U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications

NIST Authors in Bold

Displaying 851 - 875 of 1431

Security Assurance Levels: A Vector Approach to Describing Security Requirements

October 20, 2010
Author(s)
James D. Gilsinn, Ragnar Schierholz
Safety systems have used the concept of safety integrity levels (SILs) for almost two decades. This allows the safety of a component or system to be represented by a single number that defines a protection factor required to ensure the health and safety of

In Trust we Trust

October 14, 2010
Author(s)
Keith Miller, Jeff Voas, Phillip Laplante
The term trust has had a well understood definition for centuries. However after e-trust came along, and then cloud, where e-trust is not sufficient due to the non-touchability of a public cloud, the need to reconsider what trust means for a public cloud

Reliability of Embedded and Cyber-Physical Systems

October 14, 2010
Author(s)
Ram Chillarege, Jeff Voas
Cyber-physical systems feature a tight combination of a system's computational and physical elements. Understanding how to assess and design trustworthiness into these complex systems of systems remains an unsolved problem. This issue offers insights into

An Inconvenient Truth About Tunneled Authentications

October 10, 2010
Author(s)
Katrin Hoeper, Lidong Chen
In recent years, it has been a common practice to execute client authentications for network access inside a protective tunnel. Man-in-the-middle (MitM) attacks on such tunneled authentications have been discovered early on and cryptographic bindings are

Practical Combinatorial Testing

October 7, 2010
Author(s)
David R. Kuhn, Raghu N. Kacker, Yu Lei
Combinatorial testing can help detect problems like this early in the testing life cycle. The key insight underlying t-way combinatorial testing is that not every parameter contributes to every fault and most faults are caused by interactions between a

Ethics and the Cloud

September 30, 2010
Author(s)
Keith Miller, Jeff Voas
Cloud computing is an idea that's rapidly evolving. Still, the amount of money and attention devoted to this topic makes it seems sensible to discuss how ethicists view the kinds of changes in computing that are being called "the cloud." This department is

Guide to Securing WiMAX Wireless Communications

September 30, 2010
Author(s)
Karen A. Scarfone, Cyrus Tibbs, Matt Sexton
The purpose of this document is to provide information to organizations regarding the security capabilities of wireless communications using WiMAX networks and to provide recommendations on using these capabilities. WiMAX technology is a wireless

Security Architecture Design Process for Health Information Exchanges (HIEs)

September 30, 2010
Author(s)
Matthew A. Scholl, Kevin M. Stine, Kenneth Lin, Daniel Steinberg
The purpose of this publication is to provide a systematic approach to designing a technical security architecture for the exchange of health information that leverages common government and commercial practices and that demonstrates how these practices

A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications

September 16, 2010
Author(s)
Lawrence E. Bassham, Andrew L. Rukhin, Juan Soto, James R. Nechvatal, Miles E. Smid, Stefan D. Leigh, M Levenson, M Vangel, Nathanael A. Heckert, D L. Banks
This paper discusses some aspects of selecting and testing random and pseudorandom number generators. The outputs of such generators may be used in many cryptographic applications, such as the generation of key material. Generators suitable for use in

Introduction: Cybersecurity

August 31, 2010
Author(s)
David R. Kuhn
Enterprise security, often considered a burden for system administrators and users alike, is one of the most rapidly evolving areas of IT. The articles in this issue can help IT professionals who want to be intelligent providers or consumers of secure

Practical Near-Collisions for Reduced Round Blake, Fugue, Hamsi and JH

August 23, 2010
Author(s)
Meltem Sonmez Turan, Erdener Uyan
A hash function is near-collision resistant, if it is hard to find two messages with hash values that differ in only small number of bits. In this study, we used hill climbing methods to find near-collisions for some of the second round SHA-3 candidates

Guide to Adopting and Using the Security Content Automation Protocol (SCAP), Version 1.0

July 27, 2010
Author(s)
Stephen D. Quinn, Karen A. Scarfone, Matthew P. Barrett, Christopher S. Johnson
The purpose of this document is to provide an overview of the Security Content Automation Protocol (SCAP). This document discusses SCAP at a conceptual level, focusing on how organizations can use SCAP-enabled tools to enhance their security posture. It

Sigma Ballots

July 21, 2010
Author(s)
Stefan Popoveniuc, Andrew Regenscheid
We present Sigma ballots, a new type of ballot to be used in secure elections. Sigma ballots use the random order of candidates introduced by Pret a Voter, combined with the confirmation codes of Scantegrity II. These ballots can be produces by a DRE

Vulnerability Trends: Measuring Progress

July 19, 2010
Author(s)
David R. Kuhn, Christopher S. Johnson
What is the state of security engineering today? Are we as an industry making progress? What are prospects for the future? To address these questions we analyze data from the National Vulnerability Database (NVD).

Measuring Security Risk of Networks Using Attack Graphs

July 14, 2010
Author(s)
Steven Noel, Lingyu Wang, Anoop Singhal, Sushil Jajodia
Today's computer systems face sophisticated attackers who combine multiple vulnerabilities to penetrate networks with devastating impact. The overall security of a network cannot be determined by simply counting the number of vulnerabilities. To accurately
Displaying 851 - 875 of 1431