Search CSRC

NEW:  Combinatorial Coverage Difference Measurement for assurance of autonomous systems and other critical software.  Combinatorial coverage is a way of finding the rare cases that may lead to security vulnerabilities or system failures, with application to both testing and assured autonomy. Achieving sound testing or assured autonomy in any environment requires methods for measuring the input space, to show that the test environment adequately covers real-world conditions that may be encountered.  NIST is developing new combinatorial measurement methods and tools for input space coverage,...

Validation Number: 144 Vendor: Arctic Wolf Product Name: Arctic Wolf Risk Scan Engine Product Major Version: 6 Product Version Tested: 6.3.5 Tested Platforms: Microsoft Windows 7, SP1, 32-bit Microsoft Windows 7, SP1, 64-bit Microsoft Windows Vista, SP2 Microsoft Windows 8.1 SP0 32-bit Microsoft Windows 8.1 SP0 64-bit Microsoft Windows 10 SP0 32-bit Microsoft Windows 10 SP0 64-bit Microsoft Windows Server 2012 R2 SP0 64-bit Red Hat Enterprise Linux 6 32-bit Red Hat Enterprise Linux 6...

About: The Federal Cybersecurity Supply Chain Risk Management (C-SCRM) Forum fosters collaboration and the exchange of C-SCRM information among federal organizations to improve the security of federal supply chains. Through periodic meetings and informal exchanges, the Forum offers all agencies that depend upon or guide C-SCRM an opportunity to discuss issues of interest with – and to inform – many of those leading C-SCRM efforts in the federal ecosystem, including the Office of Management and Budget (OMB), the Department of Defense (DOD), the Cybersecurity and Infrastructure Security...

Participating in Federal C-SCRM Forum Participation in the Forum, including events and online exchanges, is open to: federal C-SCRM program managers federal personnel who have a dedicated and recurring responsibility for performing C-SCRM functions federal contractors who provide direct C-SCRM support (upon request by their federal sponsor and approval by the Forum co-hosts).   The Forum may establish working groups or study groups and welcomes all suggestions to the co-hosts. NIST is hosting the Forum as part of its mandate under the SECURE Technology Act and the Federal...

Application in distributed systems J.F. DeFranco, D.F. Ferraiolo, D. R. Kuhn, and J.D. Roberts, "A Trusted Federated System to Share Granular Data Among Disparate Database Resources", IEEE Computer, Mar, 2021.   D.F. Ferraiolo, J.F. DeFranco, D. R. Kuhn, and J.D. Roberts, "A New Approach to Data Sharing and Distributed Ledger Technology: A Clinical Trial Use Case", IEEE Network, Jan, 2021.  Foundations and background Kuhn, D. R. (2022). A Data Structure for Integrity Protection with Erasure Capability. NIST CSWP 25 (final version of Kuhn 2018 paper below) Kuhn, R., Yaga, D., & Voas,...

Privacy Enhanced Distributed Ledger Technology and Hyperledger Implementation, IEEE Morocco Blockchain Summit, 2024 Privacy Enhanced Distributed Ledger Technology with Hyperledger Fabric, IEEE International Conference on Artificial Intelligence, Blockchain, and Internet of Things, Sept 17, 2023 Redactable Distributed Ledger Technology with Hyperledger Fabric, IEEE Privacy Symposium, Venice, Italy, 2023.  Redactable Distributed Ledger Technology for Hyperledger Fabric, International Blockchain Summit, Istanbul, 2022 Rethinking Distributed Ledger Technology and Using it for Access...

Data block matrix examples and code: https://github.com/usnistgov/blockmatrix - implementations in Java and in Go https://github.com/PM-Master/blockmatrix - Java API to manage users and attributes using a blockmatrix. https://github.com/PM-Master/NDAC - implementation as a component of Next Gen Database Access Control (NDAC) Hyperledger Fabric drop-in component coming Dec. 5, 2022  For more, see here  

The preliminary draft "Toward a PEC use-case suite (Draft)" remains open to public comments. Abstract: This document motivates the development of a privacy-enhancing cryptography (PEC) use-case suite. This would constitute a set of proofs of concepts, showcasing the use of cryptographic tools for enabling privacy in various applications. This is not a proposal, but rather a sketch idea to motivate initial public feedback, which can be useful to determine a potential process towards a PEC use-case suite. Keywords: cryptography, privacy; privacy-enhancing cryptography (PEC); reference...

Focusing on federal agencies but also engaging with and providing resources useful to government at other levels as well as the private sector, NIST: Guidance on Software Supply Chain Security, under Executive Order 14028 Sections 4(c) and (d), focuses on the critical sub-discipline of Cybersecurity Supply Chain Risk Management (C-SCRM) from the lens of federal acquirers. It covers both existing and evolving standards, tools, and recommended practices.  The guidance is co-located with related EO guidance under NIST’s purview and will be maintained online to more easily update guidance on...

Combinatorial Testing Quick Start – two short readings make it easy to learn the basics: Read tutorial sections 2, 3, and 4 (pp. 4 to 18) (pdf in English or Espanol):   Practical Combinatorial Testing // Pruebas Combinatorias Pracaticas  Two examples are included, illustrating how to apply the combinatorial approach.  See the ACTS User Guide, which explains how to use the ACTS tool.  The user guide contains illustrations and screen shots of examples showing how to use the tool for practical testing. Now try it on your own testing project! See also: Video overview (12:46, mp4) of...

The NIST Cybersecurity & Privacy Professionals Forum is co-chaired by representatives of NIST's Information Technology Laboratory Computer Security Division (CSD) and Office of Information Systems Management (OISM).  The Forum Secretariat provides the necessary administrative and logistical support for operations.     The Forum serves as an important mechanism for NIST to: exchange information directly with cybersecurity and privacy professionals in U.S. federal, state, and local government, and higher education organizations handling federal information in fulfillment of its leadership...

