Search CSRC

Conference: 20th National Information Systems Security Conference (NISSC '97) Abstract: One of the most challenging problems in managing large networked systems is the complexity of security administration. This is particularly true for organizations that AWeb (WWW) servers. Today, security administration is costly and prone to error because administrators usually specify access contro...

Abstract:

Abstract:

Conference: 5th Annual BSI IT Security Congress Abstract: This paper is a survey of recent activities of the legislative and executive branches of the U.S. Government (and of some joint activities of government and industry) that involve the security of the evolving information infrastructure. Over the past few years, U.S. Government organizations have exp...

Abstract:

Abstract:

Abstract: This standard specifies two challenge-response protocols by which entities in a computer system may authenticate their identities to one another. These may be used during session initiation, and at any other time that entity authentication is necessary. Depending on which protocol is implemented, ei...

Abstract:

Abstract:

Abstract: This standard specifies a Digital Signature Algorithm (DSA) which can be used to generate a digital signature. Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signa...

Conference: 19th National Information Systems Security Conference Abstract: The Proceedings of the 19th National information Systems Security Conference (NISSC), held October 22-25, 1996, in Baltimore, Maryland.

Abstract: For the security of any system to be strong, the system's owners must consider three fundamental security areas: management controls, operational controls, and technical controls. While technical controls, such as encryption, digital signatures, or firewalls, receive the most attention, inadequate o...

Abstract: As more organizations share information electronically, a common understanding of what is needed and expected in securing information technology (IT) resources is required. This document provides a baseline that organizations can use to establish and review their IT security programs. The document g...

Abstract: NIST is aware of several implementation issues that can significantly affect the security of otherwise robust cryptographic systems. This bulletin describes the implementation vulnerabilities and recommends controls to mitigate overall system risk.

Abstract: This document describes the multi-national evaluation experiment of the Trusted Mach system. This report focuses on Phase I - The Developmental Evaluation Phase. The objective is to provide an historical journal discussing the experiment, and providing insight into what has been learned and accompli...

Abstract: The Office of Management and Budget (OMB) has issued a revised comprehensive policy on computer security which provides a model and structure useful to both the public and private sectors. The policy is contained in the revised OMB Circular A-130, Appendix III, Security of Federal Automated Informat...

Abstract: Computer users are finding the Internet and the World Wide Web (or Web for short) extremely useful for browsing through information, publishing documents, and exchanging information. Web applications have become popular because of the availability of powerful personal computers (PCs) capable of high...

Abstract: The use of software in the health care industry is becoming of increasing importance. One of the major roadblocks to efficient health care is the fact that important information is distributed across many sites. These sites can be located across a significant area. The problem is to provide a unifor...

Conference: Photonics East '95 Abstract: Security standards help users implement adequate protection in their systems. Independent, third-party conformance testing to security standards provides those users with a metric beyond vendor affirmation in determining conformance. Independent third-party conformance testing gives manufacturers th...

Abstract: To build secure applications in an open systems environment, one must consider general security issues related to the human/computer interface. This bulletin discusses some of these issues including the identification of users, platforms, and hardware security.

Conference: 11th Annual Computer Security Applications Conference Abstract: The central notion of Role-Based Access Control (RBAC) is that users do not have discretionary access to enterprise objects. Instead, access permissions are administratively associated with roles, and users are administratively made members of appropriate roles. This idea greatly simplifies manageme...

Conference: First ACM Workshop on Role-Based Access Control (RBAC) Abstract: With Role Based Access Control (RBAC), each role is associated with a set of operations which a user in that role may perform. The power of RBAC as an access control mechanism is the concept that an operation may theoretically be anything. This is contrasted to other access control mechanisms where...

Abstract: This bulletin provides background information on Role-Based Access Control (RBAC), a technical means for controlling access to computer resources. While still largely in the demonstration and prototype stages of development, RBAC appears to be a promising method for controlling what information...

Abstract:

Conference: 18th National Information Systems Security Conference Abstract: The National Computer Security Center (NCSC) and the Computer Systems Laboratory (CSL) are pleased to welcome you to the Eighteenth National Information Systems Security Conference. The new conference name reminds us that information systems, not just computers, must be secure. This year's program,...