U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Cybersecurity Insights

a NIST blog

Search Cybersecurity Insights

Put exact phrase in quotes (e.g., "information technology")
Displaying 1 - 25 of 337
OSCAL Blog header image

The Foundation for Interoperable and Portable Security Automation is Revealed in NIST’s OSCAL Project

May 12, 2021
Michaela Iorga
… blog is from Michaela Iorga, Senior Technical Lead of the Computer Security Division (CSD) in the Information Technology Laboratory at … Language (OSCAL) . OSCAL is a set of formats expressed in XML, JSON, and YAML. These formats provide machine-readable representations of … created? The Federal Information Security Management Act (FISMA) Implementation Program was established in January of 2003 as a result of …
Cybersecurity Awareness Month Blog Image

Cybersecurity Awareness Month: Securing Devices at Home and Work

October 13, 2020
Julie Haney
… 2020 saw a major disruption in the way many people work, learn, and socialize online. Our homes are more connected than ever. Our … of Defense for over 20 years doing vulnerability assessments, writing security guidance, and, in general, focusing on trying to convince … like phishing, viruses, or botnets. Conversely, there may be a good solution from a technology perspective, but if people can’t figure out …
Usable Cybersecurity Spotlight Banner

Staff Spotlight: NIST Usable Cybersecurity Security and Privacy of Smart Home Devices

August 11, 2020
Susanne Furman
… the work that NIST conducts in usable cybersecurity technology and protection against phishing scams by sharing thoughts from Kristen … also a NIST cognitive scientist, offers her expertise regarding the security and privacy of smart home devices. This year, consumers will … are confronting how well they protect individuals’ privacy and security. We asked Furman several questions about her important research …

Beyond User Names and Passwords: Meet the NSTIC Pilots at RSA

February 26, 2013
… that ensures the envisioned Identity Ecosystem is trustworthy and has the confidence of individuals.  Using privacy-enhancing … for identification online for consumers that increase usability, security, and interoperability to safeguard online transactions.  The … Criterion will make available to pilot partners the Wave Nodes solution, an endpoint identity service.  Nodes is designed to improve …
Security Research Image

The Next Generation Security and Privacy Controls—Protecting the Nation’s Critical Assets

September 22, 2020
Ron Ross, Victoria Yan Pillitteri, Naomi Lefkovitz
… It has been seven years since the last major update to NIST’s flagship security and privacy guidance document Special Publication (SP) 800-53, Security … and privacy communities as well as achieving more efficient control implementation. Integrating supply chain risk management: Revision 5 … The Next Generation Security and Privacy Controls—Protecting the Nation’s Critical Assets …
Learning Series Blog Header

Small Devices Can Cause Big Problems: Improving Enterprise Mobile Device Security

June 23, 2021
Barbara Ware
… in our pockets—are a permanent fixture in today’s workplace. Managing and securing them is no simple task. Gema Howell, computer scientist and … Series* webinar to discuss the challenges of enterprise mobile device security and privacy. She also shared tips for securing mobile devices. … design mobile device solutions to meet those requirements. Apply the Solution …
Staff Spotlight Image - Yee-Yin Choong

Staff Spotlight: NIST’s Human Factors Scientist

July 13, 2021
Yee-Yin Choong
… has been conducting research in the areas of human-centered design and evaluation, usable cybersecurity, public safety communication … your background, and how did you come to be at NIST working on usable security projects? I received my bachelor’s and master’s degrees in … goes on and on. Can you tell us about your research into children’s security and privacy practices? In the cyber security research …

NSTIC Pilot Common Considerations 5: An Identity Ecosystem Functional Model for the Modern Market

August 2, 2013
… fifth blog in our series highlighting some of the common questions and observations that have emerged as the NSTIC pilots continue to move … architectural flexibility (with some attendant challenges) to support security, privacy, interoperability, and ease of use. Such an … NSTIC Guiding Principles The functional model of any given identity solution can greatly influence its adherence to the NSTIC’s four Guiding …

SSDF and IoT Cybersecurity Guidance: Building Blocks for IoT Product Security

June 15, 2023
Katerina Megas, Michael Fagan, Barbara Cuthill, Murugiah Souppaya
… in Action 3.d of NIST IR 8259B , that manufacturers have considered and documented their “secure software development and supply chain … design and deliver more secure IoT products to customers. Software Security: an Essential Need for IoT Products IoT product cybersecurity … and Query Reception, and Information Dissemination. Consistent implementation of the SSDF enables an organization to more easily meet …

Take A Tour! NIST Cybersecurity Framework 2.0: Small Business Quick Start Guide

April 9, 2024
Daniel Eliot
… Small Business Week from April 28 - May 4, 2024. This week recognizes and celebrates the small business community’s significant contributions … The framework is flexible so that each organization can tailor their implementation to meet their own unique needs, mission, resources, and … to help them reduce their cybersecurity risks, such as a managed security service provider (MSSP).    4. Related Resources:  This …

Citius, Altius, Fortius: Announcing 6 new pilot projects across 10 states (and D.C.!)

