Search Results

Forum Meeting - August 29, 2023

August 29, 2023 - August 29, 2023
https://csrc.nist.gov/events/2023/forum-meeting-august-29-2023

The Federal Cybersecurity and Privacy Professionals Forum is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the sharing of system security and privacy information among federal, state, and local government, and higher education employees. The Forum maintains an extensive e-mail list and holds quarterly meetings to discuss current issues and items of interest to those responsible for protecting non-national security systems. For more information about the Forum and instructions on how to join, see: https://csrc.nist.gov/Projects/forum. A...

Building a Cybersecurity and Privacy Learning Program: NIST Releases Draft SP 800-50 Rev. 1

August 28, 2023
https://csrc.nist.gov/news/2023/nist-releases-draft-sp-800-50-rev-1

Draft NIST Special Publication (SP) 800-50r1 (Revision 1), Building a Cybersecurity and Privacy Learning Program, is now available for public comment. The comment period closes on October 27, 2023.

Combinatorial Coverage Measurement

https://csrc.nist.gov/projects/automated-combinatorial-testing-for-software/combinatorial-coverage-measurement/coverage-measurement

Latest research: Combinatorial Frequency Differencing. NIST Cybersecurity Whitepaper.- Describes measures of the frequency of combination coverage and difference between Class and Non-class elements in machine learning classification problems. Illustrates application of these methods for identifying weaknesses in physical unclonable function implementations. Combinatorial Coverage Difference Measurement. NIST Cybersecurity Whitepaper.- Introduces a variety of measures that can be applied to understanding differences in combination coverage. Also see our User Manual for the coverage...

Cybersecurity and Privacy Mapping Guide: Draft NIST IR 8477 Available for Comment

August 17, 2023
https://csrc.nist.gov/news/2023/draft-nist-ir-8477-available-for-comment

NIST has released the initial public draft (ipd) of a new report for public comment: NIST Internal Report (IR) 8477 ipd, Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines: Developing Cybersecurity and Privacy Concept Mappings.

Introducing the NIST Cybersecurity Framework 2.0 Reference Tool!

August 15, 2023
https://csrc.nist.gov/news/2023/just-released-nist-csf-2-0-reference-tool

Today, NIST is officially unveiling our new Cybersecurity Framework (CSF) 2.0 Reference Tool.

Project Description (Final)

Manufacturing Supply Chain Traceability with Blockchain Related Technology: Reference Implementation

August 14, 2023
https://csrc.nist.gov/pubs/pd/2023/08/14/manufacturing-supply-chain-traceability-with-block/final

Abstract: Manufacturing supply chains are increasingly critical to maintaining the health, security, and the economic strength of the United States. As supply chains supporting Critical Infrastructure become more complex and the origins of products become harder to discern, efforts are emerging that improve t...

NIST Releases Cybersecurity Framework 2.0 Draft & Implementation Examples

August 8, 2023
https://csrc.nist.gov/news/2023/nist-releases-cybersecurity-framework-2-0-draft

After reviewing more than a year’s worth of community feedback, NIST has released a Draft of The NIST Cybersecurity Framework (CSF) 2.0 for public comment! Please submit comments by November 6, 2023.

Conference Paper (Final)

Peering into the Phish Bowl: An Analysis of Real-World Phishing Cues

August 7, 2023
https://csrc.nist.gov/pubs/conference/2023/08/07/peering-into-the-phish-bowl-an-analysis-of-realwor/final

Conference: USENIX Symposium on Usable Privacy and Security (SOUPS) 2023 Abstract: Organizations use simulated phishing awareness training exercises to help users identify, detect, and defend against the ever-changing phishing threat landscape. Realistic phishing emails are used to test users’ ability to spot a phish from visible cues. However, there are no metrics aimed at classi...

Conference Paper (Final)

Mind the Gap: Exploring Human-Centered Security Researcher-Practitioner Interactions (Extended Abstract)

August 6, 2023
https://csrc.nist.gov/pubs/conference/2023/08/06/mind-the-gap-exploring-humancentered-security-rese/final

Conference: USENIX Symposium on Usable Privacy and Security (SOUPS) 2023 Abstract: Our work-in-progress study aims to develop an understanding of current researcher-practitioner interaction points and associated challenges throughout the entire human-centered security research life cycle.

