Search CSRC

Conference: 5th Workshop on Security Information Workers (WSIW 2019) Abstract: The in-progress case study will allow for examination of a security awareness team from several perspectives via a multi-faceted approach involving: 1) interviews of security awareness team members, managers in the team’s chain-of-command, and agency employees who receive the security awareness...

Abstract: This publication describes an online glossary of terms used in National Institute of Standards and Technology (NIST) and Committee on National Security Systems (CNSS) publications. This glossary utilizes a database of terms extracted from NIST Federal Information Processing Standards (FIPS), t...

Journal: Quantum: The Open Journal for Quantum Science Abstract: We introduce a framework for graphical security proofs in device-independent quantum cryptography using the methods of categorical quantum mechanics. We are optimistic that this approach will make some of the highly complex proofs in quantum cryptography more accessible, facilitate the discovery of...

Journal: ACM Computing Surveys Abstract: Monitoring the “physics” of cyber-physical systems to detect attacks is a growing area of research. In its basic form, a security monitor creates time-series models of sensor readings for an industrial control system and identifies anomalies in these measurements to identify potentially false contro...

Abstract: This document describes a security platform for trustworthy email exchanges across organizational boundaries. The project includes reliable authentication of mail servers, digital signatures and encryption of email, and binding cryptographic key certificates to sources and servers. The example solut...

Abstract: Cellular technology plays an increasingly large role in society as it has become the primary portal to the internet for a large segment of the population. One of the main drivers making this change possible is the deployment of 4th generation (4G) Long Term Evolution (LTE) cellular technologies. Thi...

Abstract: These guidelines provide technical requirements for federal agencies implementing digital identity services and are not intended to constrain the development or use of standards outside of this purpose. The guidelines cover identity proofing and authentication of users (such as employees, contractor...

Journal: IT Professional Abstract: Given the large and impactful data breaches making headlines in recent years, Internet users naturally wonder: Why is this happening, and how much worse can it get? Here, the authors review trends in vulnerabilities, looking at earlier findings discussed in a previous installment of this column, as...

Abstract: These guidelines provide technical requirements for federal agencies implementing digital identity services and are not intended to constrain the development or use of standards outside of this purpose. The guidelines cover identity proofing and authentication of users (such as employees, contractor...

Conference: 11th Annual Conference on Digital Forensics, Security and Law (ADFSL) Abstract: In this paper, we present an approach and experimental results to suggest the past presence of an application after the application has been uninstalled and the system has remained in use. Current techniques rely on the recovery of intact artifacts and traces, e.g., whole files, Windows Registry ent...

Abstract: This bulletin summarizes the information presented in NIST SP 800-178: A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications. The publication describes Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC), and then compar...

Journal: IEEE Software Abstract: As new and exciting healthcare applications arise that use smart technologies, the Internet of Things, data analytics, and other technologies, a critical problem is emerging: the potential loss of caring. Although these exciting technologies have improved patient care by allowing for better assessme...

Journal: INTEGERS: The electronic journal of combinatorial number theory Abstract: Working over the field Q(t), Kihara constructed an elliptic curve with torsion group Z/4Z and five independent rational points, showing the rank is at least five. Following his approach, we give a new infinite family of elliptic curves with torsion group Z/4Z and rank at least five. This matches the...

Abstract: This bulletin summarized the information presented in NISTIR 8060, "Guidelines for the Creation of Interoperable Software Identification (SWID) Tags". The publication provides an overview of the capabilities and usage of SWID tags as part of a comprehensive software lifecycle.

Conference: High Confidence Software and Systems Conference Abstract: We present a combinatorial coverage measurement analysis for (subsets) of the TLS cipher suite registries by analyzing the specified ciphers of IANA, ENISA, BSI, Mozilla and NSA Suite B. The method introduced here may contribute towards the design of quality measures of cipher suites, and may also b...

Abstract: NIST Special Publication (SP) 800-73 contains the technical specifications to interface with the smart card to retrieve and use the Personal Identity Verification (PIV) identity credentials. This document, SP 800-85A, contains the test assertions and test procedures for testing smart card middleware...

Abstract: This bulletin summarizes the information presented in NIST Special Publication 800-167, "Guide to Application Whitelisting," written by Adam Sedgewick, Murugiah Souppaya and Karen Scarfone. The publication is intended to assist organizations in understanding the basics of application whitelisting....

Abstract: The National Institute of Standards and Technology (NIST) is developing a cybersecurity performance testbed for industrial control systems. The goal of the testbed is to measure the performance of industrial control systems (ICS) when instrumented with cybersecurity controls in accordance with the b...

Abstract: This is a brief introduction on how to run the Python command-line programs (hosted on GitHub at https://github.com/usnistgov/SP800-90B_EntropyAssessment) that implement the statistical entropy estimation tests found in Section 9 of the Draft NIST SP 800-90B (August 2012). It is not a description or...

Abstract: This document captures the input received from the half-day workshop titled “Public Safety Mobile Application Security Requirements” organized by the Association of Public-Safety Communications Officials (APCO) International, in cooperation with FirstNet and the Department of Commerce and held on Fe...

Abstract: Office of Management and Budget (OMB) Memorandum M-14-03, Enhancing the Security of Federal Information and Information Systems, reminds Federal agencies that, "Our nation's security and economic prosperity depend on ensuring the confidentiality, integrity and availability of Federal information and...

Journal: IT Professional Abstract: Risk management is a common phrase when managing information, from the CISO to the programmer. We acknowledge that risk management is the identification, assessment and prioritization of risks and reflects how we manage uncertainty. These are some areas of risk that we have come to accept, their mit...

Journal: Computer (IEEE Computer) Abstract: Although access control (AC) currently plays an important role in securing data services, if properly envisaged and designed, access control can serve a more vital role in computing than one might expect. The Policy Machine (PM), a framework for AC developed at NIST, was designed with this goal in m...

Abstract: Combinatorial testing applies factor covering arrays to test all t-way combinations of input or configuration state space. In some testing situations, it is not practical to use covering arrays, but any set of tests covers at least some portion of t-way combinations up to t [less than or equal to] n...

Journal: IT Professional Abstract: To many, system policy is a statement posted on a website indicating intention to protect personal data. In reality, policy is much broader, and its enforcement far more consequential. What if policy-derived rule sets could be rigorously defined and automated for software-intensive systems? Imagine...