Search CSRC

Abstract: Monitoring the “physics” of control systems to detect attacks is a growing area of research. In its basic form a security monitor creates time-series models of sensor readings for an industrial control system and identifies anomalies in these measurements in order to identify potentially false contr...

Abstract: NIST developed this interagency report as a reference guideline about cybersecurity for small businesses. This document is intended to present the fundamentals of a small business information security program in non-technical language.

Journal: IEEE Software Abstract: As new and exciting healthcare applications arise that use smart technologies, the Internet of Things, data analytics, and other technologies, a critical problem is emerging: the potential loss of caring. Although these exciting technologies have improved patient care by allowing for better assessme...

Conference: 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS '16) Abstract: While attacks on information systems have for most practical purposes binary outcomes (information was manipulated/eavesdropped, or not), attacks manipulating the sensor or control signals of Industrial Control Systems (ICS) can be tuned by the attacker to cause a continuous spectrum in damages. Att...

Journal: Computer (IEEE) Abstract: Combinatorial methods can make software security testing much more efficient and effective than conventional approaches.

Conference: IEEE 57th Annual Symposium on Foundations of Computer Science (FOCS 2016) Abstract: We consider Boolean circuits over the full binary basis. We prove a (3+1/86)n-o(n) lower bound on the size of such a circuit for an explicitly defined predicate, namely an affine disperser for sublinear dimension. This improves the 3n-o(n) bound of Norbert Blum (1984).The proof is based on the gate...

Abstract: As greater security control mechanisms are implemented at the point of sale, retailers in the U.S. may see a drastic increase in e-commerce fraud, similar to what has been widely observed in the United Kingdom and Europe following the rollout of Europay, MasterCard, and Visa (EMV) chip-and-PIN techn...

Abstract: On January 12-13, 2016 the National Institute of Standards and Technology’s (NIST) Applied Cybersecurity Division (ACD) hosted the “Applying Measurement Science in the Identity Ecosystem” workshop to discuss the application of measurement science to digital identity management. This document summari...

Abstract: Law enforcement vehicles often serve as mobile offices. In-vehicle laptops or other computer systems are used to access a wide range of software applications and databases hosted and operated by federal, state, and local agencies, with each typically requiring a different username and password. This...

In: Cloud Computing Security: Foundations and Challenges Abstract: This chapter discusses the risk management for a cloud-based information system viewed from the cloud consumer perspective.

In: Cloud Computing Security: Foundations and Challenges Abstract: This chapter discusses the essential security challenges and requirements for cloud consumers that intend to adopt cloud-based solutions for their information systems.

Journal: Computer (IEEE Computer) Abstract: Securing the Internet requires strong cryptography, which depends on good entropy for generating unpredictable keys. Entropy as a service provides entropy from a decentralized root of trust, scaling across diverse geopolitical locales and remaining trustworthy unless much of the collective is compro...

Conference: 2016 IEEE 40th Annual Computer Software and Applications Conference (COMPSAC) Abstract: Empirical studies have shown that most software interaction faults involve one or two variables interacting, with progressively fewer triggered by three or more, and no failure has been reported involving more than six variables interacting. This paper introduces a model for the origin of this distr...

Journal: Journal of Computer and System Sciences Abstract: Given a boolean n × n matrix A we consider arithmetic circuits for computing the transformation x ↦ Ax over different semirings. Namely, we study three circuit models: monotone OR-circuits, monotone SUM-circuits (addition of non-negative integers), and non-monotone XOR-circuits (addition modulo 2)....

Journal: Computer (IEEE Computer) Abstract: A panel of seven experts discusses the state of the practice of formal methods (FM) in software development, with a focus on FM's relevance to security. In a 1996 article, formal methods (FM) advocate Tony Hoare asked, "How Did Software Get So Reliable without Proof?"1 Twenty years later, in the sa...

Abstract: This bulletin summarized the information presented in NISTIR 8060, "Guidelines for the Creation of Interoperable Software Identification (SWID) Tags". The publication provides an overview of the capabilities and usage of SWID tags as part of a comprehensive software lifecycle.

Abstract: The Association of Public-Safety Communications (APCO), in cooperation with FirstNet and the Department of Commerce held a half-day workshop on June 2nd 2015 titled “Identifying and Categorizing Data Types for Public Safety Mobile Applications.” The goal of this workshop was to begin identifying dif...

Abstract: This bulletin focuses on NIST's combinatorial testing work. Combinatorial testing is a proven method for more effective software testing at lower cost. The key insight underlying combinatorial testing's effectiveness resulted from a series of studies by NIST from 1999 to 2004. NIST research showed...

Abstract: Threats of destructive malware, malicious insider activity, and even honest mistakes create the imperative for organizations to be able to quickly recover from an event that alters or destroys any form of data (database records, system files, configurations, user files, application code, etc.). Orga...

Abstract: This report provides an overview of the capabilities and usage of software identification (SWID) tags as part of a comprehensive software lifecycle. As instantiated in the International Organization for Standardization/International Electrotechnical Commission 19770-2 standard, SWID tags support num...

Abstract: The Cybersecurity Strategy and Implementation Plan (CSIP), published by the Office of Management and Budget (OMB) on October 30, 2015, requires that federal agencies use Personal Identity Verification (PIV) credentials for authenticating privileged users. This will greatly reduce unauthorized access...

Conference: Fifth International Workshop on Combinatorial Testing (IWCT 2016) Abstract: Access control typically requires translating policies or rules given in natural language into a form such as a programming language or decision table, which can be processed by an access control system. Once rules have been described in machine-processable form, testing is necessary to ensure that...

Conference: 11th Annual Cyber and Information Security Research Conference (CISRC '16) Abstract: Industrial control systems (ICS) are composed of sensors, actuators, control processing units, and communication devices all interconnected to provide monitoring and control capabilities. Due to the integral role of the networking infrastructure, such systems are vulnerable to cyber attacks. Indepth...

Abstract: Pilots are an integral part of the National Strategy for Trusted Identities in Cyberspace (NSTIC), issued by the White House in 2011 to encourage enhanced security, privacy, interoperability, and ease of use for online transactions. This document details summaries and outcomes of NSTIC pilots; in ad...

Abstract: The Domain Name System-Based Security for Electronic Mail project will produce a proof of concept security platform that will demonstrate trustworthy email exchanges across organizational boundaries. The product of the project will include authentication of mail servers, signing and encryption of em...