Search CSRC

Validation Number: 133 Vendor: SAINT Corporation Product Name: SAINT Security Suite Product Major Version: 8 Product Version Tested: 8.7.0 (build 70206.432.2.13.2) Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures...

Validation Number: 132 Vendor: BMC Software Product Name: BMC Server Automation Product Major Version: 8.6 Product Version Tested: 8.6.00.197 Tested Platforms: Microsoft Windows 7, 64 bit Red Hat Enterprise Linux 5, 64 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Open Checklist Interactive Language (OCIL) Validated Product Vendor Provided SCAP Information Dates Tested: 10/21/2014 - 12/15/2014...

Validation Number: 131 Vendor: IBM Product Name: IBM Endpoint Manager Product Major Version: 9 Product Version Tested: 9.1.1117.0 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Validated Product Vendor Provided SCAP Information Dates Tested: 9/4/2014 - 10/3/2014 Report Submitted: 10/3/2014 DTR Version: NISTIR 7511 Rev. 3 Validation Test Suite:...

Validation Number: 130 Vendor: BMC Software Product Name: BMC Client Management Product Major Version: 12.0.0 Product Version Tested: 12.0.0 Build 140901c Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE)...

Validation Number: 129 Vendor: McAfee Product Name: Policy Auditor Product Major Version: 6.2 Product Version Tested: 6.2.0.231 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor...

Validation Number: 128 Vendor: Red Hat®, Inc. Product Name: OpenSCAP Product Major Version: 1.0 Product Version Tested: 1.0.8-1.el5_10 Tested Platforms: Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor Provided SCAP Information Dates Tested: 1/1/2013 - 4/1/2014 Report Submitted: 4/17/2014 DTR Version:...

Validation Number: 127 Vendor: Center for Internet Security Product Name: CIS-CAT Pro Assessor (formerly Configuration Assessment Tool (CIS-CAT)) Product Major Version: 3 Product Version Tested: 3.0.00 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner...

Validation Number: 126 Vendor: Tripwire Product Name: Tripwire Enterprise Product Major Version: 8 Product Version Tested: 8.3.2 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor Provided SCAP Information Dates Tested: 4/1/2013 - 11/4/2013...

Authentication mechanisms such as passwords and multi-factor authentication methods (e.g., smart cards and tokens) provide examples of the challenges involved in creating usable cybersecurity solutions. Our research explores the usage and usability of authentication mechanisms. We focus on how these mechanisms can be improved to aid in their correct, secure employment by different user populations while avoiding user frustration and circumvention. Also see our Youth Security & Privacy research area for publications related to youth passwords.   Publications Digital Identity Guidelines...

Although cryptography is an essential component of modern computing, implementing cryptography correctly is a non-trivial undertaking, often resulting in developers making errors and introducing vulnerabilities into their cryptographic products. Our cryptographic research is concerned with creating a baseline understanding of the practices and challenges of organizations that are developing products that use cryptography. This new understanding can help improve the assurance of cryptographic tools and the usability of cryptographic resources, such as standards and libraries.   Publications...

People and organizations often fail to adopt and effectively use cybersecurity best practices and technologies for a variety of reasons, including lack of knowledge/skills. Those professionals tasked with educating others may likewise face a number of challenges, including lack of resources, support, and skills needed to be effective security communicators. We conduct research to better understand the approaches and challenges with cybersecurity awareness and role-based training through the eyes of training professionals within the U.S. government. In the recent past, we also explored...

Internet of Things (IoT) technology is becoming more pervasive in the home environment. These technologies are increasingly used by non-technical users who have little understanding of the technologies or awareness of the security and privacy implications of use. We conduct research to help improve consumers' security and privacy experiences and outcomes when using IoT, with a specific focus on smart home devices.   Publications IoT Cybersecurity Labels Papers Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products  - National Institute of...

Short URL: https://csrc.nist.gov/phishing Phishing continues to be an escalating cyber threat facing organizations of all types and sizes, including industry, academia, and government. Our team performs research to understand phishing within an operational (real-world) context by examining user behaviors during phishing awareness training exercises. Our projects provide insights into users’ rationale and role in early detection, and how these might be scaffolded with technological solutions. Recent efforts have focused on the NIST Phish Scale, a method for rating the human detection...

