Search CSRC

High-performance computing (HPC) systems provide fundamental computing infrastructure and play a pivotal role in economic competitiveness and scientific discovery. Security is an essential component of HPC. NIST HPC Security Working Group (WG) has been leading the effort to create comprehensive and reliable security guidance for HPC systems. As part of the Working Group mission and to reach the greater HPC scientific community, NIST, in collaboration with the National Science Foundation (NSF), will host the 5th High-Performance Computing Security Workshop on May 7-8, 2025. The workshop aims to...

The Federal Cybersecurity & Privacy Professionals Forum is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the sharing of system security and privacy information among federal, state, and local government, and higher education employees. The Forum maintains an extensive Email list and holds quarterly meetings to discuss current issues and items of interest to those responsible for protecting non-national security systems. For more information about the Forum and instructions on how to join, see: https://csrc.nist.gov/Projects/forum. A...

The September 2003 meeting of the Information Security and Privacy Advisory Board. Minutes Selected Presentations Liberty Alliance and "Touching the Browser" Paul Madsen, Entrust and Chair of the Liberty Trust, Security, and Privacy Subteam Browser Extensions and Security Wayne A. Jansen, Computer Security Division, NIST Guideline for Mapping Types of Information and Information Systems to Security Categorization Levels William Curt Barker, Computer Security Division, NIST

(All presentations in .pdf format.) Federal Register Notice Announcing Meeting Minutes The State of the Privacy Act Ari Schwartz, Center for Democracy and Technology Geospatial Line of Business Overview –Security and Privacy Considerations Ivan B. DeLoatch, Department of Interior Information Technology Laboratory (ITL) - Strategic Planning Update Cita Furlani, Information Technology Laboratory, National Institute of Standards and Technology If you have any questions or need information please e-mail Annie Sokol .

The Software and Supply Chain Assurance Forum (SSCA) provides a venue for government, industry, and academic participants from around the world to share their knowledge and expertise regarding software and supply chain risks, effective practices and mitigation strategies, tools and technologies, and any gaps related to the people, processes, or technologies involved. Forums are held 2-3 times / year and are FREE and open to the public; registration is required.

The NIST Cyber Supply Chain Risk Management Team is hosting a webinar to provide an overview of the changes made in its Initial Public Draft of Special Publication 800 – 161, Revision 1, Supply Chain Risk Management Practices for Systems and Organizations. NIST seeks to engage stakeholders to provide clarity, answer questions, and get stakeholder comments and opinions that ensure Revision 1 will deliver comprehensive and relevant cyber supply chain risk management practices and guidance.

The automotive industry is facing significant challenges from increased cybersecurity risk and adoption of AI and opportunities from rapid technological innovations. To provide assistance to the industry, NIST has started a COI for automotive cybersecurity. This webinar will introduce the members of the COI to projects and research currently active at NIST that are of interest to the community. Participants will also be informed of ways to participate in these projects and research.

The automotive industry is facing significant challenges from increased cybersecurity risk and adoption of AI and opportunities from rapid technological innovations. This webinar will be the third community of interest call. Angela Smith, technical lead for NIST’s Cybersecurity Supply Chain Risk Management (C-SCRM) will be providing an overview and status of the C-SCRM work effort, and how it’s relevant to the automotive cybersecurity community.

Federal agencies and departments are required to comply with FIPS 140-1, Security Requirements for Cryptographic Modules. This involves the acquisition of validated cryptographic modules (which may be incorporated in a product/application) for protecting sensitive but unclassified data. Cryptographic modules are used to provide security services such as confidentiality, integrity, and authentication. FIPS 140-1 provides users with 1) a specification of security features that are required at each security level, 2) flexibility in choosing security requirements and environments, and 3) a guide...

