Search CSRC

Conference: 2017 IEEE 2nd International Workshops on Foundations and Applications of Self* Systems (FAS*W) Abstract: Cloud services have gained tremendous attention as a utility paradigm and have been deployed extensively across a wide range of fields. However, Cloud security is not catching up to the fast adoption of its services and remains one of the biggest challenges for Cloud Service Providers (CSPs) and Clo...

Abstract: Organizations rely heavily on the use of information technology (IT) products and services to run their day-to-day activities. Ensuring the security of these products and services is of the utmost importance for the success of the organization. This publication introduces the information security pr...

Abstract: This bulletin summarizes the information presented in NIST SP 800-160: Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems. The publication addresses the engineering-driven perspective and actions necessary to develop more de...

Journal: Computer (IEEE Computer) Abstract: Securing the Internet requires strong cryptography, which depends on good entropy for generating unpredictable keys. Entropy as a service provides entropy from a decentralized root of trust, scaling across diverse geopolitical locales and remaining trustworthy unless much of the collective is compro...

Abstract: This bulletin summarizes the information presented in NISTIR 7511, Rev. 4, "Security Content Automation Protocol (SCAP) Version 1.2 Validation Program Test Requirements". This is the fourth revision of the NISTIR which defines the requirements and associated test procedures necessary for products or...

Abstract: This ITL Bulletin summarizes a new ITL publication, NIST Special Publication 800-40 Revision 3, Guide to Enterprise Patch Management Technologies, which gives recommendations for organizations to improve the effectiveness and efficiency of their patch management technologies.

Abstract: This paper will present an overview of the work of the National Institute of Standards and Technology (NIST) in security and privacy for mobile technology as well as an overview on how NIST standards and guidelines can be applied in the mobile environment.

Journal: Journal of Information System Security Abstract: More than 100 years ago, Lord Kelvin observed that measurement is vital to deep knowledge and understanding in physical science. During the last few decades, researchers have made various attempts to develop measures and systems of measurement for computer security with varying degrees of success. T...

Abstract: This recommendation provides technical guidance to Federal agencies implementing electronic authentication. The recommendation covers remote authentication of users over open networks. It defines technical requirements for each of four levels of assurance in the areas of identity proofing, registrat...

Abstract: This recommendation provides technical guidance to Federal agencies implementing electronic authentication. The recommendation covers remote authentication of users over open networks. It defines technical requirements for each of four levels of assurance in the areas of identity proofing, registrat...

Abstract: This recommendation provides technical guidance to Federal agencies implementing electronic authentication. The recommendation covers remote authentication of users over open networks. It defines technical requirements for each of four levels of assurance in the areas of identity proofing, registrat...

Abstract: This Card Technology Developments and Gap Analysis Interagency Report (IR) provides information regarding current technical capabilities and limitations of storage and processor cards, current user requirements for individual and integrated technologies, and major impediments to technology exploitat...

Abstract: The Automated Security Self-Evaluation Tool (ASSET) automates the process of completing a system self-assessment. ASSET will assist organizations in completing the self-assessment questionnaire contained in NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Sy...

Abstract: A workshop was held at the National Institute of Standards and Technology (NIST) on February 10-11, 2000 to examine public key-based key establishment techniques that are currently available and to discuss the approach to the development of a Key Management Standard for Federal Government use.

Abstract: On June 10, 1994, the National Institute of Standards and Technology (NIST) hosted a one-day workshop to present and discuss key escrow encryption technology, including the recently-approved Escrowed Encryption Standard (EES), Federal Information Processing Standard (FIPS) Publication 185. Speakers...

Abstract: The use of personal computer systems (often called desktop or professional computers) in the office and home environment has placed increasingly powerful information system technology in the hands of growing numbers of users. While providing many benefits, the use of such small computer systems may...

Abstract: This report is designed to help small businesses use the NIST Cybersecurity Framework (CSF) 2.0 [1] to manage their cybersecurity risks. The document is tailored to the smallest of businesses — those with no employees other than the owner, or “non-employer” firms as defined by the...

Abstract: The NIST Workshop on SI Incident Management convened over 400 experts across government, frontier-model developers, cloud and cybersecurity providers, academia, standards organizations, and civil society to examine how organizations can prepare for, detect, handle, and recover from SI-related incide...

Abstract: The architecture of high-performance computing (HPC) systems has significantly influenced the development of artificial intelligence (AI) data centers, which are purpose-built for model training, inference, and applications. This publication conducts a threat and security gap analysis of AI data cen...

Abstract: This document introduces the white paper series titled Applying 5G Cybersecurity and Privacy Capabilities. This series is being published by the National Cybersecurity Center of Excellence (NCCoE) 5G Cybersecurity project. 5G introduced new security capabilities in the standards focusing on securing...

Journal: Communications in Cryptology Abstract: We introduce techniques to transform existing stateful hash based signature (HBS) schemes, such as LMS or XMSS, into efficient threshold and distributed signature schemes. Our approach requires a trusted dealer for setup, and uses a large (up to a few GiB, typically) common reference value for each...

Conference: 39th IFIP WG 11.3 Annual Conference on Data and Applications Security and Privacy, DBSec 2025 Abstract: Large language models (LLMs) have emerged as a powerful tool for retrieving knowledge through seamless, human-like interactions. Despite their advanced text generation capabilities, LLMs exhibit hallucination tendencies, where they generate factually incorrect statements and fabricate knowledge, und...

Abstract: This NIST Trustworthy and Responsible AI report provides a taxonomy of concepts and defines terminology in the field of adversarial machine learning (AML). The taxonomy is arranged in a conceptual hierarchy that includes key types of ML methods, life cycle stages of attack, and attacker goals, objec...

Abstract: While business impact analysis (BIA) has historically been used to determine availability requirements for business continuity, the process can be extended to provide a broad understanding of the potential impacts of any type of loss on the enterprise mission. The management of enterprise risk requi...

Abstract: The Bugs Framework (BF) is a classification of security bugs and related faults that features a formal language for the unambiguous specification of software and hardware security weaknesses and vulnerabilities. BF bugs models, multidimensional weakness and failure taxonomies, and vulnerability mode...