U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Information Technology

Cybersecurity and privacy

Search Publications

Search Title, Abstract, Conference, Citation, Keyword or Author
  • Published Date
Displaying 626 - 650 of 1521

Cardholder Authentication for the PIV Digital Signature Key

June 18, 2015
Author(s)
William Polk, Hildegard Ferraiolo, David Cooper
FIPS 201-2 requires explicit user action by the Personal Identity Verification (PIV) cardholder as a condition for use of the digital signature key stored on the card. This document clarifies the requirement for explicit user action to encourage the

Increasing Visibility and Control of Your ICT Supply Chains

June 15, 2015
Author(s)
Jon M. Boyens, Celia Paulsen, Larry Feldman, Greg Witte
This bulletin summarizes the information presented in NIST SP 800-161, Supply Chain Management Practices for Federal Information Systems and Organizations, written by Jon Boyens and Celia Paulsen. The publication provides guidance to federal agencies on

Guide to Industrial Control Systems (ICS) Security

June 3, 2015
Author(s)
Keith A. Stouffer, Victoria Y. Pillitteri, Suzanne Lightman, Marshall Abrams, Adam Hahn
This document provides guidance on how to secure Industrial Control Systems (ICS), including Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and other control system configurations such as Programmable Logic

Evaluating Bug Finders: Test and Measurement of Static Code Analyzers

May 23, 2015
Author(s)
Aurelien M. Delaitre, Bertrand C. Stivalet, Elizabeth N. Fong, Vadim Okun
Software static analysis is one of many options for finding bugs in software. Like compilers, static analyzers take a program as input. This paper covers tools that examine source code--without executing it--and output bug reports. Static analysis is a

Authentication Considerations for Public Safety Mobile Networks

May 14, 2015
Author(s)
Nelson Hastings, Joshua M. Franklin, Larry Feldman, Greg Witte
This bulletin summarizes the information presented in NISTIR 8014, Considerations for Identity Management in Public Safety Mobile Networks, written by Nelson Hastings and Joshua Franklin. The publication analyzes approaches to identity management for

Evasion-Resistant Network Scan Detection

May 9, 2015
Author(s)
Richard Harang, Peter Mell
Popular network scan detection algorithms operate through evaluating external sources for unusual connection patterns and traffic rates. Research has revealed evasive tactics that enable full circumvention of existing approaches (specifically the widely

Is Your Replication Device Making An Extra Copy For Someone Else?

April 16, 2015
Author(s)
Celia Paulsen, Larry Feldman, Gregory A. Witte
This bulletin summarizes the information presented in NISTIR 8023, Risk Management for Replication Devices, written by Celia Paulsen and Kelley Dempsey. The publication provides guidance on protecting the confidentiality, integrity, and availability of

Password Entry Errors: Memory or Motor?

April 9, 2015
Author(s)
Kristen Greene, Frank Tamborello
As we increasingly rely upon our computer information systems to store and operate on sensitive information, the methods we use to authenticate user identity also become more important. One of the most important such methods is the password. However

Towards a "Periodic Table" of Bugs

April 8, 2015
Author(s)
Irena Bojanova
Our vision for a "periodic table" of bugs is a "natural" organization of a catalog or dictionary or taxonomy to describe software weaknesses and vulnerabilities. Such an organization will help the community to: a) more closely explain the nature of

Analysis of VAES3 (FF2)

April 2, 2015
Author(s)
Morris J. Dworkin, Ray A. Perlner
The National Institute of Standards and Technology (NIST) specified three methods for format-preserving encryption (FPE) in Draft NIST Special Publication (SP) 800-38G, which was released for public comment in July, 2013. Each method was a mode of

Considerations for Identity Management in Public Safety Networks

March 30, 2015
Author(s)
Nelson Hastings, Joshua M. Franklin
This document analyzes approaches to identity management for public safety networks in an effort to assist individuals developing technical and policy requirements for public safety use. These considerations are scoped into the context of their

Guidance for Secure Authorization of Mobile Applications in the Corporate Environment

March 19, 2015
Author(s)
Athanasios T. Karygiannis, Stephen Quirolgico, Larry Feldman, Gregory A. Witte
This bulletin provides an overview of NIST Special Publication (SP) 800-163, "Vetting the Security of Mobile Applications." The NIST SP helps organizations understand the process for vetting the security of mobile applications, plan for the implementation

Advanced Metering Infrastructure Smart Meter Upgradeability Test Framework

March 2, 2015
Author(s)
Michaela Iorga, Scott Shorter
As electric utilities turn to Advanced Metering Infrastructures (AMIs) to promote the development and deployment of the Smart Grid, one aspect that can benefit from standardization is the upgradeability of Smart Meters. The National Electrical

Fuzz Testing for Software Assurance

March 1, 2015
Author(s)
Vadim Okun, Elizabeth N. Fong
Fuzz Testing, or fuzzing, is a software testing technique that involves providing invalid, unexpected, or random test inputs to the software system under test. The system is then monitored for crashes and other undesirable behavior. Fuzz testing can be

Risk Management for Replication Devices

February 23, 2015
Author(s)
Kelley L. Dempsey, Celia Paulsen
This publication provides guidance on protecting the confidentiality, integrity, and availability of information processed, stored, or transmitted on replication devices (RDs). It suggests appropriate countermeasures in the context of the System

NIST Special Publication 800-88, Revision 1: Guidelines for Media Sanitization

February 5, 2015
Author(s)
Andrew R. Regenscheid, Larry Feldman, Gregory A. Witte
NIST has published an updated version of Special Publication (SP) 800-88, Guidelines for Media Sanitization. SP 800-88 Revision 1 provides guidance to assist organizations and system owners in making practical sanitization decisions based on the
Was this page helpful?