U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Information Technology

Cybersecurity and privacy

Search Publications

Search Title, Abstract, Conference, Citation, Keyword or Author
  • Published Date
Displaying 901 - 925 of 1521

Computer Security Division 2010 Annual Report

May 31, 2011
Author(s)
Patrick D. O'Reilly
This annual report covers the work conducted within the National Institute of Standards and Technology's Computer Security Division during Fiscal Year 2010. It discusses all projects and programs within the Division, staff highlights, and publications.

Of Passwords and People: Measuring the Effect of Password-Composition Policies

May 11, 2011
Author(s)
Serge M. Egelman, Saranga Komanduri, Richard Shay, Patrick G. Kelley, Michelle L. Mazurek, Lujo Bauer, Nicolas Christin, Lorrie F. Cranor
Text-based passwords are the most common mechanism for authenticating humans to computer systems. To prevent users from picking passwords that are too easy for an adversary to guess, system administrators adopt password-composition policies (e.g

Encryption Basics

May 2, 2011
Author(s)
Kevin M. Stine, Quynh H. Dang
Healthcare and health information technology professionals are entrusted with patient data which, because of its personal nature, requires protection to ensure its confidentiality. To provide this protection, these professionals frequently look to commonly

BIOS Protection Guidelines

April 29, 2011
Author(s)
David Cooper, William Polk, Andrew Regenscheid, Murugiah Souppaya
This document provides guidelines for preventing the unauthorized modification of Basic Input/Output System (BIOS) firmware on PC client systems. Unauthorized modification of BIOS firmware by malicious software constitutes a significant threat because of

NIST Handbook 150-17, NVLAP Cryptographic and Security Testing

April 29, 2011
Author(s)
Dana S. Leaman
NIST Handbook 150-17 presents technical requirements and guidance for the accreditation of laboratories under the National Voluntary Laboratory Accreditation Program (NVLAP) Cryptogrpahic and Security Testing program. It is intended for information and use

Toward Privacy Standards Based on Empirical Studies

April 28, 2011
Author(s)
Serge M. Egelman, Erika McCallister
In this paper, we argue that if privacy standards are created to guide “do-not-track” technologies, it is imperative that these standards are created with the primary stakeholder in mind: the data subject. Previous privacy and security standards have been

Specification for the Open Checklist Interactive Language (OCIL) Version 2.0

April 7, 2011
Author(s)
David A. Waltermire, Karen Scarfone, Maria Casipe
This report defines version 2.0 of the Open Checklist Interactive Language (OCIL). The intent of OCIL is to provide a standardized basis for expressing questionnaires and related information, such as answers to questions and final questionnaire results, so

Research Directions in Security Metrics

April 4, 2011
Author(s)
Wayne Jansen
More than 100 years ago, Lord Kelvin observed that measurement is vital to deep knowledge and understanding in physical science. During the last few decades, researchers have made various attempts to develop measures and systems of measurement for computer

Thoughts on Higher Education and Scientific Research

March 22, 2011
Author(s)
Jeffrey M. Voas, George Hurlburt, Keith Miller, Phillip Laplante, Bret Michael
The notion of a "tipping point" isn't new, al though the concept has relevance in differing ways. Academia seems to be at a tipping point, whereby the steady state of disciplinary specialization is about to give way to an interdisciplinary, collaborative

Model Checking for Verification of Mandatory Access Control Models and Properties

February 28, 2011
Author(s)
Chung Tong Hu, David R. Kuhn, Tao Xie, J Hwang
Mandatory access control (MAC) mechanisms control which users or processes have access to which resources in a system. MAC policies are increasingly specified to facilitate managing and maintaining access control. However, the correct specification of the

NIST SP 500-268, Source Code Security Analysis Tool Function Specification Version 1.1

February 28, 2011
Author(s)
Elizabeth N. Fong, Paul E. Black, Michael J. Kass, Hsiao-Ming M. Koo
Software assurance tools are a fundamental resource to improve assurance in today's software applications. Some tools analyze software requirements or design models to help determine if an application is secure. Others analyze source code or executables

Guide to Using Vulnerability Naming Schemes

February 25, 2011
Author(s)
David A. Waltermire, Karen Scarfone
This publication provides recommendations for using two vulnerability naming schemes: Common Vulnerabilities and Exposures (CVE) and Common Configuration Enumeration (CCE). Draft SP 800-51 Revision 1 gives an introduction to both naming schemes and makes

National Checklist Program for IT Products Guidelines for Checklist Users and Developers

February 25, 2011
Author(s)
Stephen D. Quinn, Murugiah P. Souppaya, Melanie Cook, Karen Scarfone
Special Publication 800-70 Revision 2 - National Checklist Program for IT Products Guidelines for Checklist Users and Developers describes security configuration checklists and their benefits, and it explains how to use the NIST National Checklist Program

Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition

February 23, 2011
Author(s)
Meltem Sonmez Turan, Ray A. Perlner, Lawrence E. Bassham, William E. Burr, Dong H. Chang, Shu-jen H. Chang, Morris J. Dworkin, John M. Kelsey, Souradyuti Paul, Rene C. Peralta
The National Institute of Standards and Technology (NIST) opened a public competition on November 2, 2007 to develop a new cryptographic hash algorithm - SHA-3, which will augment the hash algorithms currently specified in the Federal Information

Glossary of Key Information Security Terms

February 17, 2011
Author(s)
Richard L. Kissel
This glossary of key information security terms has been extracted from NIST Federal Information Processing Standards (FIPS), Special Publication (SP) 800 series, NIST Interagency Report (NIST IR) series, and the Committee for National Security Systems

Who is Who? Biometrics provides answers for public and private sectors

February 10, 2011
Author(s)
Fernando L. Podio
One of the critical issues related to secured Information Technology (IT) systems and applications is the verification of the users identity. Biometrics provides for secure transactions, positive identification and augmentation to human judgment. For

Arithmetic Progressions on Edwards Curves

February 8, 2011
Author(s)
Dustin Moody
We look at arithmetic progressions on elliptic curves known as Edwards curves. By an arithmetic progression on an elliptic curve, we mean that the x-coordinates of a sequence of rational points on the curve form an arithmetic progression. Previous work has

Managing Security: The Security Content Automation Protocol

February 4, 2011
Author(s)
Shirley M. Radack, D. Richard Kuhn
Managing information systems security is an expensive and challenging task. Many different and complex software components- including firmware, operating systems, and applications-must be configured securely, patched when needed, and continuously monitored
Was this page helpful?