Search CSRC

Presentations & Speakers at a Glance: Keynote by Dr. Ron Ross (NIST); Updates from GAO; Presentations on Developing Security Control Overlays, Phishing, the NIST Privacy Framework and Collaboration Space. NOTE: THIS MEETING IS OPEN TO ONLY UNITED STATES FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. GOVERNMENT IDs WILL BE REQUIRED FOR MEETING ENTRANCE. The Federal Computer Security Program...

Presentations & Speakers at a Glance: Information Security Continuous Monitoring Program Assessment, Chad Baer, CISA & Victoria Yan Pillitteri, NIST; Making the Right Connections: An Overview of TIC 3.0, Sean Connelly, CISA. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group...

As part of an ongoing series of workshops on privacy engineering and risk management, NIST will host a public workshop on June 5th in Gaithersburg, Maryland on privacy risk assessments. This workshop builds off the concepts introduced in January 2017 in NIST Internal Report 8062 (An Introduction to Privacy Engineering and Risk Management in Federal Systems). Participants will discuss the function of privacy risk assessments as a prerequisite for conducting privacy risk management, and the role of privacy risk models. This discussion will assist NIST in the development of a body of guidance on...

Presentations & Speakers at a Glance: Updates from National Security Staff, GAO; Presentations from NIST, US-CERT, Dept. of Transportation, and GSA. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards and Technology (NIST) to...

Presentations & Speakers at a Glance: Keynotes by OMB; Updates from the Federal CISO Council and GAO; and Presentations by NIST, FedRAMP (GSA), Dept of Treasury, and DHS. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards and...

Presentations & Speakers at a Glance: Annual 2-Day Forum Meeting with updates from the White House National Security Council, OMB, GAO, presentations by DHS, Dept of Veterans Affairs, SEC, IRS, GSA, NOAA, OPM, and Day 2 Keynote by Dr. Ron Ross of NIST. Slides from this event are not available. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer...

Presentations & Speakers at a Glance: Derived PIV Credentials, Chris Brown, NIST; Internet of Things Security & Privacy Considerations, Suzanne Lightman, NIST; Tour of NCCoE, Susan Price; NIST. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National...

Presentations & Speakers at a Glance: Adopting a Vulnerability-based Risk Management Approach, Charles Wade, U.S. Air Force; Privacy Framework, Naomi Lefkovitz, NIST. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards and...

Presentations & Speakers at a Glance: FISMA SAOP Metrics, Charles Cutshall, OMB; and Ongoing Authorization, Kelley Dempsey, NIST & Lisa Barr, DHS. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards and Technology (NIST) to...

Presentations & Speakers at a Glance: Panel Discussion on Implementing CUI Programs featuring NIST, DOC, Millennium Challenge Corporation and Naval Information Warfare Center. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards and...

Presentations & Speakers at a Glance: Google Groups Intro & Forum Email List Migration Plans, Justin Senseney & Zak Mohamoud, NIST; Assessment & Authorization of Google Groups - Lessons Learned, John Connor & Rathini Vijayaveri, NIST; SP 800-63-3 and OMB M-04-04, Paul Grassi, NIST; NIST Crypto Transition Update, Andy Regenscheid & Lily Chen, NIST. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE...

Presentations & Speakers at a Glance: Keynotes by the Federal Privacy Council and Federal CISO Council; Returning to the Office: Privacy Risk Considerations Panel featuring Veterans Affairs, CFTC, DHS, and NIST; DOD Enterprise DevSecOps Initiative, Nicolas Chaillan, Air Force. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program...

NIST has released Draft SP 800-124 Revision 2, "Guidelines for Managing the Security of Mobile Devices in the Enterprise," for public comment. The comment period ends June 26, 2020.

Read the Code of Conduct for NIST Meetings Call for Submissions (submission deadline January 28, 2025) The initial public draft of NIST Special Publication (SP) 800-227, Recommendations for Key-Encapsulation Mechanisms, is now available for public comment. NIST recently published FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, to update its cryptographic standards with an algorithm designed to provide protection from quantum attacks. In addition, NIST will select one or two additional quantum-resistant key-encapsulation mechanisms (KEMs) for standardization. To...

Direct Digital Manufacturing (DDM) involves fabricating physical objects from a data file using computer-controlled processes with little to no human intervention. It includes Additive Manufacturing (AM), 3D printing, rapid prototyping, etcetera. The technology is advancing rapidly and has the potential to significantly change traditional manufacturing and supply chain industries, including for information and communication technologies (ICT). On February 3, 2015, the National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) Computer Security Division will...

