Search CSRC

Journal: IEEE Security & Privacy Abstract: The history of cryptography standards is reviewed, with a view to planning for the challenges, uncertainties, and strategies that the standardization of postquantum cryptography will entail.

Abstract: This bulletin summarizes the information in NISTIR 8114: Report on Lightweight Cryptography which provides an overview of the lightweight cryptography project at NIST and describes plans for the standardization of lightweight cryptography algorithms.

In: Cloud Computing Security: Foundations and Challenges Abstract: This chapter discusses the risk management for a cloud-based information system viewed from the cloud consumer perspective.

Abstract: Password entry on mobile devices significantly impacts both usability and security, but there is a lack of usable security research in this area, specifically for complex password entry. To address this research gap, we set out to assign strength metrics to passwords for which we already had usabili...

Conference: 2015 Workshop on Automated Decision Making for Active Cyber Defense (SafeConfig '15) Abstract: Cyber attacks inevitably generate impacts towards relevant missions. However, concrete methods to accurately evaluate such impacts are rare. In this paper, we propose a probabilistic approach based on Bayesian networks for quantitative mission impact assessment. A System Object Dependency Graph (SOD...

Abstract: This note describes a theoretical chosen-plaintext attack on the VAES3 mode for format-preserving encryption. VAES3 was specified under the name FF2 in Draft National Institute of Standards and Technology (NIST) Special Publication 800-38G.

Journal: Computer (IEEE Computer) Abstract: The Heartbleed bug highlighted a critical problem in the software industry: inadequately tested software results in serious security vulnerabilities. Available testing technologies, combined with emerging standards, can help tech companies meet increasing consumer demand for greater Internet securit...

Journal: Applied Mathematics & Information Sciences Abstract: On-off scheduling of systems that have the ability to sleep can be used to extend system idle periods and enable greater opportunities for energy savings from sleeping. In this paper, we achieve a theoretical understanding of the delay behavior of on-off scheduling as it may apply to communications...

Journal: Journal of Computer Security Abstract: Quantifying security risk is an important and yet difficult task in enterprise network security management. While metrics exist for individual software vulnerabilities, there is currently no standard way of aggregating such metrics. We present a model that can be used to aggregate vulnerability metr...

Conference: IEEE International Workshop on Information Forensics and Security 2012 (WIFS 2012) Abstract: Attack graphs compute potential attack paths from a system configuration and known vulnerabilities of a system. Evidence graphs model intrusion evidence and dependencies among them for forensic analysis. In this paper, we show how to map evidence graphs to attack graphs. This mapping is useful for a...

Journal: IT Professional Abstract: Enterprise security, often considered a burden for system administrators and users alike, is one of the most rapidly evolving areas of IT. The articles in this issue can help IT professionals who want to be intelligent providers or consumers of secure products and services.

Journal: Journal of AHIMA Abstract: This publication discusses, at a high level, the ubiquitous threats facing email systems today and impresses the need to secure these systems. This article will provide high level tips and techniques for securing email systems and point to resources that an organization can use to further this cause...

Journal: IT Professional Abstract: This article reviews risks and vulnerabilities in interdomain routing, and best practices that can have near-term benefits for routing security. It includes examples of routing failures and common attacks on routers, and coutermeasures to reduce router vulnerabilities.

Conference: 16th International Workshop, Fast Software Encryption (FSE 2009) Abstract: The CBC-MAC, or cipher block chaining message authentication code, is a well-known method to generate message authentication codes. Unfortunately, it is not forgery-secure over an arbitrary domain. There are several secure variants of CBC-MAC, among which OMAC (or one-key CBC-MAC) is a widely-used c...

Journal: IT Professional Abstract: This article introduces "insecure IT", a new department for IT Professional that will cover security weaknesses in IT systems, ranging from desktops to global e-commerce networks. This regular feature will offer ideas to improve IT security, both by looking at ways it can go wrong as well as by cove...

Journal: IEEE Security & Privacy Abstract: [This is a response to comments on INCITS Standard 359-2004, Role Based Access Control. For original paper see Ninghui Li et al., IEEE Security & Privacy, vol. 5, no. 6, p.41, (2007).]

Abstract: This ITL Bulletin summarizes NIST SP 800-50, Building an Information Technology Security Awareness and Training Program. It provides guidelines for building and maintaining a comprehensive awareness and training program, as part of an organization's IT security program.

Abstract: The purpose of this document is to provide guidance for security program manager, technical managers, functional managers, and other information technology (IT) staff members who deal with systems concerning when and how to perform tests for network security vulnerabilities and policy implementation...

Conference: Eighth ACM Symposium on Access Control Models and Technologies (SACMAT '03) Abstract: Role-based Access Control (RBAC) models have been implemented not only in self-contained resource management products such as DBMSs and Operating Systems but also in a class of products called Enterprise Security Management Systems (ESMS). ESMS products are used for centralized management of authori...

Abstract: A comprehensive toolkit of cryptographic standards and associated guideline that covers a wide range of cryptographic technology is currently under development by the Computer Security Division at NIST. These standards and guidelines will enable U.S. Government agencies to select cryptographic secur...

Abstract: NIST sponsored a public workshop for the analysis of block cipher modes of operation on August 24, 2001, in Goleta, California. This report summarizes the presentations and discussions at that workshop.

Abstract: A workshop was held to discuss the modes of operation for symmetric key block cipher algorithms on October 20, 2000 at the Baltimore Convention Center in Baltimore Maryland.

Abstract: [The NIST Computer Security Division prepared this report for the Security, Privacy, and Critical Infrastructure Committee of the CIO Council.] The Federal Information Technology (IT) Security Assessment Framework (or Framework) provides a method for agency officials to 1) determine the current sta...

Abstract: This National Institute of Standards and Technology (NIST) Interagency Report (NISTIR) is a compendium of computer security training and awareness courses. The purpose of this publication is to assist federal agencies locate computer security training resources. This publication is part of a continu...

Abstract: Connection to the Internet provides users and organizations quick and easy access to information, data, software, and discussion groups on every subject imaginable. Access to information on the Internet has become easier and more efficient since the appearance of the mosaic application. This client...