Search CSRC

Abstract: Users have developed various coping strategies for minimizing or avoiding the friction and burden associated with managing and using their portfolios of user IDs and passwords or personal identification numbers (PINs). Many try to use the same password (or different versions of the same password) ac...

Journal: Computer (IEEE Computer) Abstract: This special issue presents papers that focus on important problems within the Software Testing community.

Journal: Computer (IEEE Computer) Abstract: The strength of cryptographic keys is an active challenge in academic research and industrial practice. In this paper we discuss the entropy as fundamentally important concept for generating hard-to-guess, i.e., strong, cryptographic keys and outline the difficulties in generating and estimating the...

Journal: IT Professional Abstract: Risk management is a common phrase when managing information, from the CISO to the programmer. We acknowledge that risk management is the identification, assessment and prioritization of risks and reflects how we manage uncertainty. These are some areas of risk that we have come to accept, their mit...

Conference: 2013 International Conference on Social Computing (SocialCom) Abstract: Access control (AC) policies can be implemented based on different AC models, which are fundamentally composed by semantically independent AC rules in expressions of privilege assignments described by attributes of subjects/attributes, actions, objects/attributes, and environment variables of the pr...

Journal: IEEE Transactions on Dependable and Secure Computing Abstract: By enabling a direct comparison of different security solutions with respect to their relative effectiveness, a network security metric may provide quantifiable evidences to assist security practitioners in securing computer networks. However, research on security metrics has been hindered by diffic...

Abstract: This document provides Federal agencies with a definition of attribute based access control (ABAC). ABAC is a logical access control methodology where authorization to perform a set of operations is determined by evaluating attributes associated with the subject, object, requested operations, and, i...

Abstract: This publication provides a catalog of security and privacy controls for federal information systems and organizations and a process for selecting controls to protect organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizati...

Abstract: The Computer Security Division within ITL has recently provided a draft of Special Publication (SP) 800-152, A Profile for U. S. Federal Cryptographic Key Management Systems, for public comment. NIST SP 800-152 is based on NIST SP 800-130, A Framework for Designing Cryptographic Key Management Syste...

Journal: IEEE Wireless Communications Abstract: When enabling handover between different radio interfaces (e.g., handover from 3G to Wi-Fi), reducing network access authentication latency and securing handover related signaling messages are major challenging problems, amongst many others. The IEEE 802 LAN/MAN Standards committee has recently fini...

Abstract: The National Vulnerability Database (NVD), and its companion, the National Checklist Program (NCP), have provided a valuable and flexible set of services to users around the world since NVD was established in 2005. The NVD was established to provide a U.S. government repository of data about softwar...

Abstract: A password policy may seem formal in the sense that it is written in a legalistic language, giving the impression of a binding contract. However, such policies are informal in the logical sense that the policy statements are not written in a clear, unambiguous form. In password policy research at th...

Abstract: In order to protect power generation, transmission and distribution, energy companies need to be able to control physical and logical access to their resources, including buildings, equipment, information technology and industrial control systems (ICS). They must be able to authenticate the individu...

Abstract: This ITL Bulletin announces the release of the Preliminary Cybersecurity Framework and gives instructions for submitting comments.

Journal: Applied Mathematics & Information Sciences Abstract: On-off scheduling of systems that have the ability to sleep can be used to extend system idle periods and enable greater opportunities for energy savings from sleeping. In this paper, we achieve a theoretical understanding of the delay behavior of on-off scheduling as it may apply to communications...

Conference: 7th International Workshop on Critical Information Infrastructures Security (CRITIS 2012) Abstract: Prevention, detection and response are nowadays considered to be three priority topics for protecting critical infrastructures, such as energy control systems. Despite attempts to address these current issues, there is still a particular lack of investigation in these areas, and in particular in dyn...

Abstract: On September 5, 2013, ITL released Revision 2 of FIPS 201 (FIPS 201-2), Personal Identity Verification of Federal Employees and Contractors. The revision includes adaptations to changes in the environment and new technology since the first revision of the standard. FIPS 201-2 also provides clarifica...

Conference: Ninth IFIP WG 11.9 International Conference on Digital Forensics Abstract: Evidence Graphs model network intrusion evidence and their dependencies, which helps network forensics analysts collate and visualize dependencies. In particular, probabilistic evidence graph provide a way to link probabilities associated with different attack paths with available evidence. Existing...

Journal: IT Professional Abstract: Does your organization have systematic procedures to remove sensitive data from obsolete equipment, or do you use a somewhat ad hoc process for the cleanup and disposal of old gear? Careless disposal of data storage hardware has led to costly and embarrassing incidents for organizations that discove...

Conference: 2013 IEEE Conference on Communications and Network Security (CNS) Abstract: This paper discusses limitations in one of the most widely cited single source scan detection algorithms: threshold random walk (TRW). If an attacker knows that TRW is being employed, these limitations enable full circumvention allowing undetectable high speed full horizontal and vertical scanning o...

Conference: 2013 ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM 2013) Abstract: This poster presents some measures of combinatorial coverage that can be helpful in estimating residual risk related to insufficient testing of rare interactions, and a tool for computing these measures.

Journal: Journal of Computer Security Abstract: Quantifying security risk is an important and yet difficult task in enterprise network security management. While metrics exist for individual software vulnerabilities, there is currently no standard way of aggregating such metrics. We present a model that can be used to aggregate vulnerability metr...

Journal: Notes on Number Theory and Discrete Mathematics Abstract: In this article, we study the quartic Diophantine equation x^4+y^4-2z^4-2w^4=0. We find non-trivial integer solutions. Furthermore, we show that when a solution has been found, a series of other solutions can be derived. We do so using two different techniques. The first is a geometric method due to...

Abstract: To interact with various services in the cloud and to store the data generated/processed by those services, several security capabilities are required. Based on a core set of features in the three common cloud services - Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software a...

Conference: Second International Workshop on Lightweight Cryptography for Security and Privacy (LightSec 2013) Abstract: Lightweight cryptography aims to provide sufficient security with low area/power/energy requirements for constrained devices. In this paper, we focus on the lightweight encryption algorithm specified and approved in NRS 009-6-7:2002 by Electricity Suppliers Liaison Committee to be used with tokens i...