Skip to main content

Home/ CSIA 459/ Group items tagged NIST

Rss Feed Group items tagged

Filter: All | Bookmarks | Topics Simple Middle
Amy Harding

NIST sorting comments on cybersecurity framework - FierceGovernmentIT - 7 views

www.fiercegovernmentit.com/...2013-04-08

cybersecurity framework NIST

shared by Amy Harding on 09 Apr 13 - No Cached
  • Amy Harding on 09 Apr 13
     
    Be careful what you ask for -- NIST is now sorting through all the public comments related to the cybersecurity executive order and 185 days to get the framework publish.
Amy Harding

Cryptographic Module Validation Program (CMVP) - 8 views

csrc.nist.gov/...index.html

NIST CMVP

shared by Amy Harding on 05 Mar 13 - No Cached
  • Amy Harding on 05 Mar 13
     
    Read and explore this NIST website. Do you see any products that are you are familar with? Can you determine how this program enhances the security of these products?
  • Phil Kemp on 21 Mar 13
     
    After looking through the website, I found the Vendor list for 140-2, which provides what I would think is the complete product list of Vendors and products which meet the standard. A couple items which meet the standard are Microsoft Windows 7 Bitlocker Drive Encryption, and Research In Motions Blackberry Cryptographic Kernel. It is important that the CMV Program is in place within the U.S. If we are going to rely on encryption to keep our secrets safe, then the products we use to encrypt our data, need to be checked to ensure they are secure.
Amy Harding

The Security Content Automation Protocol (SCAP) - NIST - 5 views

scap.nist.gov

shared by Amy Harding on 06 Mar 13 - Cached
  • Amy Harding on 06 Mar 13
     
    Using the links to the left of the screen, click around the SCAP website and think about how this protocol could help organizations manage their security vulnerabilities. Does your organization use SCAP?
Shondre Fort

Researchers Share Useful Lessons Learned in Evaluating Emerging Technologies - 0 views

www.nist.gov/...score-062111.cfm

shared by Shondre Fort on 16 Mar 13 - No Cached
  • Schlenoff and his colleagues used their SCORE approach to evaluate technologies as they progressed under two DARPA programs: ASSIST and TRANSTAC. In ASSIST, DARPA is funding efforts to instrument soldiers with wearable sensors—video cameras, microphones, global positioning devices and more—to continuously record activities while they are on a mission. TRANSTAC is driving the development of two-way speech-translation systems that enable speakers of different languages to communicate with each other in real-world situations, without an interpreter. By providing constructive feedback on system capabilities, the SCORE evaluative framework helps to drive innovation and performance improvements.
  • samuelrios on 16 Mar 13
     
    SCORE (System, Component and Operationally Relevant Evaluations) is a unified set of criteria and software tools for defining a performance evaluation approach for complex intelligent systems. It provides a comprehensive evaluation blueprint that assesses the technical performance of a system and its components through isolating and changing variables as well as capturing end-user utility of the system in realistic use-case environments. The SCORE framework has proven to be widely-applicable in nature and equally relevant to technologies ranging from manufacturing to military systems. It has been applied to the evaluation of technologies in DARPA programs that range from soldier-worn sensor on patrol to speech-to-speech translation systems. It is also currently being applied to the assessing the control of autonomous vehicles on a shop floor.
  • Shondre Fort on 30 Jun 13
     
    From NIST Tech Beat: June 21, 2011 Most industry executives, military planners, research managers or venture capitalists charged with assessing the potential of an R&D project probably are familiar with the wry twist on Arthur C. Clarke's third law*: "Any sufficiently advanced technology is indistinguishable from a rigged demo."
Amy Harding

Security Requirements for Cryptographic Modules - 4 views

csrc.nist.gov/...fips1402.pdf

shared by Amy Harding on 06 Mar 13 - No Cached
  • Amy Harding on 06 Mar 13
     
    This standards publication (FIPS 140-2) is a key standard's document. Skim through it and see if you can find some ideas for emerging threats against the standard(s).
  • ...1 more comment...
  • Dan Schulman on 20 Mar 13
     
    FIPS 140-3 is on its way and is needed as 140-2 is quite old now. Interestingly however, crypto is one of the slower moving changes in information security. Many of our algorithms have been around for many years; we have moved forward by increasing key size rather than changing the algorithms. AES and 3DES are still FIPS approved, whereas RC4 is not (which is used by many internet giants such as google and facebook).
  • Phil Kemp on 02 Apr 13
     
    Any time you are allowed to introduce code into a program, you have a chance for error. By allowing cryptographic software and firmware to be updated, I think you will always have the chance for emerging threats to be introduced in the form of malware. Recently, the U.S. has stopped allowing the use of Chinese built hardware for certain DOD/ Federal agencies. if we allow the enemy to build the devices we use to form our security foundations, we have already lost the war.
  • samuelrios on 03 Apr 13
     
    I believe the frequency of review of this policy is untimely to the speed technology advances in. If they could move the review from 5 years to 2 years will suffice. At times, once the policy is published folks are already working on the revision to keep up with technology growth. "Since a standard of this nature must be flexible enough to adapt to advancements and innovations in science and technology, this standard will be reviewed every five years in order to consider new or revised requirements that may be needed to meet technological and economic changes."
Amy Harding

http://www.safegov.org/media/46155/measuring_what_matters_final.pdf - 3 views

www.safegov.org/...asuring_what_matters_final.pdf

shared by Amy Harding on 27 Mar 13 - No Cached
  • Amy Harding on 27 Mar 13
     
    Agencies must establish a unique baseline threat assessment and automate monitoring to ensure good cybersecurity, says a SafeGov report released Tuesday.
  • Ben Garey on 31 Mar 13
     
    Safegov has an interesting approach to cybersecurity. I feel the framework an effective way to approach security. Ben
  • samuelrios on 31 Mar 13
     
    The legislation proposal aims at achieving cybersecurity due to increased network threats in government and in organizations. Educating the public and the use of cyber security technologies have great impacts on government agencies. Our government department comply with NIST and ISO/IEC, and the two bodies help in enhancing privacy and security in the national and international levels. It is important to identify efficient operational, technical and management security controls in a comprehensive computer security plan. Risk assessment in management control assists in identification of risks and in putting up risk assessment policies. Operational controls have their basis on restrictions to access information resources and in user permissions. Sam
Amy Harding

CAESARS Framework Extension: An Enterprise Continuous Monitoring Technical Reference Mo... - 7 views

csrc.nist.gov/...R-7756_second-public-draft.pdf

shared by Amy Harding on 29 Jul 13 - No Cached
  • Amy Harding on 29 Jul 13
     
    For Week 6
1 - 9 of 9
Showing 20▼ items per page