Questions tagged [nist]

Abreviation for National Institute of Standards and Technology. A USA government institution which publishes standards, most notably the FIPS 140-2 standard for cryptographic modules.

Filter by
Sorted by
Tagged with
5 votes
2 answers
2k views

How do I decide which security framework is most suited to my organization?

There are many IT security frameworks/standards/regulations/etc to chose from, each with their own pros and cons. For example, IS0 27000 series, NIST CSF, NIST RMF, PCI-DSS, etc. My question is, is ...
user1720897's user avatar
0 votes
1 answer
446 views

CVSS v3 and v3.1 Missing temporal metrics (Exploit Code Maturity and Remediation Level) in all CVEs using NVD API

I have been working with the NIST - NVD API v2 and I have noticed that the temporal metrics "remediationLevelType" and "exploitCodeMaturityType" are missing in ALL CVEs that I have ...
Tlopasha's user avatar
1 vote
0 answers
174 views

Different results for CPE search on NVD

I usually stick to finding the right CPE candidate for product-version I am interested in by using the Search Vulnerability Database with Search Type selected as Advanced and then narrowing down from ...
Youbecks003's user avatar
1 vote
2 answers
76 views

any security baseline reference we can use? paid or free

We are looking to provide our Devs and Ops with minimal security baseline requirements - reference materials that they should follow during coding/implementation/etc. Maybe requirements based on NIST ...
Andrei Clear's user avatar
17 votes
4 answers
4k views

Should one reject login attempts when the correct password is newly added to a password deny list?

Best practices say that when users choose a password (at signup or when changing an existing password), the application should reject that password if it appears on a list of passwords known to be ...
Jens Bannmann's user avatar
1 vote
0 answers
27 views

Do comparable standards like FIPS exist for Germany or the European Union? [duplicate]

NIST, the National Institute of Standards and Technology, does publish FIPS, the Federal Information Processing Standards Publications. Does Germany or the European Union have their own standards? Or ...
foshyboy's user avatar
0 votes
1 answer
969 views

Why is there an ASN1 OID and a NIST CURVE reference for the same curve?

$ openssl ecparam -in param-ec.pem -text -noout ASN1 OID: secp384r1 NIST CURVE: P-384 The file param-ec.pem indicates the curve is P-384, also known as secp384r1. In the same way: secp521r1 = P-521 ...
Eddie's user avatar
  • 771
1 vote
0 answers
53 views

Should vendors add their CPEs in the log4j NIST entry?

Software that has packaged a vulnerable version of the log4j library is considered vulnerable to CVE-2021-44228 or "log4shell". When I look at the NIST definition I can see that the ...
Neil P's user avatar
  • 181
0 votes
1 answer
148 views

Verifying that a TLS server supports the PSK-Modes Extension?

I am trying to verify if a TLS Server is configured according to the guidelines specified in NIST SP 800-52. One rule stated is the following: TLS servers that support TLS 1.3 and the Pre-Shared Key ...
Robert Engel's user avatar
0 votes
2 answers
230 views

What are the differences between "identifying threats and vulnerabilities" and "risk management"?

I am struggling to appreciate the differences between the 7 steps of the NIST Framework for Improving Critical Infrastructure, which should help an organisation implement it. Step 1: Prioritize and ...
Beginner's user avatar
3 votes
2 answers
153 views

Incident Response and when to consider an incident resolved

I am currently making amendments to an IR process and the topic of incident closure has come up. The organisation follows NIST and therefore their IR process has four phases: Preparation Detection &...
JLPH's user avatar
  • 107
0 votes
1 answer
81 views

What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?

I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is. Is it all internal ...
joshhemphill's user avatar
25 votes
6 answers
8k views

Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?

Context NIST SP 800-63b gives the following guidance for password forms (aka login pages): Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This ...
Mike Ounsworth's user avatar
1 vote
1 answer
161 views

Is there a documented security standard that forbids or discourages rolling your own crypto?

Is there any security standard published by NIST or another reputed body in information security that explicitly forbids or discourages rolling your own crypto? If yes, would you please post the ...
Lone Learner's user avatar
2 votes
1 answer
162 views

How to tell if Microsoft office has been patched for a vulnerability?

The NIST database holds records for Microsoft Office vulnerabilities, however it only lists the application (i.e. Word 2016) and the service pack. Microsoft release hotfixes outside of service packs, ...
Neil P's user avatar
  • 181
1 vote
0 answers
252 views

"Something you have" on a multi-user device - what is the opinion regarding the NIST AAL3 definition?

