Search CSRC

Journal: ACM Transactions on Information and System Security Abstract: This paper describes NIST's enhanced RBAC model and our approach to designing and implementing RBAC features for networked Web servers. The RBAC model formalized in this paper is based on the properties that were first described in Ferraiolo and Kuhn [1992] and Ferraiolo et al. [1995], with adjustme...

Abstract: This standard specifies a suite of algorithms which can be used to generate a digital signature. Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signature in provin...

Conference: CALS Expo International and 21st Century Commerce 1998: Global Business Solutions for the New Millennium Abstract: Establishing and maintaining a presence on the World Wide Web (Web), once a sideline for U.S. industry, has become a key strategic aspect of marketing and sales. Many companies have demonstrated that a well designed Web site can have a positive effect on their profitability. Enabling customers to an...

Conference: Third ACM Workshop on Role-Based Access Control (RBAC '98) Abstract: Role based access control (RBAC) is attracting increasing attention as a security mechanism for both commercial and many military systems. This paper shows how RBAC can be implemented using the mechanisms available on traditional multi-level security systems that implement information flow policies....

Conference: 21st National Information Systems Security Conference (NISSC '98) Abstract: This paper analyzes and compares role-based access control (RBAC) features supported in the most recent versions of three popular commercial database management systems: Informix Online Dynamic Server Version 7.2, Oracle Enterprise Server Version 8.0 and Sybase Adaptive Server Release 11.5. We categ...

Conference: 21st National Information Systems Security Conference (NISSC '98) Abstract: Role Based Access Control (RBAC) refers to a class of security mechanisms that mediate access to resources through organizational identities called roles. A number of models have been published that formally describe the basic properties of RBAC. One feature of these models is the notion of a role h...

Abstract: Role Based Access Control (RBAC) refers to a class of security mechanisms that mediate access to resources through organizational identities called roles. A number of models have been published that formally describe the basic properties of RBAC. This report focuses on an RBAC model originally propo...

Conference: Second ACM Workshop on Role-Based Access Control (RBAC '97) Abstract: Role based access control (RBAC) is attracting increasing attention as a security mechanism for both commercial and many military systems. Much of RBAC is fundamentally different from multi-level security (MLS) systems, and the properties of RBAC systems have not been explored formally to the extent...

Conference: 20th National Information Systems Security Conference (NISSC '97) Abstract: One of the most challenging problems in managing large networked systems is the complexity of security administration. This is particularly true for organizations that AWeb (WWW) servers. Today, security administration is costly and prone to error because administrators usually specify access contro...

Abstract: NIST is aware of several implementation issues that can significantly affect the security of otherwise robust cryptographic systems. This bulletin describes the implementation vulnerabilities and recommends controls to mitigate overall system risk.

Abstract: This document describes the multi-national evaluation experiment of the Trusted Mach system. This report focuses on Phase I - The Developmental Evaluation Phase. The objective is to provide an historical journal discussing the experiment, and providing insight into what has been learned and accompli...

Conference: First ACM Workshop on Role-Based Access Control (RBAC) Abstract: With Role Based Access Control (RBAC), each role is associated with a set of operations which a user in that role may perform. The power of RBAC as an access control mechanism is the concept that an operation may theoretically be anything. This is contrasted to other access control mechanisms where...

Conference: 18th National Information Systems Security Conference Abstract: The National Computer Security Center (NCSC) and the Computer Systems Laboratory (CSL) are pleased to welcome you to the Eighteenth National Information Systems Security Conference. The new conference name reminds us that information systems, not just computers, must be secure. This year's program,...

Conference: 18th National Information Systems Security Conference (NISSC) Abstract: The National Security Agency (NSA) with the cooperation of the National Institute of Standards and Technology (NIST) formed a technical group to create security requirements for distributed systems. These include requirements for data confidentiality, data integrity, cryptography, distributed identi...

Abstract: The Validated Products List (VPL) identifies information technology products that have been tested for conformance to Federal Information Processing Standards (FIPS) in accordance with Computer Systems Laboratory (CSL) conformance testing procedures, and have a current validation certificate or regi...

Abstract: On July 17, 1995, the National Institute of Standard and Technology (NIST), Computer Systems Laboratory (CSL), established the Cryptographic Module Validation (CMV) Program which validates cryptographic modules to Federal Information Processing Standard (FIPS) 140-1, Security Requirements for Crypto...

Abstract: The Validated Products List (VPL) identifies information technology products that have been tested for conformance to Federal Information Processing Standards (FIPS) in accordance with Computer Systems Laboratory (CSL) conformance testing procedures, and have a current validation certificate or regi...

Abstract: The Validated Products List (VPL) identifies information technology products that have been tested for conformance to Federal Information Processing Standards (FIPS) in accordance with Computer Systems Laboratory (CSL) conformance testing procedures, and have a current validation certificate or regi...

Abstract: The Validated Products List (VPL) identifies information technology products that have been tested for conformance to Federal Information Processing Standards (FIPS) in accordance with Computer Systems Laboratory (CSL) conformance testing procedures, and have a current validation certificate or regi...

Abstract: This guideline discusses threats and vulnerabilities and considers technical security services and security mechanisms.

Abstract: To advance the use of electronic commerce in federal government and other business transactions, the National Institute of Standards and Technology (NIST) issued Federal Information Processing Standard (FIPS) 186, Digital Signature Standard (DSS) on May 19, 1994. The standard becomes effective Decem...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...

Abstract: This Guideline describes the primary alternative methods for verifying the identities of computer system users, and provides recommendations to Federal agencies and departments for the acquisition and use of technology which supports these methods. Although the traditional approach to authentication...

Abstract: The purpose of the Invitational Workshop on Information Technology (IT) Assurance and Trustworthiness was to identify crucial issues on assurance in IT systems and to provide input into the development of policy guidance on determining the type and level of assurance appropriate in a given environme...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...