Search CSRC

Type: Presentation

Type: Presentation

Type: Presentation

Abstract: The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks. It offers a taxonomy of high-level cybersecurity outcomes that can be used by any organization — regardless of its size, sector, or maturity — to bett...

Conference: 2021 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) Abstract: Cross-Site scripting (XSS) is a common class of vulnerabilities in the domain of web applications. As it re-mains prevalent despite continued efforts by practitioners and researchers, site operators often seek to protect their assets using web application firewalls (WAFs). These systems employ filte...

Abstract: Enterprises use encryption—a cryptographic technique—to protect data transmission and storage. While encryption in transit protects data confidentiality and integrity, it also reduces the organization’s visibility into the data flowing through their systems. The NCCoE initiated a project to address...

Abstract: Network-layer onboarding of an Internet of Things (IoT) device is the provisioning of network credentials to that device. The current lack of trusted IoT device onboarding processes leaves many networks vulnerable to having unauthorized devices connect to them. It also leaves devices vulnerable to b...

Abstract: An organization must protect its information from unauthorized access and disclosure. Data breaches large and small can have far-reaching operational, financial, and reputational impacts. The goal of this project is to provide a practical solution to detect, respond to, and recover from incidents th...

Abstract: An organization must protect its information from unauthorized access and disclosure. Data breaches large and small can have far-reaching operational, financial, and reputational impacts. The goal of this project is to provide a practical solution to identify and protect the confidentiality of an en...

Conference: Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019) Abstract: Smart home devices are increasingly being used by nontechnical users who have little understanding of the technology, including privacy and security implications. To better understand perceptions of smart home privacy and security, we are conducting an interview study of individuals living in smart...

Conference: 2018 IEEE Symposium on Service-Oriented System Engineering (SOSE) Abstract: This article presents challenges and solutions to testing systems based on the underlying products and services commonly referred to as the Internet of ‘things’ (IoT).

Abstract: Ransomware, destructive malware, insider threats, and even honest user mistakes present ongoing threats to organizations. Organizations’ data, such as database records, system files, configurations, user files, applications, and customer data, are all potential targets of data corruption, modificati...

Abstract: Ransomware, destructive malware, insider threats, and even honest mistakes present an ongoing threat to organizations that manage data in various forms. Database records and structure, system files, configurations, user files, application code, and customer data are all potential targets of data cor...

Abstract: This project provides guidance on the governance and management of Transport Layer Security (TLS) server certificates in enterprise environments to reduce outages, improve security, and enable disaster recovery related to certificates. The project will be provided in a freely available NIST Cybersec...

Abstract: In the past, medical devices were stand-alone instruments that interacted only with the patient. Today, medical devices have operating systems and communication hardware that allow them to connect to networks and other devices. While this technology has created more powerful tools and improved healt...

Abstract: This NISTIR 7628 User's Guide is intended to provide an easy-to-understand approach that you can use to navigate the NISTIR 7628. While NISTIR 7628 covers many significant cybersecurity topics, this User's Guide is focused primarily on the application of NISTIR 7628 Volume 1 in the context of an org...

Abstract: [For the latest information on vulnerabilities, see the National Vulnerability Database, nvd.nist.gov] It seems that every week, computer security organizations are issuing press releases concerning the latest hacker attack. Some sound dangerous, like the Killer Resume, or mysterious like the Mstrea...

Abstract: This CSL Bulletin discusses issues related to sensitive information and clarifies the meaning of "sensitivity" as applied to agency information systems. It draws upon several years of NIST's experience in assisting federal agencies to implement the Computer Security Act of 1987 and the visits to sen...

Type: Presentation

Type: Presentation

Type: Presentation

Type: Presentation

Type: Presentation

Type: Presentation

Type: Presentation