Security and Privacy Controls for Federal Information Systems and Organizations [including updates as of 1/22/2015]
[Rev. 4 was superseded by Rev. 5 on 9/23/2020; Rev. 4 will be withdrawn one year from that date, on 9/23/2019] This publication provides a catalog of security and privacy controls for federal information systems and organizations and a process for
Recommendation for Key Management Part 3: Application-Specific Key Management Guidance
Special Publication 800-57 provides cryptographic key management guidance. It consists of three parts. Part 1 provides general guidance and best practices for the management of cryptographic keying material. Part 2 provides guidance on policy and security
Public Safety Mobile Application Security Requirements Workshop Summary
This document captures the input received from the half-day workshop titled "Public Safety Mobile Application Security Requirements" organized by the Association of Public-Safety Communications Officials (APCO) International, in cooperation with FirstNet
Cryptographic primitives need random numbers to protect your data. Random numbers are used for generating secret keys, nonces, random paddings, initialization vectors, salts, etc. Deterministic pseudorandom number generators are useful, but they still need
A Decision Guidance Framework for Sustainability Performance Analysis of Manufacturing Processes
Life-Cycle Assessment (LCA) methods are widely used to assess the sustainability of manufacturing processes. Although it has several advantages such as systematic estimation and efficiency, it has significant limitations due to lack of functionality to
An efficient curve evolution algorithm for multiphase image segmentation
We propose a novel iterative algorithm for segmentation of multiphase images by curve evolution. Specifically, we address a multiphase version of the Chan-Vese piecewise constant segmentation energy. Our algorithm is efficient: it is based on an explicit
Measuring Impact of Cybersecurity on the Performance of Industrial Control Systems
The National Institute of Standards and Technology (NIST) is developing a cybersecurity testbed for industrial control systems (ICS). The goal of the testbed is to measure the performance of ICS when instrumented with cybersecurity countermeasures in
Release of NIST Special Publication 800-157, Guidelines for Derived Personal Identity Verification (PIV) Credentials
NIST has recently released Special Publication (SP) 800-157, Guidelines for Derived Personal Identity Verification (PIV) Credentials. Itto provide the technical details for a system by which mobile devices such as smart phones and tables are provisioned
Deployment-driven Security Configuration for Virtual Networks
Virtualized Infrastructures are increasingly deployed in many data centers. One of the key components of this virtualized infrastructure is the virtual network - a software-defined communication fabric that links together the various Virtual Machines (VMs)
Guidelines for Derived Personal Identity Verification (PIV) Credentials
This recommendation provides technical guidelines for the implementation of standards-based, secure, reliable, interoperable PKI-based identity credentials that are issued by Federal departments and agencies to individuals who possess and prove control
Media sanitization refers to a process that renders access to target data on the media infeasible for a given level of effort. This guide will assist organizations and system owners in making practical sanitization decisions based on the categorization of
Discussion of challenges and ways of improving Cyber Situational Awareness dominated our previous chapters. However, we have not yet touched on how to quantify any improvement we might achieve. Indeed, to get an accurate assessment of network security and
Natural Scene Statistics (NSS) produces powerful perceptually relevant tools that have been highly successful in image quality analysis of visible light images. These NSS capture statistical regularities in the physical world and thus can be applicable to
Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans
[Superseded by SP 800-53A Rev. 5 (January 2022): https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=933932 ] This publication provides a set of procedures for conducting assessments of security controls and privacy controls employed within federal
Knowing what makes a software systems vulnerable to attacks is critical, as software vulnerabilities hurt security, reliability, and availability of the system as a whole. In addition, understanding how an adversary operates is essential to effective cyber
Effective and Scalable Uncertainty Evaluation for Large-Scale Complex System Applications
Effective uncertainty evaluation is a critical step toward real-time and robust decision-making for complex systems in uncertain environments. A Multivariate Probabilistic Collocation Method (M-PCM) was developed to effectively evaluate system uncertainty