identities, such as secret cryptographic keys, can be used to identify which policies need to be enforced for each machine. Centralized management of machine identities...

Abstract: As supply chains become more complex and the origins of products become harder to discern, efforts are emerging that improve traceability of goods by exchanging traceability data records using blockchain and related technologies. This NIST NCCoE publication explores the issues that surround traceabi...

Conference: IEEE International Conference on Software Testing Verification and Validation Workshop (ICSTW 2022) Abstract: Combinatorial coverage measures have been defined and applied to a wide range of problems. These methods have been developed using measures that depend on the inclusion or absence of t-tuples of values in inputs and test cases. We extend these coverage measures to include the frequency of occurrence...

Abstract: Organizational security awareness programs experience a number of challenges, including lack of resources, difficulty measuring the impact of the program, and perceptions among the workforce that training is a boring, “check-the-box” activity. While prior surveys and research have examined programs...

Abstract: Organizational cybersecurity awareness (hereafter shortened to “security awareness”) programs may experience a number of challenges, including lack of funding and staff with the appropriate knowledge and skills to manage an effective program. While prior surveys and research have examined programs i...

Journal: Computer (IEEE Computer) Abstract: Widescale adoption of intelligent algorithms requires that Artificial Intelligence (AI) engineers provide assurances that an algorithm will perform as intended. Providing such guarantees involves quantifying capabilities and the associated risks across multiple dimensions including: data quality, al...

Journal: Measurement Science and Technology Abstract: Software-controlled measuring instruments used in commercial transactions, such as fuel dispensers and smart meters, are sometimes subject to “memory replacement” attacks. Cybercriminals replace the approved software by a malicious one that then tampers with measurement results, inflicting a financi...