Questions tagged [nist]

Abreviation for National Institute of Standards and Technology. A USA government institution which publishes standards, most notably the FIPS 140-2 standard for cryptographic modules.

Filter by
Sorted by
Tagged with
0
votes
0answers
36 views

Which certificate is recommended for releasing software in Healthcare domain?

Is there any third party company who assess software and provide a certificate saying the product is secured? I was reading about HITRUST alliance. I also read bit on EU cybersecurity certification ...
0
votes
0answers
32 views

NICE Framework - is there a link between Tasks and KSAs?

In the NICE Cybersecurity Workforce Framework document there are 1,007 Tasks and 1,180 KSAs - is there any explanation of the direct links between the Tasks and KSAs? (or any database) In the ...
0
votes
1answer
38 views

Distinction among the criteria “implemented correctly”, “operating as intended”, and “producing the desired outcome”

Throughout the RMF documents, one finds the phrase, a) "implemented correctly, b) operating as intended, and c) producing the desired outcome" with respect to meeting security requirements or control ...
0
votes
1answer
121 views

Email under GDPR [closed]

I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
1
vote
1answer
374 views

API to Get CVE Info [closed]

I'm working on a project that uses an API which gives back CVE IDs. We need to programmatically fetch details about those CVEs. The main thing we need is the CVSS v2 base vector (e.g. AV:A/AC:H/Au:M/C:...
1
vote
1answer
62 views

How comprehensive is CPE?

How authoritative and comprehensive is NIST's CPE, as a list of applications, hardware and operating systems? It's clearly a vast labour for which I am grateful, but I need to know how good it is. ...
1
vote
1answer
447 views

nvd json database without vendor and product info

I'm trying to parse nvd databases from nvd vulnerabilities feeds https://nvd.nist.gov/vuln/data-feeds#JSON_FEED I see many entries, where vendor product information is not filled in (cve->affects->...
5
votes
2answers
835 views

What is the recommended expiration for a password reset link?

What is the recommended expiration for a password reset link generated for a user? Citations/ links to NIST guidelines and documentation are very much appreciated.
6
votes
3answers
140 views

Security Testing Methods for Enterprise Level

I have been asked to perform risk assessment for a company. The scope covers about 100 applications and in various business units. Major task is to assess currently implemented security controls and ...
2
votes
3answers
377 views

What are some best practices for WiFi security, in light of recently discovered vulnerabilities?

In the past few months, we've seen the revelation of several WiFi vulnerabilities (eg KRACK). It doesn't look like NIST has updated any of its best practices. How should we configure our enterprise ...
2
votes
1answer
26 views

Periods in Common Platform Enumeration WFN (NIST Interagency Report 7695 )

I’m looking at NIST Interagency Report 7695 and the grammar described in 5.3.2 seems to say that all . need to be preceded by a \, but this doesn’t seem to be followed in the CPE dictionary. Am I ...
1
vote
1answer
122 views

The NIST randomness tests for a generated key

Does different tests for key randomness provided by NIST are available online? where one can test that which test for key generated are passed and which are failed?
1
vote
2answers
271 views

Are there currently any standards for Homomorphic encryption?

I am curious if there are any released standards for homomorphic encryption, or computing on encrypted data. Perhaps by NIST, ANSI, or ISO. If not, are there any that are under development right now? ...
1
vote
0answers
54 views

Is there a security standard/framework which interpret the CISO role as independent position

It is more or less an open secret that the CISO should act independently in the company. In my opinion, a supposed reporting line to the CIO is a conflict of interest (budget vs. security). The CISO ...
1
vote
1answer
309 views

Why would Bill Burr of NIST say N3v$r M1^d?

Wall Street Journal wrote that Bill regrets his password recommendations NIST SP 800-63 Appendix A. Apprendix A is titled "Estimating Password Entropy and Strength". It is about how we might assess ...
4
votes
2answers
2k views

What is the format of an X9.62 key?

RFC8292 contains this gem: The "k" parameter includes an ECDSA public key [FIPS186] in uncompressed form [X9.62] that is encoded using base64url encoding [RFC7515]. There is an example of the use of ...
0
votes
0answers
53 views

SQL RLS for NIST compliance

Is there specific NIST documentation advising about implementing MS SQL Row-Level security for 800-53 compliance?
2
votes
1answer
162 views

Suggestions on satisfying security controls described in NIST SP 800-53?

I recently started working on a project where my role is partially that of a cybersecurity engineer. Reading through the NIST SP 800-53, I understand the necessity of the security controls assigned, ...
1
vote
1answer
487 views

NIST 800-53 rev 4 - CM-7(2) implementation on Linux

NIST 800-53 rev 4 CM-7(2) states: (2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION The information system employs automated mechanisms to prevent program execution in accordance with [Selection (...
3
votes
1answer
368 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
1
vote
0answers
62 views

How are local admin accounts handled in a DFARS compliant environment?

In most IT departments that I've been apart of we've had local administrator accounts that we can use when the given machine, for some reason, doesn't have network access, or domain access. One of ...
3
votes
0answers
55 views

What options exist for logging off users after x time of inactivity? [closed]

I'm looking at NIST SC-10, and I thought something simple would exist in Group Policy that would control this, but I haven't been able to find anything built in. Things I've thought about trying: ...
2
votes
2answers
132 views

Conflicting requirements in FIPS 140-2 regarding manual key entry

Requirement 1 All output data exiting the cryptographic module via the "data output" interface shall only pass through the output data path. The output data path shall be logically disconnected ...
5
votes
1answer
334 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
1
vote
0answers
34 views

Are protocol implementations also tested as part of FIPS certification?

