U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications

NIST Authors in Bold

Displaying 176 - 200 of 411

Secure Domain Name System (DNS) Deployment Guide

September 18, 2013
Author(s)
Ramaswamy Chandramouli, Scott W. Rose
The Domain Name System (DNS) is a distributed computing system that enables access to Internet resources by user-friendly domain names rather than IP addresses, by translating domain names to IP addresses and back. The DNS infrastructure is made up of

A Framework for Designing Cryptographic Key Management Systems

August 15, 2013
Author(s)
Elaine B. Barker, Miles Smid, Dennis Branstad, Santosh Chokhani
This Framework for Designing Cryptographic Key Management Systems (CKMS) contains topics that should be considered by a CKMS designer when developing a CKMS design specification. For each topic, there are one or more documentation requirements that need to

Computer Security Division 2012 Annual Report

July 22, 2013
Author(s)
Patrick D. O'Reilly
Title III of the E-Government Act of 2002, entitled the Federal Information Security Management Act (FISMA) of 2002, requires NIST to prepare an annual public report on activities undertaken in the previous year, and planned for the coming year, to carry

Guide to Enterprise Patch Management Technologies

July 22, 2013
Author(s)
Murugiah P. Souppaya, Karen Scarfone
Patch management is the process for identifying, acquiring, installing, and verifying patches for products and systems. Patches correct security and functionality problems in software and firmware. There are several challenges that complicate patch

Guide to Malware Incident Prevention and Handling for Desktops and Laptops

July 22, 2013
Author(s)
Murugiah P. Souppaya, Karen Scarfone
Malware, also known as malicious code, refers to a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the

Biometric Specifications for Personal Identity Verification

July 11, 2013
Author(s)
Patrick J. Grother, Wayne J. Salamon, Ramaswamy Chandramouli
Homeland Security Presidential Directive HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors [HSPD-12], called for new standards to be adopted governing interoperable use of identity credentials to allow physical and

Guidelines for Managing the Security of Mobile Devices in the Enterprise

June 21, 2013
Author(s)
Murugiah P. Souppaya, Karen Scarfone
Mobile devices, such as smart phones and tablets, typically need to support multiple security objectives: confidentiality, integrity, and availability. To achieve these objectives, mobile devices should be secured against a variety of threats. The purpose

Report on the Static Analysis Tool Exposition (SATE) IV

February 4, 2013
Author(s)
Vadim Okun, Aurelien M. Delaitre, Paul E. Black
The NIST SAMATE project conducted the fourth Static Analysis Tool Exposition (SATE IV) to advance research in static analysis tools that find security defects in source code. The main goals of SATE were to enable empirical research based on large test sets

Recommendation for Cryptographic Key Generation

December 21, 2012
Author(s)
Elaine B. Barker, Allen L. Roginsky
Cryptography is often used in an information technology security environment to protect data that is sensitive, has a high value, or is vulnerable to unauthorized disclosure or undetected modification during transmission or while in storage. Cryptography

Guide for Conducting Risk Assessments

September 17, 2012
Author(s)
Ron Ross
The purpose of Special Publication 800-30 is to provide guidance for conducting risk assessments of federal information systems and organizations, amplifying the guidance provided in Special Publication 800-39. This document provides guidance for carrying

Recommendation for Applications Using Approved Hash Algorithms

August 24, 2012
Author(s)
Quynh H. Dang
Hash functions that compute a fixed-length message digest from arbitrary length messages are widely used for many purposes in information security. This document provides security guidelines for achieving the required or desired security strengths when

Computer Security Incident Handling Guide

August 6, 2012
Author(s)
Paul R. Cichonski, Thomas Millar, Timothy Grance, Karen Scarfone
Computer security incident response has become an important component of information technology (IT) programs. Security-related threats have become not only more numerous and diverse but also more damaging and disruptive. An incident response capability is

Guide to Bluetooth Security

June 11, 2012
Author(s)
John Padgette, Lidong Chen, Karen Scarfone
[Superseded by SP 800-121 Rev. 2 (May 2017): http://www.nist.gov/manuscript-publication- search.cfm?pub_id=922974] Bluetooth is an open standard for short-range radio frequency communication. Bluetooth technology is used primarily to establish wireless

Cloud Computing Synopsis and Recommendations

May 29, 2012
Author(s)
Mark L. Badger, Timothy Grance, Robert Patt-Corner, Jeff Voas
This document reprises the NIST-established definition of cloud computing, describes cloud computing benefits and open issues, presents an overview of major classes of cloud technology, and provides guidelines and recommendations on how organizations

Guidelines for Securing Wireless Local Area Networks (WLANs)

February 21, 2012
Author(s)
Murugiah P. Souppaya, Karen Scarfone
A wireless local area network (WLAN) is a group of wireless networking devices within a limited geographic area, such as an office building, that exchange data through radio communications. The security of each WLAN is heavily dependent on how well each

Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher

January 23, 2012
Author(s)
William C. Barker, Elaine B. Barker
This publication specifies the Triple Data Encryption Algorithm (TDEA), including its primary component cryptographic engine, the Data Encryption Algorithm (DEA). When implemented in an SP 800-38-series-compliant mode of operation and in a FIPS 140-2

Recommendation for Existing Application-Specific Key Derivation Functions

December 23, 2011
Author(s)
Quynh Dang
Cryptographic keys are vital to the security of internet security applications and protocols. Many widely-used internet security protocols have their own application-specific Key Derivation Functions (KDFs) that are used to generate the cryptographic keys
Displaying 176 - 200 of 411
Was this page helpful?