Search CSRC

People and organizations often fail to adopt and effectively use cybersecurity best practices and technologies for a variety of reasons, including lack of knowledge/skills. Those professionals tasked with educating others may likewise face a number of challenges, including lack of resources, support, and skills needed to be effective security communicators. We conduct research to better understand the approaches and challenges with cybersecurity awareness and role-based training through the eyes of training professionals within the U.S. government. In the recent past, we also explored...

Short URL: https://csrc.nist.gov/phishing Phishing continues to be an escalating cyber threat facing organizations of all types and sizes, including industry, academia, and government. Our team performs research to understand phishing within an operational (real-world) context by examining user behaviors during phishing awareness training exercises. Our projects provide insights into users’ rationale and role in early detection, and how these might be scaffolded with technological solutions. Recent efforts have focused on the NIST Phish Scale, a method for rating the human detection...

If you would like to participate in the Online Informative Reference (OLIR) Program please consult NISTIR 8278A Rev. 1 National Online Informative References (OLIR) Program: Submission Guidance for OLIR Developers document and become familiar with the requirements and all procedures involved during the life cycle. Developers of Informative References considering a submission are welcome to contact NIST with questions before completing the entire Informative Reference submission package. Questions and draft Informative Reference documents may be directed to [email protected]. Submitting parties can...

NEW: Combinatorial Coverage Difference Measurement for assurance of autonomous systems and other critical software. Combinatorial coverage is a way of finding the rare cases that may lead to security vulnerabilities or system failures, with application to both testing and assured autonomy. Achieving sound testing or assured autonomy in any environment requires methods for measuring the input space, to show that the test environment adequately covers real-world conditions that may be encountered. NIST is developing new combinatorial measurement methods and tools for input space coverage,...

Focusing on federal agencies but also engaging with and providing resources useful to government at other levels as well as the private sector, NIST: Guidance on Software Supply Chain Security, under Executive Order 14028 Sections 4(c) and (d), focuses on the critical sub-discipline of Cybersecurity Supply Chain Risk Management (C-SCRM) from the lens of federal acquirers. It covers both existing and evolving standards, tools, and recommended practices. The guidance is co-located with related EO guidance under NIST’s purview and will be maintained online to more easily update guidance on...

Combinatorial Testing Quick Start – two short readings make it easy to learn the basics: Read tutorial sections 2, 3, and 4 (pp. 4 to 18) (pdf in English or Espanol): Practical Combinatorial Testing // Pruebas Combinatorias Pracaticas Two examples are included, illustrating how to apply the combinatorial approach. See the ACTS User Guide, which explains how to use the ACTS tool. The user guide contains illustrations and screen shots of examples showing how to use the tool for practical testing. Now try it on your own testing project! See also: Video overview (12:46, mp4) of...

A generic application (app, for short) of beacon randomness is enabling public-verifiability of randomized procedures. For example, when randomly sampling for audits, auditors are prevented from biasing the selections (or being accused of it), and auditees are prevented from knowing the selections in advance (or being accused of it). An interesting randomness/determinism duality: although beacon applications relate to the use of randomness, their public auditability requires a well specified deterministic operation (which then uses as input the needed random values). The remainder of this...

XLSX: All CPRT data and queries can be downloaded in XLSX format. This is the common format used by Microsoft Excel. JSON: All CPRT data uses a common format. Therefore, every document, and query, within the CPRT can use the same JSON schema. This schema provides a machine readable view into the CPRT for users to interact with the data in a repeatable and predictable way. The schema is flat, containing only 4 top level elements (documents, elements, relationships, relationship_types). This structure allows users to quickly iterate through the data and build any data structure that suits...

The NIST PQC team will host talks -- open to the public -- relating to the NIST PQC standardization process. To propose a talk, please send an email to Dr. Maxime Bros at [email protected] To subscribe to the mailing list and get notifications about coming talks, please send an email to [email protected] (more detailed instructions here). Instructions to connect (PDF) # Date Speaker Title Media 22 January 7, 2025 10:00am - 11:00am** Dr. Sarah Arpin, Virginia Polytechnic Institute and State University, USA and...

