Search Results

IR 8379 (Final)

Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance

September 9, 2021
https://csrc.nist.gov/pubs/ir/8379/final

Abstract: This report summarizes the feedback received on the work of the NIST Cybersecurity for IoT program on device cybersecurity at a virtual workshop conducted April 22, 2021. NIST conducted the “Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance” to discuss and gather community in...

Ransomware Risk Management: Draft NISTIR 8374 Available for Comment

September 8, 2021
https://csrc.nist.gov/news/2021/draft-nistir-8374-ransomware-risk-management

The public comment period for Draft NISTIR 8374, "Ransomware Risk Management," is open through October 8, 2021

Prioritizing Cybersecurity Risk for Enterprise Risk Management: Draft NISTIR 8286B Available for Comment

September 1, 2021
https://csrc.nist.gov/news/2021/draft-nistir-8286b-prioritizing-cyber-risk-for-erm

The public comment period for Draft NISTIR 8286B, "Prioritizing Cybersecurity Risk for Enterprise Risk Management," is open through October 15, 2021.

Validating the Integrity of Computing Devices: Preliminary Draft of SP 1800-34B Available for Comment

August 31, 2021
https://csrc.nist.gov/news/2021/prelim-draft-sp-1800-34-volume-b

The NCCoE has released a preliminary draft of NIST Special Publication (SP) 1800-34 Volume B, and the comment period is open through September 29, 2021.

Mitigating Cybersecurity Risk in Telehealth Smart Home Integration: Draft Project Description Available for Comment

August 31, 2021
https://csrc.nist.gov/news/2021/draft-mitigating-cyber-risk-telehealth-smart-home

The NCCoE has released a Draft Project Description on "Mitigating Cybersecurity Risk in Telehealth Smart Home Integration." The public comment period is open through October 4, 2021.

IoT Non-Technical Supporting Capability Core Baseline: NISTIR 8259B

August 25, 2021
https://csrc.nist.gov/news/2021/iot-non-tech-supporting-capability-core-baseline

NIST has published NISTIR 8259B, "IoT Non-Technical Supporting Capability Core Baseline," to complement the technical abilities defined in NISTIR 8259A, "Core Device Cybersecurity Capability Baseline."

Mobile Application Single Sign-On for First Responders: NIST SP 1800-13

August 25, 2021
https://csrc.nist.gov/news/2021/mobile-application-single-sign-on-first-responders

NIST Special Publication (SP) 1800-13, "Mobile Application Single Sign-On: Improving Authentication for Public Safety First Responders," is now available.

IR 8259B (Final)

IoT Non-Technical Supporting Capability Core Baseline

August 25, 2021
https://csrc.nist.gov/pubs/ir/8259/b/final

Abstract: Non-technical supporting capabilities are actions a manufacturer or third-party organization performs in support of the cybersecurity of an IoT device. This publication defines an Internet of Things (IoT) device manufacturers’ non-technical supporting capability core baseline, which is a set of non-...

IR 8170 (Final)

Approaches for Federal Agencies to Use the Cybersecurity Framework

August 17, 2021
https://csrc.nist.gov/pubs/ir/8170/upd1/final

Abstract: The document highlights examples for implementing the Framework for Improving Critical Infrastructure Cybersecurity (known as the Cybersecurity Framework) in a manner that complements the use of other NIST security and privacy risk management standards, guidelines, and practices. These examples incl...

Conference Paper (Final)

It's the Company, the Government, You and I: User Perceptions of Responsibility for Smart Home Privacy and Security

August 11, 2021
https://csrc.nist.gov/pubs/conference/2021/08/11/perceptions-of-responsibility-smart-home-privacy-a/final

Conference: 30th USENIX Security Symposium Abstract: Smart home technology exposes adopters to increased risk to network security, information privacy, and physical safety. However, users may lack understanding of the privacy and security implications. Additionally, manufacturers often fail to provide transparency and configuration options, and few go...

SP 1271 (Final)

Getting Started with the NIST Cybersecurity Framework: A Quick Start Guide

August 6, 2021
https://csrc.nist.gov/pubs/sp/1271/final

Abstract: This document intends to provide direction and guidance to those organizations – in any sector or community – seeking to improve cybersecurity risk management via utilization of the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework or the Framework). Cyberse...

Planning for a Zero Trust Architecture: Draft Cybersecurity White Paper Available for Comment

August 4, 2021
https://csrc.nist.gov/news/2021/planning-for-a-zero-trust-architecture-draft-cyber

A new draft NIST Cybersecurity White Paper on "Planning for a Zero Trust Architecture" is available for comment through September 3, 2021.

Migration to Post-Quantum Cryptography: Project Description Released

August 4, 2021
https://csrc.nist.gov/news/2021/migration-to-post-quantum-cryptography-proj-desc

The National Cybersecurity Center of Excellence has released a final project description for "Migration to Post-Quantum Cryptography."

