U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Information Technology

Cybersecurity and privacy

Search Publications

Search Title, Abstract, Conference, Citation, Keyword or Author
  • Published Date
Displaying 1051 - 1075 of 1509

Forensic Protocol Filtering of Phone Managers

July 24, 2008
Author(s)
Wayne Jansen, Aurelien M. Delaitre
Phone managers are non-forensic tools sometimes used by forensic investigators to recover data from a cell phone when no suitable forensic tool is available for the device. While precautions can be taken to preserve the integrity of data on a cell phone

Web Services Security: Techniques and Challenges (Extended Abstract)

July 21, 2008
Author(s)
Anoop Singhal
Web services-based computing is currently an important driver for the software industry. While several standards bodies (such as W3C and OASIS) are laying the foundation for Web services security, several research problems must be solved to make secure Web

An Attack Graph Based Probabilistic Security Metric

July 16, 2008
Author(s)
Lingyu Wang, Tania Islam, Tao Long, Anoop Singhal, Sushil Jajodia
To protect critical resources in today's networked environments, it is desirable to quantify the likelihood of potential multi-step attacks that combine multiple vulnerabilities. This now becomes feasible due to a model of causal relationships between

Performance Measurement Guide for Information Security

July 16, 2008
Author(s)
Elizabeth Chew, Marianne M. Swanson, Kevin M. Stine, N Bartol, Anthony Brown, W Robinson
This document provides guidance on how an organization, through the use of metrics, identifies the adequacy of in-place security controls, policies, and procedures. It provides an approach to help management decide where to invest in additional security

The Keyed-Hash Message Authentication Code (HMAC)

July 16, 2008
Author(s)
National Institute of Standards and Technology (NIST), Quynh Dang
This Standard describes a keyed-hash message authentication code (HMAC), a mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative Approved cryptographic hash function, in combination with a shared

Dynamic Routing and Congestion Control Through Random Assignment of Routes

July 15, 2008
Author(s)
Fern Y. Hunt, Vladimir V. Marbukh
We introduce an algorithm for maximizing utility through congestion control and random allocation of routes to users. The allocation is defined by a probability distribution whose degree of randomness as measured by its entropy, is controlled. We seek to

A Framework for Measuring the Vulnerability of Hosts

June 30, 2008
Author(s)
Karen A. Scarfone, Timothy Grance
This paper proposes a framework for measuring the vulnerability of individual hosts based on current and historical operational data for vulnerabilities and attacks. Previous approaches have not been scalable because they relied on complex manually

Policy Specification and Enforcement for Smart ID Cards Deployment

June 3, 2008
Author(s)
Ramaswamy Chandramouli
Deployment of Smart Cards for Identity Verification requires collection of credentials and provisioning of credentials from and to heterogeneous and sometimes legacy systems. To facilitate this process, a centralized identity store called Identity

Practical Combinatorial Testing: Beyond Pairwise

June 1, 2008
Author(s)
David R. Kuhn, Yu Lei, Raghu N. Kacker
With new algorithms and tools, developers can apply high-strength combinatorial testing to detect elusive failures that occur only when multiple components interact. In pairwise testing, all possible pairs of parameter values are covered by at least one

The NIST Hash Competition

May 20, 2008
Author(s)
William E. Burr
Since the discovery of collision attacks against several well known cryptographic hash functions in 2004 there has been a rush of new cryptanalytic results that cast doubt on our current hash function standards. The relatively new NIST SHA-2 standards are

Tight Bounds for the Multiplicative Complexity of Symmetric Functions

April 28, 2008
Author(s)
Joan Boyar, Rene Peralta
The multiplicative complexity of a Boolean function f is defined as the minimum number of binary conjunction (AND) gates required to construct a circuit representing f , when only exclusive-or, conjunction and negation gates may be used. This article

Codes for the Identification of Federal and Federally-Assisted Organization

April 25, 2008
Author(s)
William C. Barker, Hildegard Ferraiolo
The Homeland Security Presidential Directive HSPD-12 called for new standards to be adopted governing the interoperable use of identity credentials to allow physical and logical access to Federal government locations and systems. The Personal Identity

Second Preimage Attacks on Dithered Hash Functions

April 17, 2008
Author(s)
Elena Andreeva, Charles Bouillaguet, Pierre-Alain Fouque, Jonathan J. Hoch, John M. Kelsey, Adi Shamir, Sebastien Zimmer
We develop a new generic long-message second preimage attack, based on combining the techniques in the second preimage attacks of Dean Dean99} and Kelsey and Schneier KS05} with the herding attack of Kelsey and Kohno KK06}. We show that these generic

Computer Security Division 2007 Annual Report

April 1, 2008
Author(s)
Kevin M. Stine, Mark Wilson
Title III of the E-Government Act of 2002, entitled the Federal Information Security Management Act (FISMA) of 2002, requires NIST to prepare an annual public report on activities undertaken in the previous year, and planned for the coming year, to carry

A Two-Tier Bloom Filter to Achieve Faster Membership Testing

March 27, 2008
Author(s)
Miguel Jimeno, K Christensen, Allen L. Roginsky
Testing for element membership in a Bloom Filter requires hashing of a test element (e.g., a string) and multiple look-ups in memory. A design of a new two-tier Bloom filter with on-chip hash functions and cache is described. For elements with a heavy

Handling Computer Security Incidents: NIST Issues Updated Guidelines

March 27, 2008
Author(s)
Shirley M. Radack
This bulletin summarizes information disseminated in revised NIST Special Publication (SP) 800-61-1, Computer Security Incident Handling Guide: Recommendations of the National Institute of Standards and Technology. Written by Karen Scarfone and Tim Grance

Guidelines on Active Content and Mobile Code

March 7, 2008
Author(s)
Wayne Jansen, Theodore Winograd, Karen A. Scarfone
Active content technologies allow code, in the form of a script, macro, or other kind of portable instruction representation, to execute when the document is rendered. Like any technology, active content can be used to deliver essential services, but it
Was this page helpful?