Search CSRC

Abstract: Industrial Control Systems (ICS) that operate manufacturing environments play a critical role in the supply chain. Manufacturing organizations rely on control systems to monitor and control physical processes that produce goods for public consumption. These same systems are facing an increasing numb...

Abstract: The report proposes a conceptual aggregation model for software acquisitions. The proposed approach relies on the immutability and auditability of blockchain technology. The model also enables automated, dynamic queries to the National Vulnerability Database (NVD) to continuously identify newly disc...

Abstract: A RESTful API platform is a stateless architectural framework that leverages standard HTTP protocols to manage and exchange data as "resources," serving as the primary bridge for communication between modern web applications. This alignment with Web is the reason they are also called Web APIs and re...

Conference: 19th IEEE International Conference on Software Testing, Verification and Validation (ICST) Abstract: Although there are many available approaches for designing machine learning models and experiments, not all of these approaches are explainable or interpretable. Combination frequency differencing (CFD) provides information on the relationship between feature values and predicted class in the form o...

Abstract: Falcon is a lattice-based digital signature scheme offering excellent performance and key sizes, and it has been selected for standardization by the National Institute of Standards and Technology (NIST) as part of their post-quantum standardization project. However, the use of floating-point and/or...

Journal: IEEE Security & Privacy Abstract: This article establishes information-theoretic limitations for robustness of artificial intelligence (AI) security and alignment. Knowing these limitations and preparing for their challenges is essential for responsible adoption of AI. Broader implications for cognitive reasoning limitations of AI s...

Abstract: This report describes the evaluation criteria and selection process of the Second Round of the Additional Digital Signatures for the NIST Post-Quantum Cryptography (PQC) Standardization Process, which will identify public-key digital signature algorithms for potential standardization to protect sens...

Abstract: The protection of Controlled Unclassified Information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication pro...

Abstract: The protection of controlled unclassified information (CUI) resident in nonfederal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its essential missions and functions. This publication pro...

Journal: IEEE Security & Privacy Abstract: We present the key themes from the workshop “ConnectCon: Minding the Gaps in Human-Centered Cybersecurity,” which can inform efforts of researchers and practitioners toward a collective goal of improving cybersecurity outcomes for all.

Abstract: A security configuration checklist is a document that contains instructions, procedures, or machine-readable and executable content to configure an IT product to a specific risk posture for an operational environment, verify that the product has been configured properly, identify unauthorized config...

Abstract: The national and economic security of the United States (U.S.) is dependent upon the reliable operation and responsible use of Positioning, Navigation, and Timing (PNT) services. This document provides the Cybersecurity Framework (CSF) Version 2.0 Community Profile developed for supporting positioni...

Abstract:

Abstract: High-performance computing (HPC) systems provide fundamental computing infrastructure for large-scale and complex simulations, big data analysis, and the training of artificial intelligence (AI) and machine learning (ML) models, all at exceptional speeds. Securing HPC systems is essential to safegua...

Abstract: Internet of Things (IoT) products often lack product cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving the securability of their IoT products by providing necess...

Abstract: Cryptography is often used in an information technology security environment to protect data that is sensitive, has high value, or is vulnerable to unauthorized disclosure or undetected modification during transmission or while in storage. Cryptography relies upon two basic components...

Abstract: This paper describes design mechanisms that reconfigure component firmware as a network of forensic units that passively observe bus traffic to extract and share forensic data beyond typical communication. By employing consensus-building algorithms among these distributed units, the augmented firmwa...

Abstract: The Cryptographic Module Validation Program (CMVP) validates third-party assertions that cryptographic module implementations satisfy the requirements of Federal Information Processing Standards (FIPS) Publication 140-3, Security Requirements for Cryptographic Modules. Historically, t...

Abstract: This report is designed to help small businesses use the NIST Cybersecurity Framework (CSF) 2.0 to manage their cybersecurity risks. The document is tailored to the smallest of businesses—those with no employees other than the owner, or “non-employer” firms as defined by the U...

Abstract: This Special Publication serves as a technical extension of FIPS 205, the specification for the Stateless Hash-based Digital Signature Algorithm (SLHsig). While standard SLHsig parameter sets are designed to maintain full security for up to 2^64 signatures, the resulting signature sizes and/or verif...

Abstract: Today’s software applications are typically constructed by combining a diverse range of elements, including components, frameworks, libraries, and tools. Rather than building everything from the ground up, developers often leverage a mix of internally developed and externally sourced component...

Abstract: This Quick-Start Guide (QSG) draws on concepts and practices from enterprise risk management, cybersecurity risk management, and workforce management to help organizations improve communication about cybersecurity risks and to plan and implement workforce decisions based upon risk reality and planne...

Abstract: This document introduces the white paper series titled Applying 5G Cybersecurity and Privacy Capabilities. This series is being published by the National Cybersecurity Center of Excellence (NCCoE) 5G Cybersecurity project. 5G introduced new security capabilities in the standards focusing on securing...

Abstract: This white paper describes how Subscription Concealed Identifier (SUCI) protection can be enabled in 5G networks. SUCI protection is defined by 5G standards as an optional security capability for operator deployments. Although it is optional, it provides important security and privacy protections fo...

Abstract: This white paper provides an overview and an example of employing hardware-enabled security capabilities to provision, measure, attest to, and enforce the integrity of the compute platform to foster trust in a 5G system’s server infrastructure. It discusses security threats within computi...