Welcome to the Computer Forensics Tool Testing (CFTT) Project Web Site. There is a critical need in the law enforcement community to ensure the reliability of computer forensic tools. The goal of the Computer Forensic Tool Testing (CFTT) project at the National Institute of Standards and Technology (NIST) is to establish a methodology for testing computer forensic software tools by development of general tool specifications, test procedures, test criteria, test sets, and test hardware. The results provide the information necessary for toolmakers to improve tools, for users to make informed...

The following table summarizes the first several years of FIPS 140-3 development. Date Activity 2/12/2005 Federal Register Notice: Announcing Development of Federal Information Processing Standard (FIPS) 140-3, a Revision of FIPS 140-2, Security Requirements for Cryptographic Modules. 2/28/2005 Public comment period ended for new and revised requirements for FIPS 140-3. 9/26/2005-9/29/2005 Physical Security Testing Workshop 3/31/2007 NIST completed preparing the first public draft of FIPS 140-3 and began the NIST /...

Combinatorial coverage measures are used in industry for high assurance software used in critical applications. Industry examples include the following: Kuhn, D. R., Raunak, M. S., & Kacker, R. N. (2021). Combinatorial Frequency Differencing. NIST Cybersecurity Whitepaper. - Describes measures of the frequency of combination coverage and difference between Class and Non-class elements in machine learning classification problems. Illustrates application of these methods for identifying weaknesses in physical unclonable function implementations. Kuhn, D. R., Raunak, M. S., & Kacker, R. N....

The following is a list of algorithms with example values for each algorithm. This list may not always accurately reflect all Approved* algorithms. Please refer to the actual algorithm specification pages for the most accurate list of algorithms. Encryption - Block Ciphers Visit the Block Cipher Techniques Page FIPS 197 - Advanced Encryption Standard (AES) AES-AllSizes AES-128 AES-192 AES-256 SP 800-67 - Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher TDES FIPS 185 - Escrowed Encryption Standard containing the Skipjack algorithm Skipjack...

Presentations Introduction to Industry Day Workshop for FIPS 201 Personal Identity Verification For Federal Employees and Contractors Presentation on Special Publication 800-73 (SP 800-73), Integrated Circuit Card for Personal Identity Verification Jim Dray, NIST Identity Proofing, Registration and Credential Issuance Donna Dodson, NIST Biometric Data Specification on PIV Card Ramaswamy (Mouli) Chandramouli, NIST FIPS 201 Cryptography William (Tim) Polk, NIST

The field of formal methods covers a broad range of mathematically-based techniques for specifying and verifying properties of software and systems. Formal methods can be very effective for certain classes of problems, but they have gained a reputation for enormous expense. One of the greatest opportunities for cost-effective use of these methods is the union of formal methods with testing. When a formal specification can be used in generating expected test results, the cost of developing the specification can be offset by a great reduction in the otherwise high cost of producing a test...

For the most up to date macOS security recommendations, please visit the mSCP GitHub page listed below, which is supported by SP-800-219r1, Apple Security Guidance: macOS Security Compliance Project. https://github.com/usnistgov/macos_security

Quick introductions to Combinatorial Testing: Practical Applications of Combinatorial Testing, East Carolina University, March 22, 2012. Combinatorial Testing and Design of Experiments, TU Berlin, June 28, 2011. Combinatorial Testing, Institute for Defense Analyses, April 6, 2011. (approx. 2 hours) Combinatorial Testing Seminar, US Army Test & Evaluation Command, Aberdeen Proving Ground, May 17, 2010. (approx. 3 hours). Combinatorial Testing, Carnegie-Mellon University Jan 26, 2010. (approx. 60 min.) Combinatorial Testing Tutorial, National Defense Industrial Association, Reston, VA,...

This page provides resources for the OSCAL metaschema framework, which provides the modeling language and Java components used to generate and process OSCAL schemas and content across XML, Java, and YAML formats. For more information, please visit the official NIST OSCAL page. OSCAL Metaschema: An OSCAL metaschema is a format-agnostic modeling language and framework to define the data structures and models utilize metaschemas for the definition fields. Metaschema modeling language - a language developed by NIST, used to generate a schema for a corresponding information model in a...

July 15, 2024 NIST Releases SP 800-73-5 and SP 800-78-5 including comment dispositions for SP 800-73-5 (Part 1, Part 2, and Part 3) and SP 800-78-5. September 27, 2023 Personal Identity Verification (PIV) Interfaces, Cryptographic Algorithms, and Key Sizes: Drafts of SP 800-73-5 and SP 800-78-5 Available for Public Comment In January 2022, NIST revised Federal Information Processing Standard (FIPS) 201, which establishes standards for the use of Personal Identity Verification (PIV) Credentials – including the credentials on PIV Cards. NIST Special Publication (SP) 800-73-5: Parts 1–3 and...