The NIST AAL3 specification requires In order to authenticate at AAL3, claimants SHALL prove possession and control of two distinct authentication factors through secure authentication ...
MrMoosehead's user avatar
0 votes
0 answers
147 views

NICE Framework - is there a link between Tasks and KSAs?

In the NICE Cybersecurity Workforce Framework document there are 1,007 Tasks and 1,180 KSAs - is there any explanation of the direct links between the Tasks and KSAs? (or any database) In the ...
Joseph's user avatar
  • 1
0 votes
1 answer
132 views

Distinction among the criteria "implemented correctly", "operating as intended", and "producing the desired outcome"

Throughout the RMF documents, one finds the phrase, a) "implemented correctly, b) operating as intended, and c) producing the desired outcome" with respect to meeting security requirements or control ...
Tupelo Thistlehead's user avatar
1 vote
1 answer
294 views

Email under GDPR [closed]

I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
user211383's user avatar
5 votes
1 answer
4k views

API to Get CVE Info [closed]

I'm working on a project that uses an API which gives back CVE IDs. We need to programmatically fetch details about those CVEs. The main thing we need is the CVSS v2 base vector (e.g. AV:A/AC:H/Au:M/C:...
a_dude_in_an_office's user avatar
1 vote
1 answer
126 views

How comprehensive is CPE?

How authoritative and comprehensive is NIST's CPE, as a list of applications, hardware and operating systems? It's clearly a vast labour for which I am grateful, but I need to know how good it is. ...
Laska's user avatar
  • 111
2 votes
1 answer
936 views

nvd json database without vendor and product info

I'm trying to parse nvd databases from nvd vulnerabilities feeds https://nvd.nist.gov/vuln/data-feeds#JSON_FEED I see many entries, where vendor product information is not filled in (cve->affects->...
Роман Коптев's user avatar
8 votes
2 answers
5k views

What is the recommended expiration for a password reset link?

What is the recommended expiration for a password reset link generated for a user? Citations/ links to NIST guidelines and documentation are very much appreciated.
ztech's user avatar
  • 183
6 votes
3 answers
207 views

Security Testing Methods for Enterprise Level

I have been asked to perform risk assessment for a company. The scope covers about 100 applications and in various business units. Major task is to assess currently implemented security controls and ...
ray bash's user avatar
2 votes
3 answers
477 views

What are some best practices for WiFi security, in light of recently discovered vulnerabilities?

In the past few months, we've seen the revelation of several WiFi vulnerabilities (eg KRACK). It doesn't look like NIST has updated any of its best practices. How should we configure our enterprise ...
Filipon's user avatar
  • 1,264
2 votes
1 answer
90 views

Periods in Common Platform Enumeration WFN (NIST Interagency Report 7695 )

I’m looking at NIST Interagency Report 7695 and the grammar described in 5.3.2 seems to say that all . need to be preceded by a \, but this doesn’t seem to be followed in the CPE dictionary. Am I ...
Adam D's user avatar
  • 131
1 vote
1 answer
307 views

The NIST randomness tests for a generated key

Does different tests for key randomness provided by NIST are available online? where one can test that which test for key generated are passed and which are failed?
WBAN_crypto's user avatar
2 votes
2 answers
664 views

Are there currently any standards for Homomorphic encryption?

I am curious if there are any released standards for homomorphic encryption, or computing on encrypted data. Perhaps by NIST, ANSI, or ISO. If not, are there any that are under development right now? ...
jburcham's user avatar
  • 158
1 vote
2 answers
136 views

Is there a security standard/framework which interpret the CISO role as independent position

It is more or less an open secret that the CISO should act independently in the company. In my opinion, a supposed reporting line to the CIO is a conflict of interest (budget vs. security). The CISO ...
wundidajah's user avatar
1 vote
1 answer
506 views

Why would Bill Burr of NIST say N3v$r M1^d?

Wall Street Journal wrote that Bill regrets his password recommendations NIST SP 800-63 Appendix A. Apprendix A is titled "Estimating Password Entropy and Strength". It is about how we might assess ...
philcolbourn's user avatar
7 votes
2 answers
9k views

What is the format of an X9.62 key?

RFC8292 contains this gem: The "k" parameter includes an ECDSA public key [FIPS186] in uncompressed form [X9.62] that is encoded using base64url encoding [RFC7515]. There is an example of ...
Wouter Verhelst's user avatar
0 votes
0 answers
116 views

SQL RLS for NIST compliance

Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
Ayan Mullick's user avatar
2 votes
1 answer
386 views

Suggestions on satisfying security controls described in NIST SP 800-53?

