Search CSRC

Abstract: Cell phones and personal digital assistants (PDAs) have become indispensable tools for today's highly mobile workforce. Small and relatively inexpensive, these devices can be used for many functions, including sending and receiving electronic mail, storing documents, delivering presentations, and re...

Conference: 22nd Annual IFIP WG 11.3 Working Conference on Data and Applications Security Abstract: In today's networked environments, protecting critical resources usually requires us to understand and measure the likelihood of multi-step attacks that combine different vulnerabilities for reaching the attack goal. Such a measurement is now feasible due to a qualitative model of causal relationsh...

Abstract: This bulletin summarizes information disseminated in revised NIST Special Publication (SP) 800-61-1, Computer Security Incident Handling Guide: Recommendations of the National Institute of Standards and Technology. Written by Karen Scarfone and Tim Grance of NIST and by Kelly Masone of Booz Allen Ha...

Abstract: Forensic specialists periodically encounter unusual devices and new technologies outside of traditional computer forensics. Cell phones are an emerging area with such characteristics. The objective of this guide is twofold: to help organizations evolve appropriate policies and procedures for dealing...

Abstract: The purpose of this document is to present recommendations for Personal Identity Verification (PIV) card readers in the area of performance and communications characteristics to foster interoperability. This document is not intended to re-state or contradict requirements specifically identified in F...

Abstract: This bulletin summarizes the information provided in NIST SP 800-84, concerning the need to design, develop, conduct, and evaluate Test, Training, and Exercise (TT&E) activities. The bulletin provides information on how organizations can prepare for, respond to, manage, and recover from adverse even...

Abstract: Forensic specialists periodically encounter unusual devices and new technologies normally not envisaged as having immediate relevance from a digital forensics perspective. The objective of the guide is twofold: to help organizations evolve appropriate policies and procedures for dealing with Persona...

Abstract: This report presents a generic methodology for conducting an analysis of a Private Branch Exchange (PBX) in order to identify security vulnerabilities. The report focuses on digital-based PBXs and addresses the following areas for study: System Architecture; Hardware; Maintenance; Administrative Dat...

Abstract: Mars, RC6, Rijndael, Serpent and Twofish were selected as finalists for the Advanced Encryption Standard (AES). To evaluate the finalists’ suitability as random number generators, empirical statistical testing is commonly employed. Although it widely believed that these five algorithms are indeed ra...

Abstract: One of the criteria used to evaluate the Advanced Encryption Standard candidate algorithms was their demonstrated suitability as random number generators. That is, the evaluation of their output utilizing statistical tests should not provide any means by which to computationally distinguish them fro...

Journal: ACM Transactions on Information and System Security Abstract: This paper describes NIST's enhanced RBAC model and our approach to designing and implementing RBAC features for networked Web servers. The RBAC model formalized in this paper is based on the properties that were first described in Ferraiolo and Kuhn [1992] and Ferraiolo et al. [1995], with adjustme...

Abstract: This standard specifies a Digital Signature Algorithm (DSA) which can be used to generate a digital signature. Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signa...

Abstract: For the security of any system to be strong, the system's owners must consider three fundamental security areas: management controls, operational controls, and technical controls. While technical controls, such as encryption, digital signatures, or firewalls, receive the most attention, inadequate o...

Conference: 17th National Computer Security Conference Abstract: The Proceedings of the 17th National Computer Security Conference, "Communicating our Discipline: Strategies for the Emerging Information Infrastructures," held October 11-14, 1994 in Baltimore, Maryland. It includes refereed papers and panel summaries from the conference (listed on pp. iv-xv). Page...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...

Abstract: Computer viruses continue to pose a threat to the integrity and availability of computer systems. This is especially true for users of personal computers. A variety of anti-virus tools are now available to help manage this threat. These tools use a wide range of techniques to detect, identify, and r...

Conference: 15th National Computer Security Conference (NCSC) Abstract: While Mandatory Access Controls (MAC) are appropriate for multilevel secure military applications, Discretionary Access Controls (DAC) are often perceived as meeting the security processing needs of industry and civilian government. This paper argues that reliance on DAC as the principal method of a...

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...