Search CSRC

NIST seeks public comments on Draft NIST Interagency Report (NISTIR) 8074, which comprises two volumes, "Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objectives for Cybersecurity" (Vol. 1) and "Supplemental Information" (Vol. 2).

The National Institute of Standards and Technology (NIST) announces proposed changes to Federal Information Processing Standard (FIPS) Publication 201, Standard for Personal Identity Verification of Federal Employees …

NIST has released Special Publication 800-52 Revision 1, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations. TLS provides mechanisms to protect sensitive data during electronic dissemination across networks.

NIST announces the release of an errata update to Special Publication 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach.

The initial public draft (ipd) of NIST Interagency Report (IR) 8446, Bridging the Gap between Standards on Random Number Generation: Comparison of SP 800-90 Series and AIS 20/31, is now available for public comment through December 20, 2024.

NIST is pleased to announce the public comment release of Draft Special Publication 800-116 Revision 1, A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS). ...

Draft CSWP 36C, Reallocation of Temporary Identities - Applying 5G Cybersecurity & Privacy Capabilities White Paper Series for Public Comment. The public comment period is open through December 6, 2024.

Journal: IEEE Security & Privacy Abstract: The National Initiative for Cybersecurity Education (NICE) aims to create an operational, sustainable, and continually improving program for cybersecurity awareness, education, training, and workforce development. As part of the initiative, the NICE Cybersecurity Workforce Framework aims to codify c...

NIST announces the public comment release of Draft Special Publication 800-52 Revision 2, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations. Transport Layer Security (TLS) provides.....

NIST announces the public comment release of Draft NIST Internal Report (NISTIR 8058), Security Content Automation Protocol (SCAP) Version 1.2 Content Style Guide: Best Practices for Creating and Maintaining SCAP 1.2 Content.

NIST announces the public comment release of NIST Special Publication 800-178, A Comparison of Attribute Based Access Control (ABAC) Standards for Data Services. Extensible Access Control Markup Language (XACML) ...

Abstract: This paper provides an example of how to conduct genomic data threat modeling for privacy on a data processing environment, including documenting the architecture, identifying threats, applying sample interventions, and iterating the process as needed. The paper complements the earlier NIST CSWP 35,...

Conference: Annual Computer Security Applications Conference (ACSAC) 2020 Abstract: In this work, we provide a metric to calculate the most significant software security weaknesses as defined by an aggregate metric of the frequency, exploitability, and impact of related vulnerabilities. The Common Weakness Enumeration (CWE) is a well known and used list of software security weaknes...

Draft NISTIR 8276, "Key Practices in Cyber Supply Chain Risk Management: Observations from Industry” is available for comment; the comment period closes March 4, 2020. Six new Case Studies in Cyber SCRM are also available, along with a "Summary of Findings and Recommendations."

NIST Cybersecurity White Paper (CSWP) 36B Using Hardware-Enabled Security to Ensure 5G System Platform Integrity - Applying 5G Cybersecurity and Privacy Capabilities White Paper Series is available for public comment. The deadline to submit comments to this draft document is October 30, 2024.

Abstract: This ITL Bulletin describes the recent update of NISTIR 7298, Glossary of Key Information Security Terms. NISTIR 7298, Revision 2, provides a summary glossary of terms used in NIST publications and other relevant sources.

The Secretary of Commerce has approved the withdrawal of FIPS 46-3, Data Encryption Standard (DES); FIPS 74, Guidelines for Implementing and Using the NBS Data Encryption Standard; and FIPS 81, …

Journal: IEEE Security & Privacy Abstract: We present the key themes from the workshop “ConnectCon: Minding the Gaps in Human-Centered Cybersecurity,” which can inform efforts of researchers and practitioners toward a collective goal of improving cybersecurity outcomes for all.

Journal: Computer Abstract: By fostering public–private partnerships in cybersecurity education, the U.S. government is motivating federal agencies, industry, and academia to work more closely together to defend cyberspace.

The National Institute of Standards and Technology (NIST) announces the Revised Draft Federal Information Processing Standard (FIPS) Publication 201-2, “Personal Identity Verification of Federal Employees and Contractors,” for public review and comment…

The National Institute of Standards and Technology (NIST) launched a public competition in November 2007 to develop a new cryptographic hash algorithm for standardization to augment the Government...

NIST is requesting review and comments on the existing four-volume set of SP 800-63 publications, "Digital Identity Guidelines." The public comment period ends August 10, 2020.

Conference: 2022 ACM SIGSAC Conference on Computer and Communications Security Abstract: In this work, we recover the private key material of the FrodoKEM key exchange mechanism as submitted to the NIST Post Quantum Cryptography (PQC) standardization process.The new mechanism that allows for this is a Rowhammer-assisted poisoning of the FrodoKEM Key Generation (KeyGen) process. The Rowh...

NIST's National Cybersecurity Center of Excellence (NCCoE) has finalized NISTIR 8320A, "Hardware-Enabled Security: Container Platform Security Prototype."

Journal: IEEE Security & Privacy Abstract: The authors investigated users' understanding of online security by conducting in-depth interviews to identify correct perceptions, myths, and potential misperceptions. Participants were aware of and concerned with online and computer security but lacked a complete skill set to protect their compute...