I recently started working on a project where my role is partially that of a cybersecurity engineer. Reading through the NIST SP 800-53, I understand the necessity of the security controls assigned, ...
DyslexicHobo's user avatar
2 votes
1 answer
1k views

NIST 800-53 rev 4 - CM-7(2) implementation on Linux

NIST 800-53 rev 4 CM-7(2) states: (2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION The information system employs automated mechanisms to prevent program execution in accordance with [Selection (...
positive return's user avatar
4 votes
1 answer
804 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
Shashank V's user avatar
1 vote
0 answers
136 views

How are local admin accounts handled in a DFARS compliant environment?

In most IT departments that I've been apart of we've had local administrator accounts that we can use when the given machine, for some reason, doesn't have network access, or domain access. One of ...
trueCamelType's user avatar
3 votes
0 answers
105 views

What options exist for logging off users after x time of inactivity? [closed]

I'm looking at NIST SC-10, and I thought something simple would exist in Group Policy that would control this, but I haven't been able to find anything built in. Things I've thought about trying: ...
trueCamelType's user avatar
2 votes
2 answers
200 views

Conflicting requirements in FIPS 140-2 regarding manual key entry

Requirement 1 All output data exiting the cryptographic module via the "data output" interface shall only pass through the output data path. The output data path shall be logically disconnected ...
Shashank V's user avatar
5 votes
1 answer
469 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
Sum's user avatar
  • 113
1 vote
0 answers
77 views

Are protocol implementations also tested as part of FIPS certification?

I just went to CMVP website and opened a random FIPS certificate. https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/2898 In the FIPS certificate, FIPS algorithms ...
Shashank V's user avatar
1 vote
0 answers
384 views

What are the similarities and differences between CISSP CBK, ISO/IEC, and the NIST NICE Framework? [closed]

There are a ton of different information security/cyber security frameworks but I was wondering if someone can give a quick rundown of some major similarities and differences. It'll really help me ...
Keith Axelrod's user avatar
5 votes
1 answer
703 views

Practical applications of NIST new password policy

I have previously asked about the application of the NIST Special Publication 800-63-3 (password policy). Password Policy Without a simple way to add a password blacklist to AD, what are the common ...
Chri3's user avatar
  • 327
4 votes
4 answers
489 views

Can you establish a weak/common password policy in Active Directory in line with NIST guidelines?

Does anyone know if it is possible within Active Directory to add a table of 'weak passwords' that will be banned? Looking to align password policies with the new NIST recommendations: https://pages....
Chri3's user avatar
  • 327
10 votes
2 answers
16k views

Password expiration and compliance (ISO, NIST, PCI, etc)

I'm quite confused about what is the current state in 2017 for the idea of password expiration/rotation especially related to security certifications as ISO, PCI, etc. I keep reading that password ...
Jacob's user avatar
  • 233
3 votes
3 answers
6k views

I need assistance in properly understanding the IA-7 control in NIST SP 800-53

I've recently been working on a number of A&A tasks for the RMF for a US Government entity, and I'm having a hard time properly understanding the IA-7 control of NIST SP 800-53 and the supplement ...
scjohnson's user avatar
0 votes
1 answer
714 views

Public vulnerability feed with CVSS v3

NIST NVD publishes XML feeds of CVEs but, as far as I'm concerned, only with CVSS v2 vectors. CVSS v3 results are available on web portal. Is there available any up to date, processing friendly, raw ...
Dave Yarsky's user avatar
3 votes
0 answers
356 views

NIST Framework Cyber Security Maturity Assessment [closed]

How can I assess customer cyber security posture based on NIST framework and provide scoring? What is the easiest approach, milestones, steps to do it - I know that I need to ask questions and then ...
user142835's user avatar
1 vote
0 answers
103 views

Firewall rulebase analysis offline/vendor agnostic a thing for FISMA/NIST

During design-time before a build-out, I currently create an excel file version of a firewall rulebase (policy) representing source/target/port/protocol/etc definitions before being pushed to the ...
dhartford's user avatar
  • 131
1 vote
0 answers
106 views

Multiple Frameworks for Risk Assessments?

My organization utilizes Risk Assessments as the catalyst for a lot of our Information Security efforts. Currently we assess applications using the cloud security alliance's CAIQ framework and ...
VectorPrime's user avatar
2 votes
1 answer
532 views

Why Microsoft claims that SQL Server is the least vulnerable database? [closed]

Microsoft claims in their official site that “SQL Server is the least vulnerable database for six years running in the NIST vulnerabilities database”, I reviewed the NIST web site, but I can’t find a ...
Sameh Deabes's user avatar