U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Information Technology

Cybersecurity and privacy

Search Publications

Search Title, Abstract, Conference, Citation, Keyword or Author
  • Published Date
Displaying 551 - 575 of 1521

Demystifiying the Internet of Things

June 27, 2016
Author(s)
Jeffrey M. Voas
This short column introduces the need for a foundational science to the Internet of Things (IoT). It introduces the notion of primitives and elements, and their relationship to trustworthiness.

Metamorphic Testing for Cybersecurity

June 27, 2016
Author(s)
Tsong Yueh Chen, Fei-Ching Kuo, Wenjuan Ma, Willy Susilo, Dave Towey, Jeff Voas, Zhi Q. Zhou
Testing is a major approach for the detection of software defects, including security vulnerabilities. This article introduces metamorphic testing (MT), a relatively new testing method, and discusses how the new perspective of MT can help to conduct

Estimating t-way Fault Profile Evolution During Testing

June 10, 2016
Author(s)
Raghu N. Kacker, David R. Kuhn
Empirical studies have shown that most software interaction faults involve one or two variables interacting, with progressively fewer triggered by three or more, and no failure has been reported involving more than six variables interacting. This paper

Derived PIV Application and Data Model Test Guidelines

June 6, 2016
Author(s)
David Cooper, Hildegard Ferraiolo, Ramaswamy Chandramouli, Nabil Ghadiali, Jason Mohler, Steven Brady
NIST Special Publication (SP) 800-157 contains technical guidelines for the implementation of standards-based, secure, reliable, interoperable Public Key Infrastructure (PKI)-based identity credentials that are issued for mobile devices by federal

Extending Network Security into Virtualized Infrastructure

June 3, 2016
Author(s)
Ramaswamy Chandramouli, Larry Feldman, Gregory A. Witte
This bulletin summarizes the information presented in NIST Special Publication (SP) 800-125B, "Secure Virtual Network Configuration for Virtual Machine (VM) Protection." That publication provides an analysis of various virtual network configuration options

Multicast Delayed Authentication For Streaming Synchrophasor Data in the Smart Grid

May 30, 2016
Author(s)
Sergio Camara, Dhananjay Anand, Victoria Yan Pillitteri, Luiz F. Carmo
Multicast authentication of synchrophasor data is challenging due to the design requirements of Smart Grid monitoring systems such as low security overhead, tolerance of lossy networks, time-criticality and high data rates. In this work, we propose inf

Representation of PIV Chain-of-Trust for Import and Export

May 20, 2016
Author(s)
Hildegard Ferraiolo, Ramaswamy Chandramouli, Ketan L. Mehta, Jason Mohler, Stephen Skordinski, Steven Brady
This document provides a common XML-based data representation of a chain-of-trust record to facilitate the exchange of PIV Card enrollment data. The exchanged record is the basis to personalize a PIV Card for a transferred employee and also for service

On various nonlinearity measures for boolean functions

May 19, 2016
Author(s)
Joan Boyar, Magnus G. Find, Rene Peralta
A necessary condition for the security of cryptographic functions is to be "sufficiently distant" from linear, and cryptographers have proposed several measures for this distance. We show that six common measures, nonlinearity, algebraic degree

They Know Your Weaknesses Do You?: Reintroducing Common Weakness Enumeration

May 1, 2016
Author(s)
Yan Wu, Yaacov Yesha, Irena Bojanova, Paul E. Black
Knowing what makes your software systems vulnerable to attacks will be exceptionally critical in the emerging future of interdependent clouds, cyber-physical systems, mobile apps, and big data sets. The Common Weakness Enumeration (CWE) is a respectable

Report on Post-Quantum Cryptography

April 28, 2016
Author(s)
Lidong Chen, Stephen P. Jordan, Yi-Kai Liu, Dustin Moody, Rene C. Peralta, Ray A. Perlner, Daniel C. Smith-Tone
In recent years, there has been a substantial amount of research on quantum computers - machines that exploit quantum mechanical phenomena to solve mathematical problems that are difficult or intractable for conventional computers. If large-scale quantum

Baseline Tailor User Guide

April 25, 2016
Author(s)
Joshua Lubell
This guide describes how to use Baseline Tailor, a software tool for navigating the United States Government's Cybersecurity Framework and for tailoring the National Institute of Standards and Technology Special Publication 800-53 Revision 4 security

Measuring the Usability and Security of Permuted Passwords on Mobile Platforms

April 25, 2016
Author(s)
Kristen K. Greene, John M. Kelsey, Joshua M. Franklin
Password entry on mobile devices significantly impacts both usability and security, but there is a lack of usable security research in this area, specifically for complex password entry. To address this research gap, we set out to assign strength metrics

Guidelines for the Creation of Interoperable Software Identification (SWID) Tags

April 22, 2016
Author(s)
David A. Waltermire, Brant Cheikes, Larry Feldman, Gregory A. Witte
This report provides an overview of the capabilities and usage of software identification (SWID) tags as part of a comprehensive software lifecycle. As instantiated in the International Organization for Standardization/International Electrotechnical

Best Practices for Privileged User PIV Authentication

April 21, 2016
Author(s)
Hildegard Ferraiolo, David Cooper, Andrew R. Regenscheid, Karen Scarfone, Murugiah P. Souppaya
The Cybersecurity Strategy and Implementation Plan (CSIP), published by the Office of Management and Budget (OMB) on October 30, 2015, requires that federal agencies use Personal Identity Verification (PIV) credentials for authenticating privileged users

New NIST Security Standard Can Protect Credit Cards, Health Information

April 14, 2016
Author(s)
Morris J. Dworkin, Larry Feldman, Gregory A. Witte
This bulletin summarizes the information presented in NIST Special Publication (SP) 800-38G, "Recommendation for Block Cipher Modes of Operation: Methods for Format-Preserving Encryption." The publication specifies two methods for format-preserving

PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 compliance)

April 13, 2016
Author(s)
David Cooper, Hildegard Ferraiolo, Ramaswamy Chandramouli, Jason Mohler
NIST Special Publication (SP) 800-73 contains the technical specifications to interface with the smart card to retrieve and use the Personal Identity Verification (PIV) identity credentials. This document, SP 800-85A, contains the test assertions and test

NIST Cryptographic Standards and Guidelines Development Process

March 31, 2016
Author(s)
Andrew R. Regenscheid
This document describes the principles, processes and procedures that drive cryptographic standards and guidelines development efforts at the National Institute of Standards and Technology. This document reflects public comments received on two earlier

Using a Capability Oriented Methodology to Build Your Cloud Ecosystem

March 31, 2016
Author(s)
Michaela Iorga, Karen Scarfone
Organizations often struggle to capture the necessary functional capabilities for each cloud-based solution adopted for their information systems. Identifying, defining, selecting, and prioritizing these functional capabilities and the security components

Analysis of Virtual Networking Options for Securing Virtual Machines

March 20, 2016
Author(s)
Ramaswamy Chandramouli
Virtual Machines (VMs) constitute the primary category of resources to be protected in virtualized infrastructures. Out of the two types of protection for VMs -- Host-level and Network-level -- it is the approaches for the Network-level protection that are
Was this page helpful?