U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications

NIST Authors in Bold

Displaying 951 - 975 of 1431

Guide to Information Security Testing and Assessment

December 18, 2008
Author(s)
Shirley M. Radack
This bulletin summarizes information disseminated in NIST Special Publication (SP) 800-115, Technical Guide to Information Security Testing and Assessment: Recommendations of the National Institute of Standards and Technology, which was written by Karen

Two New Efficient CCA-Secure Online Ciphers : MHCBC and MCBC

December 17, 2008
Author(s)
Mridul Nandi
Online ciphers are those ciphers whose ciphertexts can be computed in an online manner. HCBC1 and HCBC2 are two known examples of Hash Cipher Block Chaining online ciphers. HCBC1 is secure against chosen plaintext adversary (or called CPA-secure) whereas

Security Challenges in Seamless Mobility - How to ``Handover'' the Keys?

November 30, 2008
Author(s)
Katrin Hoeper, Lidong Chen, Antonio Izquierdo Manzanares, Nada T. Golmie
In this paper, we discuss key management challenges for seamless handovers across heterogeneous wireless networks. We focus on fast access authentication protocols that allow expedited network entry by utilizing existing keying material from previous

A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS)

November 20, 2008
Author(s)
William I. MacGregor, Ketan L. Mehta, David A. Cooper, Karen A. Scarfone
This document provides best practice guidelines for integrating the PIV Card with the physical access control systems (PACS) that authenticate the cardholders in Federal facilities. Specifically, this document recommends a risk-based approach for selecting

Recommendation for Key Derivation Using Pseudorandom Functions

November 12, 2008
Author(s)
Lidong Chen
This Recommendation specifies techniques for the derivation of additional keying material from a secret key, either established through a key establishment scheme or shared through some other manner, using pseudorandom functions.

Security Considerations in the System Development Life Cycle

October 16, 2008
Author(s)
Richard L. Kissel, Kevin M. Stine, Matthew A. Scholl, Hart Rossman, J Fahlsing, Jessica Gulick
The purpose of this guideline is to assist agencies in building security into their IT development processes. This should result in more cost-effective, risk-appropriate security control identification, development, and testing. This guide focuses on the

Technical Guide to Information Security Testing and Assessment

September 30, 2008
Author(s)
Murugiah P. Souppaya, Karen A. Scarfone
The purpose of this document is to assist organizations in planning and conducting technical information security tests and examinations, analyzing findings, and developing mitigation strategies. The guide provides practical recommendations for designing

On the shortest linear straight-line program for computing linear forms

August 29, 2008
Author(s)
Joan Boyar, Philip Matthews, Rene Peralta
We study the complexity of the Shortest Linear Program (SLP) problem, which is to the number of linear operations necessary to compute a set of linear forms. SLP is shown to be NP-hard. Furthermore, a special case of the corresponding decision problem is

Forensic Filtering of Cell Phone Protocols

August 27, 2008
Author(s)
Aurelien M. Delaitre, Wayne Jansen
Phone managers are non-forensic software tools designed to carry out a range of tasks for the user, such as reading and updating the contents of a phone, using one or more of the communications protocols supported by the phone. Phone managers are sometimes

Evidence-Based, Good Enough, and Open

August 4, 2008
Author(s)
Karen A. Scarfone
One of the holy grail questions in computer security is how secure are my organization systems? This paper describes our new approach to answering this question. This approach is distinguished from previous efforts in three ways: 1) uses evidence-based

Guide to General Server Security

July 25, 2008
Author(s)
Karen A. Scarfone, Wayne Jansen, Miles C. Tracy
The purpose of this document is to assist organizations in understanding the fundamental activities performed as part of securing and maintaining the security of servers that provide services over network communications as a main function. The document

Guide to Securing Legacy IEEE 802.11 Wireless Networks

July 25, 2008
Author(s)
Karen A. Scarfone, Derrick Dicoi, Matt Sexton, Cyrus Tibbs
The purpose of this document is to provide guidance to organizations in securing their legacy Institute of Electrical and Electronics Engineers (IEEE) 802.11 wireless local area networks (WLAN) that cannot use IEEE 802.11i. The document provides an

Forensic Protocol Filtering of Phone Managers

July 24, 2008
Author(s)
Wayne Jansen, Aurelien M. Delaitre
Phone managers are non-forensic tools sometimes used by forensic investigators to recover data from a cell phone when no suitable forensic tool is available for the device. While precautions can be taken to preserve the integrity of data on a cell phone

Web Services Security: Techniques and Challenges (Extended Abstract)

July 21, 2008
Author(s)
Anoop Singhal
Web services-based computing is currently an important driver for the software industry. While several standards bodies (such as W3C and OASIS) are laying the foundation for Web services security, several research problems must be solved to make secure Web

An Attack Graph Based Probabilistic Security Metric

July 16, 2008
Author(s)
Lingyu Wang, Tania Islam, Tao Long, Anoop Singhal, Sushil Jajodia
To protect critical resources in today's networked environments, it is desirable to quantify the likelihood of potential multi-step attacks that combine multiple vulnerabilities. This now becomes feasible due to a model of causal relationships between

Performance Measurement Guide for Information Security

July 16, 2008
Author(s)
Elizabeth Chew, Marianne M. Swanson, Kevin M. Stine, N Bartol, Anthony Brown, W Robinson
This document provides guidance on how an organization, through the use of metrics, identifies the adequacy of in-place security controls, policies, and procedures. It provides an approach to help management decide where to invest in additional security
Displaying 951 - 975 of 1431