August 25, 2016
… to date, today NIST is proud to add six new projects to our ranks and bring the total number of projects to 24. It’s a tricky needle to … approach: it’s not about a single killer app or any given shiny solution, it’s about creating the network effects by which all natural … about it. We know that  54% of consumers were not confident that the security of their personal data was protected on the internet in 2015, …

WHOA-OH! WE’RE HALFWAY THERE! Happy NSTICiversary!

April 15, 2016
… passwords for their daily online activity, according to a UK study , and 3 out of 4 Americans don’t use sufficiently strong passwords for … . Some companies are getting more aggressive in pursuing better security; 2011 is the year Google released two-factor authentication … in a limited production pilot with Connect.Gov–an operational implementation of a privacy-enhancing technology. In 2013, with funding …

Press Release: Five Pilot Projects Receive Grants to Promote Online Security and Privacy

September 20, 2012
… The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) today announced more than $9 million in grant … policies and consensus-based standards support greater trust and security when individuals, businesses and other organizations conduct … science, standards and technology in ways that enhance economic security and improve our quality of life. To learn more about NIST, …
Image of power lines after dark

Keeping the Lights On

July 31, 2020
Ron Ross
… to a disruption in power generation or distribution, our productivity and quality of life do, too. In today’s cyber environment, diverse and … to subvert our critical systems such as the power grid. The National Security Agency (NSA) and the Department of Homeland Security (DHS) … true cyber resiliency We should not presume a particular outcome or solution to this difficult and challenging problem, but rather begin to …

Standards: The CPSO’s Best Friend

July 11, 2022
Katerina Megas
… on Role of Standards in Cybersecurity for IoT What do Chief Product Security Officers (CPSOs) want to make their job easier? As it turns … guidance for IoT products, NIST remains committed to an open and transparent process that builds on input from stakeholders, … security concerns and the frequency of changes in the underlying implementation of hardware and software components and back-end …

Everybody Needs Identity.

November 28, 2014
… important – particularly as identity breaches become more pervasive and affect more people worldwide. A recent study revealed the concerns … (NSTIC) is focused on empowering individuals to better protect their security and privacy online. Protecting and controlling our digital … that can better protect their identity is usability: if a solution makes things more complicated and offers little visible …
Cybersecurity Awareness Month Blog Image

Cybersecurity Awareness Month: If You Connect IT, Protect IT.

October 28, 2020
Katerina Megas
… such as 5G, might impact the online experiences of consumers and businesses, how IoT is changing security risks, and what solutions are emerging for a more secure … be adapted to the continuous evolution of connected devices?  The solution for a more secure Internet of Things probably lies in a …
The Application of Cybersecurity for IoT Capabilities to Real-World Scenarios

The Application of Cybersecurity for IoT Capabilities to Real-World Scenarios

April 12, 2022
Jeff Marron
… between its programs, which helps maximize project impacts and practicality to industry. One great example is between NIST’s … to assess how well the project’s reference design addresses the security requirements that it was intended to support. Essentially, the … evaluation criteria, linking the capabilities to a real-world solution. Basically, the mappings answer the question: what are the IoT …

My heart bleeds for better identity solutions, my brain is excited by the progress

April 22, 2014
Jeremy Grant
… could be used in lieu of passwords to enable more secure, convenient and privacy-enhancing transactions everyplace they go online.   Looking … piped two-factor solutions. We have to do better. To truly improve security, we need to also improve convenience.   And that requires … version 1 of Identity Ecosystem functional elements that will help to guide other IDESG deliverables going forward.   Adam Madlin of host …

NCCoE 5G Cybersecurity: Connecting the Dots Between IT and Teleco Cybersecurity Capabilities in 5G Systems

November 22, 2023
Jeffrey Cichonski
… single industry—from healthcare to financial to even agriculture and transportation...and its impact is only increasing over time. Despite its benefits, it comes with privacy and security risks. An increasing number of interconnected devices increases … components being used in 5G networks around the world. Our testbed implementation is bringing together both the latest telecommunication …

My heart bleeds for better identity solutions, my brain is excited by the progress

April 22, 2014
… could be used in lieu of passwords to enable more secure, convenient and privacy-enhancing transactions everyplace they go online.  Looking … two-factor solutions. We have to do better. To truly improve security, we need to also improve convenience.  And that requires … 1 [LINK] of Identity Ecosystem functional elements that will help to guide other IDESG deliverables going forward.   Adam Madlin of host …
Was this page helpful?