Combinatorial methods make it possible to detect a significant proportion of faults without a conventional test oracle. This seemingly impossible task is achieved using two layers of covering arrays with equivalence classes. Oracle-free Testing with Two-layer Covering Arrays (NSF Research Experience for Undergraduates presentation, 2015) Kuhn, D. R., Kacker, R. N., Lei, Y., & Torres-Jimenez, J. (2015, April). Equivalence Class Verification and Oracle-free Testing Using Two-layer Covering Arrays. In Software Testing, Verification and Validation Workshops (ICSTW), 2015 IEEE Eighth...

The primary goal of the Tool Catalog is to provide an easily searchable catalog of forensic tools. This enables practitioners to find tools that meet their specific technical needs. The Catalog provides the ability to search by technical parameters based on specific digital forensics functions, such as disk imaging or deleted file recovery. Note: tool information is provided by the vendor. Any mention of commercial or non-commercial products is for information only and does not imply that a product has been tested. https://toolcatalog.nist.gov/

Topics of Interest In accordance with 15 U.S.C. 278g-4, the duties of the Information Security and Privacy Advisory Board are to identify emerging managerial, technical, administrative, and physical safeguard issues relative to information security and privacy. The focus of the Board's work for FY 2015-2016 includes the following areas: Quantum (physics, pre-shared keys, quantum key distribution, block chains) Cybersecurity Office of Management and Budget OMB Circular A-130 Revised Cyber-marathon CyberStats Measuring outcomes for cybersecurity Cybersecurity protections in...

Zero-Knowledge Proof (ZKP) is an important Privacy-Enhancing Cryptography (PEC) technique. It enables proving the truthfulness of a mathematical statement, without revealing information that may have been useful in finding said truthfulness and is not apparent in the statement. Besides myriad privacy-preserving applications, ZKPs are also useful in establishing correct behavior in other cryptography protocols, such as in Secure Multi-Party Computation (MPC). The NIST PEC project is accompanying ZKP developments and initiatives toward future useful standards. For technical reasons, it is...

Additional resources are available for the following SWID Tag specification revisions: ISO/IEC 19770-2:2015 Revision ISO/IEC 19770-2:2015 Resources SWID Tag Validation Tool NIST has developed a SWID Tag validation tool that can be used to verify that a produced SWID has properly implemented the requirements defined in NISTIR 8060. This tool can validate different types of SWID Tags that are used in different stages of the software lifecycle: SWID Tags that pass this validation tool provide support for license management as well as multiple cybersecurity use cases including:...

Validation Number: 138 Vendor: Rapid7 Product Name: Nexpose Product Major Version: 6 Product Version Tested: 6.2.1 Tested Platforms: Microsoft Windows XP Professional SP3, 32 bit Microsoft Windows Vista SP1, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor Provided SCAP Information Dates Tested: 10/20/2015 - 4/8/2016 Report Submitted: 11/20/2015 DTR Version:...

Validation Number: 132 Vendor: BMC Software Product Name: BMC Server Automation Product Major Version: 8.6 Product Version Tested: 8.6.00.197 Tested Platforms: Microsoft Windows 7, 64 bit Red Hat Enterprise Linux 5, 64 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Open Checklist Interactive Language (OCIL) Validated Product Vendor Provided SCAP Information Dates Tested: 10/21/2014 - 12/15/2014...

Call for Proposals 4.C Algorithm and Implementation Characteristics 4.C.1 Flexibility Assuming good overall security and performance, schemes with greater flexibility will meet the needs of more users than less flexible schemes, and therefore, are preferable. Some examples of “flexibility” may include (but are not limited to) the following: The scheme can be modified to provide additional functionalities that extend beyond the minimum requirements of public-key encryption, KEM, or digital signature (e.g., asynchronous or implicitly authenticated key exchange, etc.). It is...

