Search CSRC

Abstract: This National Institute of Standards and Technology Interagency Report (NISTIR) presents a risk assessment methodology developed by the U.S. Department of Energy. This NISTIR contains Volume I: DOE Risk Assessment Guideline Instructions. Resource Table, and Completed Sample and Volume II: DOE Risk A...

Conference: International Conference on Systems Integration (Systems Integration '90) Abstract: The emphasis on “open systems’’ in the past few years has led to the development of interface standards in almost all areas of computing: operating systems, data communications, graphics, programming languages, and others. While intelligent use of standards can solve many integration problems, the a...

Journal: Journal of Research of the National Institute of Standards and Technology Abstract: The National Computer Systems Laboratory (NCSL) of the National Institute of Standards and Technology (NIST) and the National Computer Security Center (NCSC) of the Department of Defense (DoD) co-sponsored the Twelfth National Computer Security Conference held in Baltimore, Maryland on October 10-13...

Abstract: NISTIR 90-4262 includes four documents dealing with key management which were developed by the National Security Agency (NSA) as output from the Secure Data Network System (SDNS) project. SDN.601, Communication Protocol Requirements for Support of the SDNS Key Management Protocol, supplies a profile...

Abstract: NISTIR 90-4259 consists of three documents developed by the National Security Agency (NSA) as output from the Secure Data Network System (SDNS) project. The Access Control Concept Document, SDN.801, describes the principles and functions underlying the SDNS access control and authentication security...

Abstract: The SP3 Protocol is one of a number of protocols defined under the United States Government SDNS (Secure Data Network System) activity. The purpose of this protocol is to provide various security services, through the use of cryptographic mechanisms. This document defines the services provided by th...

Abstract: The NIST Secure Data Network System (SDNS) project implements computer to computer communications security for distributed applications. The internationally accepted Open Systems Interconnection (OSI) computer networking architecture provides the framework for SDNS, which is a project of the Nationa...

Abstract: This guideline provides a framework for determining the training needs of employees involved with computer systems. It describes the learning objectives of agency computer security training programs. A focus on learning objectives--what the employee should know and be able to direct or actually perf...

Conference: 12th National Computer Security Conference Abstract: The Proceedings of the 12th National Computer Security Conference, "Information Systems Security: Solutions for Today--Concepts for Tomorrow," held October 10-13, 1989 in Baltimore, Maryland. It includes refereed papers and panel summaries from the conference (listed on pp. ii-ix).

Conference: 12th National Computer Security Conference (NCSC) Abstract: This paper describes a Token Based Access Control System (TBACS) developed by the Security Technology Group of the National Institute of Standards and Technology (NIST). TBACS replaces traditional password based access control systems which have often failed to prevent logins by unauthorized parties...

Abstract: This document recommends a process for selecting automated risk analysis tools. It is primarily intended for managers and those responsible for managing risks in computer and telecommunications systems. The document describes important considerations for developing selection criteria for acquiring r...

Abstract: This guide is designed to help the policy maker address a host of questions regarding the protection and safety of computer systems and data processed within your agency. It introduces information systems security concerns, outlines the management issues that must be addressed by agency policies and...

Abstract: This guide introduces information systems security concerns and outlines the issues that must be addressed by all agency managers in meeting their responsibilities to protect information systems within their organizations. It describes essential components of an effective information resource protec...

Abstract: While excellent progress has been made in computer technology, very little has been done to inform users of the vulnerability of data and information to such threats as unauthorized modification, disclosure, and destruction, either deliberate or accidental. This guide will make users aware of some o...

Journal: Software Engineering Journal Abstract: The paper describes a method for providing improved prototyping capabilities in a process control system emulation tool. The tool, the NIST Hierarchical Control System Emulator, allows concurrent execution of modules emulating both physical processes and decision processes. The concurrent modules ar...

Abstract: This document provides guidance for technical managers for the reduction of risk to their computer systems and networks from attack by computer viruses, unauthorized users, and related threats. The guidance discusses the combined use of policies, procedures, and controls to address security vulnerab...

Journal: Journal of Research of the National Institute of Standards and Technology Abstract: The National Computer Systems Laboratory (NCSL) and the National Computer Security Center (NCSC) of the Department of Defense co-sponsored the Eleventh National Computer Security Conference held in Baltimore, Maryland on October 17-20, 1988. More than 1600 attendees from government, industry, and ac...

Abstract: This is the Report of the Invitational Workshop on Integrity Policy in Computer Information Systems which was sponsored by the IEEE Computer Society's Technical Committee on Security and Privacy, the Special Interest Group on Security, Audit, and Control (SIGSAC) of the Association for Computing Mac...

Conference: DocProcess88: Conference on Document Processing Systems Abstract: The DTD editing tool is a window and icon based tool for creation, manipulation and comprehension of SGML Document Type Definitions (DTDs). This tool allows users to manipulate SGML DTDs without any knowledge of the rather complex SGML syntax. More generally, the tool allows users to manipulate cont...

Conference: 11th National Computer Security Conference Abstract: The Proceedings of the 11th National Computer Security Conference, "Computer Security...Into the Future," held October 10-17, 1988, in Baltimore, Maryland. It includes refereed papers and panel summaries from the conference (listed on pp. ii-vii of Vol. 1).

Conference: 11th National Computer Security Conference Abstract: This paper describes a suite of tools used in evaluating software for security certification. The tools are currently being used on software for secure Electronic Funds Transfer, but could be applied to other applications as well.

Journal: Communications of the ACM Abstract: The following excerpts have been gleaned from a 130-page report of potential inaccuracies and fraud in computerized voting systems. Recent difficulties in automated vote-tallying, including specific legal cases, are detailed along with a summary of conclusions and recommendations.

Abstract: Passwords are often used to authenticate a system user's identity and to grant or deny access to data. The National Bureau of Standards' recently published Password Usage Standard outlines effective password implementation and control rules. Using this standard as a guide, the EDP auditor can assess...

Abstract: A smart card is a credit-card-sized device containing one or more integrated circuit chips, which perform the functions of a microprocessor, memory, and an input/output interface. Smart cards, and other related devices, may be used to provide an increased level of security in applications requiring...

Abstract: Recommendations are provided to promote accuracy, integrity, and security in computerized vote-tallying, and to improve confidence in the results produced. The recommendations respond to identified problems, and concern software, hardware, operational procedures, and institutional changes. It is pro...