Search CSRC

Conference: 12th National Computer Security Conference Abstract: The Proceedings of the 12th National Computer Security Conference, "Information Systems Security: Solutions for Today--Concepts for Tomorrow," held October 10-13, 1989 in Baltimore, Maryland. It includes refereed papers and panel summaries from the conference (listed on pp. ii-ix).

Journal: IEEE Security & Privacy Abstract: Ten years ago, we introduced a research program applying high strength combinatorial test methods to vulnerability and fault detection for cybersecurity. This article discusses advances in the field and where these methods may be effective for today’s complex security problems.

Journal: Computer (IEEE Computer) Abstract: Current multipronged cybersecurity measures require the active support and participation of users for their successful deployment. Although no formal definition of usable security exists, it is time to make it a reality for users.

Abstract: This bulletin summarizes the information presented in NIST SP 800-177, Trustworthy Email. This publication gives recommendations and guidelines for enhancing trust in email. This guideline applies to federal IT systems and will also be useful for any small or medium sized organizations.

In: Cloud Computing Security: Foundations and Challenges Abstract: This chapter discusses the essential security challenges and requirements for cloud consumers that intend to adopt cloud-based solutions for their information systems.

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-125B, "Secure Virtual Network Configuration for Virtual Machine (VM) Protection." That publication provides an analysis of various virtual network configuration options for protection of VMs and to present recomm...

Journal: Computer (IEEE Computer) Abstract: Continuous Authentication has been around but has been met with several limitations. Recent development of mobile platforms are providing relief for many of these limitations as they take advantage of multiple sensors and sufficient processing power for the user and system monitoring.

Abstract: The Standard specifies a suite of algorithms that can be used to generate a digital signature. Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signature as evidence...

Journal: IT Professional Abstract: This article explains problems and approaches to designing permission structures for role based access control. RBAC and the RBAC standard are summarized, common approaches to role engineering described, and the current status and plans for the INCITS role engineering standard are explained.

Abstract: This publication provides recommendations for improving an organization s malware incident prevention measures. It also gives extensive recommendations for enhancing an organization s existing incident response capability so that it is better prepared to handle malware incidents, particularly widesp...

Abstract: This standard specifies the architecture and technical requirements for a common identification standard for Federal employees and contractors. The overall goal is to achieve appropriate security assurance for multiple applications by efficiently verifying the claimed identity of individuals seeking...

Abstract: This ITL Bulletin discusses advances in firewall technology and outlines a number of issues involved in selecting the right kind of firewall for your organizational environment. It contains a series of recommendations for configuring and managing firewalls. The bulletin summarizes NIST Special Publi...

Abstract: This publication describes a basis for establishing principles, concepts, activities, and tasks for engineering trustworthy secure systems. Such principles, concepts, activities, and tasks can be effectively applied within systems engineering efforts to foster a common mindset to deliver security fo...

Journal: Computer (IEEE Computer) Abstract: A Deep Neural Network (DNN) based system, such as the one used for autonomous vehicle operations, is a “black box” of complex interactions resulting in a classification or prediction. An important question for any such system is how to increase the reliability of, and consequently the trust in, the...

Journal: Journal of Mathematical Cryptology Abstract: Elliptic curves are typically defined by Weierstrass equations. Given a kernel, the well-known Velu's formula shows how to explicitly write down an isogeny between Weierstrass curves. However, it is not clear how to do the same on other forms of elliptic curves without isomorphisms mapping to and fr...

Abstract: The National Institute of Standards and Technology (NIST) provides cryptographic key management guidance for defining and implementing appropriate key management procedures, using algorithms that adequately protect sensitive information, and planning ahead for possible changes in the use of cryptogr...

Abstract: This document gives recommendations and guidelines for enhancing trust in email. The primary audience includes enterprise email administrators, information security specialists and network managers. This guideline applies to federal IT systems and will also be useful for small or medium sized organi...

Abstract: This document gives recommendations and guidelines for enhancing trust in email. The primary audience includes enterprise email administrators, information security specialists and network managers. This guideline applies to federal IT systems and will also be useful for small or medium sized organi...

Abstract: The Standard specifies a suite of algorithms that can be used to generate a digital signature. Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signature as evidence...

Journal: Crosstalk (Hill AFB): the Journal of Defense Software Engineering Abstract: Pairwise testing has become a popular approach to software quality assurance because it often provides effective error detection at low cost. However, pairwise (2-way) coverage is not sufficient for assurance of mission-critical software. Combinatorial testing beyond pairwise is rarely used because...

Conference: Seventh Annual Conference on Computer Assurance Abstract: This study examines standards, draft standards, and guidelines that provide requirements for the assurance of high-integrity software. It focuses on identifying the attributes necessary in such documents for providing reasonable assurance for high-integrity software, and on identifying the relative...

Abstract: NIST provides cryptographic key management guidance for defining and implementing appropriate key-management procedures, using algorithms that adequately protect sensitive information, and planning for possible changes in the use of cryptography because of algorithm breaks or the availability of mor...

Conference: 4th Symposium on Configuration Analytics and Automation (SAFECONFIG), 2011 Abstract: This paper applies methods for analyzing fault hierarchies to the analysis of relationships among vulnerabilities in misconfigured access control rule structures. Hierarchies have been discovered previously for faults in arbitrary logic formulae, such that a test for one class of fault is guaranteed...

Conference: Selected Areas in Cryptography (SAC 2025) Abstract: HPPC is a multivariate signature scheme submitted to the NIST PQC standardization process in response to the recent call for additional signature schemes. We show that, despite some non-standard notational choices in the submission document, HPPC can be viewed as a special case of the well-studied,...

Abstract: This report contains the results of NIST s research into technologies to improve the voting process for United States citizens living overseas. It splits the overseas voting process into three stages: voter registration and ballot request, blank ballot delivery, and voted ballot return. For each sta...