Search CSRC

Journal: International Journal of Reliability, Quality and Safety Engineering Abstract: Most complex systems today contain software, and systems failures activated by software faults can provide lessons for software development practices and software quality assurance. This paper presents an analysis of software-related failures of medical devices that caused no death or injury but led...

Abstract: This bulletin provides background information on Role-Based Access Control (RBAC), a technical means for controlling access to computer resources. While still largely in the demonstration and prototype stages of development, RBAC appears to be a promising method for controlling what information...

Abstract: The Validated Products List (formerly called the Validated Processor List) is a collection of registers describing implementations of Federal Information Processing Standards (FTPS) that have been validated for conformance to FTPS. The Validated Products List also contains information about the orga...

Abstract: The NIST Secure Data Network System (SDNS) project implements computer to computer communications security for distributed applications. The internationally accepted Open Systems Interconnection (OSI) computer networking architecture provides the framework for SDNS, which is a project of the Nationa...

Abstract: The document specifies basic security criteria for two different uses of passwords in an ADP system, (I) personal identity authentication and (2) data access authorization. It establishes the basic criteria for the design, implementation and use of a password system in those systems where passwords...

Journal: Computer (IEEE Computer) Abstract: Distributed ledger technology (DLT) offers new and unique advantages for information systems, but some of its features are not a good fit for many applications. We review the properties of DLT and show how two recently developed ideas can be used to retain its advantages while simplifying design.

Abstract: Pilots are an integral part of the National Strategy for Trusted Identities in Cyberspace (NSTIC), passed by the White House in 2011 to encourage enhanced security, privacy, interoperability, and ease of use for online transactions. This document details summaries and outcomes of NSTIC pilots; in ad...

Conference: Neuroscience 2014, the 44th Annual Meeting of the Society for Neuroscience (SfN 2014) Abstract: While measuring physiological responses is a common practice in the field of neuroscience, it is rare in the usability arena and in password usability studies, in particular. This is unfortunate, as the use of such implicit measures could complement more traditional, explicit metrics of performance...

Abstract: Forensic science provides the methodologies for understanding crime scenes. It is used for analyzing evidence, identifying suspects, and prosecuting and convicting criminals while exonerating innocent people. To maintain the integrity of the U.S. criminal justice system, the validity and reliability...

Conference: Third International Workshop on Combinatorial Testing (IWCT 2014) Abstract: This poster gives an overview of methods for estimating fault detection effectiveness of a test set based on combinatorial coverage for a class of software.

Abstract: There is a great demand from federal departments and agencies for supply chain risk management (SCRM) guidance. This document is a summary of a workshop held October 15-16, 2012 to broadly engage all stakeholders in an effort to set a foundation for NIST's future work on Information and Communicatio...

Journal: The Next Wave - The National Security Agency's Review of Emerging Technologies Abstract: This article provides an overview of the establishment of the National Initiative for Cybersecurity Education (NICE), its government structure, and it goals. Parallels are drawn between the strategic R&D thrust, Developing Scientific Foundations, described in "Trustworthy Cyberspace: Strategic P...

Journal: Finite Fields and Their Applications Abstract: Edwards curves are a new model for elliptic curves, which have attracted notice in cryptography. We give exact formulas for the number of F_q-isomorphism classes of Edwards curves and twisted Edwards curves. This answers a question recently asked by R. Farashahi and I. Shparlinski.

Journal: IT Professional Abstract: In this paper, free and open source software are discussed. Open source is an intellectual property destroyer. Nothing could be worse than this for the software business and the intellectual-property business. Microsoft has an official open source presence on the Web (www.microsoft.com/opensource),...

Journal: Computer (IEEE Computer) Abstract: The term trust has had a well understood definition for centuries. However after e-trust came along, and then cloud, where e-trust is not sufficient due to the non-touchability of a public cloud, the need to reconsider what trust means for a public cloud arises. This paper looks at the issues of thi...

Journal: IEEE Security & Privacy Abstract: This short piece is the guest editor intro for IEEE Security and Privacy Magazine for the September 2010 issue. This short piece introduces the topic and selected papers. Cyber-physical systems feature a tight combination of a system's computational and physical elements. Understanding how to assess...

Journal: IEEE Security & Privacy Abstract: This paper describes some practical administrative issues and challenges in the deployment of DNSSEC - an IETF specified suite of security measures for securing the Domain Name System (DNS). The issues covered include: (a) Choice of Cryptographic algorithms and Key Sizes (2) Roll over schemes for Cr...

Abstract: This report contains a list of selected acronyms and abbreviations for system and network security terms with their generally accepted or preferred definitions. It is intended as a resource for Federal agencies and other users of system and network security publications.

Abstract: This standard specifies the architecture and technical requirements for a common identification standard for Federal employees and contractors. The overall goal is to achieve appropriate security assurance for multiple applications by efficiently verifying the claimed identity of individuals seeking...

Abstract: This standard specifies the architecture and technical requirements for a common identification standard for Federal employees and contractors. The overall goal is to achieve appropriate security assurance for multiple applications by efficiently verifying the claimed identity of individuals seeking...

Abstract: This ITL Bulletin describes two projects in the computer forensics arena and provides guidance on the use of the products developed from them. The first project, the National Software Reference Library (NSRL), describes a database of known file "fingerprints" for use in investigations of crimes that...

Abstract: This bulletin focuses on security considerations for organizations considering Internet connections. Spurred by developments in high-speed networking technology and the National Research and Education Network (NREN), many organizations and individuals are looking at the Internet as a means for expan...

Abstract: Several United States and European documents describing criteria for specifying and evaluating the trust of computer products and systems have been written. This report reviews five of these documents and discusses the approach each one uses to provide criteria for specifying and evaluating the trus...

Abstract: High-performance computing (HPC) systems provide fundamental computing infrastructure for large-scale and complex simulations, big data analysis, and the training of artificial intelligence (AI) and machine learning (ML) models, all at exceptional speeds. Securing HPC systems is essential to safegua...

Conference: Association of Computing Machinery CHI conference on Human Factors in Computing Systems (CHI 2025) Abstract: Experts struggle with explaining cybersecurity in a language and tone appropriate for non-expert audiences. This communication gap may make it difficult for a broad and diverse audience to fully engage in cybersecurity. Fundamental forms of communication, such as definitions, can be for a means for...