U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications by: Karen Scarfone (Ctr)

Search Title, Abstract, Conference, Citation, Keyword or Author
Displaying 26 - 50 of 67

Guide to Securing WiMAX Wireless Communications

September 30, 2010
Author(s)
Karen A. Scarfone, Cyrus Tibbs, Matt Sexton
The purpose of this document is to provide information to organizations regarding the security capabilities of wireless communications using WiMAX networks and to provide recommendations on using these capabilities. WiMAX technology is a wireless

Guide to Adopting and Using the Security Content Automation Protocol (SCAP), Version 1.0

July 27, 2010
Author(s)
Stephen D. Quinn, Karen A. Scarfone, Matthew P. Barrett, Christopher S. Johnson
The purpose of this document is to provide an overview of the Security Content Automation Protocol (SCAP). This document discusses SCAP at a conceptual level, focusing on how organizations can use SCAP-enabled tools to enhance their security posture. It

An Analysis of CVSS Version 2 Vulnerability Scoring

October 14, 2009
Author(s)
Karen A. Scarfone, Peter M. Mell
The Common Vulnerability Scoring System (CVSS) is a specification that is used to measure the relative severity of software vulnerabilities. CVSS version 2, which was finalized in June 2007, was designed to address several deficiencies discovered during

System and Network Security Acronyms and Abbreviations

September 30, 2009
Author(s)
Karen A. Scarfone, Victoria Thompson
This report contains a list of selected acronyms and abbreviations for system and network security terms with their generally accepted or preferred definitions. It is intended as a resource for Federal agencies and other users of system and network

Guidelines on Firewalls and Firewall Policy

September 28, 2009
Author(s)
Karen A. Scarfone, Paul Hoffman
Firewalls are devices or programs that control the flow of network traffic between networks or hosts employing differing security postures. This publication provides an overview of several types of firewall technologies and discusses their security

Security for Enterprise Telework and Remote Access Solutions

June 24, 2009
Author(s)
Karen A. Scarfone
Many people telework (also known as telecommuting), which is the ability for an organization s employees and contractors to perform work from locations other than the organization s facilities. Teleworkers use various client devices, such as desktop and

Cyber Security Standards

June 15, 2009
Author(s)
Karen A. Scarfone, Daniel R. Benigni, Timothy Grance
The goal of cyber security standards is to improve the security of information technology (IT) systems, networks, and critical infrastructures. A cyber security standard defines both functional and assurance requirements within a product, system, process

Cyber Security Metrics and Measures

March 2, 2009
Author(s)
Paul E. Black, Karen A. Scarfone, Murugiah P. Souppaya
Metrics are tools to facilitate decision making and improve performance and accountability. Measures are quantifiable, observable, and objective data supporting metrics. Operators can use metrics to apply corrective actions and improve performance

A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS)

November 20, 2008
Author(s)
William I. MacGregor, Ketan L. Mehta, David A. Cooper, Karen A. Scarfone
This document provides best practice guidelines for integrating the PIV Card with the physical access control systems (PACS) that authenticate the cardholders in Federal facilities. Specifically, this document recommends a risk-based approach for selecting

Vulnerability Scoring for Security Configuration Settings

October 29, 2008
Author(s)
Karen A. Scarfone, Peter M. Mell
The best-known vulnerability scoring standard, the Common Vulnerability Scoring System (CVSS), is designed to quantify the severity of security-related software flaw vulnerabilities. This paper describes our efforts to determine if CVSS could be adapted

Technical Guide to Information Security Testing and Assessment

September 30, 2008
Author(s)
Murugiah P. Souppaya, Karen A. Scarfone
The purpose of this document is to assist organizations in planning and conducting technical information security tests and examinations, analyzing findings, and developing mitigation strategies. The guide provides practical recommendations for designing

Evidence-Based, Good Enough, and Open

August 4, 2008
Author(s)
Karen A. Scarfone
One of the holy grail questions in computer security is how secure are my organization systems? This paper describes our new approach to answering this question. This approach is distinguished from previous efforts in three ways: 1) uses evidence-based

Guide to General Server Security

July 25, 2008
Author(s)
Karen A. Scarfone, Wayne Jansen, Miles C. Tracy
The purpose of this document is to assist organizations in understanding the fundamental activities performed as part of securing and maintaining the security of servers that provide services over network communications as a main function. The document

Guide to Securing Legacy IEEE 802.11 Wireless Networks

July 25, 2008
Author(s)
Karen A. Scarfone, Derrick Dicoi, Matt Sexton, Cyrus Tibbs
The purpose of this document is to provide guidance to organizations in securing their legacy Institute of Electrical and Electronics Engineers (IEEE) 802.11 wireless local area networks (WLAN) that cannot use IEEE 802.11i. The document provides an

A Framework for Measuring the Vulnerability of Hosts

June 30, 2008
Author(s)
Karen A. Scarfone, Timothy Grance
This paper proposes a framework for measuring the vulnerability of individual hosts based on current and historical operational data for vulnerabilities and attacks. Previous approaches have not been scalable because they relied on complex manually