The Cryptographic Module Validation Program Symposium 2004 will be held on September 14-15, 2004 at the DoubleTree Hotel & Executive Meeting Center in Rockville, MD. NIST and the Communications Security Establishment (CSE) invite you to this event. The CMVP Symposium will include presentations and discussions on the FIPS 140-2, Security Requirements for Cryptographic Modules, supporting documents such as the Derived Test Requirements and Implementation Guidance, cryptographic algorithm testing suites, expectations, future direction, panel discussions from Federal and user agencies and...

(All presentations in .pdf format.) Federal Register Notice Announcing Meeting Minutes NIST Computer Security Division (CSD) Briefing Donna Dodson, NIST Deputy Cyber Security Advisor and Computer Security Division, Deputy Division Chief, NIST Use and Implementation of Federal IT Security Products as a Baseline Patrick Howard, CISO, HUD Brenda Abrams, IG Auditor, GSA A Practical Guide To Web 2.0, Enterprise 2.0, and Information Assurance Hart Rossman, Chief Security Technologist, SAIC Social Networks, Web 2.0, and Security Sandy Smith, Manager of Technical Development, Forum One...

To discuss challenges, tips, and techniques for implementing the requirements of the HIPAA Security Rule, with particular focus on strategies for assessing the effectiveness of implemented security controls to support compliance and audit, as well as an organization’s overarching risk management program. HIPAA 2009 Presentations All Powerpoint presentations have been converted to PDF format. Day 1 - Monday, May 18: Keynote Presentation Julie Boughn - CIO and Director, Office of Information Services (OIS), Centers for Medicare and Medicaid Services (CMS) CMS Security Compliance Review...

The HHS Office for Civil Rights (OCR) enforces the HIPAA Privacy Rule, which protects the privacy of individually identifiable health information; the HIPAA Security Rule, which sets national standards for the security of electronic protected health information; the confidentiality provisions of the Patient Safety Rule, which protect identifiable information being used to analyze patient safety events and improve patient safety; and, the Breach Notification regulations requiring HIPAA covered entities and their business associates to notify individuals when their health information is...

NIST and the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) are pleased to co-host the 7th annual conference, Safeguarding Health Information: Building Assurance through HIPAA Security, on September 23-24, 2014 at the Grand Hyatt, Washington, D.C. The conference will explore the current health information technology security landscape and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This event will highlight the present state of health information security, and practical strategies, tips and techniques for implementing the HIPAA...

Privacy is a challenging subject that spans a number of domains, including law, policy and technology. Notwithstanding numerous sets of principles, including the foundational Fair Information Practice Principles (FIPPs), that seek to address the handling of individuals' personal information, many concerns exist about the future of privacy in the face of rapidly evolving technologies. Process-oriented principles are an important component of an overall privacy framework, but on their own, they do not achieve consistent and measurable results in privacy protection. In the security field, risk...

Elliptic curve cryptography will be critical to the adoption of strong cryptography as we migrate to higher security strengths. NIST has standardized elliptic curve cryptography for digital signature algorithms in FIPS 186 and for key establishment schemes in NIST Special Publication 800-56A. In FIPS 186-2, NIST recommended 15 elliptic curves of varying security levels for use in these elliptic curve cryptography standards. The provenance of the curves was not fully specified, leading to recent public concerns that there could be a hidden weakness in these curves. We remain confident in...

NIST and the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) are pleased to co-host the 10th annual conference, Safeguarding Health Information: Building Assurance through HIPAA Security, on September 5-6, 2017 at the Hyatt Regency, Washington, D.C. The conference will explore the current healthcare cybersecurity landscape and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This event will highlight the present state of healthcare cybersecurity, and practical strategies, tips and techniques for implementing the HIPAA Security Rule....

Presentations & Speakers at a Glance: GSA’s Approach to Identifying Requirements: FISMA, FedRAMP or Controlled Unclassified Information, Pranjali Desai and Bo Berlas, GSA Growth in the NVD: API Keys, Documentation, and More!, Andrew Artz, NIST What's New in SP 800-53A, Revision 5, Jessica Dickson & Victoria Pillitteri, NIST Multi-Factor Authentication and Key Updates for NIST Special Publication 800-63, Revision 4, David Temoshok, NIST SP 800-63 and Privacy, Naomi Lefkovitz, NIST NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND...

