U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Information Technology

Cybersecurity and privacy

Search Publications

Search Title, Abstract, Conference, Citation, Keyword or Author
  • Published Date
Displaying 1026 - 1050 of 1521

Cyber Security Standards

June 15, 2009
Author(s)
Karen A. Scarfone, Daniel R. Benigni, Timothy Grance
The goal of cyber security standards is to improve the security of information technology (IT) systems, networks, and critical infrastructures. A cyber security standard defines both functional and assurance requirements within a product, system, process

Directions in Security Metrics Research

April 30, 2009
Author(s)
Wayne Jansen
More than 100 years ago, Lord Kelvin insightfully observed that measurement is vital to deep knowledge and understanding in physical science. During the last few decades, researchers have made various attempts to develop measures and systems of measurement

A Location-Based Mechanism for Mobile Device Security

March 31, 2009
Author(s)
Wayne Jansen, Vlad Korolev
While mobile handheld devices, such as cell phones and PDAs, provide productivity benefits, they also pose new risks. A vital safeguard against unauthorized access to a device s contents is authentication. This paper describes a location-based

Making the Case for EAP Channel Bindings

March 30, 2009
Author(s)
T. C. Clancy, Katrin Hoeper
In current networks that use EAP and AAA for authenticated admission control, such as WiFi, WiMAX, and various 3G internetworking protocols, a malicious base station can advertise false information to prospective users in an effort to manipulate network

Surviving Insecure IT: Effective Patch Management

March 21, 2009
Author(s)
Simon Liu, D. Richard Kuhn, Hart Rossman
The amount of time to protect enterprise systems against potential vulnerability continues to shrink. Enterprises need an effective patch management mechanism to survive the insecure IT environment. Effective patch management is a systematic and repeatable

Computer Security Division 2008 Annual Report

March 16, 2009
Author(s)
Patrick D. O'Reilly
This annual report covers the work conducted within the National Institute of Standards and Technology's Computer Security Division during Fiscal Year 2008. It discusses all projects and programs within the Division, staff highlights, and publications.

Randomized Hashing for Digital Signatures

February 25, 2009
Author(s)
Quynh H. Dang
NIST-approved digital signature algorithms require the use of an approved cryptographic hash function in the generation and verification of signatures. Approved cryptographic hash functions and digital signature algorithms can be found in FIPS 180-3

Security of Cell Phones and PDAs

January 29, 2009
Author(s)
Shirley M. Radack
This bulletin summarizes the information disseminated in NIST Special Publication (SP) 800-124, Guidelines on Cell Phone and PDA Security: Recommendations of the National Institute of Standards and Technology, which was written by Wayne Jansen and Karen

Introducing "Insecure IT"

January 20, 2009
Author(s)
David R. Kuhn, Hart Rossman, Simon Liu
This article introduces a new department for IT Professional that will cover security in IT systems, ranging from desktops to global e-commerce networks. Our goal is to offer ideas to improve IT security, both by looking at ways it can go wrong as well as

Symmetric Key Injection onto Smart Cards

December 22, 2008
Author(s)
David A. Cooper, William I. MacGregor
This paper describes architectures for securely injecting secret keys onto smart cards. Specifically, this paper details key injection architectures based on the identity credentials available on the Personal Identify Verification (PIV) Card. The primary

Property Verification for Generic Access Control Models

December 20, 2008
Author(s)
Chung Tong Hu, David R. Kuhn, Tao Xie
To formally and precisely capture the security properties that access control should adhere to, access control models are usually written to bridge the rather wide gap in abstraction between policies and mechanisms. In this paper, we propose a new general

A Threat Analysis on UOCAVA Voting Systems

December 19, 2008
Author(s)
Andrew R. Regenscheid, Nelson E. Hastings
This report contains the results of NIST s research into technologies to improve the voting process for United States citizens living overseas. It splits the overseas voting process into three stages: voter registration and ballot request, blank ballot

Guide to Information Security Testing and Assessment

December 18, 2008
Author(s)
Shirley M. Radack
This bulletin summarizes information disseminated in NIST Special Publication (SP) 800-115, Technical Guide to Information Security Testing and Assessment: Recommendations of the National Institute of Standards and Technology, which was written by Karen

Two New Efficient CCA-Secure Online Ciphers : MHCBC and MCBC

December 17, 2008
Author(s)
Mridul Nandi
Online ciphers are those ciphers whose ciphertexts can be computed in an online manner. HCBC1 and HCBC2 are two known examples of Hash Cipher Block Chaining online ciphers. HCBC1 is secure against chosen plaintext adversary (or called CPA-secure) whereas

Security Challenges in Seamless Mobility - How to ``Handover'' the Keys?

November 30, 2008
Author(s)
Katrin Hoeper, Lidong Chen, Antonio Izquierdo Manzanares, Nada T. Golmie
In this paper, we discuss key management challenges for seamless handovers across heterogeneous wireless networks. We focus on fast access authentication protocols that allow expedited network entry by utilizing existing keying material from previous

A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS)

November 20, 2008
Author(s)
William I. MacGregor, Ketan L. Mehta, David A. Cooper, Karen A. Scarfone
This document provides best practice guidelines for integrating the PIV Card with the physical access control systems (PACS) that authenticate the cardholders in Federal facilities. Specifically, this document recommends a risk-based approach for selecting

Recommendation for Key Derivation Using Pseudorandom Functions

November 12, 2008
Author(s)
Lidong Chen
This Recommendation specifies techniques for the derivation of additional keying material from a secret key, either established through a key establishment scheme or shared through some other manner, using pseudorandom functions.
Was this page helpful?