Search CSRC

Conference: 4th International Conference on Research in Security Standardisation (SSR 2018) Abstract: We discuss the development of a new format for beacons—servers which provide a sequence of digitally signed and hash-chained public random numbers on a fixed schedule. Users of beacons rely on the trustworthiness of the beacon operators. We consider several possible attacks on the users by the beaco...

Abstract: While a physical asset management system can tell you the location of a computer, it cannot answer questions like, “What operating systems are our laptops running?” and “Which devices are vulnerable to the latest threat?” An effective IT asset management (ITAM) solution can tie together physical and...

Conference: 2017 IEEE International Conference on Software Quality Reliability and Security (QRS-C 2017) Abstract: Computer security has been a subject of serious study for at least 40 years, and a steady stream of innovations has improved our ability to protect networks and applications. But attackers have adapted and changed methods over the years as well. Where do we stand today in the battle between attacker...

Abstract: Enterprises rely upon strong access control mechanisms to ensure that corporate resources (e.g. applications, networks, systems and data) are not exposed to anyone other than an authorized user. As business requirements change, enterprises need highly flexible access control mechanisms that can adap...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-82, Guide to Industrial Control Systems Security: Recommendations of the National Institute of Standards and Technology. The publication was written by Keith Stouffer and by Joe Falco of NIST, and by Karen Scarfo...

Abstract: This glossary of key information security terms has been extracted from NIST Federal Information Processing Standards (FIPS), Special Publication (SP) 800 series, NIST Interagency Report (NIST IR) series, and the Committee for National Security Systems Instruction (CNSSI) 4009 (Information Assurance...

In: Abstract: This newly revised edition of "Role-Based Access Control" offers the latest details on a security model aimed at reducing the cost and complexity of security administration for large networked applications. The second edition provides more comprehensive and updated coverage of access control models,...

NIST has released Special Publication (SP) 800-232, Ascon-Based Lightweight Cryptography Standards for Constrained Devices: Authenticated Encryption, Hash, and Extendable Output Functions.

NIST Cybersecurity White Paper (CSWP) 31, Proxy Validation and Verification for Critical AI Systems: A Proxy Design Process has been published.

Today, NIST is releasing Special Publication (SP) 800-218A, Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile.

Journal: ACM Journal on Autonomous Transportation Systems Abstract: The viability of automated driving is heavily dependent on the performance of perception systems to deliver real-time, accurate, and reliable information for robust decision-making and vehicle maneuvers. These systems must perform reliably not only under ideal conditions but also when challenged by...

Abstract: Threats of destructive malware, malicious insider activity, and even honest mistakes create the imperative for organizations to be able to quickly recover from an event that alters or destroys any form of data (database records, system files, configurations, user files, application code, etc.). Orga...

The NCCoE has released Draft NISTIR 8269, "A Taxonomy and Terminology of Adversarial Machine Learning," for public comment. Comments are due by January 30, 2020.

The NCCoE has released Draft SP 1800-16, "Securing Web Transactions: Transport Layer Security (TLS) Server Certificate Management," for public comment. The comment period ends September 13, 2019.

Abstract: The Computer Security Division of NIST/ITL supports the development of biometric conformance testing methodology standards and other conformity assessment efforts through active technical participation in the development of these standards and the associated conformance test architectures and test s...

Abstract: The Cryptographic Module Validation Program (CMVP) validates third-party assertions that cryptographic module implementations satisfy the requirements of Federal Information Processing Standards (FIPS) Publication 140-3, Security Requirements for Cryptographic Modules. Historically, t...

Abstract: Product integrity and the ability to distinguish trustworthy products is a critical foundation of cyber supply chain risk management (C-SCRM). Authoritative information regarding the provenance and integrity of the components provides a strong basis for trust in a computing device, whether it is a c...

Conference: NDSS Symposium 2017 Abstract: Online security experiences, perceptions, and behaviors are key to understanding users security practices. Users express that they are concerned about online security, but they also express frustration in navigating the often confusing and mentally taxing cybersecurity world. Thi...

Conference: 2015 Annual Meeting of the Human Factors and Ergonomics Society Abstract: Passwords are tightly interwoven with the digital fabric of our current society. Unfortunately, passwords that provide better security generally tend to be more complex, both in length and composition. Complex passwords are problematic both cognitively and motorically, leading to both memory and mot...

Conference: 8th International Conference on Universal Access in Human-Computer Interaction (UAHCI 2014) Abstract: Social media has become a mainstream activity where people share all kinds of personal and intimate details about their lives. These social networking sites (SNS) allow users to conveniently authenticate to the third-party website by using their SNS credentials, thus eliminating the need of creating...

Conference: Third ACM Workshop on Role-Based Access Control (RBAC '98) Abstract: Role based access control (RBAC) is attracting increasing attention as a security mechanism for both commercial and many military systems. This paper shows how RBAC can be implemented using the mechanisms available on traditional multi-level security systems that implement information flow policies....

Abstract: This bulletin summarizes information disseminated in Federal Information Processing Standard (FIPS) 180-3, Secure Hash Standard; NIST Special Publication (SP) 800-107, Recommendation for Applications Using Approved Hash Algorithms, by Quynh Dang; SP 800-106, Randomized Hashing for Digital Signatures...

NIST requests information about the level of awareness throughout critical infrastructure organizations, and initial experiences with the Framework for Improving Critical Infrastructure Cybersecurity (the “Framework”).

NIST announces the release of Draft Special Publication 800-63-2, Electronic Authentication Guideline for public review and comment. This recommendation provides technical guidelines for Federal agencies implementing electronic ...

The NIST NCCoE has published the final version of NIST Internal Report (NIST IR) 8473, Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure.