U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Cybersecurity Insights

a NIST blog

Search Cybersecurity Insights

Put exact phrase in quotes (e.g., "information technology")
Displaying 76 - 100 of 337

Advancing Product Security: New IoT Guidance and New Engagement

June 24, 2026
Michael Fagan
… are managing growing device complexity, evolving threats, and pressure to turn guidance into operational decisions…so we remain focused on helping stakeholders apply security guidance in ways that are practical and actionable. What’s Been … to SP 800-213 IPD. Learning what stakeholders are seeking in IoT security guidelines, including how to make them more accessible to a …

Welcome to NSTIC Notes, the official blog of the National Program Office implementing the National Strategy for Trusted Identities in Cyberspace!

May 23, 2012
… part of daily life. How we work, gather news, manage errands, and learn – it’s all inextricably linked to the Internet. We have also … you use your credential, enabling higher levels of trust and security.  As President Obama noted when he signed the Strategy, “Giving … Department of Commerce established a National Program Office to lead implementation of NSTIC across the public and private sectors.  In the …

Build Trust and Verify: New funding opportunity to assess our state pilots!

March 10, 2017
Trusted Identities Group
… Last year we issued five grants so state and local jurisdictions could use digital identity technologies to … to quantify the benefits these solutions bring to the organization and end users, share lessons learned, and shed light on how successfully … team to establish baseline metrics and collect ongoing data during implementation, with different timelines for each pilot. We anticipate …

Reflections from the First Cyber AI Profile Workshop

July 30, 2025
Katerina Megas, Julie Nethery Snyder, Bronwyn Patrick
… this past April! This work intends to support the cybersecurity and AI communities — and the input you provided during this workshop is … sessions. During workshop discussions, stakeholders shared that the security of these systems is important, as well as how best to use AI to … of human-in-the-loop processes and training to ensure effective implementation and oversight of AI systems used for cybersecurity. …

Cybersecurity, NIST, and the RSA Conference: what you need to know

May 2, 2018
NIST Cyber
… ! This year’s conference was from April 16-20 th in San Francisco, CA—and thousands of attendees gathered to see presentations, visit booths … identity, cybersecurity education and workforce, mobile and IoT security, cloud, privacy, and virtualization (to name a few). We had a … Officer at RSA) for a session called ‘NCCoE Trusted Cloud: A Secure Solution,’ which highlighted how the NCCoE developed a trusted cloud …

Save the Date: NSTIC identity proofing, authentication, and attributes workshop - January 2016

September 29, 2015
… Ecosystem.’ Participants will collaborate about ways to measure and compare the performance of key solutions in the Identity Ecosystem, … NIST campus in Gaithersburg, Maryland, will bring together leading security practitioners, solution providers, experts, and policy makers from across sectors. With … Save the Date: NSTIC identity proofing, authentication, and attributes workshop - January 2016 …

Big Pilots Drive the Big Picture: Building an Ecosystem of Ecosystems

September 17, 2013
… Webster's calls an ecosystem "the complex of a community of organisms and its environment functioning as an ecological unit." And to all those … of "entities" function together to enhance online choice, efficiency, security, and privacy. To successfully build an ecosystem, we need lots …
Cybersecurity Awareness Month Blog Image

Cybersecurity Awareness Month: What's New at NIST on IOT Security?

October 19, 2020
Barbara Cuthill
… multiple-choice test: What's new at NIST on Internet of Things (IoT) security? (a) SP 800-213:  IOT Device Cybersecurity Guidance for the … For IoT Device Cybersecurity: Next Steps for Securing Federal Systems and those who provided us with feedback on our initial analysis results … least one agency chose to take an IoT-based system off-line until the security of the system and the privacy of information collected could be …
Image: Cybersecurity Insights Blog: Year-In-Review 2020

Cybersecurity Insights Blog: Year-In-Review 2020

December 1, 2020
Kristina Rigopoulos
… anytime soon. Faced with unanticipated challenges, new concerns, and constant adjustments forced by the global pandemic, we were … which comes down to controlling what someone can infer from data, and security, which means controlling who can access the data, must be … their respective advantages and downsides. 3. The Next Generation Security and Privacy Controls— Protecting the Nation’s Critical Assets …

As NSTIC Turns 4…

March 30, 2015
Jeremy Grant
… President Obama called for industry, advocates, agencies, academics, and individuals to collaborate to make online transactions more secure for businesses and consumers alike. Over the past four years, we’ve been privileged to … made these last few years is notable. At a time when concerns about security and privacy continue to keep the Internet from reaching its …

Launching iGov: secure and privacy-enhancing identity authentication and authorization profiles developed on an international scale

October 21, 2015
… International collaboration among the public and private sectors is now expanding with the announcement of a new … profile of OpenID Connect (OIDC) to allow users to authenticate and share consented attribute information in a consistent and … lessons learned of multiple international governments to develop a security and privacy profile that can be utilized across a range of …

All aboard: the NIST Cybersecurity for IoT Program is headed to our next stop! Share your input on where we’re headed during our Future Directions Two-Day Workshop on March 31st.

