Search CSRC

Conference: World Multi-Conference on Systemics, Cybernetics and Informatics 2011 (WMSCI 2011) Abstract: With the increasing maturity of various cloud service delivery models (Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS)) and deployment models (Private, Community, Public, Hybrid), the security risk profile of each cloud service configuration is coming i...

Abstract: This bulletin is written to assist federal departments and agencies to meet their information security training responsibilities. Determining who has significant responsibilities for information security is the crucial first step that allows an organization to focus its information security trainin...

NIST publishes NIST Internal Report (IR) 8618, Summary Report for “Cybersecurity for IoT Workshop: Future Directions”.

Conference: International Workshop on Combinatorial Testing (IWCT) 2024 Abstract: In this paper, we present an application of combinatorial security testing to the well-known anonymity network Tor. Rigorous testing of the Tor network is important to evaluate not only its functionality, but also the security it provides to its users. However, such testing efforts are facing challe...

Conference: Fifth International Workshop on Post-Quantum Cryptography (PQCrypto 2013) Abstract: Multivariate Public Key Cryptography(MPKC) has become one of a few options for security in the quantum model of computing. Though a few multivariate systems have resisted years of effort from the cryptanalytic community, many such systems have fallen to a surprisingly small pool of techniques. There...

Journal: Theoretical Computer Science Abstract: The multiplicative complexity of a Boolean function f is defined as the minimum number of binary conjunction (AND) gates required to construct a circuit representing f, when only exclusive-or, conjunction and negation gates may be used. This article explores in detail the multiplicative complexity o...

Conference: 15th Annual Computer Security Applications Conference, 1999 (ACSAC '99) Abstract: Decoupling authorization logic from application logic allows applications with fine-grain access control requirements to be independent of a particular access control policy and from factors that are used in authorization decisions as well as access control models, no matter how dynamic those polici...

Conference: 12th National Computer Security Conference (NCSC) Abstract: This paper describes a Token Based Access Control System (TBACS) developed by the Security Technology Group of the National Institute of Standards and Technology (NIST). TBACS replaces traditional password based access control systems which have often failed to prevent logins by unauthorized parties...

Journal: IEEE Transactions on Dependable and Secure Computing Abstract: Under a newly introduced setting of multi stream classification, two data streams are involved, which are referred to as source and target streams. The source stream continuously generates data instances from a certain domain with labels, while the target stream does the same task without labels fro...

Journal: Crosstalk (Hill AFB): the Journal of Defense Software Engineering Abstract: Many software testing problems involve sequences of events. The methods described in this paper were motivated by testing needs of mission critical systems that may accept multiple communication or sensor inputs and generate output to several communication links and other interfaces, where it is imp...

Conference: 2022 IEEE 29th Annual Software Technology Conference (STC) Abstract: Artificial intelligence (AI) systems are increasingly seen in many public facing applications such as self-driving land vehicles, autonomous aircraft, medical systems and financial systems. AI systems should equal or surpass human performance, but given the consequences of failure or erroneous or un...

Journal: Journal of Computer Security Abstract: Network attacks have become a major security concern for organizations worldwide. A category of network attacks that exploit the logic (security) flaws of a few widely-deployed authentication protocols has been commonly observed in recent years. Such logic-flaw-exploiting network attacks often do no...

Abstract: The Federal Cloud Strategy, February 8, 2010, outlines a federal cloud computing program that identifies program objectives aimed at accelerating the adoption of cloud computing across the federal government. NIST, along with other agencies, was tasked with a key role and specific activities in supp...

Journal: Journal of Cyber Security and Information Systems Abstract: A corpus of computer programs with known bugs is useful in determining the ability of tools to find bugs. This article describes the content of NIST's Software Assurance Reference Dataset (SARD), which is a publicly available collection of thousands of programs with known weaknesses. SARD has progra...

Conference: 2013 Proceedings of the Annual Reliability and Maintainability Symposium (RAMS'13) Abstract: In this manuscript, we present our efforts towards a framework for exposing the functionality of a mobile application through a combination of static and dynamic program analysis that attempts to explore all available execution paths including libraries. We verified our approach by testing a large n...

Journal: IEEE Wireless Communications Abstract: When enabling handover between different radio interfaces (e.g., handover from 3G to Wi-Fi), reducing network access authentication latency and securing handover related signaling messages are major challenging problems, amongst many others. The IEEE 802 LAN/MAN Standards committee has recently fini...

Conference: Photonics East '95 Abstract: Security standards help users implement adequate protection in their systems. Independent, third-party conformance testing to security standards provides those users with a metric beyond vendor affirmation in determining conformance. Independent third-party conformance testing gives manufacturers th...

Journal: Journal of the American Medical Informatics Association Abstract: Objective: To address database interoperability challenges to improve collaboration among disparate organizations.Materials and Methods: We developed a lightweight system to allow broad but well-controlled data sharing while preserving local data protection policies. We used 2 NIST-developed t...

Conference: 2017 IEEE Conference on Communications and Network Security (CNS): The Network Forensics Workshop Abstract: Business or military missions are supported by hardware and software systems. Unanticipated cyber activities occurring in supporting systems can impact such missions. In order to quantify such impact, we describe a layered graphical model as an extension of forensic investigation. Our model has thre...

Conference: International Symposium on Stabilization, Safety, and Security of Distributed Systems Abstract: Most modern electronic devices can produce a random number. However, it is difficult to see how a group of mutually distrusting entities can have confidence in any such hardware-produced stream of random numbers, since the producer could control the output to their gain. In this work, we use public...

Journal: IEEE Transactions on Software Engineering Abstract: Combinatorial testing typically considers a single input model and creates a single test set that achieves \(t\) -way coverage. This paper addresses the problem of combinatorial test generation for multiple input models with shared parameters. We formally define the problem and propose an effic...

Conference: 1st International Conference on Information Technology, 2008 (IT 2008) Abstract: This paper proposes a framework for measuring the vulnerability of individual hosts based on current and historical operational data for vulnerabilities and attacks. Previous approaches have not been scalable because they relied on complex manually constructed models, and most approaches have examin...

Conference: 52nd Annual ACM Symposium on Theory of Computing (STOC 2020) Abstract: How can two parties with competing interests carry out a fair coin flip across a quantum communication channel? This problem (quantum weak coin-flipping) was formalized more than 15 years ago, and, despite some phenomenal theoretical progress, practical quantum coin-flipping protocols with vanishing...

Conference: 16th National Computer Security Conference Abstract: Within the last year, several security protocols pertaining to the lower layers of the OSI reference model have emerged from the international standardization process. These standards offer similar, but not identical, security services for the transport, network, and data link layers. This paper att...

Journal: Measurement Abstract: Software has become increasingly ubiquitous in tools and methods used for science, engineering, medicine, commerce, and human interactions. Extensive testing is required to assure that software works correctly. Combinatorial testing is a versatile methodology which is useful in a broad range of situ...