U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications

NIST Authors in Bold

Displaying 1276 - 1300 of 1431

Application of XML Tools for Enterprise-Wide RBAC Implementation Tasks

July 27, 2000
Author(s)
Ramaswamy Chandramouli
The use of Extensible Markup Language (XML) and its associated APIs, for information modeling and information interchange applications is being actively explored by the research community. In this paper we develop an XML Document Type Definition (DTD) for

The NIST Model for Role-Based Access Control: Towards a Unified Standard

July 26, 2000
Author(s)
R. Sandhu, David F. Ferraiolo, D. Richard Kuhn
This paper describes a unified model for role-based access control (RBAC). RBAC is a proven technology for large-scale authorization. However, lack of a standard model results in uncertainty and confusion about its utility and meaning. The NIST model seeks

CIO Cyber Security Notes

July 19, 2000
Author(s)
J E. Frye
The CIO Cyber Security Notes will be published six times a year and distributed to the senior-level CIOs and senior-level executives within the Federal government. Its purpose is to heighten awareness of cyber security trends and issues. It will report

Identifying Critical Patches With ICAT

July 1, 2000
Author(s)
Peter M. Mell
[For the latest information on vulnerabilities, see the National Vulnerability Database, nvd.nist.gov]The NIST computer security division has created a searchable index containing 700 of the most important computer vulnerabilities. This index, called the

Mitigating Emerging Hacker Threats

June 28, 2000
Author(s)
Peter M. Mell, John P. Wack
[For the latest information on vulnerabilities, see the National Vulnerability Database, nvd.nist.gov] It seems that every week, computer security organizations are issuing press releases concerning the latest hacker attack. Some sound dangerous, like the

Public Key Infrastructures for the Financial Services Industry

June 21, 2000
Author(s)
William E. Burr, K L. Lyons-Burke
This paper addresses how financial institutions can use a Public Key Infrastructure (PKI) and some of the problems they may face in the process. PKI is an emerging cryptographic technology that is badly needed to realize the potential of information

Randomness Testing of the Advanced Encryption Standard Finalist Candidates

April 1, 2000
Author(s)
Juan Soto, Lawrence E. Bassham
Mars, RC6, Rijndael, Serpent and Twofish were selected as finalists for the Advanced Encryption Standard (AES). To evaluate the finalists' suitability as random number generators, empirical statistical testing is commonly employed. Although it widely

Security Implementations of Active Content

March 30, 2000
Author(s)
Wayne Jansen, Athanasios T. Karygiannis
Active content documents offer several benefits to both the users of these documents and their authors. Java applets, JavaScript, and ActiveX provide more functionality to static Web pages, plug-ins enable browsers to support new types of content

A Comparison of the SSE-CMM and NVLAP IT Security Testing

February 16, 2000
Author(s)
R J. Medlock
This paper describes the general accreditation requirements of the NIST National Voluntary Laboratory Accreditation Program (NVLAP) and the specific accreditation requirements for the Cryptographic Module Testing (CMT) and Common Criteria Testing (CCT)

A Resource Access Decision Service for CORBA-Based Distributed Systems

December 9, 1999
Author(s)
Konstantin Beznosov, Yi Deng, Bob Blakley, Carol Burt, John Barkley
Decoupling authorization logic from application logic allows applications with fine-grain access control requirements to be independent from a particular access control policy and from factors that are used in authorization decisions as well as access

Report on the NIST Java TM AES Candidate Algorithm Analysis

November 25, 1999
Author(s)
James F. Dray Jr.
NIST solicited candidate algorithms for the Advanced Encryption Standard in a Federal Register Announcement dated September 12, 1997. Fifteen candidates were submitted, and NIST has subsequently worked with a worldwide community of cryptanalysts and

Status Report on the First Round of the Development of the Advanced Encryption Standard

November 17, 1999
Author(s)
James R. Nechvatal, Elaine B. Barker, Donna F. Dodson, Morris J. Dworkin, James Foti, E Roback
In 1997, the National Institute of Standards and Technology (NIST) initiated a process to select a symmetric-key encryption algorithm to be used to protect sensitive (unclassified) Federal Information, in furtherance of NIST's statutory responsibilities

Acquiring and Deploying Intrusion Detection Systems

November 16, 1999
Author(s)
Peter M. Mell
This ITL Bulletin provides basic information about intrusion detection systems (IDSs) to help organizations avoid common pitfalls in acquiring, deploying, and maintaining IDSs.

Supporting Relationships in Access Control Using Role Based Access Control

October 29, 1999
Author(s)
John Barkley, Konstantin Benznosov, Jinny Uppal
The Role Based Access Control (RBAC) model and mechanism have proven to be useful and effective. This is clear from the many RBAC implementations in commercial products. However, there are many common examples where access decisions must include other

Towards a Measurement Technique for Risk Management

October 20, 1999
Author(s)
D G. Marks
The field of computer security is impeded by a lack of objective, quantitative measures. As a result, most systems, whether theoretical or actual, attempt to avoid, rather than manage, risk. Risk management requires looking at the complete protect, detect

Statistical Testing of Random Number Generators

October 19, 1999
Author(s)
D L. Banks
Random Number Generators (RNGs) are an important building block for algorithms and protocols in cryptography. They are paramount in the construction of encryption keys and other cryptographic algorithm parameters. In practice, statistical testing is

Status of the Advanced Encryption Standard (AES) Development Effort

October 19, 1999
Author(s)
James Foti
The purpose of this presentation will be to articulate the status of NIST=s Advanced Encryption Standard (AES) development effort. This presentation will include a description of the overall AES development effort, a summary of comments and analysis from

Applying Mobile Agents to Intrusion Detection and Response

October 1, 1999
Author(s)
Wayne Jansen, Tom T. Karygiannis, D G. Marks, Peter M. Mell
Effective intrusion detection capability is an elusive goal, not solved easily or with a single mechanism. However, mobile agents go a long way toward realizing the ideal behavior desired in an Intrusion Detection System (IDS). This report is an initial

Mobile Agent Security

October 1, 1999
Author(s)
Wayne Jansen, Athanasios T. Karygiannis
Mobile agent technology offers a new computing paradigm in which a program, in the form of a software agent, can suspend its execution on a host computer, transfer itself to another agent-enabled host on the network, and resume execution on the new host
Displaying 1276 - 1300 of 1431