Project Description (Final)

Migration to Post-Quantum Cryptography

August 4, 2021
https://csrc.nist.gov/pubs/pd/2021/08/04/migration-to-postquantum-cryptography/final

Abstract: The NIST National Cybersecurity Center of Excellence (NCCoE) is initiating the development of practices to ease the migration from the current set of public-key cryptographic algorithms to replacement algorithms that are resistant to quantum computer-based attacks. These practices will take the form...

Conference Paper (Final)

Exploring Government Security Awareness Programs: A Mixed-Methods Approach

August 3, 2021
https://csrc.nist.gov/pubs/conference/2021/08/03/exploring-government-security-awareness-programs-a/final

Conference: 7th Workshop on Security Information Workers (WSIW 2021) Abstract: Organizational security awareness programs are often underfunded and rely on part-time security awareness professionals who may lack sufficient background, skills, or resources necessary to manage an effective and engaging program. U.S. government organizations, in particular, face challenges due to...

Data Classification Practices: Final Project Description Released

July 22, 2021
https://csrc.nist.gov/news/2021/data-classification-practices-final-pd

NIST's National Cybersecurity Center of Excellence has released a final Project Description on data classification practices.

Project Description (Final)

Data Classification Practices: Facilitating Data-Centric Security Management

July 22, 2021
https://csrc.nist.gov/pubs/pd/2021/07/22/data-classification-practices-datacentric-security/final

Abstract: As part of a zero trust approach, data-centric security management aims to enhance protection of information (data) regardless of where the data resides or who it is shared with. Data-centric security management necessarily depends on organizations knowing what data they have, what its cha...

Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management: 2nd Public Draft of NISTIR 8286A Available for Comment

July 6, 2021
https://csrc.nist.gov/news/2021/identifying-estimating-cybersecurity-risk-for-erm

A second public draft of NISTIR 8286A is available: "Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management." The comment period is open through August 6, 2021.

Journal Article (Final)

Cybersecurity Advocates: Force Multipliers in Security Behavior Change

July 5, 2021
https://csrc.nist.gov/pubs/journal/2021/07/cybersecurity-advocates-force-multipliers-in-secur/final

Journal: IEEE Security & Privacy Abstract: Cybersecurity advocates motivate individuals and organizations to adopt positive security behaviors. Based on our research, we describe qualities of successful advocates. Our findings have practical implications for expanding the cybersecurity workforce by recruiting and developing professionals who...

Conference Paper (Final)

Scaling the Phish: Advancing the NIST Phish Scale

July 3, 2021
https://csrc.nist.gov/pubs/conference/2021/07/03/scaling-the-phish-advancing-the-nist-phish-scale/final

Conference: Human Computer Interaction International 2021 Abstract: Organizations use phishing training exercises to help employees defend against the phishing threats that get through automatic email filters, reducing potential compromise of information security and privacy for both the individual and their organization. These exercises use fake and realistic phish...

Automation of the Cryptographic Module Validation Program (CMVP): Final Project Description Released

July 1, 2021
https://csrc.nist.gov/news/2021/automation-of-the-cmvp-final-project-description

NIST's National Cybersecurity Center of Excellence has released a final Project Description for "Automation of the Cryptographic Module Validation Program (CMVP)."

Introduction to Cybersecurity for Commercial Satellite Operations: Draft NISTIR 8270 Available for Comment

June 30, 2021
https://csrc.nist.gov/news/2021/intro-to-cyber-for-commercial-satellite-operations

NIST has released Draft NISTIR 8270, "Introduction to Cybersecurity for Commercial Satellite Operations." The public comment period is open through August 13, 2021.

Combinatorial Coverage Difference Measurement: Draft White Paper Available

June 22, 2021
https://csrc.nist.gov/news/2021/combinatorial-coverage-difference-measurement-drft

A draft NIST Cybersecurity White Paper, "Combinatorial Coverage Difference Measurement," is now available. The public comment period is open through August 20, 2021.

Hardware-Enabled Security for Containers: NISTIR 8320A Published

June 17, 2021
https://csrc.nist.gov/news/2021/hardware-enabled-security-containers-nistir-8320a

NIST's National Cybersecurity Center of Excellence (NCCoE) has finalized NISTIR 8320A, "Hardware-Enabled Security: Container Platform Security Prototype."

IR 8320A (Final)

Hardware-Enabled Security: Container Platform Security Prototype

June 17, 2021
https://csrc.nist.gov/pubs/ir/8320/a/final

Abstract: In today’s cloud data centers and edge computing, attack surfaces have significantly increased, hacking has become industrialized, and most security control implementations are not coherent or consistent. The foundation of any data center or edge computing security strategy should be securing the pl...

Search CSRC