Presentations & Speakers at a Glance: Update on NIST SP 800-63, David Temoshok, NIST VA's Cyber NexGen Developmental Program, Clarence Williams and Sharon McPherson, Department of Veterans Affairs Facilitated Discussion: Agency Use of NIST Cybersecurity Framework and NIST Risk Management Framework, Victoria Pillitteri and Katherine Schroeder, NIST Update to (Draft) NIST SP 800-50, Rev. 1: Building a Cybersecurity and Privacy Awareness and Training Program, Don Walden, IRS and Marian Merritt, NIST The Federal Cybersecurity and Privacy Professionals...

On June 6, 2023, NIST will host a webinar to provide an overview of the significant changes in NIST Special Publication (SP) 800-171, Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. This revision to NIST SP 800-171 represents over one year of data collection, technical analyses, customer interaction, redesign, and development of the security requirements and supporting information for the protection of Controlled Unclassified Information (CUI). Draft SP 800-171, Revision 3 is currently available for public comment through July 14, 2023....

"Working with encrypted data without decrypting" We have long known that encryption has some amazing properties. Those of us who don't think in terms of mathematical formulas often think of encryption as "putting a message in a secure vault, or a tamper-proof envelope, or some other such physical model". These analogies are useful, but they hide some of the magic powers of encryption. For example, it would be hard to see how we could prove to others that we know the contents of the "vault" without opening it for them and revealing at least some of the contents. Yet encryption does allow us to...

Three tracks are being designed to enable attendees to gain the maximum benefit from the NICE 2015 Conference: Track 1: Accelerate Learning and Skills Development - Invoke a sense of urgency in both the public and private sectors to address the shortage of a skilled cybersecurity workforce. Stimulate approaches and techniques that can more rapidly increase the supply of qualified cybersecurity workers Reduce the time and cost for obtaining knowledge, skills, and abilities for in demand work roles Influence employers to shape job descriptions to reflect knowledge, skills, and abilities...

Agenda Introduction and Overview 9:00 – 9:25 ET Sanjay Rekhi - NIST Kevin Stine - NIST Hardware Development Lifecycle 9:30 – 10:30 ET Jonathan Ring – Office of the National Cyber Director Adam Golodner - Semiconductor Industry Association Matt Areno – Intel Michael Ogata – NIST 10:30 – 10:45 ET Break Metrology 10:45 – 11:45 ET Lok Yan – DARPA Mark Tehranipoor – University of Florida Jason Oberg – Cycuity, Inc. Nelson Hastings – NIST 11:45 – 12:45 ET Lunch...

The purpose of the 3-day workshop is to provide a high-level tutorial of the six part standard, ISO/IEC 24727 - Identification cards – Integrated circuit card programming interfaces, a multi-part standard for interoperable identification, authentication, and signature services for credentials and applications. The workshop will also provide sessions on the use of ISO/IEC 24727 to include an overview of NIST IR 7611, Use of ISO/IEC 24727 -- Service Access Layer Interface for Identity (SALII): Support for Development and use of Interoperable Identity Credentials, which describes ISO/IEC 24727...

NIST hosted the third Lightweight Cryptography Workshop on November 4-6, 2019 to discuss candidate algorithms, including design strategies, implementations, performance, cryptanalysis, and target applications and to obtain valuable feedback from the crypto community. On-Demand Webcast Accepted Papers (papers included) Cryptography in Industrial Embedded Systems: our experience of needs and constraints Jean-Philippe Aumasson, Antony Vennard FELICS-AE: a framework to benchmark lightweight authenticated block ciphers Kevin Le Gouguec Does gate count matter? Hardware efficiency...