U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Information Technology

Cybersecurity and privacy

Search Publications

Search Title, Abstract, Conference, Citation, Keyword or Author
  • Published Date
Displaying 626 - 650 of 1509

Towards a "Periodic Table" of Bugs

April 8, 2015
Author(s)
Irena Bojanova
Our vision for a "periodic table" of bugs is a "natural" organization of a catalog or dictionary or taxonomy to describe software weaknesses and vulnerabilities. Such an organization will help the community to: a) more closely explain the nature of

Analysis of VAES3 (FF2)

April 2, 2015
Author(s)
Morris J. Dworkin, Ray A. Perlner
The National Institute of Standards and Technology (NIST) specified three methods for format-preserving encryption (FPE) in Draft NIST Special Publication (SP) 800-38G, which was released for public comment in July, 2013. Each method was a mode of

Considerations for Identity Management in Public Safety Networks

March 30, 2015
Author(s)
Nelson Hastings, Joshua M. Franklin
This document analyzes approaches to identity management for public safety networks in an effort to assist individuals developing technical and policy requirements for public safety use. These considerations are scoped into the context of their

Guidance for Secure Authorization of Mobile Applications in the Corporate Environment

March 19, 2015
Author(s)
Athanasios T. Karygiannis, Stephen Quirolgico, Larry Feldman, Gregory A. Witte
This bulletin provides an overview of NIST Special Publication (SP) 800-163, "Vetting the Security of Mobile Applications." The NIST SP helps organizations understand the process for vetting the security of mobile applications, plan for the implementation

Advanced Metering Infrastructure Smart Meter Upgradeability Test Framework

March 2, 2015
Author(s)
Michaela Iorga, Scott Shorter
As electric utilities turn to Advanced Metering Infrastructures (AMIs) to promote the development and deployment of the Smart Grid, one aspect that can benefit from standardization is the upgradeability of Smart Meters. The National Electrical

Fuzz Testing for Software Assurance

March 1, 2015
Author(s)
Vadim Okun, Elizabeth N. Fong
Fuzz Testing, or fuzzing, is a software testing technique that involves providing invalid, unexpected, or random test inputs to the software system under test. The system is then monitored for crashes and other undesirable behavior. Fuzz testing can be

Risk Management for Replication Devices

February 23, 2015
Author(s)
Kelley L. Dempsey, Celia Paulsen
This publication provides guidance on protecting the confidentiality, integrity, and availability of information processed, stored, or transmitted on replication devices (RDs). It suggests appropriate countermeasures in the context of the System

NIST Special Publication 800-88, Revision 1: Guidelines for Media Sanitization

February 5, 2015
Author(s)
Andrew R. Regenscheid, Larry Feldman, Gregory A. Witte
NIST has published an updated version of Special Publication (SP) 800-88, Guidelines for Media Sanitization. SP 800-88 Revision 1 provides guidance to assist organizations and system owners in making practical sanitization decisions based on the

IT Security

February 4, 2015
Author(s)
Morris Chang, D. Richard Kuhn, Timothy Weil
How can IT professionals adapt to ever-changing security challenges quickly and without draining their organizations' resources? Articles in this issue highlight emerging trends and suggest ways to approach and address cybersecurity challenges. [guest

Report on Pairing-based Cryptography

February 3, 2015
Author(s)
Dustin Moody, Rene C. Peralta, Ray A. Perlner, Andrew R. Regenscheid, Allen L. Roginsky, Lidong Chen
This report summarizes study results on pairing-based cryptography. The main purpose of the study is to form NIST’s position on standardizing and recommending pairing-based cryptography schemes currently published in research literature and standardized in

A Logic Based Network Forensics Model for Evidence Analysis

January 28, 2015
Author(s)
Changwei Liu, Anoop Singhal, Duminda Wijesekera
Many attackers tend to use sophisticated multi-stage and/or multi-host attack techniques and anti-forensic tools to cover their traces. Due to the limitations of current intrusion detection and network forensic analysis tools, reconstructing attack

Vetting the Security of Mobile Applications

January 26, 2015
Author(s)
Stephen Quirolgico, Jeffrey M. Voas, Tom T. Karygiannis, Christoph Michael, Karen Scarfone
The purpose of this document is to help organizations (1) understand the process for vetting the security of mobile applications, (2) plan for the implementation of an app vetting process, (3) develop app security requirements, (4) understand the types of

Public Safety Mobile Application Security Requirements Workshop Summary

January 22, 2015
Author(s)
Michael Ogata, Barbara Guttman, Nelson Hastings
This document captures the input received from the half-day workshop titled "Public Safety Mobile Application Security Requirements" organized by the Association of Public-Safety Communications Officials (APCO) International, in cooperation with FirstNet

How Random is Your RNG?

January 18, 2015
Author(s)
Meltem Sonmez Turan, John M. Kelsey, Kerry A. McKay
Cryptographic primitives need random numbers to protect your data. Random numbers are used for generating secret keys, nonces, random paddings, initialization vectors, salts, etc. Deterministic pseudorandom number generators are useful, but they still need

Deployment-driven Security Configuration for Virtual Networks

December 28, 2014
Author(s)
Ramaswamy Chandramouli
Virtualized Infrastructures are increasingly deployed in many data centers. One of the key components of this virtualized infrastructure is the virtual network - a software-defined communication fabric that links together the various Virtual Machines (VMs)
Was this page helpful?