Search CSRC

Abstract: The bulletin summarizes the information presented in NISTIR 7904, "Trusted Geolocation in the Cloud: Proof of Concept Implementation". The publication explains security challenges involving Infrastructure as a Service (IaaS) cloud computing technologies and geolocation.

Journal: IEEE Security & Privacy Abstract: What can you glean from using inexpensive, off-the-shelf parts to create Internet of Things (IoT) use cases? As it turns out, a lot. The fast productization of IoT technologies is leaving users vulnerable to security and privacy risks.

Abstract: This report defines the requirements and associated test procedures necessary for products or modules to achieve one or more Security Content Automation Protocol (SCAP) validations. Validation is awarded based on a defined set of SCAP capabilities by independent laboratories that have been accredite...

Abstract: This report documents proof of concept research for Derived Personal Identity Verification (PIV) Credentials. Smart card-based PIV Cards cannot be readily used with most mobile devices, such as smartphones and tablets, but Derived PIV Credentials (DPCs) can be used instead to PIV-enable these device...

Abstract: This bulletin summarizes the information presented in NISTIR 7966, "Security of Interactive and Automated Access Management Using Secure Shell (SSH)." The publication assists organizations in understanding the basics of SSH interactive and automated access management in an enterprise, focusing on th...

Abstract: This report provides background information and analysis in support of NISTIR 8074 Volume 1, "Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity." It provides a current summary of ongoing activities in critical int...

Abstract: This interagency report sets out proposed United States Government (USG) strategic objectives for pursuing the development and use of international standards for cybersecurity and makes recommendations to achieve those objectives. The recommendations cover interagency coordination, collaboration wit...

Abstract: This publication explains selected security challenges involving Infrastructure as a Service (IaaS) cloud computing technologies and geolocation. It then describes a proof of concept implementation that was designed to address those challenges. The publication provides sufficient details about the p...

Journal: Rocky Mountain Journal of Mathematics Abstract: In this work, we present a modification of a well-established measure of dependence appropriate for the analysis of stopping times for adversarial processes on cryptographic primitives. We apply this measure to construct generic criteria for the ideal behavior of fixed functions in both the random o...

Conference: 22nd ACM Conference on Computer and Communications Security (CCS '15) Abstract: Modern-day attackers tend to use sophisticated multi-stage/multi-host attack techniques and anti-forensics tools to cover their attack traces. Due to the current limitations of intrusion detection and forensic analysis tools, reconstructing attack scenarios from evidence left behind by the attackers...

Abstract: Users and hosts must be able to access other hosts in an interactive or automated fashion, often with very high privileges, for a variety of reasons, including file transfers, disaster recovery, privileged access management, software and patch management, and dynamic cloud provisioning. This is ofte...

Conference: 2015 Workshop on Automated Decision Making for Active Cyber Defense (SafeConfig '15) Abstract: Cyber attacks inevitably generate impacts towards relevant missions. However, concrete methods to accurately evaluate such impacts are rare. In this paper, we propose a probabilistic approach based on Bayesian networks for quantitative mission impact assessment. A System Object Dependency Graph (SOD...

Abstract: FIPS 201-2 requires explicit user action by the Personal Identity Verification (PIV) cardholder as a condition for use of the digital signature key stored on the card. This document clarifies the requirement for explicit user action to encourage the development of compliant applications and middlewa...

Abstract: This bulletin summarizes the information presented in NISTIR 8014, Considerations for Identity Management in Public Safety Mobile Networks, written by Nelson Hastings and Joshua Franklin. The publication analyzes approaches to identity management for public safety networks in an effort to assist ind...

Conference: Fourth International Workshop on Combinatorial Testing (IWCT 2015) Abstract: This short paper introduces a method for verifying equivalence classes for module/unit testing. This is achieved using a two-layer covering array, in which some or all values of a primary covering array represent equivalence classes. A second layer covering array of the equivalence class values is c...

Abstract: This bulletin summarizes the information presented in NISTIR 8023, Risk Management for Replication Devices, written by Celia Paulsen and Kelley Dempsey. The publication provides guidance on protecting the confidentiality, integrity, and availability of information processed, stored, or transmitted o...

Abstract: Enterprises rely upon strong access control mechanisms to ensure that corporate resources (e.g. applications, networks, systems and data) are not exposed to anyone other than an authorized user. As business requirements change, enterprises need highly flexible access control mechanisms that can adap...

Journal: Crosstalk (Hill AFB): the Journal of Defense Software Engineering Abstract: There are relatively few good methods for evaluating test set quality, after ensuring basic requirements traceability. Structural coverage, mutation testing, and related methods can be used if source code is available, but these approaches may entail significant cost in time and resources. This pape...

Abstract: As electric utilities turn to Advanced Metering Infrastructures (AMIs) to promote the development and deployment of the Smart Grid, one aspect that can benefit from standardization is the upgradeability of Smart Meters. The National Electrical Manufacturers Association (NEMA) standard SG-AMI 1-2009,...

Abstract: This publication provides guidance on protecting the confidentiality, integrity, and availability of information processed, stored, or transmitted on replication devices (RDs). It suggests appropriate countermeasures in the context of the System Development Life Cycle. A security risk assessment tem...

Journal: Journal of Research of the National Institute of Standards and Technology Abstract: This report summarizes study results on pairing-based cryptography. The main purpose of the study is to form NIST’s position on standardizing and recommending pairing-based cryptography schemes currently published in research literature and standardized in other standard bodies. The report reviews t...

Abstract: This document captures the input received from the half-day workshop titled “Public Safety Mobile Application Security Requirements” organized by the Association of Public-Safety Communications Officials (APCO) International, in cooperation with FirstNet and the Department of Commerce and held on Fe...

Abstract: The Cryptographic Module Validation Program (CMVP) validates cryptographic modules for compliance with Federal Information Processing Standard (FIPS) Publication 140-2, Security Requirements for Cryptographic Modules, and other cryptography based standards. The CMVP is a joint effort between NIST an...

Conference: Neuroscience 2014, the 44th Annual Meeting of the Society for Neuroscience (SfN 2014) Abstract: While measuring physiological responses is a common practice in the field of neuroscience, it is rare in the usability arena and in password usability studies, in particular. This is unfortunate, as the use of such implicit measures could complement more traditional, explicit metrics of performance...

Conference: 10th IEEE International Conference on Collaborative Computing: Networking, Applications and Worksharing (CollaborateCom) Abstract: Access Control (AC) systems are among the most critical of network security components. A system’s privacy and security controls are more likely to be compromised due to the misconfiguration of access control policies rather than the failure of cryptographic primitives or protocols. This problem bec...