Loading…

We often get the question whether patching/updating a FIPS validation module (particularly when there is a significant security-related reason such as addressing a CVE) will invalidate that module’s FIPS status. The original version would maintain its validation but the new version that includes the patch/update would not be validated. Changing the code of the module results in that portion being untested and the CMVP is only able to make validation assurances for the tested configuration. As noted in our guidance:  The tested/validated module version, operational environment upon which it...

The SSDF uses these established secure development practice documents as references. Note that these references were current at the time SSDF version 1.1 was published, and may no longer be current. NIST Publications General Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1 National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (SP 800-181) Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5) Software Development Cybersecurity Supply Chain Risk Management Practices for Systems and...

ATTENTION: The Project Lead is no longer at NIST. Inquiry responses may be delayed.   ISO/IEC 29147  International Organization for Standardization/International Electrotechnical Commission (2018) ISO/IEC 29147:2018 – Information technology – Security techniques – Vulnerability disclosure (ISO, Geneva, Switzerland). Available at https://www.iso.org/standard/72311.html ISO/IEC 30111 International Organization for Standardization/International Electrotechnical Commission (2019) ISO/IEC 30111:2019 – Information technology – Security techniques – Vulnerability handling processes (ISO,...

At A Glance       Purpose: Implement the controls in the security and privacy plans for the system and organization   Outcomes:  controls specified in security and privacy plans implemented security and privacy plans updated to reflect controls as implemented     Resources for Implementers RMF Quick Start Guide (QSG): Implement Step FAQs Security Configuration Settings Multiple Supporting NIST Publications include templates Examples include: SP 800-88, Guidelines for Media Sanitization, SP 800-34 Revision 1, Contingency Planning Guide for Federal Information...

At A Glance   Purpose: Determine if the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security and privacy requirements for the system and the organization.   Outcomes:  assessor/assessment team selected security and privacy assessment plans developed assessment plans are reviewed and approved control assessments conducted in accordance with assessment plans security and privacy assessment reports developed remediation actions to address deficiencies in controls are taken security and privacy plans are...

At A Glance     Purpose: Provide  accountability by requiring a senior official to determine if the security and privacy risk based on the operation of a system or the use of common controls, is acceptable.   Outcomes:  authorization package (executive summary, system security and privacy plan, assessment report(s), plan of action and milestones) risk determination rendered risk responses provided authorization for the system or common controls is approved or denied   Resources for Implementers RMF Introductory Online Course RMF Quick Start Guide (QSG): Authorize Step...

Welcome to the NIST SP 800-53 Public Comment Website   The NIST SP 800-53 Public Comment Site was developed to ensure that the SP 800-53 control catalog provides the most comprehensive and up-to-date set of controls/countermeasures to manage security, privacy, and supply chain risk. By modernizing the NIST comment process and moving to an online dataset instead of following a document-based update process, NIST can provide its stakeholders the most up-to-date controls in multiple data formats to manage risk while encouraging use of automation.  Stakeholders can provide feedback on...

The NIST SP 800-53 Controls Public Comment Site was developed to ensure that the SP 800-53 control catalog provides the most comprehensive and up-to-date set of controls/countermeasures to manage security, privacy, and supply chain risk. By modernizing the NIST comment process and moving to an online dataset instead of following a document-based update process, NIST can provide its stakeholders the most up-to-date controls in multiple data formats to manage risk while encouraging use of automation.  Stakeholders can provide feedback on controls by: submitting a "proposal" for a new...

General Questions and Background What is the purpose of the SP 800-53 Public Comment Website? NIST believes that robust, widely understood, and participatory development processes produce the strongest, most effective, most trusted, and broadly accepted standards and guidelines. The following principles guide NIST's standards and guidelines development: Transparency: All interested and affected parties have access to essential information regarding standards and guidelines-related activities throughout the development process. Openness: Participation is open to all interested...

As NIST continues to refine the SP 800-53 Comment Site, screenshots included in the User Guide may differ slightly from the latest version.    Each topic area below includes a step-by-step guide demonstrating how to: Navigate to the SP 800-53 Public Comment Site Users can reach the SP 800-53 Public Comment Site directly, or by browsing from the NIST Risk Management Framework (RMF) project page.  Option 1: Access by Direct Link Access the SP 800-53 Public Comment Site directly: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/public-comments. Figure 1 below shows the...

The NIST Security and Privacy Control Overlay Repository (SCOR) provides stakeholders a platform for voluntarily sharing control overlays created by subject matter experts to help reduce the duplication of effort and share best practices for the information security and privacy community. What is a Control Overlay? An overlay may provide a fully specified set of controls, control enhancements, and parameter values to address specific circumstances, situations, and/or conditions unique to specific communities of interest, industry sectors, or coalitions/partnerships. Learn More About...

Download the SP 800-53 Controls in Different Data Formats Note that NIST Special Publication (SP) 800-53, 800-53A, and SP 800-53B contain additional background, scoping, and implementation guidance in addition to the controls, assessment procedures, and baselines. This NIST SP 800-53 database represents the derivative format of controls defined in NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations. If there are any discrepancies noted in the content between these NIST SP 800-53 and 53A derivative data formats and the latest published NIST SP...

Background NIST cryptography standards (Federal Information Processing Standards, or “FIPS”) and other publications (typically specified in the Special Publication (SP) 800 series) are intended to protect non-national security federal information and information systems. Outside the Federal Government, these publications are voluntarily relied upon across many sectors to promote economic development and protect sensitive personal and corporate information.   Cryptography standards and other publications must be reviewed and maintained regularly because of rapid technological advances, the...