Search CSRC

Abstract: The Validated Products List is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the organizations, test methods and procedures that sup...

Abstract: The Validated Products List (formerly called the Validated Processor List) is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the orga...

Abstract: This document provides guidance for technical managers for the reduction of risk to their computer systems and networks from attack by computer viruses, unauthorized users, and related threats. The guidance discusses the combined use of policies, procedures, and controls to address security vulnerab...

Journal: Journal of Research of the National Institute of Standards and Technology Abstract: The National Computer Systems Laboratory (NCSL) and the National Computer Security Center (NCSC) of the Department of Defense co-sponsored the Eleventh National Computer Security Conference held in Baltimore, Maryland on October 17-20, 1988. More than 1600 attendees from government, industry, and ac...

Abstract: This overview is intended to provide ADP policy managers, information resource managers, ADP technical managers, and ADP staff with a comprehensive summary of and guide to FIPS PUB 102, "Guideline to Computer Security Certification and Accreditation," September 27, 1983. FIPS PUB 102 presents in det...

Abstract: The Federal Data Encryption Standard (DES) (FIPS 46) specifies a cryptographic algorithm to be used for the cryptographic protection of sensitive, but unclassified, computer data. This FIPS defines four modes of operation for the DES which may be used in a wide variety of applications. The modes spe...

Abstract: Operational Technology (OT) backups are vital for recovery from reliability or cyber incidents. Effective backup management in an OT environment involves integrating backups into the change management process, creating them regularly, testing them, and reviewing them during recovery exercises.

Journal: IEEE Security & Privacy Abstract: Three cybersecurity experts from academia and industry discuss the reasons why many phishing training programs fail to change behavior, the importance of meaningful measures of effectiveness, and strategies for improving organizational resilience against current and future phishing threats.

Abstract: There is a need in the community of privacy practitioners for a trustworthy, collaborative shared database of differentially private deployments, to help foster norms about best practices. We propose a shared governance resource to (1) help industry grow to consensus on best practices, (2) provide p...

Journal: Computer (IEEE Computer) Abstract: The data-intensive nature of machine learning (ML)-enabled systems introduces unique challenges in test and evaluation. We present an overview of combinatorial coverage, exploring its applications across the ML-enabled system lifecycle and its potential to address key limitations in performing test...

Journal: IEEE Transactions on Reliability Abstract: This article summarizes some recent novel approaches to the problem of verification, testing, and assurance of autonomous systems. These include proxy verification and combinatorial methods for input space coverage measurement, which also has applications to explainable artificial intelligence. The...

Conference: 23rd International Conference on Computational Science Abstract: Simulation is a useful and effective way to analyze and study complex, real-world systems. It allows researchers, practitioners, and decision makers to make sense of the inner working of a system that involves many factors often resulting in some sort of emergent behavior. The number parameter value...

Abstract: Structural coverage criteria are widely used tools in software engineering, useful for measuring aspects of test execution thoroughness. However in many cases structural coverage may not be applicable, either because source code is not available, or because processing is based on neural networks or...

Abstract: NIST conducted a review of the available alternative approaches for providing confidence in the cybersecurity of Internet of Things (IoT) devices in November 2020 through January 2021, conducting interviews with government and private sector organizations who are experts on these approaches. This wh...

Conference: The Seventh International Conference on Advances and Trends in Software Engineering (SOFTENG 2021) Abstract: Understanding the landscape of software vulnerabilities is key for developing effective security solutions. Fortunately, the evaluation of vulnerability databases that use a framework for communicating vulnerability attributes and their severity scores, such as the Common Vulnerability Scoring Syste...

Abstract: This bulletin summarizes the information found in the voluntary NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management (Version 1.0). The Privacy Framework is a tool developed in collaboration with stakeholders intended to help organizations identify and manage priva...

Journal: Computer Abstract: Testing is the most commonly used approach for software assurance, yet it remains as much judgment and art as science. We suggest that structural coverage measures must be supplemented with measures of input space coverage, providing a means of verifying that an adequate input model has been defined...

Abstract: This guide provides general implementation guidance (Volume 1) and example proof-of-concept solutions demonstrating how available open-source and commercial off-the-shelf (COTS) products could be implemented in manufacturing environments to satisfy the requirements in the Cybersecurity Framework (CS...

Journal: Computer (IEEE Computer) Abstract: I present a computationally efficient and accurate feedforward neural network for sentiment prediction capable of maintaining high transfer accuracy when coupled with an effective semantics model of the text. Experimental results show the advantages of the new approach. Applications to security vali...

Abstract: This bulletin summarizes the NIST Automated Cryptographic Validation (ACV) Testing project. NIST selects and standardizes cryptographic algorithms as NIST-approved for use within the U.S. Federal Government. The Computer Security Division specifies the relative strength of various cryptographic algo...

Abstract: This bulletin summarizes the information found in NIST SP 800-171A: Assessing Security Requirements for Controlled Unclassified Information (CUI) which provides federal and nonfederal organizations with assessment procedures and a methodology that can be employed to conduct assessments of the CUI se...

Abstract: In recent years, there has been a substantial amount of research on quantum computers - machines that exploit quantum mechanical phenomena to solve mathematical problems that are difficult or intractable for conventional computers. If large-scale quantum computers are ever built, they will compromis...

Journal: Computer (IEEE Computer) Abstract: The security of encrypted data depends not only on the theoretical properties of cryptographic primitives but also on the robustness of their implementations in software and hardware. Threshold cryptography introduces a computational paradigm that enables higher assurance for such implementations.

Abstract: When supported by trust frameworks, identity federations provide a secure method for leveraging shared identity credentials across communities of similarly-focused online service providers. This document explores the concepts around trust frameworks and identity federations and provides topics to co...

Abstract: This bulletin summarizes the information found in NIST SP 800-190, Application Container Security Guide and NISTIR 8176, Security Assurance Requirements for Linux Application Container Deployments. The bulletin offers an overview of application container technology and its most notable security chal...