Search CSRC

Abstract: The use of mobile handheld devices, such as Personal Digital Assistants (PDAs) and tablet computers, within the workplace is expanding rapidly. These devices are no longer viewed as coveted gadgets for early technology adopters, but instead have become indispensable tools that offer competitive busi...

Abstract: This ITL Bulletin summarizes NIST Special Publication (SP) 800-48, Wireless Network Security, 802.11, Bluetooth, and Handheld Devices. Written by Tom Karygiannis and Les Owens. NIST SP 800-48 provides recommendations to improve the security of wireless networks. It discusses three aspects of wireles...

Abstract: This ITL Bulletin summarizes Special Publication (SP) 800-47, Security Guide for Interconnecting Information Technology Systems. That publication provides guidance for planning, establishing, maintaining, and terminating secure yet cost-effective interconnections between IT systems that are owned an...

Abstract: The Automated Security Self-Evaluation Tool (ASSET) automates the process of completing a system self-assessment. ASSET will assist organizations in completing the self-assessment questionnaire contained in NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Sy...

Abstract: The Automated Security Self-Evaluation Tool (ASSET) automates the process of completing a system self-assessment. ASSET will assist organizations in completing the self-assessment questionnaire contained in NIST Special Publication (Special Publication) 800-26, Security Self-Assessment Guide for Inf...

In: Abstract: Over the past decade, interest in role-based access control (RBAC) has increased dramatically, with most major information technology (IT) vendors offering a product that incorporates some form of role-based access. The profusion of new RBAC products offers many advantages for security administrator...

Abstract: This ITL Bulletin summarizes NIST Special Publication (SP) 800-45, Guidelines on Electronic Mail Security, September 2002, by Miles Tracy, Wayne Jansen, and Scott Bisker, which helps federal agencies improve the secure design, implementation, and operation of their electronic mail servers and client...

Abstract: This ITL Bulletin summarizes NIST Special Publication 800-44, Guidelines on Securing Public Web Servers.

Conference: 27th Annual NASA Goddard/IEEE Software Engineering Workshop (SEW ’02) Abstract: Approaches to software testing based on methods from the field of design of experiments have been advocated as a means of providing high coverage at relatively low cost. Tools to generate all pairs, or higher n-degree combinations, of input values have been developed and demonstrated in a few applic...

Abstract: This Federal Information Processing Standard (140-2) specifies the security requirements that will be satisfied by a cryptographic module, providing four increasing, qualitative levels intended to cover a wide range of potential applications and environments. The areas covered, related to the secure...

Abstract: The National Institute of Standards and Technology (NIST), Information Technology Laboratory, Computer Security Division, has developed this S/MIME (Secure / Multipurpose Internet Mail Extensions) client profile as guidance in the development and procurement of commercial-off-the-shelf (COTS) S/MIME...

Abstract: The purpose of this document is to provide agencies with guidance for establishing secure wireless networks. Agencies are encouraged to tailor the recommended guidelines and solutions to meet their specific security or business requirements. However, NIST recommendations are not intended to supersed...

Abstract: The document is intended to assist the users and system administrators of Windows 2000 Professional systems in configuring their hosts by providing configuration templates and security checklists. The guide provides detailed information about the security features of Win2K Pro, security configuratio...

Abstract: This bulletin summarizes NIST SP 800-46, Security for Telecommuting and Broadband Communications, published September 2002. The report discusses both technical and policy issues, and provides guidance on using personal firewalls, strengthening the security of personal computers and web browsers, pro...

Abstract: Web servers maintained for public use are normally the most targeted and attacked hosts on an organization's network. Thus, it is essential to secure Web servers and the network infrastructure that supports them. This document has been developed to assist federal departments and agencies, state agen...

Abstract: Today more than ever, timely response to vulnerabilities is critical to maintain the operational availability, confidentiality, and integrity of information technology (IT) systems. To assist federal agencies and industry respond to vulnerabilities in a timely manner, ITL recently released two new p...

Abstract: Electronic mail (email) is perhaps the most popularly used system for exchanging information over the Internet. After Web servers, mail servers are often the most targeted and attacked hosts on an organization's network. Various types of mail content and attachments have also proven to be effective...

Abstract: A comprehensive toolkit of cryptographic standards and associated guideline that covers a wide range of cryptographic technology is currently under development by the Computer Security Division at NIST. These standards and guidelines will enable U.S. Government agencies to select cryptographic secur...

Abstract: The Common Vulnerabilities and Exposures (CVE) vulnerability naming scheme is a dictionary of common names for publicly known information technology (IT) system vulnerabilities. It is an emerging industry standard that has achieved wide acceptance by the security industry and a number of government...

Abstract: The Security Guide for Interconnecting Information Technology Systems provides guidance for planning, establishing, maintaining, and terminating interconnections between information technology (IT) systems that are owned and operated by different organizations. They are consistent with the requireme...

Abstract: This standard specifies four secure hash algorithms, SHA-1, SHA-256, SHA-384, and SHA-512. All four of the algorithms are iterative, one-way hash functions that can process a message to produce a condensed representation called a message digest. These algorithms enable the determination of a message...

Abstract: Timely patching is critical to maintain the operational availability, confidentiality, and integrity of IT systems. However, failure to keep operating system and application software patched is the most common mistake made by information technology (IT) professionals. To help address this growing pr...

Abstract: This document introduces broadband communication technologies, and the security considerations associated with them. It discusses the use of a personal firewall, which is essential in protecting a home computer from intrusion; provides instructions on how to configure PCs and web browsers for added...

Abstract: This Government Smart Card Interoperability Specification (GSC-IS) provides solutions to a number of the interoperability problems associated with smart card technology. The original version of the GSC-IS (version 1.0) was developed by the GSC Interoperability Committee led by the General Services A...

Abstract: Risk Management is the process of identifying risk, assessing risk, and taking steps to reduce risk to an acceptable level. Organizations use risk assessment, the first step in the risk management methodology, to determine the extent of the potential threat, vulnerabilities, and the risk associated...