I just went to CMVP website and opened a random FIPS certificate. https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/2898 In the FIPS certificate, FIPS algorithms ...
1
vote
0answers
267 views

What are the similarities and differences between CISSP CBK, ISO/IEC, and the NIST NICE Framework? [closed]

There are a ton of different information security/cyber security frameworks but I was wondering if someone can give a quick rundown of some major similarities and differences. It'll really help me ...
4
votes
1answer
581 views

Practical applications of NIST new password policy

I have previously asked about the application of the NIST Special Publication 800-63-3 (password policy). Password Policy Without a simple way to add a password blacklist to AD, what are the common ...
4
votes
4answers
420 views

Can you establish a weak/common password policy in Active Directory in line with NIST guidelines?

Does anyone know if it is possible within Active Directory to add a table of 'weak passwords' that will be banned? Looking to align password policies with the new NIST recommendations: https://pages....
8
votes
2answers
11k views

Password expiration and compliance (ISO, NIST, PCI, etc)

I'm quite confused about what is the current state in 2017 for the idea of password expiration/rotation especially related to security certifications as ISO, PCI, etc. I keep reading that password ...
3
votes
2answers
2k views

I need assistance in properly understanding the IA-7 control in NIST SP 800-53

I've recently been working on a number of A&A tasks for the RMF for a US Government entity, and I'm having a hard time properly understanding the IA-7 control of NIST SP 800-53 and the supplement ...
0
votes
1answer
406 views

Public vulnerability feed with CVSS v3

NIST NVD publishes XML feeds of CVEs but, as far as I'm concerned, only with CVSS v2 vectors. CVSS v3 results are available on web portal. Is there available any up to date, processing friendly, raw ...
2
votes
0answers
297 views

NIST Framework Cyber Security Maturity Assessment [closed]

How can I assess customer cyber security posture based on NIST framework and provide scoring? What is the easiest approach, milestones, steps to do it - I know that I need to ask questions and then ...
1
vote
0answers
46 views

Firewall rulebase analysis offline/vendor agnostic a thing for FISMA/NIST

During design-time before a build-out, I currently create an excel file version of a firewall rulebase (policy) representing source/target/port/protocol/etc definitions before being pushed to the ...
1
vote
0answers
51 views

Multiple Frameworks for Risk Assessments?

My organization utilizes Risk Assessments as the catalyst for a lot of our Information Security efforts. Currently we assess applications using the cloud security alliance's CAIQ framework and ...
2
votes
1answer
414 views

Why Microsoft claims that SQL Server is the least vulnerable database? [closed]

Microsoft claims in their official site that “SQL Server is the least vulnerable database for six years running in the NIST vulnerabilities database”, I reviewed the NIST web site, but I can’t find a ...
3
votes
1answer
673 views

In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)

There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently ...
1
vote
1answer
190 views

NIST SP 800-90A DRBG, incorrect reult following algorithm, correct result rearranging algorithm steps?

I've been starring at this issue for about three days now, and think I need a second set of eyes on the problem. I'm implementing NIST's HASH_DRBG from SP 800-90A Rev. 1, June 2015 (its the latest doc ...
3
votes
1answer
449 views

What are the NIST/FBI requirements for Fingerprint readers, and Iris scans?

Background I'm trying to locate the US government standard for fingerprint readers and mobile devices. I heard in passing that the iOS fingerprint reader only scans 9 points, where the FBI ...
4
votes
1answer
159 views

FIPS-2 assumptions (CJIS)

I feel more like a lawyer than an IT admin today. When the CJIS Security Policy states that "The remote administrative personnel connection shall be via an encrypted (FIPS 140-2 certified) path," I'm ...
2
votes
0answers
206 views

NIST SI-7 experience [closed]

On a recent project we have been asked to implement NIST SI-7 parts 1, 3 and 4. I have looked for a full software solution, but cannot find anything like that. Does anyone have any experience on this?...
4
votes
0answers
291 views

Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list

I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance. As far as I have researched in https://technet.microsoft.com/en-us/library/security/...
-2
votes
1answer
258 views

how to make non HTTP Applications PK-enabled

I have a server application that is using Winsock2.0 for client communication, this application is a service. The client is also a Windows desktop application and performs few operations. For example ...
6
votes
1answer
334 views

Who can certify RNG according NIST SP800-22?

I have written my own random number generator as a C library and I tested it on NIST Statistical Test Suite. Now I would like to get a certification to have a formal proof that my C library generates ...
4
votes
2answers
402 views

Requirements Placed on a User of a FIPS 140-2 Validated System

Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be ...
7
votes
2answers
3k views

More secure curve than Curve25519

As far as I know, Curve25519 offers "only" a security level equal to an 128bit symmetric cipher. I'd like to know if there are new (not NIST) curves, which provide a security-level comparable to a ...
2
votes
1answer
866 views

OpenSSL implemented AES not according to NIST?

I have been using the Encryption/Decryption code from https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption. The NIST test vectors (http://csrc.nist.gov/groups/STM/cavp/) for AES ...
1
vote
0answers
448 views

FIPS_mode_set failed: f06d065

I execute the following code in Netbeans and get the error : FIPS_mode_set failed: f06d065. How to enable FIPS mode and get the code running? #include <openssl/crypto.h> int main() { int mode ...
5
votes
1answer
163 views

CCM instead of key wrap

Is there any instance of NIST or other encryption standards using AES-CCM to encrypt/authenticate key data? I would like to use CCM over a keywrap function, but cannot find any precedent for this in ...
1
vote
1answer
3k views

Information Security Policy and Information Security Plan

I have a question about the guidance in NIST 800-53. The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information ...
0
votes
0answers
335 views

Cryptographic Testing

Given an algorithm (say, AES), how to create/generate test vectors? I have tried using the NIST test vectors for AES and found it to be working fine with a package of "chilkat". Suppose, for a ...