We conduct research with an end goal of improving the usability of privacy mechanisms so that people are better able to protect their sensitive information online. Privacy is often integrated into our other research areas (also see Internet of Things, User Perceptions & Behaviors, Youth Security & Privacy).   Publications Differential Privacy Videos What is differential privacy?  (2018) Privacy Behaviors and Events Papers Non-breach Privacy Events  - Simson L Garfinkel & Mary Theofanos. IEEE Security & Privacy (2018) Preserving Privacy – More Than Reading a Message  -...

Understanding user perceptions and behavior is critical to achieving security objectives. People are repeatedly bombarded with messages about the dangers lurking on the Internet and are encouraged (or forced) to take numerous security-related actions, often without a clear understanding of why and to what end. We conduct research to discover people’s security and privacy perceptions, attitudes, and behaviors with a goal of developing cybersecurity guidance that: 1) takes into account user needs, skills, and limitations and 2) helps people make sound security decisions. Recent projects include...

The overlays listed are based on security and privacy controls included in the current revision of NIST SP 800-53. Supply Chain Overlay Name:  NIST SP 800-161, Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations Overlay Publication Date: May 2022 Technology or System: Cyber Supply Chain Overlay Author: Jon Boyens (NIST), Angela Smith (NIST), Nadya Bartol (BCG), Kris Winkler (BCG), Alex Holbrook (BCG), Matthew Fallon (BCG) Overview: Identification and augmentation of cybersecurity supply chain risk management (C-SCRM)-related controls in SP...

Overlay Submission Documents  All documents must be complete and submitted to [email protected] for inclusion in the SCOR.  Download All Files Download all files below as .ZIP or select individual files from list Submission Form Participation Agreement (Public Org) and Participation Agreement (Federal Gov) Overlay Technical Criteria  (Not a download; references section below)   Overview of the SCOR Submission Process Organizations sanitize their security control overlay for public review and ensure overlay is based on NIST SP 800-53 security controls. Organizations...

  NIST welcomes feedback on the NIST Security and Privacy Control Overlay Repository (SCOR). If you have any questions about submitting overlays to the NIST SCOR, participation agreements, or any suggestions, comments, or questions regarding the repository, send an e-mail to [email protected]. Return to Control Overlay Repository Overview    

The following products have been placed on the Removed Products List because they do not conform to the requirements of FIPS 201-2 effective since 9/05/14 or  to the requirements of FIPS 140-2.   All questions regarding the implementation and/or use of any PIV Card Application located on the validation list should first be directed to the vendor. Cert # Product Name Vendor Issue Date/ Update Date FIPS 140-2 validation certificate # and date Product Details Removed Reason 1 PIV End Point Java Card Applet (Version: v1.08[1], v.1.09[2]) for...

Call for Proposals The cover sheet of a submission package shall contain the following information: Name of the proposed cryptosystem. Principal submitter’s name, e-mail address, telephone, organization, and postal address. Name(s) of auxiliary submitter(s). Name of the inventor(s)/ developer(s) of the cryptosystem. Name of the owner, if any, of the cryptosystem (normally expected to be the same as the submitter). Signature of the submitter. (optional) Backup point of contact (with telephone, fax, postal address, and e-mail address).

Call for Proposals Each submission must include: a complete written specification a detailed performance analysis Known Answer Test values a thorough description of the expected security strength an analysis of the algorithm with respect to known attacks a statement of advantages and limitations. Further details are described below. 2.B.1   A complete written specification of the algorithms shall be included, consisting of all necessary mathematical operations, equations, tables, and diagrams that are needed to implement the algorithms. The document shall also include a design...

Call for Proposals All electronic data shall be provided either in a zip file, or on a single CD-ROM, DVD, or USB flash drive labeled with the submitter’s name, as well as the name of the proposed cryptosystem. 2.C.1 Implementations Two implementations are required in the submission package: a reference implementation and an optimized implementation. The goal of the reference implementation is to promote understanding of how the submitted algorithm may be implemented. Since this implementation is intended for reference purposes, clarity in the implementation code is more important than the...