Search CSRC

Abstract: This report defines version 2.0 of the Open Checklist Interactive Language (OCIL). The intent of OCIL is to provide a standardized basis for expressing questionnaires and related information, such as answers to questions and final questionnaire results, so that the questionnaires can use a standardi...

Journal: Journal of Information System Security Abstract: More than 100 years ago, Lord Kelvin observed that measurement is vital to deep knowledge and understanding in physical science. During the last few decades, researchers have made various attempts to develop measures and systems of measurement for computer security with varying degrees of success. T...

Abstract: NIST’s Information Technology Lab awarded the Supply Chain Management Center of the Robert H. Smith School of Business at the University of Maryland in College Park a grant in support of the development of cyber supply chain best practice guidelines by NIST. In October, 2010, the Supply Chain Manage...

Journal: Journal of Systems Architecture Abstract: The ability to control access to sensitive data in accordance with policy is perhaps the most fundamental security requirement. Despite over four decades of security research, the limited ability for existing access control mechanisms to generically enforce policy persists. While researchers, practi...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-39, Integrated Enterprise-Wide Risk Management: Organization, Mission and Information System View. This publication was developed by the Joint Task Force Transformation Initiative, a joint partnership among the D...

Journal: IT Professional Abstract: The notion of a "tipping point" isn't new, al though the concept has relevance in differing ways. Academia seems to be at a tipping point, whereby the steady state of disciplinary specialization is about to give way to an interdisciplinary, collaborative approach to knowledge acquisition. To underst...

Abstract: The purpose of Special Publication 800-39 is to provide guidance for an integrated, organization-wide program for managing information security risk to organizational operations (i.e., mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation...

Abstract: The success of biometric applications is particularly dependent on the interoperability of biometric systems. Deploying these systems requires a comprehensive portfolio of biometric standards developed in support of interoperability and data interchange. A number of these domestic and international...

Journal: International Journal of Software Engineering and Knowledge Engineering Abstract: Mandatory access control (MAC) mechanisms control which users or processes have access to which resources in a system. MAC policies are increasingly specified to facilitate managing and maintaining access control. However, the correct specification of the policies is a very challenging problem. To f...

Abstract: Special Publication 800-70 Revision 2, National Checklist Program for IT Products Guidelines for Checklist Users and Developers, describes security configuration checklists and their benefits, and it explains how to use the NIST National Checklist Program (NCP) to find and retrieve checklists. The p...

Abstract: This document provides the definitive technical specification for Version 1.1 of the Security Content Automation Protocol (SCAP). SCAP consists of a suite of specifications for standardizing the format and nomenclature by which security software communicates information about software flaws and secu...

Abstract: This publication provides recommendations for using two vulnerability naming schemes: Common Vulnerabilities and Exposures (CVE) and Common Configuration Enumeration (CCE). SP 800-51 Revision 1 gives an introduction to both naming schemes and makes recommendations for end-user organizations on using...

Abstract: The National Institute of Standards and Technology (NIST) opened a public competition on November 2, 2007 to develop a new cryptographic hash algorithm – SHA-3, which will augment the hash algorithms currently specified in the Federal Information Processing Standard (FIPS) 180-3, Secure Hash Standar...

Abstract: This whitepaper for the Technical Guidelines Development Committee (TGDC) identifies desirable security properties of remote electronic voting systems, potential benefits and threats to these systems, and current and emerging technical approaches for mitigating risks. It is intended for election off...

Abstract: This glossary of key information security terms has been extracted from NIST Federal Information Processing Standards (FIPS), Special Publication (SP) 800 series, NIST Interagency Report (NIST IR) series, and the Committee for National Security Systems Instruction (CNSSI) 4009 (Information Assurance...

Journal: ISO Focus+ Abstract: One of the critical issues related to secured Information Technology (IT) systems and applications is the verification of the users identity. Biometrics provides for secure transactions, positive identification and augmentation to human judgment. For decades, biometric technologies were used primari...

Journal: Journal of Integer Sequences Abstract: We look at arithmetic progressions on elliptic curves known as Edwards curves. By an arithmetic progression on an elliptic curve, we mean that the x-coordinates of a sequence of rational points on the curve form an arithmetic progression. Previous work has found arithmetic progressions on Weierstras...

Journal: IT Professional Abstract: Managing information systems security is an expensive and challenging task. Many different and complex software components- including firmware, operating systems, and applications-must be configured securely, patched when needed, and continuously monitored for security. Most organizations have an ex...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-119, Guidelines for the Secure Deployment of IPv6. Written by Sheila Frankel of NIST, Richard Graveman of RFG Security, John Pearce of Booz Allen Hamilton and Mark Rooks of L-1 Identity Solutions (formerly of Boo...

Abstract: The purpose of SP 800-125 is to discuss the security concerns associated with full virtualization technologies for server and desktop virtualization, and to provide recommendations for addressing these concerns. Full virtualization technologies run one or more operating systems and their application...

Abstract: At the start of the 21st century, the National Institute of Standards and Technology (NIST) began the task of providing cryptographic key management guidance, which includes defining and implementing appropriate key management procedures, using algorithms that adequately protect sensitive informatio...

Conference: 44th Annual Hawaii International Conference on System Sciences (HICSS), 2011 Abstract: In meteorology, the most destructive extratropical cyclones evolve with the formation of a bent-back front and cloud head separated from the main polar-front, creating a hook that completely encircles a pocket of warm air with colder air. The most damaging winds occur near the tip of the hook. The c...

In: Encyclopedia of Cryptography and Security Abstract: Biometric technologies establish or verify the personal identity of previously enrolled individuals based on biological or behavioural characteristics. Over the past several years the marketplace for biometric-based applications has widened significantly since they are now increasingly being used in...

Abstract: This document contains the technical specifications needed for the mandatory and optional cryptographic keys specified in FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, as well as the supporting infrastructure specified in FIPS 201 and the related Special Public...

Journal: IEEE Reliability Society 2010 Annual Technical Report Abstract: Every computer user is familiar with software bugs. Many seem to appear almost randomly, suggesting that the conditions triggering them must be complex, and some famous software bugs have been traced to highly unusual combinations of conditions. For example, the 1997 Mars Pathfinder mission began ex...