Search CSRC

Abstract: NIST hosted the second annual Public Key Infrastructure (PKI) Research Workshop on April 28-29, 2003. The two-day event brought together PKI experts from academia, industry, and government to explore the remaining challenges in deploying public key authentication and authorization technologies, and...

Abstract: This ITL Bulletin summarizes NIST Special Publication 800-64, Security Considerations in the Information Sys­ tem Development Life Cycle. That guide presents a framework for incorporating security into all phases of the information system development life cycle (SDLC) process, from initiation to dis...

Abstract: The purpose of this document is to provide agencies with guidance for establishing secure wireless networks. Agencies are encouraged to tailor the recommended guidelines and solutions to meet their specific security or business requirements. However, NIST recommendations are not intended to supersed...

Abstract: Web servers maintained for public use are normally the most targeted and attacked hosts on an organization's network. Thus, it is essential to secure Web servers and the network infrastructure that supports them. This document has been developed to assist federal departments and agencies, state agen...

Journal: IEEE Communications Magazine Abstract: Electronic commerce over the Internet is now tens of billions of dollars per year and growing. This article describes how objects used in EC can be located and protected from unauthorized access. It discusses the three kinds of EC: customer interactions with a business, business interactions with ot...

Conference: 21st National Information Systems Security Conference Abstract: The Proceedings of the 21st National information Systems Security Conference (NISSC), held October 5-8, 1998, in Arlington, Virginia. CD-ROM: "Early Computer Security Papers (1970-1985)" At NISSC '98, attendees were given a CD that contained papers that are unpublished, seminal work...

Conference: 11th Annual Computer Security Applications Conference Abstract: The central notion of Role-Based Access Control (RBAC) is that users do not have discretionary access to enterprise objects. Instead, access permissions are administratively associated with roles, and users are administratively made members of appropriate roles. This idea greatly simplifies manageme...

Abstract: The selective application of technological and related procedural safeguards is an important responsibility of every Federal organization in providing adequate security to its electronic data systems. This publication specifies a cryptographic algorithm which may be used by Federal organizations to...

Abstract: The Database Language SQL (SQL) is a standard interface for accessing and manipulating relational databases. An SQL-compliant database management system (DBMS) will include a minimum level of functionality in a variety of areas. However, many additional areas are left unspecified by the SQL standard...

Conference: 12th Annual International Cryptology Conference (CRYPTO '92) Abstract: NIST Received comments from 109 separate government agencies, companies, and private individuals concerning the proposed Digital Signature Standard. Both positive and negative comments were received. However the number of negative comments was significantly larger than normally received for a propos...

Abstract: For communications between computer systems to be useful in many environments, the systems and their communications must be secure. One prerequisite to secure communications is the management of keying material needed by the underlying cryptographic mechanisms that provide security. This report addr...

Abstract: In a cooperative effort with government and industry, the National Institute of Standards and Technology (NIST) conducted a study to assess the current and future information technology (IT) security needs of the commercial, civil, and military sectors. The primary objectives of the study were to: a...

Abstract: As a participant in the U. S. Army Computer Vulnerability/Survivability Study Team, the National Institute of Standards and Technology has been tasked with providing an assessment of the threats associated with commercial hardware and software. This document is the second and final deliverable under...

Abstract: Computer systems and the information they store and process are valuable resources which need to be protected. With the current trend toward networking, compromise of one computer on a network can often affect a significant number of other machines connected to the network. The first step toward sec...

Abstract: The Computer Systems Laboratory (CSL) of the National Institute of Standards and Technology (NIST) receives many inquiries regarding the implementation of Federal Information Processing Standard (FIPS) 140, General Security Requirements for Equipment Using the Data Encryption Standard. Since FIPS 14...

Abstract: This National Institute of Standards and Technology Interagency Report (NISTIR) presents the Simplified Risk Analysis Guidelines developed by the U.S. Department of Justice, Justice Management Division, Security and Emergency Planning Staff, ADP/Telecommunications Group. The National Institute of St...

Abstract: This guideline provides a framework for determining the training needs of employees involved with computer systems. It describes the learning objectives of agency computer security training programs. A focus on learning objectives--what the employee should know and be able to direct or actually perf...

Abstract: This publication specifies a standard to be used by Federal organizations which require that the integrity of computer data be cryptographically authenticated. In addition, it may be used by any organization whenever cryptographic authentication is desired. Cryptographic authentication of data durin...

Abstract: This publication describes the design and operation of the NBS testbed that is used for the validation of hardware implementations of the Federal Information Processing Data Encryption Standard (DES). A particular implementation is verified if it correctly performs a set of 291 test cases that have...

Abstract: This publication describes the design and operation of the NBS testbed that is used for the validation of hardware implementations of the Federal Information Processing Data Encryption Standard (DES). A particular implementation is verified if it correctly performs a set of 291 test cases that have...

Abstract: The National Bureau of Standards, with the support of the U.S. General Accounting Office, sponsored an invitational workshop on "Audit and Evaluation of Computer Security," held in Miami Beach, Florida on March 22-24, 1977. Its purpose was to explore the state-of-the-art in this area and define appr...

Abstract: This Workshop was conducted at the National Bureau of Standards (NBS), Gaithersburg, Maryland, on August 30-31, 1976, to provide the NBS Institute for Computer Sciences and Technology (ICST) with current scientific and technical information on advances in computer technology which could signifi...

Abstract: This index is a list of certain requirements which must be considered by Federal technical and administrative personnel in order to comply with those provisions of the Privacy Act of 1974* relating to automated systems design and development . This index has been derived from the Office of Managemen...

Abstract: On February 20, 1975, nine informed EDP professionals were invited by the Systems and Software Division of the Institute for Computer Sciences and Technology to discuss the costs Federal agencies should anticipate in complying with the Privacy Act of 1974. The invitees came from Federal agencies, pr...

Abstract: This publication summarizes and contains the proceedings of a conference held at the National Bureau of Standards on March 4-5, 1974 to continue the dialog in search of ways to protect confidential information in computer systems. Proposals are presented for meeting governmental needs in safeguardin...