Search CSRC

Abstract: The objective of NIST SP 800-53 is to provide a set of security controls that can satisfy the breadth and depth of security requirements levied on information systems and organizations and that is consistent with and complementary to other established information security standards. Revision 3 is th...

Abstract: This bulletin summarizes information about the Risk Management Framework (RMF) and points to NIST standards and guidelines that assist agencies in achieving effective security for their information technology (IT) systems. The RMF guides agencies through a series of steps, taking into account the ri...

Conference: 16th International Workshop, Fast Software Encryption (FSE 2009) Abstract: The CBC-MAC, or cipher block chaining message authentication code, is a well-known method to generate message authentication codes. Unfortunately, it is not forgery-secure over an arbitrary domain. There are several secure variants of CBC-MAC, among which OMAC (or one-key CBC-MAC) is a widely-used c...

Conference: 13th World Multi-Conference on Systemics, Cybernetics and Informatics (WMSCI 2009) Abstract: Deployment of smart cards as identity tokens (Smart ID Cards) requires the support of an enterprise system called Identity Management System (IDMS) for collection, storage, processing and distribution of personal identity credentials. Secure configuration of IDMS for this application domain (IDMS-SC...

Conference: 14th Australasian Conference on Information Security and Privacy (ACISP 2009) Abstract: This paper characterizes collision preserving padding rules and provides variants of Merkle-Damgard (MD) which are having less or no overhead costs due to length. We first show that suffix-free property of padding rule is necessary as well as sufficient to preserve the collision security of MD hash...

Abstract: The Standard specifies a suite of algorithms that can be used to generate a digital signature. Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signature as evidence...

Abstract: Many people telework (also known as telecommuting), which is the ability for an organization s employees and contractors to perform work from locations other than the organization s facilities. Teleworkers use various client devices, such as desktop and laptop computers, cell phones, and personal di...

Abstract: Many organizations employees and contractors use enterprise telework technologies to perform work from external locations. Most teleworkers use remote access technologies to interface with an organization's non-public computing resources. The nature of telework and remote access technologies permitt...

In: Wiley Handbook of Science and Technology for Homeland Security Abstract: The goal of cyber security standards is to improve the security of information technology (IT) systems, networks, and critical infrastructures. A cyber security standard defines both functional and assurance requirements within a product, system, process, or technology environment. Well-developed cy...

Journal: IT Professional Abstract: IT systems have long been at risk from vulnerable software, malicious actions, or inadvertent user errors, in addition to run-of-the-mill natural and human-made disasters. As we discussed in the last issue ( Surviving Insecure IT: Effective Patch Management, pp. 49 51), effective patch management is...

Abstract: More than 100 years ago, Lord Kelvin insightfully observed that measurement is vital to deep knowledge and understanding in physical science. During the last few decades, researchers have made various attempts to develop measures and systems of measurement for computer security with varying degrees...

Abstract: This bulletin summarizes the information that was disseminated by the National Institute of Standards and Technology (NIST) in Special Publication (SP) 800-64, Revision 2, Security Considerations in the System Development Life Cycle. This publication was developed by Richard Kissel, Kevin Stine, and...

Conference: 8th Symposium on Identity and trust on the Internet (IDtrust '09) Abstract: Public key cryptography is widely used to secure transactions over the Internet. However, advances in quantum computers threaten to undermine the security assumptions upon which currently used public key cryptographic algorithms are based. In this paper, we provide a survey of some of the public key...

Abstract: The objective of this document [SP 800-85A-1] is to provide test requirements and test assertions that could be used to validate the compliance/conformance of two PIV components PIV middleware and PIV card application with the specifications in NIST SP 800-73-2.

Conference: 2009 WRI World Congress on Computer Science and Information Engineering Abstract: While mobile handheld devices, such as cell phones and PDAs, provide productivity benefits, they also pose new risks. A vital safeguard against unauthorized access to a device s contents is authentication. This paper describes a location-based authentication mechanism that employs trusted servers ca...

Conference: IEEE Sarnoff Symposium, 2009 (SARNOFF '09) Abstract: In current networks that use EAP and AAA for authenticated admission control, such as WiFi, WiMAX, and various 3G internetworking protocols, a malicious base station can advertise false information to prospective users in an effort to manipulate network access in some way. This can result a number o...

Abstract: This bulletin summarizes information disseminated in Federal Information Processing Standard (FIPS) 180-3, Secure Hash Standard; NIST Special Publication (SP) 800-107, Recommendation for Applications Using Approved Hash Algorithms, by Quynh Dang; SP 800-106, Randomized Hashing for Digital Signatures...

Journal: IT Professional Abstract: The amount of time to protect enterprise systems against potential vulnerability continues to shrink. Enterprises need an effective patch management mechanism to survive the insecure IT environment. Effective patch management is a systematic and repeatable patch distribution process which includes e...

Abstract: This annual report covers the work conducted within the National Institute of Standards and Technology's Computer Security Division during Fiscal Year 2008. It discusses all projects and programs within the Division, staff highlights, and publications.

Abstract: This bulletin summarizes information disseminated in NIST Special Publication (SP) 800-116, A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS), written by William MacGregor of NIST, Ketan Mehta of Mehta, Inc., and David Cooper and Karen Scarfone of NIST. The pu...

Abstract: NIST-approved digital signature algorithms require the use of an approved cryptographic hash function in the generation and verification of signatures. Approved cryptographic hash functions and digital signature algorithms can be found in FIPS 180-3, Secure Hash Standard (SHS), and FIPS 186-3, Digit...

Abstract: Cryptographic hash functions that compute a fixed- length message digest from arbitrary length messages are widely used for many purposes in information security. This document provides security guidelines for achieving the required or desired security strengths when using cryptographic applications...

In: Encyclopedia of Biometrics Abstract: Common Biometric Exchange Formats Framework (CBEFF) provides a standardized set of definitions and procedures that support the interchange of biometric data in standard data structures called CBEFF biometric information records (BIRs). CBEFF permits considerable flexibility regarding BIR structures...

Abstract: This bulletin summarizes the information disseminated in NIST Special Publication (SP) 800-124, Guidelines on Cell Phone and PDA Security: Recommendations of the National Institute of Standards and Technology, which was written by Wayne Jansen and Karen Scarfone of NIST, and issued in October 2008....

Journal: IT Professional Abstract: This article introduces "insecure IT", a new department for IT Professional that will cover security weaknesses in IT systems, ranging from desktops to global e-commerce networks. This regular feature will offer ideas to improve IT security, both by looking at ways it can go wrong as well as by cove...