Conference Paper (Final)

How to Scale a Phish: An Investigation into the Use of the NIST Phish Scale

August 6, 2023
https://csrc.nist.gov/pubs/conference/2023/08/06/how-to-scale-a-phish-an-investigation-into-the-use/final

Conference: USENIX Symposium on Usable Privacy and Security (SOUPS) 2023 Abstract: Organizations around the world are using the NIST Phish Scale (NPS) in their phishing awareness training programs. As a new metric for measuring human phishing detection difficulty of phishing emails, the use of the NPS by phishing training implementers across different types of organizations has no...

Conference Paper (Final)

Cybersecurity Definitions for Non-Experts

August 6, 2023
https://csrc.nist.gov/pubs/conference/2023/08/06/cybersecurity-definitions-for-nonexperts/final

Conference: USENIX Symposium on Usable Privacy and Security (SOUPS) 2023 Abstract: Despite the importance of cybersecurity, there is no standard definition nor common terminology for explaining cybersecurity. Existing definitions largely target academics or technical experts but not non-experts (those without cybersecurity proficiency). To gain a better understanding of which defi...

Conference Paper (Final)

Analyzing Cybersecurity Definitions for Non-experts

July 26, 2023
https://csrc.nist.gov/pubs/conference/2023/07/26/analyzing-cybersecurity-definitions-for-nonexperts/final

Conference: IFIP International Symposium on Human Aspects of Information Security & Assurance (HAISA 2023) Abstract: Current definitions of cybersecurity are not standardized and are often targeted towards cybersecurity experts and academics. There has been little evaluation about the appropriateness and understandability of these definitions for non-experts (individuals without cybersecurity expertise). This pose...

STPPA (series of talks) Event #6

July 25, 2023 - July 25, 2023
https://csrc.nist.gov/events/2023/stppa6

Event #6's theme: Community Efforts on Advanced Cryptographic Techniques Featured topics: FHE, MPC, ZKP, ABE, Threshold Crypto, PAKE. Structure: Welcome/introduction; 6 invited talks; panel conversation. Date and time: July 25th (Tuesday), 2023, 09:30–15:00 EDT. Location: Virtual event (video conference). Attendance: Open and free to the public, upon registration. Format: Webinar (presenters can share video and audio; attendees can use text for questions and comments). Tweet: https://twitter.com/NISTcyber/status/1678435569284812802 Schedule Welcome and introduction...

Introduction to Cybersecurity for Commercial Satellite Operations: NIST IR 8270

July 25, 2023
https://csrc.nist.gov/news/2023/cyber-for-commercial-satellite-operations

Space operations are vital to advancing the security, economic prosperity, and scientific knowledge of the Nation.

IR 8270 (Final)

Introduction to Cybersecurity for Commercial Satellite Operations

July 25, 2023
https://csrc.nist.gov/pubs/ir/8270/final

Abstract: Space is a newly emerging commercial critical infrastructure sector that is no longer the domain of only national government authorities. Space is an inherently risky environment in which to operate, so cybersecurity risks involving commercial space – including those affecting commercial satellite v...

SP 800-219 Rev. 1 (Final)

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)

July 21, 2023
https://csrc.nist.gov/pubs/sp/800/219/r1/final

Abstract: The macOS Security Compliance Project (mSCP) provides resources that system administrators, security professionals, security policy authors, information security officers, and auditors can leverage to secure and assess macOS desktop and laptop system security in an automated way. This publication in...

Papers

https://csrc.nist.gov/projects/automated-combinatorial-testing-for-software/acts-library/papers

Fundamental background papers: Empirical justification for combinatorial testing: D.R. Kuhn, D.R. Wallace, A.M. Gallo, Jr., Software Fault Interactions and Implications for Software Testing, IEEE Transactions on Software Engineering, vol. 30, no. 6, June 2004, pp. 418-421.Abstract; DOI: 10.1109/TSE.2004.24 Preprint. Comment: Investigates interaction level required to trigger faults in a large distributed database system. IPOG algorithm used in construction of covering arrays: Y.Lei, R. Kacker, D.R. Kuhn, V. Okun and J. Lawrence, IPOG: a General Strategy for T-way Software Testing, 14th...

