U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications

NIST Authors in Bold

Displaying 1326 - 1350 of 1431

Network Security Testing Using Mobile Agents

March 25, 1998
Author(s)
Athanasios T. Karygiannis
This paper describes a prototype security testing tool that is currently under development at NIST. This prototype tool uses autonomous mobile agents to perform distributed, fault-tolerant, and adaptive network security testing. The security testing

Information Security and the World Wide Web (WWW)

February 12, 1998
Author(s)
Shirley M. Radack
This bulletin discusses some of the vulnerabilities and threats to information security that organizations may experience in their use of the Internet and the World Wide Web (WWW). Both Web server and Web browser software can introduce vulnerabilities

Modes of Operation Validation System (MOVS): Requirements and Procedures

February 1, 1998
Author(s)
Sharon S. Keller, Miles E. Smid
The National Institute of Standards and Technology (NIST) Modes of Operation Validation System (MOVS) specifies the procedures involved in validating implementations of the DES algorithm in FIPS PUB 46-2 , The Data Encryption Standard (DES) and the

Minimum Interoperability Specification for PKI Components (MISPC), Version 1

January 1, 1998
Author(s)
William E. Burr, Donna F. Dodson, William T. Polk, N Nazario
The Minimum Interoperability Specification for PKI Components (MISPC) supports interoperability for a large scale public key infrastructure (PKI) that issues, revokes and manages X.509 version 3 digital signature public key certificates and version 2

Internet Electronic Mail

November 25, 1997
Author(s)
Barbara Guttman, Robert H. Bagwill, Elizabeth B. Lennon
This ITL Bulletin summarizes a chapter of the draft Internet Security Policy: A Technical Guide. It describes email protocols, organization email policy, email problems, and solutions.

Comparing Simple Role Based Access Control Models and Access Control Lists

November 7, 1997
Author(s)
John Barkley
The RBAC metaphor is powerful in its ability to express access control policy in terms of the way in which administrators view organizations. The functionality of simple Role Based Access Control (RBAC) models are compared to access control lists (ACL). A

Specifying and Managing Role-Based Access Control Within a Corporate Intranet

November 7, 1997
Author(s)
David F. Ferraiolo, John Barkley
In order for intranets to reach their full potential, access control and authorization management mechanisms must be in place that can regulate user access to information in a manner that is consistent with the current set of laws, regulations, and

Role Based Access Control for the World Wide Web

October 10, 1997
Author(s)
John Barkley, Anthony V. Cincotta, David F. Ferraiolo, Serban I. Gavrila, David R. Kuhn
One of the most challenging problems in managing large networked systems is the complexity of security administration. This is particularly true for organizations that AWeb (WWW) servers. Today, security administration is costly and prone to error because

U.S. Government Activities to Protect the Information Infrastructure

April 28, 1997
Author(s)
Dennis D. Steinauer, Shirley M. Radack, Stuart W. Katzke
This paper is a survey of recent activities of the legislative and executive branches of the U.S. Government (and of some joint activities of government and industry) that involve the security of the evolving information infrastructure. Over the past few

Entity Authentication Using Public Key Cryptography

February 18, 1997
Author(s)
James Foti
[Withdrawn October 19, 2015] This standard specifies two challenge-response protocols by which entities in a computer system may authenticate their identities to one another. These may be used during session initiation, and at any other time that entity

Role-Based Access Control (RBAC): Features and Motivations

December 15, 1995
Author(s)
David F. Ferraiolo, Janet A. Cugini, David R. Kuhn
The central notion of Role-Based Access Control (RBAC) is that users do not have discretionary access to enterprise objects. Instead, access permissions are administratively associated with roles, and users are administratively made members of appropriate

Implementing Role-Based Access Control Using Object Technology

December 1, 1995
Author(s)
John Barkley
With Role Based Access Control (RBAC), each role is associated with a set of operations which a user in that role may perform. The power of RBAC as an access control mechanism is the concept that an operation may theoretically be anything. This is

An Introduction to Computer Security: the NIST Handbook

October 2, 1995
Author(s)
Barbara Guttman, E Roback
This handbook provides assistance in securing computer-based resources (including hardware, software, and information) by explaining important concepts, cost considerations, and interrelationships of security controls. It illustrates the benefits of

Telecommunications Security Guidelines for Telecommunications Management Network

October 2, 1995
Author(s)
John Kimmins, Charles Dinkel, Dale Walters
This Telecommunication Security Guideline is intended to provide a security baseline for Network Elements (NEs) and Mediation Devices (MDs) that is based on commercial security needs. In addition, some National Security and Emergency Preparedness (NS/EP)

Keeping Your Site Comfortably Secure: An Introduction to Internet Firewalls

December 1, 1994
Author(s)
John P. Wack, Lisa J. Carnahan
This document provides an overview of the Internet and security-related problems. It then provides an overview of firewall components and the general reasoning behind firewall usage. Several types of network access policies are described, as well as
Displaying 1326 - 1350 of 1431