Search CSRC

Abstract: Cyber threat information is any information that can help an organization identify, assess, monitor, and respond to cyber threats. Cyber threat information includes indicators of compromise; tactics, techniques, and procedures used by threat actors; suggested actions to detect, contain, or prevent a...

Journal: Computer (IEEE Computer) Abstract: We asked 7 experts 1 simple question to find out what has occurred recently in terms of applying formal methods (FM) to security-centric, cyber problems: Please summarize in a paragraph the state of the research and practitioner communities in formal method as you see it. Please include standards, c...

Conference: 7th International Workshop on Post-Quantum Cryptography (PQCrypto 2016) Abstract: Multivariate Public Key Cryptography (MPKC) is one of the most attractive post-quantum options for digital signatures in a wide array of applications. The history of multivariate signature schemes is tumultuous, however, and solid security arguments are required to inspire faith in the schemes and t...

Abstract: De-identification removes identifying information from a dataset so that individual data cannot be linked with specific individuals. De-identification can reduce the privacy risk associated with collecting, processing, archiving, distributing or publishing information. De-identification thus attempt...

Journal: Journal of Cryptology Abstract: We introduce a new cryptographic primitive called a blind coupon mechanism (BCM). In effect, a BCM is an authenticated bit commitment scheme, which is AND-homomorphic. We show that a BCM has natural and important applications. In particular, we use it to construct a mechanism for transmitting alerts...

Conference: 16th IEEE International Conference on Information Reuse and Integration (IRI 2015) Abstract: Attribute Based Access Control (ABAC) is a popular approach to enterprise-wide access control that provides flexibility suitable for today’s dynamic distributed systems. ABAC controls access to objects by evaluating policy rules against the attributes of entities (subject and object), operations, an...

Conference: 2015 International Conference on Grid & Cloud Computing and Applications (GCA '15) Abstract: Cloud Data centers are predominantly made up of Virtualized hosts. The networking infrastructure in a cloud (virtualized) data center, therefore, consists of the combination of physical IP network (data center fabric) and the virtual network residing in virtualized hosts. Network Segmentation (Isola...

In: Advances in Computers Abstract: Combinatorial testing has rapidly gained favor among software testers in the past decade as improved algorithms have become available and practical success has been demonstrated. This chapter reviews the theory and application of this method, focusing particularly on research since 2010, with a brie...

Journal: IEEE Cloud Computing Abstract: Despite the undisputed advantages of cloud computing, customers-in particular, small and medium enterprises (SMEs)-still need meaningful understanding of the security and risk-management changes that the cloud entails so they can assess whether this new computing paradigm meets their security requir...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-161, Supply Chain Management Practices for Federal Information Systems and Organizations, which provides guidance to federal agencies on identifying, assessing and mitigating ICT supply chain risks at all levels...

Abstract: This publication provides a set of procedures for conducting assessments of security controls and privacy controls employed within federal information systems and organizations. The assessment procedures, executed at various phases of the system development life cycle, are consistent with the securi...

Conference: 6th International Workshop on Post-Quantum Cryptography (PQCrypto 2014) Abstract: Multivariate Public Key Cryptography (MPKC) has been put forth as a possible post-quantum family of cryptographic schemes. These schemes lack provable security in the reduction theoretic sense, and so their security against yet undiscovered attacks remains uncertain. The effectiveness of differentia...

Journal: IT Professional Abstract: Approximately 100 IT professionals participated in the 2014 IT Pro Conference on Information Systems Governance, held at the National Institute of Standards and Technology (NIST) on May 22, 2014 (www.computer.org/itproconf). Information systems governance focuses on properly managing IT resources to...

Abstract: Mobile device forensics is the science of recovering digital evidence from a mobile device under forensically sound conditions using accepted methods. Mobile device forensics is an evolving specialty in the field of digital forensics. This guide attempts to bridge the gap by providing an in-depth lo...

Conference: Second International Workshop on Combinatorial Testing 2013 (IWCT 2013) Abstract: Combinatorial testing applies factor covering arrays to test all t-way combinations of input or configuration state space. In some testing situations, it is not practical to use covering arrays, but any set of tests covers at least some portion of t-way combinations up to t <= n. This report desc...

In: Abstract: Security Automation Essentials: Streamlined Enterprise Security Management & Monitoring with SCAP lays out comprehensive technical, administrative, and operational strategies for security management. Discover how to define baseline requirements, automatically confirm patches and updates, id...

Conference: 4th ACM Workshop on Security and Artificial Intelligence (AISec '11) Abstract: A binary de Bruijn sequence of order n is a cyclic sequence of period 2^n, in which each n-bit pattern appears exactly once. These sequences are commonly used in applications such as stream cipher design, pseudo-random number generation, 3-D pattern recognition, network modeling, mainly due to their...

Abstract: Bluetooth is an open standard for short-range radio frequency communication. Bluetooth technology is used primarily to establish wireless personal area networks (WPANs), and it has been integrated into many types of business and consumer devices. This publication provides information on the security...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. The guide helps organizations develop an ISCM strategy and implement an ISCM program that provides awarene...

Conference: 13th IFIP TC13 Conference on Human-Computer Interaction (INTERACT 2011) Abstract: A field study of 24 participants over 10 weeks explored user behavior and perceptions in a smartcard authentication system. Ethnographic methods used to collect data included diaries, surveys, interviews, and field observations. We observed a number of issues users experienced while they integrated...

Abstract: This report defines the Common Platform Enumeration (CPE) Dictionary version 2.3 specification. The CPE Dictionary Specification is a part of a stack of CPE specifications that support a variety of use cases relating to IT product description and naming. An individual CPE dictionary is a repository...

Abstract: Today’s information systems face sophisticated attackers who combine multiple vulnerabilities to penetrate networks with devastating impact. The overall security of an enterprise network cannot be determined by simply counting the number of vulnerabilities. To more accurately assess the security of...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-39, Integrated Enterprise-Wide Risk Management: Organization, Mission and Information System View. This publication was developed by the Joint Task Force Transformation Initiative, a joint partnership among the D...

Conference: 44th Annual Hawaii International Conference on System Sciences (HICSS), 2011 Abstract: In meteorology, the most destructive extratropical cyclones evolve with the formation of a bent-back front and cloud head separated from the main polar-front, creating a hook that completely encircles a pocket of warm air with colder air. The most damaging winds occur near the tip of the hook. The c...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-127, Guide to Securing WiMAX Wireless Communications: Recommendations of the National Institute of Standards and Technology. The publication, which was written by Karen Scarfone (formerly of NIST) and by Cyrus Ti...