Research

https://csrc.nist.gov/projects/measurements-for-information-security/research

These are current NIST research to identify meaningful metrics and measures in context to understand the effectiveness and resource needs of different cybersecurity technical measures. Measuring Security Risk in Enterprise Networks Methodology to measure the overall system risk by combining the attack graph structure with the Common Vulnerability Scoring System (CVSS). Cyber Risk Analytics and Measurement Research and prototype methods and tools to enable predictive risk analytics and identify cyber risk trends. Develop guidelines to improve the assessment and measurement of...

Now Available for Public Comment — Draft NIST IR 8473, Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure

July 14, 2023
https://csrc.nist.gov/news/2023/csf-profile-for-ev-xfc-infrastructure

The NCCoE has released an initial public draft of NIST Internal Report (IR) 8473, "Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure." The public comment period is open through August 28, 2023.

Conference Paper (Final)

Parents, passwords, and parenting: How parents think about passwords and are involved in their children's password practices

July 9, 2023
https://csrc.nist.gov/pubs/conference/2023/07/09/parents-passwords-and-parenting-how-parents-think/final

Conference: 5th International Conference on HCI for Cybersecurity, Privacy, and Trust (HCI-CPT 2023) Abstract: Though much is known about how adults understand and use passwords, little research attention has been paid specifically to parents or, more importantly, to how parents are involved in their children’s password practices. To better understand both the password practices of parents, as well as how pa...

Conference Paper (Final)

'They're not risky' vs 'It can ruin your whole life': How youth/parent dyads differ in their understandings of online risk

July 9, 2023
https://csrc.nist.gov/pubs/conference/2023/07/09/theyre-not-risky-vs-it-can-ruin-your-whole-life-ho/final

Conference: 15th International Conference on Social Computing and Social Media (SCSM 2023) Abstract: Encountering or engaging in risky online behavior is an inherent aspect of being an online user. In particular, youth are vulnerable to such risky behavior, making it important to know how they understand and think about this risk-taking behavior. Similarly, with parents being some of the first and...

Conference Paper (Final)

Data Guardians: Behaviors and Challenges While Caring for Others' Personal Data

July 9, 2023
https://csrc.nist.gov/pubs/conference/2023/07/09/data-guardians-behaviors-and-challenges-while-cari/final

Conference: 25th International Conference on Human-Computer Interaction Abstract: Many professional domains require the collection and use of personal data. Protecting systems and data is a major concern in these settings, making it necessary that workers who interact with personal data understand and practice good security and privacy habits. However, to date, there has been lit...

Conference Paper (Final)

Smart Home Device Loss of Support: Consumer Perspectives and Preferences

July 9, 2023
https://csrc.nist.gov/pubs/conference/2023/07/09/smart-home-device-loss-of-support-consumer-perspec/final

Conference: 5th International Conference on HCI for Cybersecurity, Privacy and Trust Abstract: Unsupported smart home devices can pose serious safety and security issues for consumers. However, unpatched and vulnerable devices may remain connected because consumers may not be alerted that their devices are no longer supported or do not understand the implications of using unsupported devices....

NICE Framework Competencies: Preparing a Job-Ready Cybersecurity Workforce

June 21, 2023
https://csrc.nist.gov/news/2023/nice-framework-competencies-nist-ir-8355

NIST Internal Report (NIST IR) 8355, NICE Framework Competencies: Preparing a Job-Ready Cybersecurity Workforce, has been published. This publication describes Competency Areas as included in the NICE Framework, providing information on how Competency Areas are defined and how they can be used.

IR 8355 (Final)

NICE Framework Competency Areas: Preparing a Job-Ready Cybersecurity Workforce

June 21, 2023
https://csrc.nist.gov/pubs/ir/8355/final

Abstract: This publication from the National Initiative for Cybersecurity Education (NICE) describes Competency Areas as included in the Workforce Framework for Cybersecurity (NICE Framework), NIST Special Publication 800-181, Revision 1, a fundamental reference for describing and sharing information about cy...

Search CSRC