U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications

NIST Authors in Bold

Displaying 826 - 850 of 1431

NIST SP 500-268, Source Code Security Analysis Tool Function Specification Version 1.1

February 28, 2011
Author(s)
Elizabeth N. Fong, Paul E. Black, Michael J. Kass, Hsiao-Ming M. Koo
Software assurance tools are a fundamental resource to improve assurance in today's software applications. Some tools analyze software requirements or design models to help determine if an application is secure. Others analyze source code or executables

Guide to Using Vulnerability Naming Schemes

February 25, 2011
Author(s)
David A. Waltermire, Karen Scarfone
This publication provides recommendations for using two vulnerability naming schemes: Common Vulnerabilities and Exposures (CVE) and Common Configuration Enumeration (CCE). Draft SP 800-51 Revision 1 gives an introduction to both naming schemes and makes

National Checklist Program for IT Products Guidelines for Checklist Users and Developers

February 25, 2011
Author(s)
Stephen D. Quinn, Murugiah P. Souppaya, Melanie Cook, Karen Scarfone
Special Publication 800-70 Revision 2 - National Checklist Program for IT Products Guidelines for Checklist Users and Developers describes security configuration checklists and their benefits, and it explains how to use the NIST National Checklist Program

Status Report on the Second Round of the SHA-3 Cryptographic Hash Algorithm Competition

February 23, 2011
Author(s)
Meltem Sonmez Turan, Ray A. Perlner, Lawrence E. Bassham, William E. Burr, Dong H. Chang, Shu-jen H. Chang, Morris J. Dworkin, John M. Kelsey, Souradyuti Paul, Rene C. Peralta
The National Institute of Standards and Technology (NIST) opened a public competition on November 2, 2007 to develop a new cryptographic hash algorithm - SHA-3, which will augment the hash algorithms currently specified in the Federal Information

Glossary of Key Information Security Terms

February 17, 2011
Author(s)
Richard L. Kissel
This glossary of key information security terms has been extracted from NIST Federal Information Processing Standards (FIPS), Special Publication (SP) 800 series, NIST Interagency Report (NIST IR) series, and the Committee for National Security Systems

Who is Who? Biometrics provides answers for public and private sectors

February 10, 2011
Author(s)
Fernando L. Podio
One of the critical issues related to secured Information Technology (IT) systems and applications is the verification of the users identity. Biometrics provides for secure transactions, positive identification and augmentation to human judgment. For

Arithmetic Progressions on Edwards Curves

February 8, 2011
Author(s)
Dustin Moody
We look at arithmetic progressions on elliptic curves known as Edwards curves. By an arithmetic progression on an elliptic curve, we mean that the x-coordinates of a sequence of rational points on the curve form an arithmetic progression. Previous work has

Managing Security: The Security Content Automation Protocol

February 4, 2011
Author(s)
Shirley M. Radack, D. Richard Kuhn
Managing information systems security is an expensive and challenging task. Many different and complex software components- including firmware, operating systems, and applications-must be configured securely, patched when needed, and continuously monitored

Guide to Security for Full Virtualization Technologies

January 28, 2011
Author(s)
Murugiah P. Souppaya, Karen Scarfone, Paul Hoffman
The purpose of SP 800-125 is to discuss the security concerns associated with full virtualization technologies for server and desktop virtualization, and to provide recommendations for addressing these concerns. Full virtualization technologies run one or

Cloud Hooks: Security and Privacy Issues in Cloud Computing

January 4, 2011
Author(s)
Wayne Jansen
In meteorology, the most destructive extratropical cyclones evolve with the formation of a bent-back front and cloud head separated from the main polar-front, creating a hook that completely encircles a pocket of warm air with colder air. The most damaging

Guidelines for the Secure Deployment of IPv6

December 29, 2010
Author(s)
Sheila E. Frankel, Richard Graveman, John Pearce, Mark Rooks
Due to the exhaustion of IPv4 address space, and the Office of Management and Budget (OMB) mandate that U.S. federal agencies begin to use the IPv6 protocol, NIST undertook the development of a guide to help educate federal agencies about the possible

Securing WiMAX Wireless Communications

December 27, 2010
Author(s)
Shirley M. Radack
This bulletin summarizes the information presented in NIST Special Publication (SP) 800-127, Guide to Securing WiMAX Wireless Communications: Recommendations of the National Institute of Standards and Technology. The publication, which was written by Karen

k-Zero Day Safety: Measuring the Security Risk of Networks Against Unknown Attacks

December 10, 2010
Author(s)
Lingyu Wang, Sushil Jajodia, Anoop Singhal, Steven Noel
The security risk of a network against unknown zero day attacks has been considered as something unmeasurable since software flaws are less predictable than hardware faults and the process of finding such flaws and developing exploits seems to be chaotic

Cryptanalysis of the ESSENCE Family of Hash Functions

November 30, 2010
Author(s)
Nicky Mouha , Gautham Sekar, Jean-Philippe Aumasson , Thomas Peyrin, Soren S. Thomsen , Meltem Sonmez Turan, Bart Preneel
ESSENCE is a family of cryptographic hash functions, accepted to the first round of NIST's SHA-3 competition. This paper presents the first known attacks on ESSENCE. We present a semi-free-start collision attack on 31 out of 32 rounds of ESSENCE-512

Intrusion Detection and Prevention Systems

October 22, 2010
Author(s)
Karen A. Scarfone, Peter M. Mell
Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents. An intrusion detection and prevention system (IDPS) is software that automates the intrusion detection
Displaying 826 - 850 of 1431