March 20, 2026
Michael Fagan
… 31 - April 1, 2026 Where: NIST’s Gaithersburg campus!  Registration and Details : HERE Can’t make it? We still want to hear from you – email … themes seen across organizations, and the need to protect product security, data security, and individual privacy. From there, we continued along our …

A Retrospective Look: Advancing standards for strong identity and authentication in the Identity Ecosystem

April 9, 2015
… As the NSTIC pilots develop and implement innovative identity solutions, they are confronting … but more largely it represents a holistic effort to enhance the security and privacy of three standards – OAUTH, OpenID Connect, and … (IOT) offers exciting new possibilities, but also raises privacy and security concerns. NIST is starting to explore how standards may help to …

The IDEF Registry: an open invite to commit to trusted digital identity solutions

June 6, 2016
… with the release of the Identity Ecosystem Framework (IDEF) – and today they’re inviting organizations to publicly put it to good use. … at the Cloud Identity Summit in New Orleans, the IDESG announced the implementation of the IDEF Registry , an online listing service where … will review the form, contact the organization with any questions, and then publish the listing to the Registry. The IDESG's flexible …

How will they measure up? RTI awarded to evaluate the class of 2016 state and local pilots!

September 7, 2017
Mike Garcia
… measurement agency. While the ultimate goal is innovation and adoption in the market, we need to know that the solutions being deployed present an advance for organizations and individuals alike. Measurement is critical to understanding what … team to establish baseline metrics and collect ongoing data during implementation, with different timelines for each pilot. NIST …

What We’ve Heard: Aggregating (Even More!) Stakeholder Feedback

June 25, 2018
Katerina Megas
… of Things (IoT) Program has been engaging with public, private, and academic stakeholders through conferences, meetings, and … the Cybersecurity Coalition, the NIST-Led Discussion on Managing IoT Security and Privacy Risks , and the RSA Peer2Peer session, NIST Discussion on IoT Security and Privacy Risk Considerations . The 9th Annual Internet of …

Mapping out our Destination: Responsible Innovation via the NIST Identity Roadmap

May 22, 2023
Ryan Galluzzo
… RSA Conference week is always a whirlwind. NIST was there front and center last month, and we learned a lot, shared a lot, and made a … guidance, research, or reference implementations: Enhance privacy and security by integrating confidentiality, integrity, and availability … that NIST intends to explore in the coming years: Accelerate implementation and adoption of mobile driver’s license and …
Celebrating 50 years of Cybersecurity at NIST

The Cornerstone of Cybersecurity – Cryptographic Standards and a 50-Year Evolution

May 13, 2022
Lily Chen, Matthew Scholl
… world, cryptographic algorithms are implemented in every device and applied to every link to protect information in transmission and in … constant transition to cryptographic algorithms with higher levels of security strength. As historian David Kahn noted in   The Codebreakers: … the story of mankind.” By the mid-1990s, it was anticipated that the security strength of DES soon would be overtaken by cryptanalysis …
differential privacy blog series banner

Utility Metrics for Differential Privacy: No One-Size-Fits-All

November 12, 2021
Claire McKay Bowen
… privacy, each of which offers some trade-off between privacy and utility. But what does “utility” mean, and how do we know we are preserving it? To discuss this topic, we are … series, Claire McKay Bowen, Lead Data Scientist for Privacy and Data Security at the Urban Institute. Claire’s research focuses on assessing …

Back to Basics: What’s multi-factor authentication - and why should I care?

June 16, 2016
… not so secure way to log in to your bank account: enter your username and that familiar password you probably use for most of your online … MFA, sometimes referred to as two-factor authentication or 2FA, is a security enhancement that allows you to present two pieces of evidence – … Your credentials must come from two different categories to enhance security - so entering two different passwords would not be considered …

BREAKING NEWS: 2016 state and local government pilot opportunity just announced

December 18, 2015
… satisfaction with state government services are: fast, simple, and efficient processes; the availability of online options for completing interactions; and the transparency of information. Secure and convenient digital … it fails to protect them from fraudulent access. To combat the many security incidents affecting individuals, President Obama released …
Was this page helpful?