Online Informative References Submissions We welcome your participation in the Online Informative Reference (OLIR) Program. The NISTIR 8278Ar1 (Revision 1) National Online Informative References (OLIR) Program: Submission Guidance for OLIR Developers contains detailed participation requirements and all procedures involved during the life cycle. Developers of Informative References considering a submission are welcome to contact NIST with questions. Questions and draft Informative Reference documents should be directed to [email protected]. Submitting parties can expect to hear back from NIST...

The NIST Cybersecurity & Privacy Professionals Forum is co-chaired by representatives of NIST's Information Technology Laboratory Computer Security Division (CSD) and the Department of Commerce Office of Privacy and Open Government (OPOG). The Forum Secretariat provides the necessary administrative and logistical support for operations. The Forum serves as an important mechanism for NIST to: exchange information directly with cybersecurity and privacy professionals in U.S. federal, state, and local government, and higher education organizations handling federal information in...

MagicMirror is a white-box fuzzing tool written mainly in Python 3 for Solidity Smart Contracts. It supports the detection of 9 popular security vulnerabilities. It is easy to use and provides various informative reports as output. MagicMirror is fast and can generally achieve high code coverage on many contracts. MagicMirror utilizes techniques that include constraint solving, random test generation, random state exploration, coverage and data dependency guided fuzzing, and combinatorial testing. DOWNLOADS: https://magic-mirror.gitbook.io/magicmi/ MagicMirror works on both Linux and...

MPTC-forum for publicly accessible messages: The [email protected] mailing list was created for public announcements and public conversation about the NIST Multi-Party Threshold Cryptography project. Messages: The MPTC-forum is an unmoderated mailing list; messages sent to this list are immediately distributed to all the addresses on the list, and are by default made publicly available via the email archive. Only members are allowed to post messages to the list, by sending an email to [email protected], but anyone can subscribe to become a member of the list. Email archive:...

Why are we doing this? NIST seeks to : Accelerate the adoption of our cybersecurity and privacy standards, guidelines, and frameworks by making it much easier for users of NIST products to identify, locate, compare, and customize content across NIST’s standards, guidelines, and practices. Add value to our existing reference datasets by delivering human- and machine-consumable reference datasets. The CPRT provides a centralized, standardized, and modernized mechanism for managing reference datasets, eventually creating the opportunity to correlate and establish relationships...

The National Institute of Standards and Technology previously hosted a series of monthly educational workshops focused on the Open Security Controls Assessment Language (OSCAL). NOTE: These workshops are no longer being held and remain available as an archive of education resources for the OSCAL community. The purpose of these workshops is to improve OSCAL adoption by expanding the OSCAL community of interest (COI) through the onboarding of members who have no previous knowledge of OSCAL. By helping establish the foundation for security automation, with a particular focus on the continuous...

A: All or nearly all failures involve only 1 to 6 factors The key insight underlying combinatorial testing’s effectiveness resulted from a series of studies by NIST from 1999 to 2004. NIST research showed that most software bugs and failures are caused by one or two parameters, with progressively fewer by three or more. That is, they were only revealed when multiple conditions were true. For example, a 2-way interaction fault could be "altitude = 0 AND volume < 2.2". So testing all 2-way combinations of parameter values could detect this problem. A method called "pairwise testing" has been...

07/01/2018 The CMVP's symmetric key wrapping transition plan to comply to NIST SP 800-38F (as specified in SP 800-131A) has been completed (see 12/20/17 Notice) As a result, the NIST PIV Validation Program has updated its PIV Card Application Validation List by moving affected modules with PIV Card Applications to the Removed Product’s List. 06/30/2018 The two 1-year extensions to continue issue PIV Cards with RNG rather than with DRBG ended June 30th 2018. As a result, the NIST PIV Validation Program has removed listings of PIV Card with RNG implementation from the PIV Card Application...