Search CSRC

Conference: IEEE International Conference on Software Testing Verification and Validation Workshop (ICSTW 2020) Abstract: This short paper introduces an approach to producing explanations or justifications of decisions made by artificial intelligence and machine learning (AI/ML) systems, using methods derived from fault location in combinatorial testing. We use a conceptually simple scheme to make it easy to justify cl...

The NCCoE has released an initial public draft of NIST Special Publication (SP) 1800-42A, "Digital Identities - Mobile Driver’s License (mDL): Accelerating Development and Adoption of Digital Identity for Financial Institutions." The public comment period is open through May 8, 2026.

Journal: EAI Endorsed Transactions on Security and Safety Abstract: Today's businesses are increasingly relying on the cloud as an alternative IT solution due to its flexibility and lower cost. Compared to traditional enterprise networks, a cloud infrastructure is typically much larger and more complex. Understanding the potential security threats in such infrastruc...

Journal: IEEE Reliability Magazine Abstract: Combinatorial testing is an approach where test suites are developed by efficiently covering interactions of parameter values and configuration settings. Multiple studies over the years have shown the interesting phenomenon where almost all defects in a system originate from interactions of a few sp...

The initial public draft (IPD) of NIST Special Publication (SP) 800-171, Revision 3, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," is available for public comment and review through July 14, 2023.

Abstract: The Contingency Planning Guide for Information Technology (IT) Systems provides instructions, recommendations, and considerations for government IT contingency planning. Contingency planning refers to interim measures to recover IT services after an emergency or system disruption. Interim measures m...

Abstract: Risk Management is the process of identifying risk, assessing risk, and taking steps to reduce risk to an acceptable level. Organizations use risk assessment, the first step in the risk management methodology, to determine the extent of the potential threat, vulnerabilities, and the risk associated...

Abstract: Modern computers rely on fundamental system firmware, commonly known as the Basic Input/Output System (BIOS), to facilitate the hardware initialization process and transition control to the hypervisor or operating system. Unauthorized modification of BIOS firmware by malicious software constitutes a...

Abstract:

Abstract:

Abstract: Most recent cybersecurity breaches have involved compromised credentials. Migrating from single-factor to multi-factor authentication (MFA) reduces the risk of compromised credentials and unauthorized access. Both criminal and noncriminal justice agencies need to access criminal justice information...

Journal: Journal of Combinatorics and Number Theory Abstract: R. Feng and H.Wu recently established a certain mean-value formula for the coordinates of the n-division points on an elliptic curve given inWeierstrass form (A mean value formula for elliptic curves, 2010, available at http://eprint.iacr.org/2009/586.pdf). We prove a similar result for the x and y-...

Conference: 36th International Symposium on Symbolic and Algebraic Computation (ISSAC '11) Abstract: In this paper we find division polynomials for Jacobi quartics. These curves are an alternate model for elliptic curves to the more common Weierstrass equation. Division polynomials for Weierstrass curves are well known, and the division polynomials we find are analogues for Jacobi quartics. Using t...

Conference: 2012 Annual Computer Security Applications Conference (ACSAC 2012) Abstract: Ontology for Modeling Enterprise Level Security Risk using RDF (Resource Description Framework) and OWL (Web Ontology Language). Knowledge of threats and corresponding countermeasures is integrated into this ontology framework. This ontology was applied to a test network for image management applic...

In: The Analysis, Communication, and Perception of Risk Abstract: For the past few years, the National Institute of Standards and Technology (NIST; formerly the National Bureau of Standards) and the National Security Agency (NSA) have been jointly developing a framework for computer security risk management. The need for this framework became increasingly apparent...

Conference: 2008 IEEE/IFIP International Symposium on Trust, Security and Privacy for Pervasive Applications (TSP-08) Abstract: To formally and precisely capture the security properties that access control should adhere to, access control models are usually written to bridge the rather wide gap in abstraction between policies and mechanisms. In this paper, we propose a new general approach for property verification for acces...

NIST's Crypto Publication Review Board invites comments on Special Publication (SP) 800-52 Revision 2, "Guidelines for the Selection, Configuration, and Use of TLS Implementations." The comment period is open through July 10, 2026.

Conference: 2021 Annual Modeling and Simulation Conference (ANNSIM) Abstract: Proper validation of a simulation model is essential for confidence in its accuracy and credibility. However, many of the most effective approaches for simulation validation require access to data that may be unavailable. Metamorphic Testing (MT), an approach from traditional software testing, has b...

Conference: First International Workshop on Combinatorial Testing (CT 2012) Abstract: Many software testing problems involve sequences. This paper presents an application of combinatorial methods to testing problems for which it is important to test multiple configurations, but also to test the order in which events occur. For example, the methods described in this paper were motivat...

The latest ACPT version includes Separation of Duty (SoD) specification for security requirements, improved Combinatorial Test suite generation that select all AC elements as variables, and improved UI for the hierarchy setting of subject. This version also fixed some bugs found from last version.

Journal: IEEE Transactions on Computers Abstract: We develop a new and simple way to describe Karatsuba-like algorithms for multiplication of polynomials over F2. We restrict the search of small circuits to a class of circuits we call symmetric bilinear. These are circuits in which AND gates only compute functions of the form ∑i∈Sai⋅∑i∈Sb...

Conference: Ninth IFIP WG 11.9 International Conference on Digital Forensics Abstract: Evidence Graphs model network intrusion evidence and their dependencies, which helps network forensics analysts collate and visualize dependencies. In particular, probabilistic evidence graph provide a way to link probabilities associated with different attack paths with available evidence. Existing...

NIST has posted Draft NIST SP 800-161 Rev. 1, "Cyber Supply Chain Risk Management Practices for Systems and Organizations." The public comment period is open through June 14, 2021.

Conference: 10th International Workshop on Socio-technical Aspects in Security (STAST 2020) Abstract: Smart home device updates are important tools for users to remediate security vulnerabilities and protect devices from future attacks. However, no prior research has been conducted to understand smart home users' perceptions of and experiences with updates. To address this gap, we conducted an in-de...

Conference: 7th International Workshop on Post-Quantum Cryptography (PQCrypto 2016) Abstract: ZHFE, designed by Porras et al., is one of the few promising candidates for a multivariate public-key encryption algorithm. In this article we extend and expound upon the existing security analysis on this scheme. We prove security against differential adversaries, complementing a more accurate and...